What is web3? Decentralized technology explained for business

What web3 means, and where the term came from

The Ethereum community's own explainer, ethereum.org, splits the web's history into loose periods. Web 1.0, roughly 1990 to 2004, was mostly static pages you could read. Web 2.0, from 2004, added platforms where users write and share content, while a handful of companies came to control most of the traffic and the advertising revenue. Web3 adds ownership: your assets and identity sit on a public blockchain, and you control them with a key rather than an account someone else can close. Ethereum co-founder Gavin Wood coined the term in 2014, and the same page admits it has become a catch-all with no rigid definition.

The pitch rests on four ideas: no single owner (decentralized), open to anyone (permissionless), money built into the network (native payments) and rules enforced by code and incentives rather than by a trusted company (trustless). The honest caveat comes from the same source. Ethereum.org notes that the ecosystem still depends mainly on centralized infrastructure, and its developer guide to dapps warns that when a service keeps keys on its own server, serves its front end from one server or runs important logic centrally, most of the advantages over a traditional system disappear.

Here is how the two models differ for a business deciding where its records should live:

The building blocks, in plain words

Six terms cover most of what you will read about web3. They also map onto the layers of any web3 product, from the website a customer sees down to the ledger underneath.

Blockchain

NIST's Blockchain Technology Overview defines blockchains as tamper evident and tamper resistant digital ledgers, kept in a distributed way and usually without a central authority such as a bank or a company. Transactions are grouped into blocks, and each block carries a cryptographic hash of the previous block's header, so changing an old record would break every link after it. The copies agree on the next block through a consensus method: proof of work, where computers race to solve a costly puzzle (Bitcoin), or proof of stake, where validators put up the network's own token as a deposit. Public chains such as Bitcoin and Ethereum are permissionless; permissioned chains such as Hyperledger Fabric let only authorized parties add blocks and can restrict who reads them.

NIST also points out a consequence businesses tend to discover late. Most applications create, read, update and delete records; a blockchain only creates and reads. You can append a transaction that marks an old one as superseded, but the original stays in every copy, which is why NIST warns that personal data covered by laws such as the GDPR may not belong on a chain at all.

Smart contract

A smart contract is a program stored on the chain. NIST describes it as code and data deployed through signed transactions, executed by the network's nodes, which must all reach the same result. Ethereum's documentation adds two properties that matter for risk: a contract cannot be deleted by default, and interactions with it are irreversible. The usual comparison is a vending machine: the right input always produces the programmed output, including when the programming is wrong. That is why a bug in a smart contract tends to become a public, permanent loss rather than a support ticket.

Wallet and private key

A wallet is software, or a small hardware device, that stores private keys and uses them to sign transactions. NIST is blunt about the stakes: if a user loses a private key, the assets tied to it are lost, because the key cannot be regenerated, and if the key is stolen, the thief controls everything it controls. Two answers exist. Custody services hold keys for you, which brings back a trusted company. Multi-signature (multisig) contracts require several keys, for example three of five, to approve a transfer, so no single lost or stolen key is fatal.

Token, NFT and stablecoin

A token is a balance or item that a smart contract records. The ERC-20 standard, proposed in November 2015, defines fungible tokens, where every unit is interchangeable like a coin or a fund share. The ERC-721 standard, proposed in January 2018, defines non-fungible tokens (NFTs), where each token has a unique ID and can represent a collectible, a ticket or an access key.

A stablecoin is a token that promises to stay worth a fixed amount of a currency, almost always one US dollar. The Bank for International Settlements (BIS), in its 2025 Annual Economic Report, describes three designs: backed by short-term assets in a traditional currency, backed by other crypto as collateral, or held steady by an algorithm. Most of the market is the first kind, and unlike Bitcoin, most stablecoins are issued by a single central company, with USDT (Tether) and USDC (Circle) the two largest.

Decentralized application (dApp)

A dApp combines a smart contract, which acts as its back end, with a front end that looks like any other website and asks the user's wallet to sign. The front end can be hosted on decentralized storage such as IPFS, but it is often an ordinary site on ordinary hosting. Lending and trading services built this way are called decentralized finance (DeFi), and groups that vote with tokens on how a shared pool of funds is spent, with a contract carrying out the result, are called decentralized autonomous organizations (DAOs).

What has real use as of September 2026

Three uses have documented, measurable activity. Two are financial, and the third is a well-known supply chain pilot whose limits are as instructive as its result.

Stablecoins in payments and settlement

Stablecoins are the part of web3 with real volume. A Federal Reserve staff note puts their combined market capitalization at $317 billion as of April 6, 2026, more than 50% higher than in early 2025. The same note shows that reserves differ by issuer: by their attested disclosures, USDT holds about 1.04 dollars of reserves per coin, of which only about 0.74 is in higher-quality assets such as Treasuries and bank deposits, while USDC holds a full 1.0 in such assets.

The clearest business use is settlement between institutions. Visa became one of the first major networks to settle transactions in a stablecoin in 2023, and on December 16, 2025 it opened USDC settlement to its US bank partners, starting with Cross River Bank and Lead Bank over the Solana blockchain. The practical gain it cites is timing: settlement seven days a week instead of five business days, with no change to what cardholders see. In September 2026 Visa reported that its stablecoin settlement had passed a $20 billion annualized run rate, more than 15 times the year before, with more than 160 stablecoin-linked card programs on its network.

The BIS is less enthusiastic. It argues that stablecoins fail three tests of sound money: singleness (coins from different issuers can trade at different prices, so a dollar is not always a dollar), elasticity (every new coin must be paid for in full upfront, so the system cannot extend credit when payments peak) and integrity (as bearer instruments that move freely into self-hosted wallets, they are weak on know-your-customer checks). For a business, that becomes three questions before accepting or holding one: who issues it and what backs it, whether you can redeem it at par and how fast, and how your payment provider meets anti-money-laundering rules. For card and wallet checkout in online stores, see the future of e-commerce.

Tokenized treasury funds

Tokenization means issuing a traditional asset's ownership records as tokens. The best-known example is BlackRock's BUIDL fund, launched on March 20, 2024 on the Ethereum network as the firm's first tokenized fund on a public blockchain. It invests entirely in cash, US Treasury bills and repurchase agreements, aims to hold a stable value of $1 per token, lets tokens move around the clock but only between pre-approved investors, and is open to qualified investors with a $5 million initial minimum. BNY Mellon holds the fund's assets.

A BIS bulletin from November 2025 measured the whole category. Tokenized money market funds held about $770 million at the end of 2023 and almost $9 billion by the end of October 2025, with BUIDL the largest. The bulletin also shows what tokenization does not change: custody and proof of ownership are still performed off-chain, the fund's value reaches the chain through an outside data feed (an oracle) once per business day, and the main investors in BUIDL are companies running DeFi protocols, which use the tokens as collateral. For BUIDL and another large fund, about 90% of holdings sat with just four wallets. Tokenization changed the share register, not the assets underneath.

Supply chain traceability: one documented pilot

Supply chain projects produced many announcements and few published results. The best-documented is Walmart's. With IBM, it announced two proofs of concept in October 2016 on Hyperledger Fabric, and according to the LF Decentralized Trust case study, tracing a pack of sliced mangoes back to its farm went from about 7 days to 2.2 seconds. Walmart went on to trace more than 25 products from 5 suppliers and told its leafy-greens suppliers they would be required to use the system.

Two caveats keep that result in proportion. The case study does not separate how much of the gain came from the ledger and how much from suppliers recording each step digitally for the first time. And a ledger only records what it is told. In their paper Do you need a Blockchain?, Karl Wüst and Arthur Gervais of ETH Zurich describe a supplier who keeps the trusted temperature sensor in a small cooled box while the goods ride warm: the chain faithfully records a perfect cold chain that never existed.

What failed or stalled

The failures matter more than the successes for anyone weighing a project, because they show which problems the technology does not solve.

The 2022 collapses: Terra and FTX

TerraUSD (UST) was an algorithmic stablecoin, held at one dollar by a mechanism rather than by reserves. In May 2022 it lost its peg, and UST and Terraform's other tokens fell close to zero, wiping out $40 billion in market value nearly overnight, according to the US Securities and Exchange Commission. A jury found Terraform Labs and founder Do Kwon liable for fraud in April 2024, and in June 2024 they agreed to pay more than $4.5 billion.

The crypto exchange FTX collapsed in November 2022. Its founder, Samuel Bankman-Fried, was convicted on seven counts and on March 28, 2024 sentenced to 25 years in prison; prosecutors said he had taken more than $8 billion of customers' money. FTX told customers their deposits were held separately, while its code had been altered to let his trading firm, Alameda Research, withdraw effectively unlimited amounts. No blockchain prevented it. This was a custody and governance failure at a central company, the risk you take on whenever an exchange holds your keys.

NFTs after the 2021 boom

NFT trading was the consumer face of web3 in 2021, when DappRadar counted more than $23 billion of it. In the third quarter of 2025 it counted $1.6 billion, in a quarter when volume almost doubled. The number of sales hit a record 18.1 million, but DappRadar notes that many NFTs now trade for low values, and that one marketplace's rewards campaign pushed users to trade cheap NFTs to qualify. For a brand, the lesson is that a token is a receipt: its value comes from what it gives access to.

Enterprise blockchains that were shut down

TradeLens was the flagship enterprise case. Announced in 2018 and built by IBM with a division of Maersk, it aimed to digitize the global shipping supply chain as an open, neutral industry platform. On November 29, 2022, Maersk and IBM announced they would discontinue it and take it offline by the end of the first quarter of 2023. Their stated reason was not the technology: the platform worked, but the full industry collaboration it needed never arrived, so it could not become commercially viable.

The Australian Securities Exchange (ASX) had a similar outcome with its replacement for CHESS, the system that clears and settles Australian shares, which it was building on distributed ledger technology. On November 17, 2022, after an independent review by Accenture, ASX paused the project and wrote off A$245 million to A$255 million before tax. The review found the application about 63% complete, with complexity in how ASX's requirements interacted with the application and the underlying ledger, and governance problems between ASX and its delivery partner.

The pattern across both: getting competitors to share one system, and delivering something that complex, were the hard parts. The cryptography was not.

Security: where the money is actually lost

In 2025 the large losses came from what surrounds a blockchain: keys, signing processes, front ends and people. Chainalysis counted more than $3.4 billion stolen from January to early December 2025, with North Korean groups responsible for at least $2.02 billion of it. It attributes the growing losses at exchanges and other central services to attacks on private key infrastructure and signing processes.

The largest single theft was Bybit's. On February 26, 2025, the FBI stated that North Korea was responsible for stealing about $1.5 billion in virtual assets from the exchange on or about February 21, 2025, activity the FBI tracks as TraderTraitor. The mechanism is the useful part for any business. According to Sygnia's investigation, attackers compromised a developer's Mac at Safe{Wallet}, the multisig wallet service Bybit used, likely through social engineering. With the developer's cloud credentials they modified the JavaScript served by Safe{Wallet}'s web interface, set to act only on one Bybit cold wallet. When Bybit's signers approved a transfer from that cold wallet to a warm wallet, the code changed the transaction. The browser caches of all three signers' computers held the modified files, and the code was removed from the site two minutes after the theft.

Chainalysis also reports that North Korean operators pose as recruiters for web3 and AI companies and run fake hiring processes to steal credentials and system access from the people they interview. That is ordinary social engineering, and the same controls apply: phishing-resistant sign-in, least privilege and training, the basics in our cybersecurity best practices checklist.

The rules in 2026: MiCA and the GENIUS Act

Two major laws now set the rules, and both focus on issuers and service providers rather than on the technology. MiCA is in force; the GENIUS Act is being implemented:

In the EU, MiCA was adopted on May 31, 2023. Its titles on asset-referenced tokens and e-money tokens, the two kinds of stablecoin it defines, applied from June 30, 2024, and the rest from December 30, 2024. ESMA notes that member states could let existing providers keep operating under national rules during a transition, which ended on July 1, 2026 at the latest, so providers that relied on it now need a MiCA authorization to continue.

In the US, the GENIUS Act became law on July 18, 2025. It requires issuers to hold reserves of at least one dollar per coin in cash, bank deposits, Treasury bills with 93 days or less to maturity and similar instruments, to publish the composition of those reserves every month, and not to pay holders interest or yield. It takes effect on the earlier of 18 months after enactment (January 2027) or 120 days after regulators issue final rules, so check the state of that rulemaking when you read this. Other countries run their own regimes; check the rules wherever your customers are. Regulation makes an issuer accountable; it does not make every token safe.

Energy use depends on the consensus method

Energy use is a design choice, not a property of every blockchain. Proof of work is energy-intensive by design: the US Energy Information Administration estimated in February 2024 that crypto mining probably accounts for 0.6% to 2.3% of US electricity consumption. Proof of stake needs no such race. Ethereum switched to proof of stake on September 15, 2022, in an upgrade known as the Merge, which its documentation says cut the network's energy use by about 99.95%.

For a business, two points follow. If you report on emissions, the chain you choose will show up in that report. And in the EU, MiCA requires crypto-asset white papers to disclose the principal adverse impacts on the climate of the consensus mechanism used to issue the asset.

Does your business need a blockchain? Questions to ask first

Wüst and Gervais reduced the decision to a short sequence of questions. Their conclusion is that a blockchain only makes sense when several parties who do not trust each other want to change shared records and will not agree on an online trusted third party. Work through it in order:

1. Do you need to store shared data at all? If not, you need no database, let alone a ledger.
2. Does more than one party write to it? With a single writer, an ordinary database is faster and simpler.
3. Could a trusted party that is always online run it? An industry body, a regulator, a vendor or one of the partners? If yes, let it operate a database.
4. Are all the writers known? If the set of writers is open to anyone, you are in permissionless territory, such as Ethereum.
5. Do the known writers trust each other? If they do, a database with shared write access is the better tool.
6. Must outsiders be able to verify the records? That decides between a public and a private permissioned chain.

NIST, reviewing this and similar flowcharts, notes that most paths end in "no", and advises organizations to check whether existing technology solves the problem better. If you still land on "yes", ask these before anything is built:

• What problem needs a shared ledger that a database cannot solve? Name the parties, who would otherwise run the system, and why they will not. TradeLens shows that a working platform still fails when the other parties do not join.
• Who holds the keys? Decide between a regulated custodian and your own custody, how many people must approve a transfer, how approvals are checked, and what happens when someone leaves or a key is lost.
• Which rules apply? MiCA or the GENIUS Act if you issue or handle tokens, anti-money-laundering checks for payments, privacy law for any personal data (remember that a chain cannot delete), and your accountant's view of how the assets appear on the books.
• What does it cost in energy, fees and speed? Proof of work and proof of stake differ by orders of magnitude, and public chains confirm transactions in seconds or minutes, not milliseconds.
• How does data get onto the chain, and who checks it? Sensors, oracles and manual entries are where false records come from.
• What is the exit plan? Chains, custodians and vendors change; know how you would move your records and assets.

For many teams the honest answer is that partners need shared records with a clear audit trail, not a blockchain. That often means a web application with proper sign-in, roles and an API that partners call. Portals and customer tools with the identity, roles and APIs behind them are what our web design and development team builds, and our guide to enterprise API development covers the API side. Central logging and least-privilege roles are also part of the governed landing zones our cloud transformation service puts in place.