Anecdotally, blackhats start seriously paying attention once your project crosses $100M in TVL (or an equivalent metric).
This is especially true for non-EVM chains. Ethereum has painfully endured many hacks, so its security posture has matured over time. But non-EVM ecosystems often have a false sense of safety simply because they haven’t yet crossed that critical threshold.
It’s fine to move fast and break things early. But once you hit $25M in value at risk, it's time to get paranoid. At $100M, blackhats are guaranteed to be watching.
You’ll also attract extra Blackhat attention:
1. At launch, when folks hunt for low-hanging bugs (these stories rarely go public).
2. During integrations: devs poke around, and it only takes one bad actor to trigger an exploit.
If I could offer one piece of advice: rethink your security posture around the $25M mark, especially if you moved fast or were lax early on (totally normal for startups and nothing to be ashamed of).
Crypto payments today are not business-friendly, even stablecoin payments.
Today, the pitch for stablecoin is a global, uniform interface with cheap fees. But it's absolutely a mess for tracking. Try talking to a finance person who has to deal with it.
Nobody wants to force KYC on their users, but you have to do it to stay compliant. Seriously, who in their right mind wants to build an onboarding flow where you ask your user to pull up an ID and verify the face? The churn on that step is massive.
I once talked with a lawyer about the risks, and how they enforce it is scary, even if you had no intent to transact with a sanctioned individual.
Unless the policymakers change this, if you want to run a legitimate business, you must comply, even at the expense of additional customer friction or security concerns about data.
Many products today perform 'silent KYCs' to minimize onboarding dropoffs and trigger a full KYC as transaction values and risks increase (they know who you are with the limited data you give them, like phone numbers).
TLDR: you're barking at the wrong tree on KYC. The correct tree is the regulators.