Every leveraged crypto venue has a mechanism that can close your profitable position without asking, and it fires precisely when you are most right. It is the last step in a risk waterfall, it selects victims by a published formula, and it works differently on every architecture.

Here is how it operates and what actually reduces your exposure to it.There is a category of financial risk that traders learn about only at the moment it costs them money, and in crypto derivatives the leading example is auto-deleveraging. The mechanism is simple to state and hard to accept: on a venue where you hold a large, profitable, leveraged position, the exchange may close part or all of that position without your consent, at a price you did not choose, because someone on the other side blew up so badly that the venue cannot cover the shortfall any other way. You did nothing wrong. Your analysis was correct. Your position is being reduced precisely because it was working. Every major perpetual futures venue, centralized and decentralized alike, has some version of this mechanism, and it is disclosed in their documentation, which almost nobody reads until afterward. This guide explains why the mechanism must exist, where it sits in the sequence of defenses, how venues decide whose positions to cut, how the architectures differ, and what a trader can actually do to reduce exposure to it. For the venue layer, crypto.news has explained the venues where ADL lives.

Why the math has to close

Start with the structural fact that makes the mechanism unavoidable, because auto-deleveraging is not a policy choice that a more generous venue could simply skip.

Perpetual futures markets are zero-sum. Every long position has a matching short position, and the profit on one side is funded by the loss on the other. Positions are backed by collateral, and collateral is finite. In ordinary conditions this balances: a losing trader’s collateral covers the winning trader’s gain, the venue takes fees, and nobody thinks about the plumbing.

The problem arises when a losing position moves further against its holder than their collateral covers. The venue tries to close it, but if the market gaps, or the asset is thinly traded, or everyone is liquidating simultaneously, the position may only close at a price far worse than the point at which the collateral ran out. The difference between what the collateral covered and what the market actually delivered is a shortfall, and that shortfall is real money that must come from somewhere. It cannot be conjured. There are exactly three sources: a fund the venue maintains for the purpose, the venue’s own capital, or the profits of the traders on the winning side.

Auto-deleveraging is the third option, exercised when the first two are exhausted. Framed that way it is less outrageous than it feels: the alternative to reducing winning positions is a venue that becomes insolvent and cannot pay anyone, which is worse for the same winners. The mechanism is unpopular and defensible at once, and both facts should be held together.

The waterfall

Venues describe their defenses as a sequence, and auto-deleveraging is deliberately the last step, which is why encountering it means several earlier things already failed.

Maintenance margin. Your position must keep collateral above a threshold. This is calculated against a reference or mark price computed by the venue, typically blending external market data, and not the last trade on the venue itself, which prevents a manipulated tick from triggering mass liquidations.

Liquidation into the market. Breach the threshold and the venue closes your position by sending it to the order book, ideally near the bankruptcy price, the point at which the collateral is exactly consumed. Most liquidations end here, and the loss is contained to the trader who took it.

The backstop. If the market will not absorb the position at an acceptable price, the venue’s buffer takes it: an insurance fund accumulated from prior liquidations that closed better than expected, or, on several decentralized venues, a protocol vault whose depositors have collectively agreed to be the counterparty of last resort in exchange for a share of fees and liquidation proceeds. This layer exists to make the next step unnecessary, and most of the time it succeeds. In severe events, well-capitalized vaults have profited handsomely from absorbing distressed positions at discounts and unwinding them into the recovery.

Auto-deleveraging. When the buffer is exhausted or the shortfall exceeds it, the venue reduces positions on the profitable side to close the gap. Positions are closed at the bankruptcy price of the liquidated counterparty, not at the market price, which is why the outcome feels arbitrary to the person on the receiving end. The venue’s books balance, the market continues, and someone who was winning has a smaller position than they did five minutes ago.

How you get selected

Selection is formulaic and disclosed, which means it is also, to a degree, manageable.Venues maintain a ranking of positions on each side, and while the exact formula varies, the ingredients are consistent: unrealized profit, effective leverage, and position size. The most profitable and most leveraged positions rank highest and are deleveraged first, on the reasoning that they have the most cushion to absorb the reduction and that high leverage is itself a contribution to systemic fragility. Many venues display a trader’s current rank in the queue as an indicator, often as a simple visual scale, and that indicator is one of the most useful and least examined pieces of information on any derivatives interface.

Two practical implications follow, and they are the closest thing to actionable advice this mechanism permits. First, leverage is the variable you control that most directly affects your ranking, so the same directional exposure taken with lower leverage and more collateral sits lower in the queue. Second, the indicator is live, meaning a trader in a violently trending market can see their exposure rising and choose to realize some profit instead of being reduced involuntarily at a price they did not select.

Three architectures, three profiles

The likelihood of encountering auto-deleveraging depends less on your trading than on the venue’s design, which is the aspect most explanations skip entirely.

Insurance fund venues. The traditional model, used by most centralized exchanges: a fund accumulates from liquidations that close better than the bankruptcy price and pays out shortfalls when they close worse. Its adequacy is a published number, and its health is the single best predictor of whether a venue will need to deleverage during a stress event. A fund that has been drained by a recent cascade is a venue where the next cascade reaches winners faster.

Vault-backed venues. Several decentralized venues route the backstop through a protocol vault funded by depositors, where the liquidation engine hands distressed positions to the vault instead of to an anonymous fund. The economics are more transparent, since the vault’s positions and balance are publicly visible, and the risk is more explicitly allocated, since depositors know they are the buffer. The practical effect for traders is similar: a large, healthy vault absorbs more before deleveraging becomes necessary. The practical effect for depositors is that they hold the tail risk the mechanism would otherwise distribute to winners, which is the trade they were compensated for. Crypto.news has also examined a vault-backed architecture in its Hyperliquid governance audit.

Pooled-liquidity venues. Where a pool is already the counterparty to every trade, the shortfall lands on the pool by construction, and the response is typically to adjust the pool’s exposure or its pricing instead of deleveraging individual traders. The risk does not disappear; it moves earlier in the chain and lands on depositors continuously and not on winners suddenly.

The general rule that falls out: the deeper and better capitalized the buffer between liquidation and winners, the further you sit from involuntary closure, and that buffer’s size is public information on every venue worth using.

1inch has unveiled Aqua, a new protocol designed to bring liquidity from multiple decentralized finance venues under one coordinated system. Announced this Tuesday, Aqua targets a recurring DeFi limitation: liquidity is often fragmented by protocol, which can make routing less efficient and leave some pools underutilized.

According to the 1inch announcement, Aqua works by letting liquidity providers authorize one or more strategies tied to a single wallet inventory. Rather than depositing assets permanently into any specific liquidity pool, the protocol keeps funds in the wallet until trades are settled, using atomic settlement to prevent overextension.

Key takeaways

• Aqua aims to unify liquidity across many DeFi markets without locking assets into a single pool.
• Liquidity providers can authorize multiple strategies while assets remain in their wallet until settlement.
• Trades are constrained by available wallet balance; if a swap would exceed funds, it reverts atomically.
• 1inch plans to deploy Aqua across multiple chains, including Ethereum and several L2 and alternative networks.
• Pending governance approval, Aqua incentive funding is set to include USDC and 1INCH tokens.

How Aqua coordinates liquidity without pool deposits

At the core of Aqua is an integrated toolkit that includes a generalized onchain registry, wallet-backed automated market making (AMM) strategies, atomic settlement, and position management that’s oriented around how liquidity is allocated to specific trades.

The approach is meant to widen access to liquidity because it’s not necessarily bound to one protocol’s pool structure. That said, Aqua also does not allow unlimited parallel usage of the same capital. 1inch describes a model where the funds a provider makes available can participate in only one operation at a time, even if the provider is advertising liquidity across several venues.

For example, the announcement illustrates a scenario where a liquidity provider with $10,000 can advertise $10,000 on three different protocols, potentially totaling $30,000 of advertised positions. However, at any moment, only $10,000 worth of simultaneous trades can actually execute from that inventory. The design effectively resembles coordinated “overbooking” of advertised capacity, but with strict balance checks at execution time.

Atomic settlement and balance limits

1inch provided additional detail through a spokesperson speaking to Cointelegraph. The spokesperson noted that Aqua can be used by resolvers holding a 1inch-issued access credential, while not all protocols may be supported under the system.

On execution mechanics, the spokesperson emphasized that Aqua positions are quoted against a market maker’s live wallet balance. After a fill, any remaining position quotes against the remaining balance. If a swap request would exceed what’s actually available, the system should revert atomically, preventing partial execution or mismatched accounting.

This “quote-to-balance” behavior is important for users and integrators because it helps reduce the risk of liquidity promises that can’t be honored at settlement—an issue that can arise in some routing and aggregation designs when inventory is handled off-contract or without tight execution constraints.

Deployment footprint and onchain registration

In its rollout plan, 1inch says Aqua has been deployed across 13 blockchains, listing networks that include Ethereum, Arbitrum, Base, Robinhood Chain, and BNB Chain. By spreading deployment across multiple ecosystems, Aqua is positioned as an infrastructure layer rather than a single-venue product.

The protocol’s generalized onchain registry and wallet-backed strategy system are intended to make liquidity coordination more uniform across chains, while the atomic settlement model seeks to keep execution rules consistent even as liquidity sources vary by venue and chain.

For liquidity providers and traders, the practical question is whether this architecture translates into better capital utilization and improved routing reliability. The “advertise more than you can simultaneously use” model only helps if demand patterns align—1inch’s design explicitly assumes that not all operations will require the same capital concurrently.

Incentives pending governance vote

Separately, 1inch said that—subject to approval by tokenholders through a pending governance vote—Aqua will receive incentives to support adoption.

Under the proposal described in the announcement, the protocol would allocate 500,000 USDC for Aqua incentives, alongside 10 million 1inch (1INCH) tokens. At the time of 1inch’s announcement, it stated that the token component was worth roughly $830,000.

1inch frames the incentive program as a way to accelerate liquidity growth and swap activity across the pairs supported by Aqua. If approved, these incentives would align with Aqua’s thesis: coordinating inventory across venues should make it easier for participants to route and execute swaps using the aggregated wallet-backed liquidity.

Investors and builders will likely watch whether the incentives increase actual swap throughput and whether liquidity providers continue to participate given the single-operation-at-a-time constraint.

Background amid company leadership turmoil

Today’s rollout comes after earlier reporting involving 1inch’s internal governance and management. Earlier in the month, Cointelegraph noted that Anton Bukov, a co-founder of 1inch, said he was “fired” from the company in November 2025 after “pushing for change” in its management and operations, as described in coverage linked by Cointelegraph.

While that dispute does not directly inform Aqua’s technical design, it adds context for readers tracking how 1inch’s roadmap is executed and how governance dynamics may influence future protocol decisions.

With Aqua now deployed on 13 chains and incentives awaiting community approval, the next key signal will be whether wallet-backed coordination delivers measurable improvements in routing efficiency and swap volume—especially under real trading demand where simultaneous calls may compete for the same underlying inventory.

Nexo said on July 28 that its products remain available across the European Economic Area through an operating structure involving two regulated German partners. 

Tangany provides digital-asset custody, while DLT Finance supplies brokerage infrastructure for crypto-assets and financial instruments.

The announcement does not identify a MiCA crypto-asset service provider authorisation held by Nexo itself. Instead, Nexo attributes the regulated custody and brokerage functions to Tangany and DLT Finance. The platform said the arrangement completed a testing phase without disrupting customer access.

Nexo’s MiCA setup separates custody from brokerage

Tangany holds EEA client crypto-assets through its Munich-based custody infrastructure. The company received its MiCA licence in September 2025, covering custody, transfers and staking services. Tangany said the approval allows it to passport those services across the European Union.

DLT Finance is the operating brand of DLT Securities GmbH. Under Nexo’s arrangement, it provides brokerage and execution infrastructure. Public licence data list DLT Securities as a German MiCA-authorised provider for services including exchanging crypto-assets, executing orders and placing crypto-assets. The firm also operates as an investment firm under MiFID II.

This division means the companies performing covered custody and trading functions hold the relevant permissions. Nexo continues to control the client-facing wealth platform and user experience.

MiCA entered application before the July deadline

Nexo’s release says compliance was achieved ahead of MiCAR’s “entry into force.” The more precise reference is the end of the transitional period. MiCA entered the EU statute book in 2023, its stablecoin provisions began applying on June 30, 2024, and the remaining rules applied from December 30, 2024.

Existing providers in qualifying national regimes could continue operating temporarily. That final EU-wide transition ended on July 1, 2026. ESMA said firms providing covered crypto services after that date must hold MiCA authorisation or stop those activities.

Notably, MiCA’s transition deadline forced unlicensed platforms to wind down or transfer customers. Nexo’s partner-led model allowed its covered services to remain available rather than undergo a broad EEA suspension.

Lending and rewards sit outside partner licences

Nexo’s EEA website states that custody, trading and futures are provided through Tangany and DLT Finance under their MiCA and MiFID authorisations. However, Earn rewards and crypto-backed loans are separate products offered under different terms and outside the scope of those partner permissions.

That distinction matters because MiCA does not provide a complete regulatory framework for crypto lending. European lawmakers are already examining whether future rules should cover lending, staking, decentralised finance and other activities not fully addressed by the current regime.

Nexo said all of its existing services remain available in the EEA, but that statement is a company representation. Customers still need to review the legal entity and terms governing each product because protections can differ between custody, trading, rewards and credit services.

Partner models may become more common in Europe

Nexo’s structure shows how platforms can retain their brands and interfaces while outsourcing regulated functions to authorised European infrastructure firms. Kraken previously entered Germany through a partnership with DLT Finance, using a similar local-infrastructure approach.

Such arrangements may become more common as MiCA raises compliance, capital and staffing costs. As crypto.news reported, those costs could encourage further partnerships, acquisitions and consolidation across Europe’s digital-asset sector.

No additional launch date or product migration was announced. The immediate next step is continued operation under the new structure, with Tangany and DLT Finance responsible for their authorised functions.

ESMA has advised customers to verify the exact provider and permitted services in its MiCA register. Authorisation applies to named legal entities rather than an entire international brand or every product displayed inside one application.

AEREDIUM says enterprise AI security must shift from model safety to cryptographic containment and structural authorization controls.

When OpenAI disclosed that one of its AI models escaped a restricted testing environment and breached Hugging Face’s infrastructure, the discussion quickly centered on AI safety. The questions were familiar: Can AI systems be aligned? Can they be trusted? Are today’s guardrails sufficient to prevent harmful behavior?

According to Eitan Katz, Chief Strategy Officer at AEREDIUM, those questions miss the larger lesson.

“This wasn’t just an AI safety incident,” Katz says. “It was a containment failure. Once an AI agent becomes capable enough, guardrails alone are no longer enough. Organizations need infrastructure that can cryptographically enforce what an AI agent is, and isn’t, authorized to do.”

The distinction matters because AI safety and AI containment solve different problems.

AI safety focuses on influencing a model’s behavior. It asks whether an AI system can refuse harmful requests, avoid generating dangerous outputs, or follow human instructions. AI containment begins from a different assumption: regardless of how capable or intelligent an AI agent becomes, it should never be able to exceed the authority it has been explicitly granted.

The OpenAI and Hugging Face incident illustrates that difference.

According to OpenAI’s own disclosure, the evaluation intentionally ran with production classifiers disabled and cyber refusals reduced. That makes the incident particularly instructive. Rather than demonstrating a failure of refusal training, it demonstrated what happens when structural controls become the primary line of defense. As Katz argues, once behavioral filters are absent, a capable, goal-directed agent will treat surrounding infrastructure as available surface unless something deeper prevents it from doing so.

That is why, Katz argues, containment is not fundamentally a filtering problem.

Model guardrails remain valuable for reducing accidental misuse and raising the cost of casual abuse. But they are probabilistic by nature, and they assume an AI system can be prevented or persuaded from taking an undesirable action. A sufficiently capable agent optimizing toward a specific objective may instead look for a path around those controls. The durable security boundary, Katz argues, must exist below the model itself.

“The durable control is structural,” Katz writes. “Authority has to be constrained below the point of decision, at the key itself.”

His conclusion is simple: “An action outside the mandate is not blocked. It cannot be produced.”

That philosophy forms the foundation of AERPOLICE.

Rather than attempting to determine whether an AI model is behaving safely, AERPOLICE is designed to assess whether an organization’s infrastructure can contain autonomous AI agents through structural controls. The framework focuses on whether authority is cryptographically enforced, whether permissions are bounded, and whether autonomous agents are prevented from executing actions outside the mandates they have been given.

For Katz, the implications extend beyond an organization’s own AI deployments.

The question is no longer only whether personal AI agents can be trusted. Enterprises should also assume that increasingly capable external AI agents will eventually interact with their systems. Containment therefore becomes part of an organization’s overall security posture, defining how well its infrastructure can withstand autonomous, goal-directed agents regardless of where they originate.

This also changes how enterprises should think about responsibility. Security can no longer depend solely on the behavior of the model or on the policies of whichever AI provider an organization happens to use. Organizations need controls that enforce their own authorization boundaries independently of the model itself.

None of this, Katz argues, diminishes the importance of AI safety. Guardrails continue to play an important role in reducing accidental harm and improving the overall AI ecosystem. But they should not be mistaken for the security boundary that protects enterprise systems.

The broader lesson from the OpenAI and Hugging Face incident, according to Katz, is that enterprise AI security is entering a new phase. As autonomous AI agents become more capable, organizations will increasingly need infrastructure that can enforce what those agents are authorized to do, rather than relying solely on what they are expected to do.

The future of enterprise AI security, he argues, will depend less on whether an AI model behaves correctly, and more on whether it is structurally prevented from exceeding its authority.