Blockchain Regulation Matrix

The Blockchain Regulation Matrix (BRM) establishes a framework outlining the concerns of regulating the blockchain from both the government and the consumer perspective, and in doing so, provides a pragmatic and clear approach to Web3 regulation. The BRM outlines regulation aspects of the blockchain by viewing it as a blockchain stack in many layers starting with the electricity physically supporting the blockchain at the base layer, all the way to the process of offloading crypto to fiat currency. With centralization and decentralization on either side of the matrix, the primary objective of the BRM is to understand where and how regulation of the blockchain should be developed specific to each layer.

Beginning with the electricty supporting the blockchain, as you hover over the images of each row, you'll see the specifics for that topic within that layer. The left side refers to projects that are centralized, while the right side refers to projects that are decentralized. For example, if there was an organization or business that wanted to provide electricity to miners in their area, that would be a centralized project. However, if there was a solar farm operating as a DAO that wanted to provide electricity to miners, that could be a decentralized project.

Regulatory heat map

All jurisdictionsUnited StatesEuropean UnionGlobal & other

CentralizedBlockchain LayerDecentralized

ElectricitySettlement LayerNode / Validator LayerComputation-intensive Consensus MechanismsCapabilities-based Consensus MechanismsVoting-based Consensus MechanismsTransaction LayerOn-chain Data StorageAsset Layer - StablecoinsAsset Layer - Fungible TokensAsset Layer - Non-Fungible Tokens (NFTs)Exchange LayerProtocol LayerApplication LayerPermanent Storage LayerInternet BrowserThe DeveloperProgramming Language AuditorDeFi Architecture and SecurityDeFi Architecture Standards / AuditorFiat Onboarding / Offboarding Access

Internet Browserdecentralized

✕

This row applies to internet browsers and their context of the blockchain.

UnaddressedExtension wallets are vetted only by store policies that counterfeits repeatedly pass.

Government Concerns

• Extension marketplaces distribute wallet software with no fitness or security standard
• Users hold keys in browser contexts that were never designed as vaults

Consumer Risks

• Malicious extensions reading clipboards, seeds, and session data
• Drainer pop-ups and fake signature prompts imitating wallet UIs
• Seed-phrase phishing through counterfeit wallet onboarding flows

Cons to over-regulation

• Banning browser wallets pushes users into custodial apps, eroding self-custody itself

Cons to lack of regulation

• Fake wallet extensions recur in every store with no recall or notification duty

Does blockchain technology currently exist to fulfill these obligations, and if so, what is it?

• Hardware-wallet pairing keeping keys out of the browser entirely
• EIP-6963 and EIP-712 making wallet identity and signatures legible to users
• Open-source wallet code with reproducible builds users can verify

Current regulatory landscape

• proposedDigital Wallet Security and Accreditation Act (draft) — Crypto Policy Center, 2024. Accreditation and education requirements apply equally to open-source and self-custody wallet publishers in the draft.

Notable incidents

• Fake Ledger Live app in Microsoft Store (2023) — A counterfeit wallet app passed store review and stole funds — the browser/store layer failing as gatekeeper exactly where users trust it most.
• Clipboard-hijacking malware families (ongoing) — Malware silently swaps copied wallet addresses at paste time — a browser/OS-layer attack no smart contract audit can prevent.

Wallets and RegulationSuggest an addition (GitHub)About contributing