What “trustless” really means
The most overused word in the subject. It does not mean you trust nothing. It means the trust has been moved somewhere you may not have looked.
Describing a system as trustless suggests no trust is required anywhere. That is never true of anything, and treating it as true is how people lose money in ways the technology was never claimed to prevent.
What is genuinely removed
You do not need to trust a counterparty to honour a transfer, or an institution to maintain your balance correctly, or an administrator not to freeze your account. Those are real removals and they are not trivial.
What remains
- The code. A smart contract does what it was written to do, which is not necessarily what it was meant to do. You are trusting the author's competence, and often trusting an audit you have not read.
- The economic assumption. Security rests on it being unprofitable to attack. You are trusting that the participants with the most capacity continue to find honesty more profitable.
- The client software. Almost nobody reads the code they run. Most people trust a small group of maintainers and a package manager.
- The key. If you hold your own, you are trusting yourself — your backups, your memory, your household. See seed phrases.
- Everything at the edges. Exchanges, bridges, custodians, oracles, wallet apps. This is where nearly every large loss has actually occurred.
A bank is regulated, insured in many jurisdictions, reversible, and reachable by phone. A smart contract is transparent, predictable, available at all hours, and completely unforgiving. Whether that is an improvement depends on which failure mode you are more exposed to, which is a personal question rather than a technical one.
The useful reframing
"Trust-minimised" is the more accurate term, and some practitioners use it. Better still is to ask a specific question of any system: who can take my money, and what would they have to do it?
For a self-custodied balance, the answer is: anyone with the key. For an exchange balance, the answer includes the exchange itself, which is not a hypothetical — see Mt. Gox and the 2022 collapses. For a DeFi position, the answer includes anyone who can find a flaw in the contract or manipulate the price feed it relies on.
The verification point
What these systems offer is that you can check, yourself, without permission: run a node and validate every rule, read the contract, inspect the ledger. Almost nobody does. The guarantee is that enough people can, and that anyone who wants to may join them — which is meaningfully different from being asked to take an institution's word for it, and meaningfully weaker than needing to trust nobody.