Binance’s chief security officer, Jimmy Su, says the exchange is actively testing its own workforce against simulated phishing attempts—and tying repeated failures to employment outcomes. Su told Cointelegraph that the internal “red team” runs phishing exercises on a monthly basis to gauge whether security awareness among staff is improving.

According to Su, employees who fail the exercises aren’t just retrained once. Instead, Binance uses remediation training for those who miss the mark, and persistent, repeat failures can ultimately affect their standing at the company, reflecting the role that social engineering plays in real-world cyber incidents.

Key takeaways

• Binance conducts monthly simulated phishing attacks against employees as part of an ongoing internal security program.
• The simulations are carried out by Binance’s red team, a unit focused on ethical hacking and vulnerability discovery.
• Failed employees receive remediation training, while repeated failures can negatively affect performance reviews and potentially job outcomes.
• Binance says the program has been running for three to four years, with Su describing significant improvements in security hygiene over time.
• The company uses multiple real-world lures—such as fake recruiter outreach and other “information collection” tactics—to test staff resilience.

Why Binance is testing its own staff

Su said Binance runs phishing simulations “just so we understand if our security hygiene is improving,” framing the effort as a practical measurement exercise rather than a theoretical awareness campaign. The red team’s role, as described by Su, is to attempt intrusions and interactions that mirror real attack paths, then feed results back into training.

Binance is often described as a large-scale target in crypto due to its user base and market footprint. Su did not provide additional internal metrics in the interview, but the context underscores the stakes: Binance reports 323 million registered users, while DefiLlama estimates the exchange holds $137.7 billion in assets.

For investors and traders, the takeaway is that big exchanges treat human behavior as part of their threat model. The more a firm relies on operational processes—such as customer support, account access, identity verification, and internal tooling—the more social engineering becomes a risk factor that technical defenses alone can’t fully eliminate.

Social engineering remains a recurring breach pathway

Su’s comments land in the context of broader industry reporting on social engineering as a driver of crypto security incidents. In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. Later, in April, a long-term social engineering campaign preceded Drift Protocol’s $285 million hack, according to earlier coverage referenced by Cointelegraph.

Su also said the simulated attacks have been in place for three to four years. He suggested that security hygiene has improved substantially since the program began: “In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly,” he said.

This matters because it highlights a specific operational change: Binance is not treating awareness training as a one-time checkbox, but as an ongoing feedback loop. The key shift for organizations is moving from “teach and forget” to “test, measure, and enforce.”

What the simulations look like: recruiting lures and data-harvesting scenarios

One scenario Binance uses is impersonation of job recruiters. Su said the red team poses as recruiters—an approach that mirrors a common pattern seen in phishing incidents across industries, where “legitimate-sounding” contact becomes the entry point for further manipulation.

Su also described another lure: fake “free conference invites” aimed at collecting personal information and determining how many employees fall for it. He emphasized that the job interview process is only one of multiple scenarios used by Binance’s red team.

These details are important because social engineering attacks in crypto don’t always arrive as obvious “click this link” attempts. They can be structured like legitimate professional outreach, scheduling requests, or follow-ups—channels that can appear normal to staff who might otherwise be trained to recognize traditional phishing emails.

Another well-known technique referenced in the interview is the “Zoom meeting attack,” where attackers trick victims into installing malware disguised as a video conferencing update. Many such campaigns begin with a fake job opportunity, but they can also use other professional hooks like project funding or partnership proposals.

How failure is handled: remediation, reviews, and potential dismissal

Binance’s approach doesn’t end with simulated testing. Su said employees who fail the phishing simulations undergo remediation training. He also described incentives tied to the results, stating that performance reviews reflect test outcomes.

Su’s framing is direct: “If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That’s the incentive to be vigilant.”

He further said repeated severe failures could “bottom out” performance ratings, potentially leading to dismissal. While Su did not outline exact thresholds or timelines for dismissal in the interview, the principle is clear: Binance is treating repeated susceptibility to social engineering as a personnel risk, not just a training gap.

Outside centralized exchanges, similar social engineering dynamics have produced major losses in DeFi ecosystems as well. For example, Cointelegraph referenced a September 2025 incident in which a Venus Protocol user reportedly lost around $13 million after a malicious Zoom client compromised a computer and led the attacker to gain control over the victim’s account. Venus paused the protocol and used an emergency governance vote to recover assets, later returning positions worth $11.4 million to the victim, according to earlier coverage cited in the article.

Those examples reinforce the broader point behind Binance’s internal testing: even when attackers target individuals rather than systems, the outcome can still be catastrophic at scale.

What readers should watch next is whether Binance’s approach—monthly red-team phishing tests, remediation, and performance-linked consequences—becomes a more standard pattern across large crypto firms as regulators and stakeholders increasingly focus on operational security beyond code and infrastructure.

Cryptocurrency exchange Binance runs simulated phishing attacks against its own employees and can fire staff who repeatedly fail the tests, according to Binance chief security officer Jimmy Su.

The fake attacks are conducted by Binance’s red team, an internal ethical hacking unit whose job is to break into systems to identify vulnerabilities.

“We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving,” Su told Cointelegraph. “The ones that have failed it, we will do remediation training.” 

The measure shows the lengths crypto companies will go to prepare for social engineering attacks. Binance, the largest crypto exchange in the world, reports 323 million registered users, while DefiLlama estimates the exchange holds $137.7 billion in assets.

Jimmy Su, chief security officer at Binance. Source: Binance

In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. In April, Drift Protocol suffered a $285 million hack, which came after a long-term social engineering campaign. 

Su said Binance has been running these simulated attacks for three to four years. 

“In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly.” 

One of the simulated attacks involves the red team posing as job recruiters, said Su. 

Related: Trader loses $1M after signing phishing token approval 

One of the more well-known attack methods in recent years has been the “Zoom meeting attack,” where hackers trick victims into installing malware disguised as an update to the video conferencing app. Many of these attacks start with a fake job opportunity, though some use project funding or a partnership proposal as the lure. 

In September 2025, a major Venus Protocol user lost roughly $13 million after a malicious Zoom client compromised his computer, leading him to grant an attacker control over his account. Venus paused the protocol and used an emergency governance vote to recover the assets, later returning positions worth $11.4 million to the victim. 

“The interview process is just one scenario. There are other ones. For example, it could be that we are offering some kind of free conference invite just to try to collect personal information and see how many of them will actually fall for it,” said Su.  

Su said employees are incentivized to perform well on the tests because the results are reflected in their performance reviews.

“If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That’s the incentive to be vigilant.” 

Repeated, severe failures could lead to their rating to “bottom out,” which could see them dismissed, he said.

Magazine: Fears of AI-driven DeFi hack epidemic overstated for now — but not for long

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

The world’s largest stablecoin now travels between blockchains as USDT0, a version its builders insist is not a wrapped token, while its mechanics lock collateral in an Ethereum vault and mint claims elsewhere. Here is how it actually works, who runs it, what the trust stack contains, and why a gas tank on a new chain runs on it.

Every successful monetary instrument eventually faces the geography problem: the money is in one place, and the demand is in another. Gold solved it with certificates, banks with correspondent accounts, and Tether, whose USDT is the most used digital dollar on earth, faced it acutely by 2024, when the stablecoin’s natural habitat, Ethereum and Tron, no longer contained the frontier of activity.

New chains launched monthly, each wanting the deepest dollar in crypto, and Tether’s options were unattractive: deploy a native USDT contract on every chain, multiplying operational and compliance surface with each launch, or let third-party bridges wrap USDT into a zoo of incompatible IOUs, the wrapped-asset sprawl that fragmented liquidity and produced some of crypto’s worst exploits.

USDT0, launched in January 2025, is the third option: one canonical collateral pool, on Ethereum, feeding a single standardized representation that travels anywhere, minted and burned by cross-chain messages instead of shuffled through bridge pools.

Eighteen months later, it has moved more than $50 billion cumulatively, colonized the new-chain frontier, and become something no wrapped asset ever was: the native gas token of an entire blockchain. Its operators insist, emphatically, that it is not a wrapped token. Its mechanics are a lockbox and a mint. Both statements are doing work, and understanding the gap between them is the point of this guide.

The mechanics, step by step

USDT0 is built on LayerZero’s Omnichain Fungible Token standard, OFT, and the cleanest way to understand it is to follow one dollar through the system.

Start with issuance. A market maker or exchange holding native USDT on Ethereum deposits it into the USDT0 lockbox, a smart contract on Ethereum mainnet that serves as the system’s single collateral vault. Upon deposit, an equal amount of USDT0 is minted on the destination chain of choice, Arbitrum, Berachain, HyperEVM, Plasma, Stable, or any other connected network. The mainnet USDT never leaves the vault; what circulates elsewhere is the omnichain representation, backed one-to-one by the locked collateral, with supply across all chains reconciled against the vault’s balance and attested through on-chain proof-of-reserves.

Now move it. When a holder sends USDT0 from chain A to chain B, no asset crosses anywhere. The OFT contract on chain A burns the tokens; LayerZero’s messaging layer carries a verified instruction to chain B; the contract on chain B mints the same amount to the recipient. The verification is the system’s load-bearing component: each message is attested by a configurable set of Decentralized Verifier Networks, DVNs, independent parties that confirm the source-chain burn actually happened, and delivered by an executor on the destination chain.

Because transfers are burn-and-mint against one canonical pool, there are no per-chain liquidity pools to drain, no slippage between chain versions, and no bridge inventory to exploit in the way that destroyed earlier designs; the attack surface concentrates instead in the messaging layer and its verifier configuration, which is where any honest risk analysis must spend its time.

Exit works in reverse: burn USDT0 anywhere, unlock native USDT from the Ethereum vault, redeem through Tether’s ordinary channels. The system also extends beyond the dollar, with the same architecture carrying XAUT0, the omnichain version of Tether Gold, and the roster of connected chains has grown to include most of the venues where new stablecoin activity concentrates.

Who actually runs it

Here is the structural fact most coverage elides, and it matters more than any throughput statistic: USDT0 is not operated by Tether.

The system is built and run by Everdawn Labs, a separate company operating under license from Tether, announced as the deployment partner in January 2025 for chains where Tether chose not to run a native mint. Tether’s relationship to the system is that of licensor, collateral issuer, and, as of February 2026, strategic investor in LayerZero Labs itself, an investment that formalized the alignment between the dollar, its omnichain vehicle, and the messaging layer underneath both. The arrangement mirrors patterns elsewhere in stablecoin infrastructure, where issuers increasingly delegate chain expansion to specialized partners instead of operating every deployment themselves.

For a holder, the delegation defines the trust stack, and the stack should be enumerated, not gestured at.

Layer one: Tether’s reserve risk, the same exposure any USDT holder carries, that the collateral behind the dollar is what the attestations say.

Layer two: the lockbox, an Ethereum smart contract whose integrity secures the entire omnichain supply; a flaw there is a flaw everywhere at once.

Layer three: LayerZero’s messaging, specifically the DVN configuration chosen for USDT0, since the verifiers who attest cross-chain messages are the parties who could, in a failure or compromise scenario, authorize mints that should not exist.

Layer four: Everdawn’s operational competence across all of it. Native USDT on Ethereum or Tron is a direct claim on Tether. USDT0 on a frontier chain is a claim on locked USDT, mediated by a contract, a messaging protocol, a verifier set, and an operator.

In calm conditions, the distinction is invisible, the tokens are fungible in practice, and the peg has held. The distinction exists for the other conditions, which is what trust stacks are for.

Wrapped or not? Adjudicating the claim

Everdawn’s positioning is explicit: USDT0 is not a wrapped token or a synthetic asset; it is USDT, extended across blockchains. The mechanics described above are, equally explicitly, lock-and-mint, the same skeleton as every wrapped asset since WBTC. Both claims can be examined honestly, and the resolution is more informative than either slogan.

What the not-wrapped claim gets right is the difference in kind from the wrapped-asset era’s actual pathologies. Classic wrapping was fragmentary: every bridge minted its own IOU, so one dollar became five incompatible tokens across five chains, each backed by a different custodian or pool, each trading at its own slight discount, each an island of risk.

USDT0 is canonical and unified: one standard, one collateral pool, one supply reconciliation, fungible representations everywhere, with the issuer’s blessing and proof-of-reserves attached. It also avoids the liquidity-pool bridge model whose drained pools produced the industry’s worst losses; burn-and-mint against a vault has no inventory to steal on the transfer path. In the dimensions that made wrapped a warning label, fragmentation, unofficial issuance, pool risk, USDT0 is genuinely something else.

What the claim obscures is that the something else still has the wrapped structure’s irreducible core: the circulating asset on the destination chain is a representation, and between it and the underlying dollar sit contracts, messages, and verifiers that native USDT holders do not depend on.

The honest taxonomy is that USDT0 is an official, canonical, issuer-aligned wrapper, the best-constructed version of the category, marketed as the category’s transcendence. Holders should adopt the engineering description rather than the marketing one, not because failure is likely, the system’s eighteen months have been clean, but because the description determines where to look when evaluating any chain, protocol, or yield product built on top of it: at the DVN configuration, the lockbox, and the operator, the three components a native-USDT analysis would never need to mention.

A note on what the numbers above are measuring, because USDT0 statistics arrive in three units that coverage routinely conflates. Cumulative transfer volume, the $50 billion figure, counts every cross-chain movement since launch and grows monotonically; it measures usage of the messaging rails, and a single market maker cycling inventory daily can generate billions of it.

Daily transfer volume, the hundreds of millions, measures current throughput and is the honest activity gauge. And outstanding supply, the amount of USDT locked in the Ethereum vault backing circulating USDT0, measures adoption as a stock: how many dollars actually live on the frontier at any moment, which is the number that matters for assessing both the system’s importance and its blast radius.

The three can tell different stories simultaneously: high cumulative volume with modest outstanding supply describes a busy corridor more than a settled population, and the disciplined reader checks which unit any headline is using before concluding anything.

The public dashboards report all three, and the ratio between daily volume and outstanding supply, the velocity of the omnichain dollar, is quietly the best single indicator of what USDT0 is being used for: high velocity signals bridging and arbitrage traffic, while a falling ratio with growing supply signals the thing the system was actually built for, dollars moving to new chains and staying there.

The precedent stack: how crypto got here

USDT0’s design is best appreciated against the three generations of cross-chain dollar movement it is trying to retire, because each generation’s failure wrote one of its requirements.

Generation one was the custodial wrap, WBTC’s model applied everywhere: a trusted custodian holds the asset, a merchant mints the representation, and the trust is institutional. It worked, and it concentrated risk in single custodians whose failure would orphan every wrapped unit, a structure acceptable for one flagship asset and unworkable for a dollar meant to exist on thirty chains.

Generation two was the liquidity bridge: pools of the asset parked on both sides of a route, with transfers swapping against the inventory. This is the architecture behind the industry’s grimmest leaderboard, the Ronin, Wormhole, and Nomad exploits that together lost billions, because pooled inventory is a honeypot and bridge code guarding it became the most attacked surface in crypto.

Generation three was canonical-but-fragmented: issuers deployed native contracts chain by chain, which eliminated wrapper risk and created its own sprawl, the same dollar as incompatible deployments, unofficial bridged versions filling every gap the issuer had not reached, and users left to guess which contract address was real, a confusion that persists in every wallet’s token list today.

USDT0 is the fourth-generation answer, and its design choices map one-to-one onto the predecessors’ wounds: a single canonical collateral pool instead of custodial fragmentation, burn-and-mint messaging with no pooled inventory to drain, issuer alignment and proof-of-reserves instead of unofficial IOUs, and one standard identity across every chain instead of the address-guessing game.

What it could not design away is the residual that every cross-chain system shares: a verification layer whose honesty the whole structure rests on, which in USDT0’s case is LayerZero’s DVN configuration. The generational history is therefore the fairest way to grade the system, dramatically safer than bridges, structurally cleaner than fragmented wraps, and still, irreducibly, a machine whose security equals the integrity of the parties attesting its messages.

Crypto has not escaped that equation; it has, in USDT0, produced its most disciplined answer to it so far, with the largest dollar in the industry as the test load.

Why it matters: the gas tank case study

The clearest demonstration of what USDT0 changes arrived when Stable, the Tether-ecosystem payments chain, made it the network’s native gas token, the first time the fuel of an entire Layer 1 has been a representation of somebody’s dollar.

The design solves a real problem this publication’s stablechain coverage has examined: on general-purpose chains, users must hold a volatile native asset to move their stable one, an absurdity for payments. Stable’s v1.2.0 upgrade in February retired its earlier wrapped-gas workaround and made USDT0 the chain’s fee asset directly, so a user’s balance and their fuel are the same dollar, with simple transfers gas-exempt entirely.

None of that is possible with mainnet-native USDT, which cannot leave Ethereum; it is possible with USDT0 precisely because the omnichain layer lets a new chain import the world’s deepest dollar at launch, liquidity, brand, and users included, without waiting for Tether to deploy natively.

The same import logic explains USDT0’s spread across the frontier generally: for a new chain, connecting to the standard is the difference between launching with dollars and launching with promises.

The strategic reading completes the picture. USDT0 converts USDT from a multi-chain asset into a network: one vault, many outlets, centrally standardized, and it does so under the Tether ecosystem’s own governance, not through third-party bridges it cannot control.

Every new chain that adopts the standard deepens the moat of the underlying dollar, which is why the system’s growth, $50 billion moved, hundreds of millions daily, a gas tank on a purpose-built chain, is best understood not as bridge traffic but as the largest stablecoin building its own distribution grid. The dollar stays in the vault. The claim on it goes everywhere. Whether that is called wrapping or extension matters less than knowing which one you hold.

A final calibration on scale, because the numbers reframe what kind of object this is. USDT’s total circulation runs in the $150-billion-plus range across all chains, and USDT0’s share of it, while growing fast, remains the frontier slice: the omnichain system’s cumulative $50 billion in transfers and nine-figure daily volumes measure movement, not stock, and the locked collateral backing all outstanding USDT0 is a single-digit percentage of total USDT. That proportion is the honest size of the experiment: the vast majority of the world’s largest stablecoin still lives natively on Tron and Ethereum, where remittance corridors and exchange settlement run on decade-old rails, and USDT0 is the expansion mechanism for everywhere else, the new chains, the payments experiments, the frontier.

The proportion also explains the system’s risk posture from Tether’s side: delegating the omnichain layer to a licensed operator quarantines the frontier’s novel risks, messaging, verifiers, new-chain exposure, away from the core deployments that carry the float. If the omnichain layer ever failed, the damage would be severe for the connected chains and contained for the dollar itself, a separation that is prudent engineering from the issuer’s chair and worth internalizing from the holder’s: USDT0’s guarantees are engineered to protect USDT first.

As the frontier grows into the core, on Stable above all, that proportion will shift, and the omnichain layer’s security budget, scrutiny, and systemic weight will have to grow with it. The system’s first eighteen months earned it the benefit of the doubt. Its next test is carrying a meaningful fraction of the world’s working dollar, which is a different weight class, and the honest summary for any user is the one this guide began with: know which dollar you hold, and know the stack standing between it and the vault.

Frequently Asked Questions

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. It describes third-party infrastructure whose parameters, deployments, and risk profile can change. Always verify official contract addresses and documentation before transacting. Always do your own research. Information is accurate as of July 24, 2026.

The CLARITY Act has lost momentum after Senate leaders ruled out passage before the August recess. Political disputes surrounding ethics rules and crypto oversight continue to dominate Senate discussions. As a result, attention has shifted toward a possible November window when election pressures may ease.

Election Politics Pushes Clarity Act Beyond August

The CLARITY Act has entered another period of uncertainty after Senate Majority Leader John Thune indicated that lawmakers will not pass it before the August recess. As a result, industry participants now expect the Senate to revisit the legislation later this year. Current discussions now point toward November as the next realistic opportunity for progress.

Wintermute Head of Policy and Advocacy Ron Hammond believes election politics now outweigh legislative momentum despite bipartisan backing. He maintains that the bill still has enough support across party lines to advance. However, political priorities continue to dominate Senate activity before the midterm elections.

The latest delay follows months of negotiations involving lawmakers, regulators, and crypto industry representatives. Supporters continue promoting the bill as a framework for digital asset market regulation. Meanwhile, political disagreements have slowed efforts to move the legislation toward a final Senate vote.

Ethics Debate Adds Pressure to Senate Negotiations

Ethics provisions involving President Donald Trump and other federal officials have become another major issue surrounding the CLARITY Act. Democratic lawmakers continue seeking stronger restrictions on elected officials participating in crypto business activities. Republicans have shown greater willingness to discuss additional safeguards during negotiations.

The latest draft includes Department of Justice oversight for ethics enforcement involving public officials and digital assets. However, several Democratic lawmakers argue that the proposal gives excessive authority to the Justice Department. Consequently, negotiations over governance standards continue without reaching broad agreement.

Political messaging before the elections has also increased pressure on bipartisan negotiations. Senate Minority Leader Chuck Schumer reportedly wants Democrats to emphasize corruption concerns during the campaign period. That strategy could reduce bipartisan cooperation until election-related political activity declines later this year.

The ethics debate has developed alongside wider discussions about regulatory transparency across the digital asset sector. Lawmakers continue balancing market oversight with concerns surrounding conflicts of interest. Therefore, ethics negotiations remain closely linked to the broader regulatory framework within the legislation.

Banking Opposition and Legislative Priorities Create More Obstacles

Hammond also identified banking organizations and other crypto opponents as contributors to the legislative slowdown. According to his assessment, those groups continue extending policy discussions during every negotiation stage. Their continued participation has increased the time required for lawmakers to address outstanding issues.

At the same time, Congress faces an increasingly crowded legislative calendar during the remaining months of the year. Government funding measures require immediate attention before existing deadlines expire. Defense legislation also remains among the Senate’s highest priorities before lawmakers conclude the current session.

Prediction markets now reflect lower expectations for the CLARITY Act becoming law before year-end. Polymarket currently assigns a 37% probability to passage this year, compared with previous expectations above 80%. That decline reflects growing uncertainty surrounding the Senate timetable rather than changes in the bill itself.

The CLARITY Act previously gained bipartisan support after lawmakers sought clearer rules for digital asset markets. Supporters argue that the legislation would define regulatory responsibilities between federal agencies while establishing legal certainty for crypto businesses. Despite that objective, election politics, ethics negotiations, banking opposition, and competing legislative priorities continue delaying Senate action, leaving November as the most discussed period for renewed consideration.

StableChain’s product is Tether’s dollar: gas in USDT, transfers in USDT, yield in USDT. Its native token does none of that, and holders own governance and staking rights over a network whose every cash flow is denominated in someone else’s asset. This is crypto’s value-accrual question in its purest form yet, and it deserves a straight answer.

Every blockchain token answers one question with its existence: why does this network need me? Bitcoin’s answer is total; the token is the point. Ethereum’s answer is functional: the token is the fuel and the bond. And the new generation of stablecoin chains has produced the strangest answer yet, embodied most cleanly by STABLE, the native token of the Tether-ecosystem chain whose entire design philosophy is that users should never have to touch it.

On StableChain, gas is paid in USDT0, the omnichain version of Tether’s dollar. Balances are USDT. Simple transfers are exempt from fees entirely. The yield products pay in dollar terms. A user can onboard, transact, build, and exit without ever knowing STABLE exists, and that is not an oversight; it is the pitch: a payments chain where the volatile native token has been engineered out of the user’s path completely, which leaves the token itself standing in an interesting place.

STABLE launched alongside the mainnet in December with two stated jobs, governance and staking, and a market price that implies belief in a third: that owning the token means owning something about the network’s future economics. This guide takes the question seriously from both directions: what the token actually does, mechanically, today, and what it would need to become for the belief to be right, because the gap between those two is where every dual-token chain’s story is decided.

What the token actually does

Start with the mechanical inventory, because it is short, real, and frequently misdescribed.

Job one: security. StableChain is a proof-of-stake network, and its validators stake STABLE as the bond that makes consensus honest; misbehavior risks the stake, and diligence earns rewards. This is the token’s hardest, least dismissible function: every proof-of-stake chain needs a bonding asset whose value is endogenous to the network, because a chain secured by staking someone else’s asset, USDT, say, would let an attacker rent security from outside the system it attacks.

The security budget, the total value staked and the rewards paid to maintain it, is denominated in STABLE, funded today primarily through emissions, and it is the one place where the token is structurally irreplaceable. The dual-token design’s honest logic lives here: the payment medium should be stable and external, the security bond should be volatile and internal, and one asset cannot be both.

Job two: governance. STABLE carries voting rights in the network’s governance through the framework stewarded by the Stable Foundation, the independent body launched with the mainnet to run grants, ecosystem programs, and protocol votes. Tokenholder governance over a payments chain means influence over real parameters: fee policy for the non-exempt tiers, the scope of the gas-exempt allowlist, validator-set rules, upgrade schedules, treasury allocation. Governance rights are the token’s most commonly mocked function, crypto’s history is thick with governance tokens whose votes govern nothing consequential, and the mockery should be calibrated: on a chain with a patron as dominant as Tether’s ecosystem, the live question is not whether votes happen but how much of consequence is actually delegated to them, and the honest answer this early is: it is being determined, vote by vote, and the record so far is thin because the chain is young.

And that is the complete mechanical list. STABLE is not gas, not the settlement asset, not the unit of account for the chain’s products, not required to hold, send, or build. The inventory’s brevity is the design, and everything else about the token is a question about the future.

The value question, stated honestly

A token’s price is a claim on future usefulness, so state precisely what a STABLE holder owns a claim on, and what they do not.

They do not own the chain’s product. The product is USDT mobility, and its economics flow elsewhere: the float income on the dollars flows to Tether, the fee revenue on non-exempt transactions accrues in USDT terms, and the network’s growth, more users, more transfers, more integrations, grows the patron’s business directly, the mechanism this publication’s gasless-economics guide details. A million new users transacting entirely in the free tier generate, mechanically, zero fee demand for STABLE, precisely because the design removed the token from their path.

This is the sharpest version yet of the value-accrual gap that runs through crypto’s whole history, Ethereum’s L2s paying pennies to mainnet, XRPL’s agents settling in RLUSD, adoption compounding while the associated token watches, except that on those networks the gap emerged; here it was drafted, deliberately, as a feature.

What holders do own is three claims, in ascending order of speculativeness.

First, security demand: as the value settled on the chain grows, the security budget must grow with it; a chain moving billions cannot be secured by a token worth millions without inviting attack, so a successful StableChain structurally requires a valuable STABLE, with validators and delegators buying and locking it to earn the staking yield. This is real, and it has a known weakness: security demand sets a floor proportional to what attackers could steal, not a valuation proportional to what users transact, and the two numbers can diverge by orders of magnitude.

Second, governance premium: if the parameters tokenholders control become commercially consequential, which fee tiers exist, who gets allowlisted, how the treasury deploys, then influence over them is worth paying for, particularly to businesses building on the chain.

Third, and decisive: the fee switch, the question of whether the network’s USDT-denominated cash flows are ever routed to the token, through staking rewards paid from real fees instead of emissions, buy-and-burn mechanics, or revenue sharing. Every dual-token network eventually faces this fork, and the whole investment case compresses into it: a STABLE whose staking yield is funded by growing USDT fee revenue is equity-like, a claim on a payments business; a STABLE whose yield is funded by its own emissions is a dilution machine wearing a yield costume, paying holders with their own money.

Which fork this chain takes is not yet determined, is squarely within what governance and the Foundation will decide, and is, far more than any adoption metric, the number to watch.

One structural detail deserves its own paragraph before the arithmetic: where STABLE sits in the chain’s launch history, because the token’s distribution is part of its value question. The network arrived through a pre-deposit campaign that drew more than $2 billion from over 24,000 wallets before mainnet, a mechanism this publication’s stablechain coverage has examined as its own fundraising genre, and the token generation that followed allocated STABLE across the founding ecosystem, investors from the $28 million seed round, the Foundation’s treasury, and the community programs the Foundation administers.

The composition matters for both of the token’s jobs. For governance, initial concentration among ecosystem insiders means early votes measure the founding coalition’s intentions more than any community’s, and the decentralization of the holder base is itself one of the signals the grading framework below should track.

For security, the same concentration cuts the other way, benignly: a validator set staked by aligned parties is resistant to hostile accumulation precisely because so much supply sits with the ecosystem, which is the standard early-chain trade: security through concentration now, credibility through distribution later. The unlock and emission schedules, as they publish, convert this from description to data: the float’s growth path determines how quickly the dilution ratio bites, and whose tokens are doing the diluting.

The security-budget arithmetic, worked

The token’s hardest function deserves its numbers worked in public, because security demand is the one claim STABLE holders own unconditionally, and its arithmetic is both the case’s floor and its ceiling.

A proof-of-stake chain’s security budget must answer one question: what does it cost to attack the network, and is that cost comfortably above what an attacker could gain? The attack cost is a function of the staked value, acquiring or corrupting a controlling share of stake, and the gain is a function of what the chain settles: double-spendable balances, censorable payments, extractable value in flight.

For a payments chain aspiring to carry institutional USDT settlement, the gains side scales with throughput and float parked on-chain, which is why the design community’s rule of thumb holds that staked value must grow roughly in line with the value the chain secures, and why a successful StableChain mechanically requires a substantially valuable STABLE: billions settled daily cannot sit on security worth tens of millions without the mismatch itself becoming the vulnerability.

That is the floor argument, and it is real. Its limits are equally arithmetic.

First, security demand prices the bond, not the business: a chain can secure ten billion dollars of daily settlement with, say, low single-digit billions of staked value, generous by current industry ratios, and that number is a ceiling on security-driven token demand no matter how large the payment volumes above it grow. The token’s security case, in other words, scales with the square footage of the vault, not the traffic through the lobby.

Second, the demand is circular at the margin: validators acquire STABLE to earn staking rewards, and if the rewards are emissions, the demand is buying dilution, a loop that adds lock-up but not exogenous value, which is again why the fee-switch question dominates everything; real-fee rewards are the only input that breaks the circle.

Third, the floor is contingent on decentralization actually mattering: a young chain whose validator set is effectively permissioned within a patron’s ecosystem is secured, in practice, by the patron’s reputation as much as by the bond, and the bond’s economic necessity, along with the token’s, grows only as that training-wheel arrangement is genuinely retired.

The security argument for STABLE is therefore best held precisely: it guarantees the token a job, sized to the vault; it does not guarantee the token a valuation, sized to the network; and the distance between those two is, once more, a decision waiting in governance, not a mechanism waiting in code.

The comparisons that calibrate it

Three adjacent cases put boundaries on how this can go, and each maps onto a live possibility for STABLE.

The cautionary case is the pure governance token: assets whose networks succeeded while the token’s claims never matured, votes over nothing binding, fees never routed, value asymptoting toward the governance premium alone, which history prices low. Crypto’s graveyard of DeFi governance tokens trading at fractions of their launch against thriving protocols shows the failure mode is not network failure; it is the network succeeding around the token.

The constructive case is the modern fee-sharing turn: protocols that activated their fee switches, Maker’s burn against DAI revenues in its era, the newer generation of staking modules paying real revenue, and repriced accordingly. The mechanics exist, are well understood, and require only the governance will, which on a patron-dominated chain means the patron’s will: routing USDT fees to STABLE stakers is a decision to share the rail’s economics with tokenholders instead of concentrating them in the ecosystem, and patrons make that decision when tokenholder alignment is worth more to them than the revenue, typically as the validator set decentralizes and the chain’s credibility requires it.

And the sobering case is the gas-token contrast: Ethereum’s ETH, whatever its troubles, is bought by every user by necessity, a demand floor STABLE’s design explicitly forgoes. The dual-token chain trades away that mandatory bid for a better product, stable fees, and the trade’s honesty should be admired even as its consequence is priced: on this architecture, nothing is automatic; every path from network success to token value runs through an explicit decision, by governance, by the Foundation, by the patron, to build the connection.

STABLE is, in that sense, the cleanest experiment yet run on crypto’s oldest question. The chain can succeed enormously; the token participates only if someone decides it should; and the entire due diligence of holding it reduces to a judgment about whether, when, and how generously that decision gets made.

Watch the emission schedule against real fee revenue, watch the first governance votes that touch money, and watch for any fee-switch proposal in the Foundation’s pipeline, because on a chain that engineered the token out of the product, the only thing that can engineer it back in is a vote.

A closing note on how this experiment will actually be graded, because the token’s design guarantees the verdict arrives as a series of documents, not a moment.

The first grading event is every emissions disclosure: the schedule’s dollar value against the chain’s real USDT fee revenue is the dilution ratio, and its trend is the single most information-dense number the token will ever print.

The second is the first governance vote that moves money, a fee-tier change, a treasury deployment, an allowlist decision, because it will reveal whether tokenholder governance on a patron chain is a legislature or a suggestion box, and markets will reprice the governance premium accordingly within the week.

The third is any fee-routing proposal, the fork this guide has argued everything reduces to, and its absence is also information: each quarter the network grows while staking yield remains emission-funded is a quarter of evidence about which fork the ecosystem intends.

And the last is the slow one, validator-set composition, because the security argument matures only as the set opens beyond the founding ecosystem, converting the bond from ceremony into necessity.

None of these events is a price target, and that is the point: STABLE is a claim whose value will be legislated into existence, or not, by identifiable decisions on a public calendar, which makes it, whatever else it becomes, one of the most watchable experiments in token design now running. The chain’s users will never notice any of it, by design. The holders should notice nothing else.

One comparison from outside crypto rounds out the calibration, because the dual-token structure has a traditional-finance cousin worth naming: the exchange operator. A stock exchange’s product is other people’s securities, its fees are denominated in ordinary money, and its own listed shares confer exactly what STABLE confers, governance over the venue and a claim on whatever economics the operator chooses to route to shareholders.

Nobody needs exchange shares to trade on the exchange, and the shares are valuable anyway, because the operator routes real fee revenue to them; the fee switch, permanently on, is the entire business model. The analogy clarifies both what STABLE could become and what it is not yet: exchange operators are valuable because the routing decision was made at incorporation, in the corporate form itself, while a dual-token chain makes the same decision later, optionally, through governance, under a patron whose interests may prefer the revenue concentrated elsewhere.

The distance between STABLE today and the exchange-share model is exactly one decision wide, which is both the bull case’s simplicity and the bear case’s, and it returns the analysis to where the mechanical inventory left it: a token whose two real jobs are secure and decide, holding an option on a third job, collect, that only the second job can exercise.

Frequently Asked Questions

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Token designs, governance frameworks, and reward mechanisms described here can change through protocol decisions. Nothing here is a recommendation to buy, sell, or hold any asset. Always do your own research. Information is accurate as of July 24, 2026.

Payments company Wise says it will revisit its application strategy with the US Office of the Comptroller of the Currency (OCC) after the regulator rejected its push to become a national trust bank. In a notice issued Thursday, Wise said it intends to reapply under a GENIUS Act framework—US legislation designed to create a regulated pathway for payment stablecoin activities.

The shift matters because Wise’s original charter plan has now been explicitly denied, and the GENIUS Act is meant to offer clarity for stablecoin issuers and payment providers once regulators finalize the rules. Wise’s next steps will therefore be closely watched by other fintechs weighing stablecoin-related business models in the US.

Key takeaways

• Wise was rejected by the OCC for a national trust bank charter tied to its use of stablecoin-related rails.
• The company plans to submit a new OCC application using a “GENIUS Act framework,” according to its Thursday notice.
• William Blair said Wise is likely to remain “focused on lowering the cost of cross-border transactions” without changing its position on payment stablecoins.
• The OCC cited gaps in Wise’s anti-money laundering (AML) and countering the financing of terrorism (CFT) program and other illicit-finance risks.
• The GENIUS Act—signed in July 2025—provides a regulatory framework for payment stablecoin providers, but pending regulations and missed guidance deadlines leave implementation details uncertain.

Wise pivots toward GENIUS Act framing after OCC denial

Wise’s charter application was denied by the OCC on Tuesday. In its rejection, the agency said Wise failed to demonstrate that it had an effective AML/CFT compliance program and referenced “other illicit finance activity risks.” Those deficiencies formed the basis of the refusal to grant the national trust bank charter.

Rather than abandon the pursuit of a banking charter altogether, Wise now says it will change the way it approaches the application. According to a notice on Wise’s investor relations platform, the company plans to submit a new national trust bank charter application under a “GENIUS Act framework,” tying the filing more directly to the statute that regulates certain payment stablecoin activities in the US.

Investment banking group William Blair indicated that this procedural change is not expected to alter Wise’s underlying stance on payment stablecoins. As reported by William Blair in connection with Wise’s move, Wise remains focused on reducing the cost of cross-border transfers, “agnostic of the rail.”

What the GENIUS Act is intended to do

The GENIUS Act, signed into law in July 2025, is intended to create a clearer regulatory pathway for payment stablecoin providers. The legislation provides a framework for how stablecoins used for payments should be overseen in the United States, with additional regulatory steps required before full implementation.

However, the timeline for operational certainty is not fully in place. Cointelegraph previously reported that federal agencies missed a key deadline to provide guidance on how the GENIUS Act should be implemented before its effective date in January 2027. As a result, even with the law now on the books, market participants may still face uncertainty about how regulators will interpret and apply the framework in practice.

Wise’s reapplication strategy therefore highlights a practical tension in the current US environment: companies are trying to position themselves in line with upcoming stablecoin-focused rules while still needing to satisfy established banking supervision expectations—particularly around AML/CFT controls.

Why the OCC’s AML/CFT reasoning is likely to remain central

Wise’s original denial pointed directly to compliance readiness. The OCC said Wise could not show it had an effective AML and CFT compliance program, and it also cited other illicit finance activity risks.

Even if Wise moves forward under the GENIUS Act framework, the OCC’s stated concerns underline a broader reality for any entity seeking a national trust bank charter: the regulatory bar for compliance programs does not disappear just because a stablecoin statute exists. In effect, Wise’s challenge is twofold—aligning with the GENIUS Act’s payment stablecoin posture while also meeting the OCC’s supervisory expectations around money laundering, terrorist financing, and risk management.

This is likely to be a key point for investors and partners assessing Wise’s prospects. The GENIUS Act framing may change how the application is structured, but it does not negate the OCC’s focus on effective compliance systems.

Stablecoin policy momentum is real—yet approvals have been selective

Following passage of the stablecoin legislation, the OCC has approved several applications for national trust charters from major digital asset firms, including Circle, Ripple Labs, Crypto.com, and Coinbase, according to earlier reporting referenced in the source material. Those approvals suggest that the OCC is actively working through charter requests in the post-stablecoin-bill environment.

At the same time, Wise’s rejection shows that not all applicants will clear the process on the first attempt, especially when regulators identify weaknesses in AML/CFT effectiveness. The differentiation between successful charter applicants and Wise’s denied bid may come down to the OCC’s assessment of risk controls and readiness.

For the broader market, this combination—policy momentum on one side, compliance scrutiny on the other—may influence how payment and stablecoin-adjacent businesses plan their US expansion. Companies may increasingly try to align product plans with GENIUS Act expectations while treating regulator-reviewed compliance architecture as a decisive factor.

As Wise prepares its next filing, the market will watch closely for how the company documents its AML/CFT program and addresses the specific “illicit finance activity risks” cited by the OCC. With final GENIUS Act regulations still pending and federal guidance arriving late relative to the law’s effective date, the coming months could determine how the framework is operationalized for applicants and what additional assurances regulators will require.