The ethics are fine. The architecture is broken.

For years, the security industry has treated responsible disclosure as a moral test: are you a "good" hacker who reports the bug, or a "bad" one who exploits it?

That framing was always simplistic. In 2026, it's outright delusional.

When a white hat finds a $10M exploit and receives a $500 bounty, while a black hat cashes out $292M and vanishes into the blockchain fog, the issue is not ethics. The issue is that the system is architected to make ethical behavior the most expensive option.

Ethics didn't fail. Governance did.

1.…