Single Point of Failure. What Banking Keeps Teaching Us, and the Ledger That Kept Running.

Two Addresses, One Week

On Tuesday 3 November the central bank of Paraguay suspended Ueno Bank. The app on 2.9 million phones stopped working. I wrote up what happened next: a flight into USDT, a premium that was never as big as the headline, and a deposit guarantee that started paying within 48 hours and will cover 97 percent of depositors in full. A functioning system, responding in about a week.

On Friday 6 November, at about 1:30pm in western Japan, a piece of communications equipment failed at the Shinkin Joint Center's western hub. That hub runs the core system for most of Japan's shinkin banks, the regional credit cooperatives that small businesses and pensioners use. 128 of them went dark at once. 3,430 branches. Every ATM they operate, and some they share with convenience stores. Internet banking and the apps. Direct debits on hold. Service came back shortly after 7pm. It was a hardware fault, not an attack, and nobody lost a yen. Five and a half hours.

Two different countries, two different causes, one solvent and one not. The headlines called both a crisis. Neither was. What they were, in the language I spent fifteen years using before I built this company, was the same thing.

What a Single Point of Failure Is

In systems design, a single point of failure is a component with no redundancy. When it fails, everything that depends on it fails with it, however healthy the rest of the system is. The classic examples are one database server, one network switch, one certificate that expires at midnight. You can have a thousand well-built services downstream, and one cabinet in a server room takes all of them down.

Engineers spend careers removing these. You add a second server, a second region, a second route. You assume every component will fail and design so that no one failure is visible to the user. That is the whole discipline. It is expensive and boring and it is why your phone works.

Banking has the discipline inside each institution and almost none between them. Each bank is reasonably redundant internally. But the customer has one bank, one app, one card, one settlement rail, and if the thing those depend on stops, the customer has nothing. Japan's shinkin banks consolidated their core systems into two hubs in 2010 and 2011 to save money. Sensible. It also meant that when one piece of equipment in the western hub failed, 128 banks failed with it. That is what consolidation buys you: efficiency until the day it costs you everything at once.

Paraguay is the other kind. Ueno was the digital bank. It was where salaries landed, where the state parked $850 million, where nearly half the country's accounts lived. Not a glitch. A solvency failure. But from the customer's chair the two look identical. The app does not open. The card does not work. The money exists and you cannot reach it.

The Banking Record

I want to be fair to banks here, because the point is not that they are badly run. The point is that the record is longer than people remember, and every entry on it was survivable for the people with a second path and expensive for the people without one.

Read the third column. A cabinet. An update. A migration. A rail. A bank. Each one a single dependency, each one with millions of people on the other side of it who had no say in how it was built.

And the fourth column is the one that matters. Thirty-three days is the UK Treasury Committee's figure for nine banks over two years. That is not one bad year at one bad bank. That is the normal operating condition of a mature, well-regulated banking system, measured by its own parliament.

The Ledger's Record, Honestly

Now the other side, and I am going to give you the full number rather than the flattering one.

The Tron network has produced a block roughly every three seconds since it launched its mainnet in 2018. In that time it has halted once. From 22:14 UTC on 1 November 2020 to about 01:40 UTC on 2 November, during a routine upgrade, a malicious contract exploited a flaw and the block producers stopped. About three hours. No funds were lost, nothing was rolled back, and the chain resumed from the block where it stopped. Every six hours since, there is a scheduled six-second gap while the producer rotation updates, which badly configured monitoring sometimes reports as an outage. It is not one. You can watch the block time live on our status page.

The USDT contract on that chain has been live since April 2019. As far as the public record shows, it has never been paused. It processed transfers through the FTX collapse, through the Binance hack two weeks ago, through every bank outage in the table above, and through this week in Paraguay, where it was the only dollar in the country that moved on Wednesday afternoon.

So: one three-hour halt in about eight years, against 33 days in two years for nine banks. I do not think that comparison needs me to sell it. I think it needs me to be careful with it, because the chain is not the whole system, and the parts around it have a worse record.

The Single Points That Remain

If I stopped the piece here, it would be the version of this argument that gets people hurt. The ledger running is not the same as you being able to reach your money. Between you and that ledger there is a stack, and each layer of it is a single point of failure I have watched fail.

• The exchange. On 29 October Binance lost $6.3 billion from its hot wallets and suspended withdrawals for about 48 hours. Binance covered every user. Many exchanges could not. For those two days, a Binance balance was exactly as reachable as a Ueno balance, and the chain underneath it was producing blocks the whole time. I wrote that one up too.
• The issuer. USDT is a claim on Tether, and Tether can freeze an address. It has done so 9,172 times on Tron since 2020, almost entirely for stolen funds and legal requests, and it releases about one in ten. The full dataset is here. For an ordinary holder it is a remote risk. It is a single point of failure all the same, and anyone who tells you otherwise is selling.
• The issuer's bank. In March 2023 Circle had $3.3 billion of USDC reserves in Silicon Valley Bank when it failed, and USDC traded at 87 cents for a weekend. A stablecoin's single point of failure can be a bank. The irony is complete.
• The access layer. Your wallet app talks to the chain through an RPC provider. TronGrid, the most common one, has had its own outages, and when it is down your wallet shows a spinning wheel while the chain behind it runs perfectly. The ledger was fine. Your window onto it was not.
• You. A lost seed phrase is a permanent outage with no deposit guarantee. The bank will reset your password. Nobody will reset your key.

Notice what is and is not on that list. The chain is not on it. Everything else is. That is the honest shape of the system: a very reliable ledger wrapped in layers that are about as reliable as banking, some of them less so.

Ensuring Access

So the question is not bank or chain. It is how many things have to go wrong before you cannot pay for dinner. In Paraguay this week, for most people, the answer was one. The goal is to make it three or four.

Keep the Bank. Keep the Key.

I run a company whose whole product is making the chain cheaper to use, so you should read anything I write about it with that in mind. Here is the version I would tell a friend.

Paraguay's deposit guarantee worked. Japan's banks were back by dinner. Most of the time, in most countries, the bank is fine and the outage is a few hours of inconvenience and a refunded fee. Nothing in this piece says otherwise, and a stablecoin does not come with a guarantee fund.

But every one of those outages was a single dependency failing, and the people who got through them without cost were the ones who had a second path that did not share the dependency. The ledger under USDT has been that second path through every entry in the table, with a record of one halt in eight years. It is not a replacement for the bank. It is the thing that keeps working while the bank is being fixed, which is a different job and, on the day you need it, a more important one.

In software we do not argue about whether the primary will fail. We assume it will and we make sure the failover is warm. That is all this is. A warm failover for your money. Set it up on a quiet day.

Ping. Still here.

Sources: Nippon.com and BigGo Finance on the 6 Nov 2026 shinkin outage · Bloomberg Línea on the Ueno guarantee · Which? on UK outage data (Treasury Committee and FCA) · Bloomberg on the 2023 Zengin outage · The Register on Mizuho 2021 · Crypto Briefing on the Nov 2020 Tron halt · Luganodes via KuCoin on the six-hour rotation gap · Wikipedia on the CrowdStrike outage · Wikipedia on the March 2023 USDC depeg.