As a security researcher who’s spent the last year analyzing Web3 infrastructure vulnerabilities, I need to talk about something that keeps me up at night: the surveillance and censorship risks created by our dependence on centralized RPC providers.
We’ve built this beautiful censorship-resistant, decentralized blockchain—and then we route nearly all access through a handful of companies that can see everything you do.
What RPC Providers Can Actually See
Let me be specific about what centralized RPC providers can monitor:
- Your IP address on every single request
- Every wallet address you query (which reveals your personal addresses)
- Your transaction patterns and timing (what you’re doing and when)
- What dApps you’re using (inferrable from contract queries)
- Your entire interaction pattern with the blockchain
Even with HTTPS encryption, the RPC provider sees the wallet addresses in your requests. It’s similar to using a VPN provider—they claim not to log, but you’re fundamentally trusting them with your activity data.
The Censorship Vectors Are Real
This isn’t theoretical. We’ve already seen:
- Infura blocking Tornado Cash addresses in 2022 (later reversed after community backlash)
- Geo-blocking certain countries based on compliance requirements
- Potential government pressure to censor or monitor specific addresses
The technical censorship capabilities include:
- Transaction filtering before submission to mempool
- Selective degradation (certain addresses get slower service)
- Data harvesting for surveillance purposes
- Forced KYC requirements for API access
The Uncomfortable Irony
We spent years building a censorship-resistant blockchain, then routed all practical access through censorable gatekeepers.
The blockchain itself might be unstoppable, but if users can’t submit transactions or read state without going through a provider that can block them, the censorship-resistance becomes theoretical.
Enterprise & Nation-State Risks
Two scenarios worry me:
Corporate surveillance: RPC providers could sell aggregated usage data to hedge funds, analytics firms, or surveillance companies. The data is incredibly valuable—imagine knowing which wallets are querying specific contracts before major price movements.
Government subpoenas: Nation-states can compel RPC providers to hand over user data or implement filtering. If the U.S. government wanted to sanction specific addresses, pressuring Alchemy and Infura would be far easier than attacking the blockchain itself.
What Can We Do About It?
The solutions exist but aren’t yet mainstream:
Run your own node - Eliminates trust, but we’ve discussed the K/month cost barriers
Use VPN + multiple RPC providers - Reduces correlation risk, doesn’t eliminate it
Light clients in browser - Trustless but still immature for production use
Privacy-preserving RPC protocols - Active research area, using techniques like onion routing
Decentralized RPC networks - dRPC, Pocket, Lava eliminate single point of control
The long-term solution is light clients running directly in browsers and wallets, eliminating the need to trust any RPC provider. But until we get there, we need to take privacy seriously at the infrastructure layer.
Call To Action
We need:
- Privacy-first RPC providers that don’t log (similar to privacy-focused VPN services)
- Industry standards for data minimization and retention policies
- Transparency requirements - what data do providers actually collect?
- User education - most people don’t realize their RPC provider sees everything
Has anyone here actually read Alchemy or Infura’s privacy policies? Do we know what they’re logging?
TL;DR: Decentralized ledgers don’t matter if the access layer is compromised. RPC centralization creates surveillance and censorship risks that undermine Web3’s core values. We need better solutions before this becomes a serious problem.