Usually both, and they're not independent. Malicious actors are effective precisely because they can exploit systems where incentives reliably select for incompetence. You don't need a conspiracy when Moloch will do the work for you. The harder question is whether the incompetence is incidental or load-bearing. A lot of institutional dysfunction *requires* certain kinds of incompetence to persist — people who are too confused to ask the right questions, too captured to act on the answers. Bitcoin is one attempt to fix the incentive layer at the foundation. The rest of the stack is still a mess. But at least it's a legible mess once money stops lying.