Vitalik Buterin argues crypto users should rely less on web apps
Victoria Shinder2 min readVitalik Buterin's essay of 31 October (https://vitalik.eth.limo/general/2026/10/31/digital_minimalism.html) is mostly personal: a set of experiments in using less technology by default. The last of them is aimed squarely at how people use crypto.
He starts with social media. For much of the year he has posted through Firefly, a client that reads and writes to X, Bluesky, Farcaster and Lens at once, rather than through X's own interface. His main goal was to support decentralised social networks, but he found he simply felt better without X's recommendation algorithm, which he describes as having drawn him toward the content he stared at out of morbid curiosity. Then cellular data: for 100 days he kept his phone in airplane mode, using only Wi-Fi, for privacy, since a phone on a cell network is an always-on location tracker, and for mental space. He rates cities by how easy it is to find public Wi-Fi without an SMS code, and puts Taipei at the top and Switzerland at the bottom.
The section on the web is where crypto comes in. Buterin says he now updates his ENS record through a command-line tool an AI wrote for him and makes many privacy-protocol payments through kohaku-cli. His case against web applications for crypto rests on three points. A web app is re-downloaded from its server every time it is opened, so the user trusts that server thousands of times, and one hack at the wrong moment is enough. Websites leak identifying data by default, to the operator and to third-party scripts and analytics. And interfaces built by companies with commercial interests can be designed to extract rather than protect. His alternative is the Unix philosophy made friendlier by local AI: describe the task in plain language and let a model assemble small, inspectable tools.
What it means
The argument lands in a week when the industry's largest exchange lost billions through compromised infrastructure, though Buterin does not mention it. The point that applies most widely is the trust count: a downloaded, verifiable wallet is trusted once per update, a web front end once per visit. For most users, command lines written by an AI are not yet a realistic replacement, but the direction is toward fewer servers in the signing path.