Alabama has become the second state in the United States to grant legal status to decentralized autonomous organizations under the Decentralized Unincorporated Nonprofit Association Act.

The DUNA Act, introduced in February by Republican Senator Lance Bell, provides legal recognition and limited liability protections to DAOs after passing 82-7 with 16 abstentions on March 17.

According to data from CoinLaw, there are over 13,000 DAOs across the globe, with roughly $24.5 billion worth of assets under their control. The key goal behind this framework is to offer clarity on how DAOs exist and operate within the legal system.

Alabama Governor Kay Ivey has now signed the bill into law, according to a16z Crypto’s head of policy and general counsel, Miles Jennings.

In a recent X post, Jennings said, “Decentralized governance is essential to crypto’s future—it’s one of the core constructs in market structure legislation.”

The bill will give decentralized communities “the certainty to build, govern, contract, and scale in the real world,” Jennings explained.

However, there are certain requirements that organizations must meet to qualify as a DAO. First, a DAO must have at least 100 members for a common nonprofit purpose, such as governing a blockchain network or smart contract system.

These entities can operate through blockchain technology and smart contracts, and voting, proposals, and consensus mechanisms can all be stored on-chain. Such entities will have full legal entity status, which means they can own property, enter into contracts, and sue or be sued.

This will offer individual members protection from personal liability in cases of disputes arising from DAO operations.

“As federal crypto market structure legislation moves closer to becoming law, builders need effective domestic legal structures,” Jennings said.

Back in 2024, Wyoming became the first state to grant legal status to DAOs under the DUNA Act.

Earlier this month, a similar DUNA bill was introduced in West Virginia by Representative Tristan Leavitt in February and is now awaiting the governor’s signature.

Key Takeaways

• An isolated testnet environment at Galaxy Digital was compromised by unauthorized access
• No client assets, personal information, or account data were exposed or endangered
• The financial impact was minimal, with losses under $10,000 in test-only funds
• Galaxy’s response team identified and contained the breach swiftly
• Trading operations and all client-facing services continued without disruption

Mike Novogratz’s Galaxy Digital has publicly acknowledged a recent cybersecurity incident that compromised one of its development environments. The breach targeted an isolated research and development workspace designed exclusively for testing purposes.

The firm immediately clarified that customer assets and sensitive data remained completely protected throughout the incident. Every trading platform and client service continued operating normally without any interruption.

The compromised system was a testnet infrastructure — a segregated digital environment where engineers experiment with new code and functionality away from live networks. This testing space operated entirely separate from Galaxy’s production systems and core technology infrastructure.

A source familiar with the situation revealed that the monetary damage amounted to less than $10,000. Galaxy characterized this sum as negligible, emphasizing that these funds existed solely for internal development and testing activities.

Galaxy reported that its security team identified the unauthorized entry point and acted rapidly to isolate the breach. The organization locked down the affected workspace and implemented enhanced security protocols throughout its blockchain-based infrastructure.

Understanding Testnet Environments

A testnet functions as a standalone, quarantined space where software developers validate updates and experiment with new capabilities. It replicates the framework of production systems while operating completely independently from actual user assets and information.

Despite being separated from live operations, testnets can still appeal to cybercriminals seeking to identify security vulnerabilities. While compromising such environments doesn’t directly endanger users, it may expose potential weaknesses in system architecture.

Galaxy maintains a diverse range of services including digital asset trading, investment management, lending platforms, custody solutions, cryptocurrency mining operations, staking services, and data infrastructure. The company primarily serves institutional investors while functioning as a connector between conventional financial markets and the digital asset ecosystem.

Ongoing Security Challenges in Cryptocurrency

Cybersecurity incidents and exploits remain an endemic challenge throughout the cryptocurrency space. The combination of publicly available code, substantial on-chain capital, and inconsistent security standards creates attractive opportunities for malicious actors.

According to industry analysts, annual losses from cryptocurrency-related hacks have consistently ranged between $1 billion and $2 billion in recent years. These incidents span everything from centralized exchange compromises to decentralized protocol exploits and sophisticated phishing campaigns.

Galaxy indicated that investigation into the incident continues. The company committed to sharing additional information when appropriate.

The firm has not disclosed specific details regarding the method of unauthorized entry or the particular vulnerability that was exploited during the attack.

Beyond the immediate containment measures and workspace security enhancements, Galaxy Digital has not announced any structural changes to its security personnel or broader infrastructure.

As of its official statement, Galaxy Digital confirmed that all client-facing platforms and services maintain complete security and operational integrity.

Former FTX head of engineering Nishad Singh has agreed to pay a $3.7 million fine to resolve his case with the US commodities regulator.

Singh will pay a disgorgement of $3.7 million as part of a supplemental consent order for his role in the collapse of FTX and the misappropriation of user funds, according to an April 1 statement from the U.S. Commodity Futures Trading Commission.

As part of the supplemental consent order, he has also been handed a five-year ban on trading in markets and an eight-year registration ban that blocks him from obtaining a license to operate within the sector.

CFTC enforcement director David Miller ruled out additional restitution or civil monetary penalties for now and said the current resolution reflects Singh’s cooperation with authorities.

“The defendant engaged in, and aided, significant violations of the Act and CFTC regulations as the former FTX head of engineering, and the consent orders reflect the severity of these violations,” Miller said.

A Bloomberg report noted that attorneys representing Singh said he was grateful the matter had been resolved and added that the regulator recognized his limited role in the underlying conduct.

Singh was accused of personally misappropriating millions of dollars in assets as part of FTX’s collapse. The commission charged the former executive with two counts of fraud by misappropriation and aiding and abetting fraud.

Subsequently, he entered into the consent order and agreed to cooperate with the commission’s investigators.

As previously reported by crypto.news, Singh was also spared from prison and received three years of supervised release.

In the meantime, FTX founder and former CEO Sam Bankman-Fried has filed a pro se motion seeking a new trial in his federal fraud case.

Bankman-Fried is currently serving a 25-year sentence on seven counts of fraud and conspiracy but has argued that key witness testimony was missing from his 2023 trial.

The US state of Alabama has become the second US jurisdiction after Wyoming to grant decentralized autonomous organizations (DAOs) legal status under the DUNA Act.

The Decentralized Unincorporated Nonprofit Association (DUNA) Act (Senate Bill 277) was introduced in February by Republican Senator Lance Bell. The House passed it 82-7 with 16 abstentions on March 17, and has now been signed by Alabama Governor Kay Ivey, according to a16z Crypto.

Speaking about the bill’s passage, a16z Crypto’s head of policy and general counsel, Miles Jennings, said on Wednesday that “decentralized governance is essential to crypto’s future — it’s one of the core constructs in market structure legislation.”

The bill provides legal status and limited liability protections to DAOs, solving a long-unresolved question in crypto: How DAOs exist from a legal standpoint in the real world. 

It gives decentralized communities “the certainty to build, govern, contract, and scale in the real world,” added Jennings. 

Full legal entity status for DAOs

To qualify, a DAO must have at least 100 members joined for a common nonprofit purpose, such as governing a blockchain network or smart contract system.

Governance can operate entirely through blockchain technology and smart contracts, and voting, proposals and consensus mechanisms can all be stored onchain.

These organizations will have full legal entity status, they can own property, sue and be sued, and enter into contracts, while individual members and administrators will be shielded from personal liability. 

Related: Aave DAO backs V4 mainnet plan in near-unanimous vote

“As federal crypto market structure legislation moves closer to becoming law, builders need effective domestic legal structures,” added Jennings. 

West Virginia DUNA Act awaits approval 

A similar DUNA bill (HB 5060), introduced by Representative Tristan Leavitt in February, passed the House on March 4 and is awaiting the governor’s signature in West Virginia. 

Wyoming’s DUNA Act was signed into law by Governor Mark Gordon in March 2024. The state approved the first legally recognized DAO in the United States in July 2021. 

Over 13,000 DAOs exist worldwide with collective treasury assets under DAO control surpassing $24.5 billion as of 2025, according to CoinLaw. The average DAO treasury size is around $1.2 million, and Ethereum and its layer-2 networks host over 85% of DAOs, reported PatentPC in March.

Magazine: Your guide to surviving this mini-crypto winter