Russia’s censorship crackdown and WhatsApp ban expose the decentralization gap the crypto industry keeps missing

Russia’s recent messaging crackdown is the cleanest real-world stress test of decentralization in years, and it produced an awkward result.

Roskomnadzor began throttling Telegram on Feb. 10, citing “non-compliance.” Two days later, authorities fully blocked WhatsApp, removing its domains from Russia’s national registry and forcing users toward VPNs or MAX, a state-backed messenger that critics describe as surveillance infrastructure disguised as a chat app.

The Kremlin had already mandated the preinstallation of MAX on all devices sold in Russia, effective Sept. 1, 2025.

The move seemed tailor-made to vindicate decentralized messaging. Here was textbook censorship playing out in real time, consisting of DNS manipulation, registry disruption, and platform coercion against services with more than 4 billion combined users.

Yet the “censorship-resistant” alternatives built over the past decade remained marginal. Users didn’t flood into Session, Status, or XMTP-based inboxes.

They patched the problem with VPNs and complained on Twitter.

The decentralization thesis didn’t fail because the technology doesn’t work. It failed because the technology addresses a problem most users don’t recognize, and introduces trade-offs they’re unwilling to accept.

Three-layer mismatch

What people call “decentralized messaging” actually bundles three distinct properties that rarely align in practice.

Content privacy means end-to-end encryption by default. WhatsApp uses the Signal Protocol for all messages and calls. Telegram does not, as E2EE applies only to Secret Chats, which are device-bound and don’t sync across platforms like the service’s default cloud chats.

Most Telegram users don’t toggle Secret Chats on, which makes the service’s “private” reputation misleading under pressure.

Network resilience refers to blockability. Centralized services present predictable choke points, such as DNS records, IP ranges, and CDN infrastructure.

Russia’s WhatsApp action exploited exactly that. Peer-to-peer systems reduce reliance on a single endpoint, but they trade off reliability, battery life, and the delivery guarantees that mainstream users expect.

Platform resilience is the layer almost no one discusses. Even apps marketed as decentralized depend on Apple and Google’s push notification systems (APNs and FCM) to deliver messages instantly in the background.

Those push rails create quiet centralization and metadata exposure, as Apple and Google can be legally compelled to share push notification metadata in some jurisdictions.

The coordination problem no protocol can solve

Network effects operate as a mathematical lock-in.

WhatsApp reports more than 3 billion monthly active users. Telegram claims over 1 billion. Switching costs are coordination costs: the value of a messaging app scales with the number of your contacts who use it, and the transition penalty grows exponentially with network size.

Phone numbers make this both worse and better at the same time.

Signal still requires phone-number registration even after introducing usernames. The decision isn’t an oversight, as Signal’s own documentation argues that phone numbers enable discoverability and help resist spam.

Decentralized systems that eliminate phone numbers must replace that entire scaffolding with something else. Most haven’t.

Crypto-native messaging protocols such as XMTP take a different approach, building identity around wallet addresses.

This creates composability across apps and reduces platform lock-in. Still, it also inherits problems that destroy mainstream usability: key custody risks, recovery failures, and identity confusion when users juggle multiple wallets.

Spam as the adoption ceiling and the mobile OS trap

Open networks become spam magnets unless constrained by identity systems, rate limits, or economic costs. XMTP’s documentation explicitly states that permissionless networks will attract spam and that content-level moderation cannot occur at the protocol layer if messages are encrypted.

The burden shifts to consent lists managed by individual clients and apps.

Every mechanism that might curb spam, such as identity proofs, token staking, and reputation scores, risks re-centralizing power or undermining anonymity.

If you require proof of personhood to send a message, you’ve created a new registry and a new attack surface. If you charge a fee, you’ve excluded low-income users and created opportunities for rent-seeking.

Mainstream users expect instant delivery. On iOS and Android, that expectation depends on background push notifications routed through APNs and FCM.

Even apps that position themselves as decentralized, such as Briar, Status, and Session, either compromise on “instant” delivery or accept the centralization imposed by push systems.

Push infrastructure also exposes metadata: who messaged whom, when, and from where. Authorities can compel Apple and Google to share that data in many jurisdictions.

For high-threat users, this is a fatal flaw. For everyone else, it’s invisible, until it isn’t.

Performance tax and feature regression

Multi-device sync, large group chats, media attachments, message search, and cloud backups are features users barely notice until they break.