Regulation, Custody & the Real Risks of Web3

Chapters 7 and 8 covered risk that lives inside a smart contract, or in the infrastructure directly operating one. This chapter steps back further — to a risk category that has nothing to do with code at all, and to the real, still-evolving legal frameworks governments have built in response to it.

Custody: Who Actually Holds Your Assets?

Course 1 covered private keys as the real, sole source of control over an on-chain asset — "not your keys, not your coins" is the community's own well-known shorthand for that principle. A custodial exchange breaks that principle by design: when you deposit crypto onto a centralized exchange, the exchange itself holds the private keys, and your account balance is really just an internal database entry the exchange promises corresponds to real, held assets. A non-custodial wallet, by contrast, keeps you holding the actual private key the entire time.

Case Study: The FTX Collapse (November 2022)

FTX, founded in May 2019 by Sam Bankman-Fried and Gary Wang, grew into one of the world's largest cryptocurrency exchanges, reaching a real, reported $32 billion valuation before its collapse. The exchange filed for Chapter 11 bankruptcy on 11 November 2022.

The real, documented allegation at the center of the case: FTX had lent approximately $10 billion in customer deposits to Alameda Research, and Alameda had reportedly been granted a secret exemption from FTX's own automatic liquidation safeguards — the exact kind of privileged-access failure Chapter 7's own access-control category describes, just happening inside a company's internal systems rather than inside deployed Solidity code.

Regulation: The US Approach

US securities regulation still leans heavily on a real, 78-year-old legal test. In SEC v. W. J. Howey Co. (328 U.S. 293, decided 27 May 1946), the Supreme Court held that an investment contract — and therefore a regulated security — exists whenever there is (1) an investment of money, (2) in a common enterprise, (3) with an expectation of profit, (4) derived primarily from the efforts of others. The real, ongoing debate over whether a given token counts as a security largely comes down to whether it satisfies all four of these prongs.

Regulation: The EU's MiCA

The European Union took a genuinely different approach: a dedicated, purpose-built regulation rather than an 80-year-old test stretched to fit a new technology. The Markets in Crypto-Assets regulation (MiCA) was adopted by the European Parliament on 20 April 2023 and applied in full via two real phases — stablecoins (asset-referenced and e-money tokens) from 30 June 2024, and other crypto-assets plus crypto-asset service providers (exchanges, custodial wallet providers) from 30 December 2024.

Risks Beyond Code and Custody

Two more real, well-documented Web3-specific risk categories round out this chapter's own survey. A rug pull is when a project's own developers abandon it and drain its liquidity pool (Chapter 4) after attracting real investor funds — a risk that has nothing to do with a smart contract bug at all, since the contract may be working exactly as its own creators always intended it to. A approve() phishing exploit targets a real, genuine ERC-20 feature (Course 1's own token standard) that lets a user grant a smart contract ongoing permission to move tokens on their behalf — a malicious site can trick a user into granting that permission to an attacker-controlled contract, which then drains the approved tokens directly, with no bug in the token contract itself required.

Hands-On Exercises

Three exercises applying this chapter's own custody, regulation, and risk material before Chapter 10's own capstone brings the full course together.