← Back to all insights

TL;DR. "Don't trust, verify" is the best slogan Bitcoin has, and the most misread. Read as a destination, it promises something that does not exist: zero trust. Nobody has it. Nobody has ever had it. Below is a list of forty-two things the purest cypherpunk setup on earth still trusts, from the chip fab to your own tired eyes at midnight. The point is not despair. The point is that verification is a slope, not a summit, and once you see that, the question "which setup is trustless?" dissolves into the only question that was ever real: which setup leaves the least to trust, and how much of that can you actually check?

A direction, not a destination

Every Bitcoiner knows the slogan. Fewer notice that it describes an asymptote: a curve that approaches a line forever and touches it never. You can verify more, and more, and more, and every hour of it genuinely reduces what you must take on faith. But the curve never reaches zero. Somewhere under your last verification there is always one more layer, and at that layer, you trust.

This is not a defeatist observation. It is the load-bearing fact of the whole debate about how to hold bitcoin, because both extremes misuse the slogan. The custodial crowd says "you trust something anyway, so relax and trust us", which ignores that the curve has a slope and their end of it is a cliff. And the purist crowd says "this device requires trust, therefore it is disqualified", which is a standard that disqualifies everything, including the purist's own setup, including Bitcoin itself.

Szabo never promised zero

The intellectual root of the slogan is Nick Szabo's 2001 essay Trusted Third Parties Are Security Holes, and it is worth rereading what it actually claims: a trusted third party is the most expensive and most dangerous component of a protocol, and good design minimizes it. Minimizes. Not eliminates. Szabo was an engineer describing a cost to be driven down, not a priest describing a sin to be abolished.

Bitcoin itself is the proof. The most trust-minimized money ever built still asks you to trust that a majority of hashpower follows its incentives, that the code of your node does what it says, and that the mathematics under secp256k1 and SHA-256 holds. That is a spectacularly short list compared to a central bank. It is not zero. Anyone who wields "trustless" as a binary pass-fail test has just failed Bitcoin with it.

Thompson closed the escape route

"Fine," says the purist, "then I verify the code myself." Ken Thompson took that door off its hinges in 1984, in the shortest great paper in computer science: Reflections on Trusting Trust. He built a compiler that inserts a backdoor into the login program, and inserts the backdoor-inserter into every future compiler compiled with it. Source code of both: perfectly clean. His conclusion, verbatim: "You can't trust code that you did not totally create yourself."

Reading source proves nothing final. Below the source sits the compiler, below the compiler the compiler that compiled it, then the assembler, the microcode, the die, the fab. The regress does not bottom out. Not for a hardware wallet, not for a laptop, not for an offline HTML file, not for anything. Verification is real and precious, and it floats on trust all the way down.

The purest setup that exists

So let us build the strongest setup that actually exists, the one the dark wizards of this space describe. You roll dice and debias the throws by hand, von Neumann's 1951 trick, then compute the checksum yourself with Codex32's paper volvelles, so no computer ever witnesses your entropy being born. You sign on a stateless device with no radio silicon on the board, assembled from parts bought anonymously with cash, running firmware you rebuilt through Guix's full-source bootstrap: a chain of trust that starts at a 357-byte binary a human can audit by hand. Your quorum is split across vendors and borders with a timelocked decay path for your heirs, and between sessions it rests under random-mosaic tamper seals. Your node speaks only Tor. No vendor knows you exist. This is the least-trust setup available to a human in 2026, and almost nobody, including me, lives at this altitude.

Here is what that setup still trusts.

Forty-two things you still trust

The silicon

The mathematics

The objects on your table

The build you verified

The act of verifying itself

The network, on the day it counts

Yourself

That is forty-two, and no, it is not the answer to life, the universe and self-custody; the list is not even complete, it merely stopped. Every "verify" on it rests on a deeper "trust". The purest setup in Bitcoin runs on a mountain of unexamined faith, and so does yours, and so does mine, and so does the laptop of the person who just told you hardware is a scam.

So why verify at all?

Because the slope is the whole game.

Look at the list again and notice what is not on it: a wallet vendor's closed firmware. An exchange's solvency. A browser extension's update channel. A cloud backup. An app store. Every verified layer removed one of those, and the ones removed are not hypothetical: they are precisely the layers that have actually drained people, in the billions, year after year. The loss data is unambiguous about where the money dies, and it is not at the bottom of this list. It dies at the top, in the layers verification could have removed and did not, because nobody bothered.

And the remaining surfaces are not equal. The stack under a stateless signer is a few dozen megabytes of reproducible code on a board you can hold; the stack under a laptop is tens of millions of lines from twenty companies, self-updating weekly, including a second hidden processor you are contractually forbidden to inspect. Both carry trust. One of them a motivated human can walk around with a flashlight. That difference, six orders of magnitude of it, is what the slogan was always pointing at.

Hal Finney understood this before almost anyone. His 2004 RPOW, Bitcoin's direct ancestor, ran on a tamper-resistant coprocessor that could cryptographically attest to the code it was running, under the explicit assumption that even its own operator was hostile. He did not claim zero trust. He shrank the trusted surface to one auditable box and handed the world the tools to check it. That is the move. It has always been the move.

The strongest move is deletion

There is one move even better than verifying a layer: deleting it. When you roll your seed with dice on your own table, you have not audited the vendor's random number generator. You have removed it. There is nothing left to verify, because you were the randomness, and you were in the room when it happened. The layer's trust did not shrink to something small. It stopped existing.

2026 delivered the proof at nine-figure scale. A build flag in Coldcard's open source firmware silently swapped the hardware random number generator for a weak software one, and the bug sat there, in public, for five years. Roughly a hundred million dollars left wallets whose owners had done everything else right. But the users who had deleted that layer, who rolled their own dice and fed the result in themselves, were immune, by the vendor's own analysis. They did not out-verify the bug. They had removed the code path it lived in, so the most expensive RNG failure in Bitcoin's history simply did not apply to them.

One honest footnote, because this essay does not deal in absolutes: deletion is never quite total. The device that turns your 99 rolls into 24 words is still a layer, and a lying one could ignore your dice and derive a seed it already knows. Which is why the careful version of doing-it-yourself checks the derivation on a second, independent device: two implementations, two authors, one answer. When both agree, deceiving you requires a conspiracy between strangers. The asymptote again, and you can feel the curve bend: you did not reach zero, you made the remaining trust small, explicit, and cross-checked.

The last honest pixel

Verified layers pay for themselves in the strangest places. In September 2025 the biggest supply-chain attack in npm's history poisoned packages with around two billion weekly downloads; the payload's job was to swap wallet addresses in the browser. Total reported theft: a few hundred dollars, largely because wallets that force you to confirm the address on a device's own screen made the payload useless. Five months earlier, Bybit lost $1.5 billion the opposite way: its signers held hardware in their hands and approved what a poisoned web interface showed them instead of what their devices could have shown them.

Same lesson from both directions. The screen on the signer is the last pixel that malware on your computer cannot paint. Two billion downloads of malicious code against one small verified display, and the display won by six orders of magnitude. It only protects the people who look at it.

Shrink, check, split

If the list above is the diagnosis, the treatment fits in three verbs.

Three-step diagram: a large tangled computing stack shrinks into one small signing device, its build is checked against a matching hash, and the remaining trust is split across a two-of-three quorum of devices

None of this reaches zero. All of it moves you down the curve, and the distance traveled is measured in the only unit that matters: the attacks that no longer apply to you.

The honest version of the slogan

"Don't trust, verify" does not mean zero trust; zero trust is not on the menu, for anyone, ever. It means: shrink what you must trust until verification can get its arms around it, verify what you can, and know, precisely and honestly, which is which.

Anyone who tells you their setup is trustless has simply stopped counting too early. And anyone selling you "trustless" is asking you to trust them.

Written because the word "trustless" does a lot of work in Bitcoin arguments, and most of it is unearned. Every claim above is checkable, which, as the list explains, is not the same as requiring no trust. If you find an error, tell me.