The Ethereum Foundation's Trillion Dollar Security initiative has granted funding to the Freedom of the Press Foundation to expand WEBCAT, a system that lets browsers verify a website's code matches what its developers actually published. The initiative announced the grant on August 6, 2026, framing it as work on one of crypto's least-guarded surfaces: the web page a user loads before they sign anything.
The problem WEBCAT targets is old and expensive. A user can hold their keys in a hardware wallet, review a transaction, and still lose funds because the website that built that transaction was quietly swapped for a malicious copy. The wallet does what it is told. The keys never leak. The attack lives one layer up, in the code the browser downloaded and ran.
The gap between signed code and served code
Most crypto security spending goes into smart contract audits and wallet hardening. Both matter. Neither checks whether the front end you loaded is the front end the team wrote. Web apps get served from content delivery networks, hosting accounts, and DNS records that can be compromised without touching the underlying contract at all. When that happens, the interface can show correct balances and familiar branding while routing an approval to an attacker's address.
WEBCAT closes that gap by making the served code checkable. Developers publish a signed record of what their site's code should be. The browser, through the tool, compares the code it actually received against that published record before executing it. A mismatch signals tampering somewhere between the developer and the user, whether that is a hijacked hosting account, a poisoned CDN, or a man-in-the-middle swap. This is transparency applied to code delivery rather than to on-chain state.
The approach borrows from a broader idea called code transparency, where cryptographic logs make it hard for anyone to serve one version of an application to most users and a different, malicious version to a targeted few. That targeted-delivery problem is precisely what makes front-end attacks hard to catch after the fact. A drainer served to a handful of high-value wallets can disappear before anyone files a report.
The Freedom of the Press Foundation connection
The grant partner is not a crypto company. The Freedom of the Press Foundation builds tools for journalists and sources who need to trust that the software they use has not been altered. That threat model overlaps with crypto more than it first appears. Both worlds worry about a trusted application being silently replaced. Both need a way to prove that the code running on a device is the code that was audited and published.
Funding an outside security organization rather than an internal team also fits the stated shape of the Trillion Dollar Security initiative, which has positioned itself as spreading grants across independent researchers and builders. Earlier work under the same banner has leaned on outside red teams and adversarial review rather than in-house sign-off. Independent hands checking independent code is the recurring pattern.
The front-end risk reaches everyday card spending
Phishing and spoofed interfaces are not an abstract exchange-only problem. Anyone who tops up a self-custody card, approves a token spend, or connects a wallet to a dApp is exposed to the same front-end risk. The moment you approve a contract from a web page, you are trusting that the page is genuine. Users who spend from their own wallet carry this risk directly, because there is no custodian to reverse a bad approval.
A browser-level check does not remove the need for caution. It adds a layer that operates before signing, at the point where most users have no tooling at all. The realistic near-term impact is narrow. WEBCAT has to be integrated by browsers or extensions and adopted by the sites people actually visit before it protects anyone at scale, and none of that is automatic. Publishing a signed code record is voluntary, and a site that never publishes one cannot be verified. The value shows up only where both developers and browsers opt in.
Security work of this kind also tends to be invisible when it succeeds. There is no headline for the drain that did not happen. That is part of why front-end defense has been underfunded relative to contract audits, and part of why a named grant toward it is worth noting even at an early stage.
Overview
The Ethereum Foundation, through its Trillion Dollar Security initiative, funded the Freedom of the Press Foundation to expand WEBCAT, a tool that lets browsers confirm a website's code matches what its developers published. It targets front-end and phishing attacks, where a genuine wallet signs a transaction built by a tampered web page. The defense is promising but depends on adoption by browsers and by the sites users visit, so its real-world reach will build slowly rather than arrive at once.
