Crypto's "Untrainable" Moat

In March 2025, a trader tried to game Hyperliquid’s HLP vault with a token called JELLY, pushing the vault towards a $13.5M loss. Within minutes, validators voted to delist the market, force-settle every position at the original entry price and make users whole. The vault ended the entire episode slightly in profit.

Humans overrode the code quickly and decisively. It was perhaps unimaginable a decade ago, but no one seemed to care. As deposits grew, users looked at a system where accountability required human intervention, strengthening the value proposition.

I think they were right. The episode is a prime example of “code is law” for money, with human accountability for the risk.

Trust is the lasting moat

Sarah Guo recently wrote a piece on the untrainable, arguing that models will absorb everything measurable, and the last remaining durable value left will be private, illegible ground truth that takes years of operating in the world to accumulate. She’s writing about AI, but she could have been writing about crypto.

A core tenet of public protocols is that they are open source, creating transparency and the ability to “fork” code. As a result, we’ve seen over the past decade how technology is not a viable moat in crypto. Instead, crypto’s moat is trust.

Code is law at the base layer. I want Bitcoin and Ethereum to be immutable and credibly neutral. Not just because of ideology but because this neutrality at the base layer is what allows everything above it to be accountable without being captured. But even then, they are both still beholden to social consensus, which relies on humans.

For any given protocol or onchain product, humans are critical to backstopping the trust. Code can execute a particular action, but humans are the ones setting parameters for risk, identifying and establishing standards for the industry to follow. The experience drawn from humans is ingrained into product decisions that ultimately the code executes. And in challenging moments, the strongest protocols have a team behind them that ultimately intervenes and resolves challenges. The concept of “code is law”, we’ve seen over and over again, does not apply when we’re filling holes or settling conflicts with other humans.

Onchain meets offchain

This circumstance has happened over and over again in DeFi. When Black Thursday happened in 2020, some of Maker’s liquidation auctions cleared at zero. One bot took over $8 million of ETH and left the system in the red. The code worked beautifully. But a human vote to mint and auction new MKR was made to absorb the loss the code made.

JELLY is the same exact story. In both cases, the protocol discovered that code is law, but social consensus manages the risk.

What cannot be forked is compounding risk decisions. Look at Aave, a BCAP portfolio company, as an example. Across its history, the protocol has processed hundreds of billions in loans, and bad debt has remained a rounding error, a fraction of a basis point of volume, while TVL grew past $50 billion. These decisions are guided by human judgment, which cannot be easily forked.

November 2025 was a testament to this process. When Stream Finance disclosed that an external manager had lost $93 million, its xUSD stablecoin collapsed, the hole cascaded into roughly $285 million of interconnected debt, and two more stablecoins died with it. The contagion ran through Euler, Silo, Morpho, Sonic and every venue that had listed xUSD as collateral. It never touched Aave, because Aave never listed it. In this instance, code was the mechanism of failure, and what protected Aave’s depositors was a judgment call made many months ago.

And of course, the market was pricing this reality in. At the time (Nov 2025), Aave paid roughly 5% on stablecoins while Stream paid up to 18%. Trust has a price in DeFi.

Human overlay is how DeFi grows

I’ve come to believe that human overlay is the only way DeFi grows. One of the biggest challenges Aave faced in 2026 concerned governance. Earlier this year, Chaos Labs walked away as a service provider to the protocol, citing undefined liabilities and economics that were operating at a loss. They felt the scope of risk management was too great and misaligned with their views. This was a tension over human judgment to govern a protocol.

While Aave’s track record has demonstrated a history of safety and sound decision-making around risk, this doesn’t just come back to the code but rather the humans involved in maintaining this system.

The resolution came down to conversations and negotiations with the people behind the protocol, setting risk parameters and being involved in creating the track record Aave has upheld.

I keep coming back to this. Crypto’s “untrainable” moat is trust, held by humans.

DeFi needs its stakeholders to trust that its protocols are designed, maintained and held to the highest standards with humans in the loop.

So who’s doing this?

We’ve seen a number of entities develop to bear risk up the stack. Offchain, there are blockchain intelligence firms like TRM, a BCAP portfolio company, that provide context and flag risks before they occur. Onchain, there’s Predicate, a BCAP portfolio company, enabling compliance transactions with its rules and policy engine. There’s a class of risk curators like Steakhouse Financial or Gauntlet that specialize in working with protocol teams. There are security firms like Blockaid that detect scams and exploits in real time. The team behind every protocol is responsible not only for managing the contracts that secure capital, but also for the product decisions made surrounding them.

Blockchains remove the requirement to trust intermediaries from a financial transaction. Instead, they allow you to decide where to put that trust in the financial stack.

For institutions to win in crypto, the answer is to constrain trust: code and consensus algorithms define what happens within the rules, but social consensus defines what the rules actually are.

When you look at a protocol now, ask where it sits in the stack. If it just moves money, the code should be law. If it is pricing risk, find out who answers when the model is wrong, because someone will have to, and the protocols that name that person in advance are the ones that will still be here in a decade.