Release Date: May 10, 2026
Executive Summary
This companion piece builds upon the research report "Crypto Exchange TradFi Expansion: A Five-Model Taxonomy" published by Bitbase Research on April 23, 2026 (referred to as the "preceding work"). The data cut-off date for this companion piece is consistent with the preceding work, which is April 23, 2026.
The preceding work presented five TradFi-on-crypto architectures as "architectural fingerprints," each integrating multiple dimensions such as settlement, margin, regulation, distribution, and asset structure. This companion piece elevates the "counterparty risk holder" dimension from within these fingerprints to the main analytical axis, providing a second systematic reading of the same set of architectures.
The two readings are co-extensive: they describe the same set of structural solutions, not two different sample sets. The order of Models 1 through 5 corresponds exactly across both readings, as each architectural fingerprint's multidimensional combination implies a specific counterparty structure, and vice versa. The value of the settlement-layer methodology lies in translating abstract, multi-dimensional juxtapositions into an observable problem closer to the root cause. This problem is: in a stress scenario, whose balance sheet absorbs the loss first, and whether that balance sheet has historically ever absorbed such losses.
This companion piece maps each of the five architectures defined in the preceding work back to a set of verifiable historical failure modes:
-
Stablecoin Issuer Trust Cycle
-
CFD Broker Balance Sheet
-
Off-Chain Custody & Transfer Agent Chain
-
DEX Insurance Fund & Auto-Deleveraging Mechanism
-
Unconventional Tools of Regulated Central Counterparties Under Extreme Market Conditions
Each failure mode corresponds to an independent list of observable signals. This companion piece does not predict which architecture will fail; it only describes the structural indicators that need to be monitored for each architecture.
This companion piece is not a revision of the preceding work. The preceding work is a published research product, and its publication is a commitment benchmark. This piece is a methodological extension of the preceding work; they exist in parallel.
Chapter 1: Why Write a Settlement-Layer Companion Piece
The preceding work defined five architectures by presenting five independent "architectural fingerprints," each integrating multiple dimensions such as settlement, margin, regulation, distribution, and asset structure, but these dimensions themselves were not explicitly prioritized or arranged in an upstream-downstream manner. This presentation left methodological room for subsequent re-readings that elevate a single dimension to a primary position.
This companion piece was inspired by an observation from a reader in public LinkedIn discussions from late April to early May 2026. This reader's perspective—that the five architectures represent different answers to the question "who holds the counterparty risk," and that the counterparty risk dimension in the preceding work's fingerprints played the role of the root cause most clearly differentiated by the five architectures—sharpened our reading of our own report. We adopt this perspective, elevating the counterparty risk dimension from the architectural fingerprints to the main analytical axis; but we make one calibration: we read the relationship between the settlement-layer perspective and the regulatory dimension as co-extensive, not upstream-downstream; the specific argument is detailed in Chapter 3.
We chose to publicly materialize this methodological dimension in the form of a companion piece, rather than merging it into a future Deep Dive main piece or the Q4 2026 Signal Tracking Composite Report. The reason is genre purity: future Deep Dive main pieces should take on new topics; the Q4 Signal Tracking Composite Report should strictly respond to the three reversal signals defined in Chapter 9 of the preceding work, without mixing in new analytical dimensions; a companion piece is the more appropriate intermediate genre. Bitbase Research uses this companion piece as the public materialization of this methodological dimension.
Chapter 2: The Five Counterparty Risk Holders
The five architectures from the preceding work can be summarized according to their architectural fingerprints as follows. Model 1: Offshore or non-explicitly securities-regulated CEXs offering USDT-settled perpetuals (stablecoin-settled perpetuals). Model 2: CFD brokers regulated by ESMA or similar jurisdictions. Model 3: Off-chain custodied RWA issuers regulated under securities or trust law. Model 4: DEX perpetual protocols without a regulated entity at the protocol layer. Model 5: Central Counterparty (CCP) within a CFTC-licensed DCM-DCO-FCM architecture.
Rearranging the same set of architectures by settlement layer yields a juxtaposition of counterparty risk holders.
Model 1: Stablecoin Issuer and CEX Proprietary Book. The end-user's ultimate counterparty is twofold. The first is the stablecoin issuer: the composition of its reserve assets, its susceptibility to a run, and its connectivity to the banking system determine whether USDT can maintain its 1:1 peg under stress. The second is the CEX's proprietary book: its solvency as the counterparty to stablecoin-settled perpetual contracts determines whether users can close positions and withdraw funds in a tail event. Both counterparties have a history of defaults that can be concretely characterized by regulatory documents in the chain of historical events.
Model 2: CFD Broker Balance Sheet. In the B-book business model of CFDs, the broker is not an intermediary but the user's direct counterparty—the broker internalizes client orders on its own balance sheet, profiting from client losses. When jurisdiction regulations (e.g., ESMA) mandate negative balance protection, the broker's balance sheet must absorb losses exceeding client margin in a tail event; when jurisdiction regulations do not mandate it (e.g., Mauritius FSC), losses can be passed back to the client, creating a negative balance. In the settlement-layer view, the difference between these two jurisdictions is a different allocation rule for B-book risk.
Model 3: Off-Chain Custodian and Transfer Agent Chain. Tokenized RWAs and crypto yield accounts share the same settlement-layer structure: off-chain holding + user agreement terms. The balance sheet, corporate governance, and Terms of Use language of the off-chain holder collectively determine whether users can reclaim assets upon default. This structure is distributed among multiple regulated entities in the institutionalized path (e.g., BlackRock BUIDL custodied by BNY Mellon, with Securitize as the SEC-registered transfer agent); in the crypto yield account path (Celsius, BlockFi), it is concentrated within a single company, and its Terms of Use may explicitly stipulate transfer of ownership.
Model 4: DEX Insurance Fund and Auto-Deleveraging (ADL) Mechanism. DEX perpetual protocols lack a traditional CCP-style clearing membership system and regulated, multi-layered prefunded buffers. Solvency under stress is determined jointly by the insurance fund and ADL: the insurance fund is a prefunded protocol-level reserve; when it is insufficient, ADL forces the liquidation of a portion of profitable counterparty positions to restore overall solvency. Losses are ultimately borne by protocol participants according to the rules, not by an entity with a balance sheet.
Model 5: Regulated Central Counterparty. The CFTC-licensed DCM-DCO-FCM architecture is the most institutionalized solution at the settlement layer: default fund, hierarchical loss-sharing obligations among clearing members, multi-layered prefunded resources, independent governance, compliance with CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI). But "highest institutionalization" does not equal "un-stress-testable." When extreme market conditions cause the default fund to be excessively consumed within a single day, CCPs still have a history of actually activating two categories of unconventional tools: mass cancellation and negative-pricing structural rule changes.
The loss allocation rules under stress for the five counterparty structures are structurally non-interchangeable—this is the root cause this companion piece aims to uncover.
Chapter 3: Why It's Not an Upstream-Downstream Relationship
This section contains the most critical methodological argument of this companion piece.
The initial hypothesis in the LinkedIn discussion was: the regulatory dimension is superficial (downstream), counterparty risk is the root cause (upstream), and the multi-dimensional juxtaposition in the preceding work's fingerprints did not explicitly prioritize this causal relationship. We do not adopt this upstream-downstream relationship because it cannot hold at the historical institutional choice level.
Examine the specific differences between ESMA jurisdictions and Mauritius FSC jurisdictions. On May 22, 2018, ESMA adopted Decision (EU) 2018/796 (based on MiFIR Article 40), effective August 1, 2018, imposing across the EU for retail clients: tiered leverage caps, a 50% margin close-out rule, per-account negative balance protection, prohibition of any promotional incentives, and standardized risk warnings [1][2]. Mauritius FSC does not mandate negative balance protection, nor does it mandate a client compensation scheme akin to the FCA FSCS [3]. This jurisdictional difference is itself a structural choice: ESMA's institutional choice is to compel the broker's balance sheet to absorb losses exceeding client margin in a tail event; Mauritius FSC's institutional choice is to allow such losses to be passed back to the client.
In other words, "regulatory dimension differences" and "counterparty risk allocation differences" are not two ends of a causal chain. They are two expressions of the same institutional choice. The DCM-DCO-FCM three-tier architecture adopted by the CFTC under Dodd-Frank Title VII (7 U.S.C. § 1a et seq., passed in 2010) is itself the institutionalized product of the choice to have "a central counterparty hold the risk," responding to the G-20 commitment in September 2009 that "all standardized OTC derivative contracts should be traded on exchanges or electronic trading platforms, where appropriate, and cleared through central counterparties by end-2012" [4]. The CFTC's final adoption in 2012 of the Legal Segregation, Operational Commingling (LSOC) rule eliminated "fellow customer risk"—if an FCM client defaults, the DCO cannot touch the assets of other non-defaulting clients [5]. This set of rules is a jurisdictional choice and also a counterparty structure choice; one cannot be placed "upstream" of the other.
The specific meaning of co-extensive: any counterparty structure identified here directly corresponds to the multi-dimensional combination of one of the architectural fingerprints in the preceding work, and vice versa. The two readings have no difference in classification boundaries; the difference lies only in the reading—the settlement-layer perspective is closer to the root-cause question of "whose balance sheet absorbs the loss first in a tail event."
Chapter 4: Failure Mode 1: Stablecoin Issuer Trust Cycle
Model 1 architecture has two layers of counterparty risk: the stablecoin issuer and the CEX proprietary book. Tether's history is a case chain with relatively rich, verifiable depth for the stablecoin issuer trust risk layer.
2017 Bitfinex Banking Corridor Rupture. Wells Fargo ceased processing outgoing USD wire transfers for Bitfinex and Tether from four Taiwanese correspondent banks (KGI Bank, First Commercial Bank, Hwatai Commercial Bank, Taishin Bank) around late March 2017 [6]. Bitfinex and Tether filed a lawsuit against Wells Fargo in the U.S. District Court for the Northern District of California (N.D. Cal.) on April 5, 2017, alleging Intentional Interference with Contractual Relations, seeking an injunction and damages exceeding $75,000; the lawsuit was voluntarily dismissed on April 12, 2017 [7]. Subsequent NYAG investigation revealed that from mid-2017 onward, Tether had lost banking access entirely for a period, thereafter holding cash in a trust account in the name of its General Counsel; NYAG documents record that this account balance "never exceeded $61.5 million," while USDT circulation had reached hundreds of millions [8].
2018–2019 Crypto Capital Loss Incident. NYAG documents specifically record: Bitfinex transferred approximately $850 million of commingled client and corporate funds to the Panama-registered payment processor Crypto Capital Corp. without a written contract; this fund was frozen by authorities in multiple countries starting in the summer of 2018 [8]. Bitfinex arranged a "$700 million transfer from Tether reserves to Bitfinex's balance sheet" to fill the gap. The NYAG filed In re James v. iFinex, Inc., Index No. 450545/2019 on April 25, 2019 [8].
February 17, 2021 NYAG Settlement. The Settlement Agreement between the NYAG and iFinex/Tether became effective on February 18, 2021, announced publicly on February 23, 2021. Terms included: an $18.5 million fine, cessation of any trading activity within New York State, and quarterly disclosure of Tether's reserve composition for a two-year period [8][9]. Tether and Bitfinex explicitly "neither admit nor deny" the NYAG's factual findings in the agreement.
October 15, 2021 CFTC Order. In the Matter of Tether Holdings Limited et al. (CFTC Press Release 8450-21) and In the Matter of iFinex Inc., BFXNA Inc., and BFXWW Inc. were issued on the same day [10]. The CFTC found: during at least the period from June 1, 2016, to February 25, 2019, Tether's representations did not match its actual reserves; during a 26-month sample period, Tether's actual dollar reserves backed USDT circulation only 27.6% of the days; Tether's reserves included unsecured receivables and non-fiat assets [10]. The CFTC imposed a $41 million penalty on Tether and a $1.5 million penalty on Bitfinex [10].
Reserve Structure Evolution and Commercial Paper Exposure. Tether's Q1 2022 attestation disclosed the composition of its $82.1 billion reserves [11]. Federal Reserve IFDP Working Paper No. 1334, Stablecoins: Growth Potential and Impact on Banking, discusses a potential stress scenario involving the transmission effect on short-term funding markets from the sale of short-term credit instruments during a stablecoin run scenario [12].
Settlement-Layer Conclusion. In Model 1 architecture, the user's ultimate counterparty is twofold: the susceptibility of the stablecoin issuer's reserve assets to a run, and the solvency of the CEX's proprietary book on perpetual contracts. Both have a history of defaults that can be concretely characterized by regulatory documents in the historical event chain.
Chapter 5: Failure Mode 2: CFD Broker Balance Sheet
The counterparty in Model 2 architecture is the CFD broker itself. When a tail event exceeds client margin, the solvency of the broker's balance sheet is the root cause of user risk.
January 15, 2015 Swiss Franc Black Swan Event. The Swiss National Bank (SNB) unilaterally announced at 09:30 GMT on January 15, 2015, the removal of the EUR/CHF floor of 1.20, which had been in effect since September 6, 2011. EUR/CHF plunged to a low of around 0.7710 within minutes, closing at 1.0472 for the day, a daily drop of 12.74%; USD/CHF fell to as low as 0.7462 [13].
Alpari (UK) Ltd Entering Special Administration. Alpari (UK) Ltd announced insolvency the day after the SNB decision (January 16, 2015) and was placed into the Special Administration Regime by order of the UK High Court on January 19, 2015, with KPMG LLP's Richard Heis, Samantha Bewick, and Mark Firmin appointed as Joint Special Administrators [14]. KPMG reports indicated approximately 99.8% (by value) of clients ultimately received funds through the Claims Portal, with final distributions not completed until June 2017; LeapRate reported a client shortfall of about $17.3 million during the final distribution phase [15].
FXCM and the February 6, 2017 CFTC Order. On January 15, 2015, FXCM incurred approximately $225 million in losses for the company due to client negative balances resulting from the CHF gap. It accepted a $300 million emergency loan from Leucadia the next day [16]. Two years later, the CFTC and NFA issued simultaneous settlement documents: In the Matter of Forex Capital Markets, LLC, FXCM Holdings, LLC, Dror Niv, William Ahdout (CFTC Press Release pr7528-17, February 6, 2017) [17]. The CFTC found that from September 4, 2009, through 2014, FXCM, while falsely claiming a "No Dealing Desk" agency model, actually routed order flow to the market maker Effex Capital, with which it had undisclosed affiliation and profit-sharing; NFA subsequently disclosed that FXCM received approximately $77 million in "order flow rebates" from Effex between 2010 and 2014 [17]. Outcome: CFTC penalty of $7 million; FXCM, FXCM Holdings, Niv, and Ahdout permanently banned from CFTC registration or association with registered entities [17]. FXCM's U.S. client accounts were sold to Gain Capital; the parent company FXCM Inc. was renamed Global Brokerage, Inc., and shareholders later filed Shipco Transport Inc. v. Global Brokerage, Inc., Niv, Ahdout (S.D.N.Y.), which ultimately settled for $6.5 million in 2023 [18].
ESMA Decision (EU) 2018/796 and the Institutionalization of B-book Constraints. ESMA adopted Decision (EU) 2018/796 on May 22, 2018 [1]. Supporting document ESMA35-43-1000 cites NCA survey data showing that in major EU jurisdictions, the proportion of retail investor CFD accounts in a loss-making state ranged approximately from 74% to 89%; specific page numbers and table references are based on publicly available ESMA documents [1]. A public statement issued by ESMA in February 2026 further explicitly brought "perpetual futures/contracts" into the scope of existing CFD product intervention measures [2].
Mauritius FSC as an Offshore Path. Mauritius FSC issues licenses to full-service investment dealers under legal frameworks such as the Securities Act 2005, Financial Services Act 2007, and AML/CFT Act 2009, typically allowing retail leverage of up to 1:500 to 1:2000; negative balance protection is not a mandatory obligation for the FSC [3].
Settlement-Layer Conclusion. In Model 2 architecture, the user's counterparty is the CFD broker itself. ESMA's negative balance protection rule forces losses exceeding client margin to be absorbed by the broker's balance sheet; Mauritius FSC does not mandate this rule, allowing losses to be passed back to the client. In the settlement-layer view, the difference between these two jurisdictions is a different allocation rule for B-book risk.
Chapter 6: Failure Mode 3: Off-Chain Custody and Transfer Agent Chain
In Model 3 architecture, counterparty risk resides off-chain. The balance sheet, corporate governance, and Terms of Use language of the off-chain holder collectively determine whether users can reclaim assets upon default.
Important clarification: The Celsius and BlockFi cases discussed in this section belong to the "crypto yield account" form, which is significantly different in institutionalization level from tokenized RWAs (e.g., BlackRock BUIDL). This companion piece places them under Model 3 because they share the same settlement-layer structure—off-chain holding + transfer agent chain.
Celsius Network (In re Celsius Network LLC, Bankr. S.D.N.Y. Case No. 22-10964 (MG)). Celsius Network LLC and affiliated entities filed for Chapter 11 in the U.S. Bankruptcy Court for the Southern District of New York on July 13, 2022. CoinDesk reported the next day that Celsius's balance sheet showed a hole of approximately $1.2 billion [19]; subsequent disclosures indicated liabilities to customers of about $4.7 billion [20]. The Earn Account was the largest product, accounting for about 77% of platform assets, valued at approximately $4.2 billion.
The court appointed Shoba Pillay (partner at Jenner & Block) as Examiner on September 29, 2022; Pillay submitted two core reports: the Interim Report (Doc 1411, November 19, 2022) and the Final Report (Doc 1956, January 31, 2023, 476 pages) [21]. A core conclusion of the Final Report was: Celsius operated a business materially different from what it marketed and sold to customers; Celsius spent approximately $558 million cumulatively purchasing CEL tokens in the market, being the only material buyer of CEL at virtually any point; founder Mashinsky personally profited about $68.7 million from selling CEL [21].
The most decisive ruling for the settlement layer came from Chief Judge Martin Glenn's Memorandum Opinion and Order Regarding Ownership of Earn Account Assets (ECF Doc. No. 1822) dated January 4, 2023: based on language in Celsius's various Terms of Use versions stating "grant Celsius ... all right and title to such Digital Assets, including ownership rights," crypto assets in Earn Accounts transferred to Celsius at the moment of deposit; as of the Petition Date (July 13, 2022), they became property of the bankruptcy estate [22]. Earn customers thus became unsecured creditors. This ruling meant that approximately 600,000 Earn account holders had no ownership claim to $4.2 billion in assets, only a right to recover according to the bankruptcy priority sequence [22].
BlockFi (In re BlockFi Inc. et al., Bankr. D.N.J. Case No. 22-19361 (MBK)). BlockFi filed for Chapter 11 on November 28, 2022 (while its Bermuda subsidiary BlockFi International Ltd. filed for liquidation). At filing: creditors exceeded 100,000; the largest unsecured creditor was Ankura Trust Company (representing BlockFi Interest Account clients), approximately $729 million; the second largest was FTX, approximately $275 million (corresponding to part of a $400 million revolving credit facility FTX provided to BlockFi in July 2022) [23]. BlockFi's bankruptcy was the first wave of contagion following FTX's collapse; the legal nature of its client assets was highly isomorphic to Celsius's.
Prior to bankruptcy, on February 14, 2022, BlockFi reached a landmark first-of-its-kind settlement with the SEC (In the Matter of BlockFi Lending LLC, SEC Admin. Proc. File No. 3-20700, Securities Act Release No. 33-11029): BlockFi agreed to pay $100 million ($50 million to the SEC, $50 million to 32 state regulators coordinated by NASAA) and cease selling BIAs to new U.S. clients [24].
Institutionalized RWA Tokenization: Risk Displacement, Not Elimination. Tokenized RWAs split Model 3's settlement-layer risk across multiple parties. Taking BlackRock BUIDL as an example (launched on Ethereum in March 2024, later expanding to Polygon, Arbitrum, Optimism, Avalanche, Aptos): BlackRock Financial Management acts as fund manager; Securitize, LLC (SEC-registered transfer agent) handles tokenization, whitelisting, transfer agency, and issuance; The Bank of New York Mellon acts as custodian for cash and securities; PricewaterhouseCoopers provides independent auditing [25]. BIS Bulletin No. 115 (published 2025) notes that ownership of BUIDL and WisdomTree WTGXX-like TMMFs is highly concentrated—approximately 90% of BUIDL holdings are concentrated in four wallet addresses [26].
In the settlement-layer view, this structure does not eliminate Model 3 counterparty risk; it distributes it across three parties: BNY Mellon (custodial failure risk), Securitize (transfer agent record-keeping failure risk), and the SPV legal wrapper (bankruptcy remoteness risk under BVI legal environment).
Settlement-Layer Conclusion. In Model 3 architecture, counterparty risk is off-chain, and the off-chain holder's balance sheet, corporate governance, Terms of Use language, and transfer agent records are the actual determinants of whether users can reclaim assets. The Celsius and BlockFi cases demonstrate the bankruptcy law outcome when "crypto yield accounts" explicitly transfer ownership to the platform at the user agreement level; BUIDL-like institutionalized paths demonstrate the same off-chain holding structure under a different risk allocation involving regulated multi-party collaboration.
One point that requires explicit separation: Crypto yield accounts and tokenized RWAs share the same settlement-layer structure (off-chain holding + transfer agent chain), but they differ significantly in institutionalization aspects such as governance, independent custody, registered transfer agents, independent auditing, and SPV legal wrappers. The failure modes listed in this section apply to the structural constraint of "explicit ownership transfer to a single company at the user agreement level"; the specific failure modes under stress for BUIDL-like institutionalized paths currently have no verifiable historical precedent, so they cannot be extrapolated from the Celsius/BlockFi judgments. The specific failure modes for BUIDL-like paths remain open observation items, noted in the Model 3 watchlist in Chapter 9 under the item concerning "bankruptcy precedents for tokenized RWAs in BVI, Cayman, Liechtenstein, and other SPV legal environments."
Chapter 7: Failure Mode 4: DEX Insurance Fund and Auto-Deleveraging
In Model 4 architecture, the ability to absorb counterparty risk under stress is essentially determined by the insurance fund size, ADL trigger rules, and oracle design. Two historical incidents involving GMX and dYdX demonstrate that insurance funds can be depleted not only due to contract vulnerabilities but also by being deliberately "drained" due to the protocol design itself.
Structural Differences Between DEX Insurance Funds and CCP Default Funds. The CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI, published April 2012, 24 principles and 5 responsibilities) require CCPs to maintain prefunded resources (default fund) that "cover extreme but plausible market conditions," a clear default waterfall, and recovery and orderly wind-down plans [27]. Insurance funds in DEX perpetual protocols bear structural similarity but lack the multi-layered prefunded buffers, hierarchical loss-sharing obligations among clearing members, and independent governance required by PFMI. When the insurance fund is insufficient, DEX perpetual protocols typically employ ADL (Auto-Deleveraging), forcing the liquidation of a portion of profitable counterparty positions to restore overall solvency. Tarun Chitra's Autodeleveraging: Impossibilities and Optimization (arXiv:2512.01112, v1 submitted November 30, 2025, v3 revised February 16, 2026) posits a trilemma for ADL mechanisms: no single ADL strategy can simultaneously satisfy exchange solvency, revenue, and trader fairness [28].
GMX V1 Price Manipulation Event in AVAX/USD Market (September 18, 2022). GMX is a DEX perpetual protocol deployed on Arbitrum and Avalanche. Its core design is: LPs provide GLP (a basket of BTC/ETH/AVAX/stablecoins) to act as market makers; traders trade at the Chainlink oracle price (zero slippage, zero price impact). Starting at 01:15:31 UTC on September 18, 2022, a trader, in 5 cycles, each time opened a large position in the GMX AVAX/USD market with approximately $4-5 million in size, simultaneously manipulated the AVAX spot price on centralized exchanges, and then closed positions for profit. On-chain analysis by Joshua Lim (then Head of Derivatives at Genesis Trading) showed the first cycle profit was about $158,000, with total profits around $565,000 (borne by GLP holders) [29]. GMX set the AVAX/USD long open position limit to $2 million and short limit to $1 million that day [29]. The nature of the event was not a smart contract vulnerability but an exploitability inherent in GMX's design of "zero price impact + single oracle price feed" under large directional positions.
dYdX v3 Insurance Fund Drain Event in YFI Market (November 17–18, 2023). Starting around November 1, 2023, YFI saw highly concentrated long position accumulation—data shared publicly by dYdX founder Antonio Juliano showed YFI open interest on dYdX v3 rose from $800,000 to $67 million within days [30]. Between November 17 and 18, 2023, the YFI price fell approximately 40% to 43% cumulatively within hours. The attacker attempted to close positions but largely failed due to liquidity drying up, ultimately triggering automatic liquidation with positions entering negative equity, absorbed by the insurance fund: the dYdX v3 insurance fund paid out approximately $9 million, about 40% of the v3 insurance fund, leaving $13.5 million [31]. dYdX's official Post Mortem on SUSHI and YFI Incident noted: dYdX v3's design, under oracle manipulation risk, makes the insurance fund the ultimate bearer of losses; this is fundamentally different from the multi-layered waterfall in traditional CCPs consisting of clearing members, default fund, and CCP's own capital upon default [32].
Settlement-Layer Conclusion. In Model 4 architecture, users do not face a counterparty with a balance sheet but a protocol-level loss allocation mechanism consisting of an insurance fund and ADL rules. The robustness of this mechanism depends on oracle design, liquidity parameters, and trigger rules, not on the solvency of any external entity.
Chapter 8: Failure Mode 5: Unconventional Tools of CCPs Under Extreme Market Conditions
Model 5 architecture is the most institutionalized solution at the settlement layer, but history also shows that CCPs are not "infallible" under stress. This section presents two historical precedents that have occurred: mass cancellation and negative-pricing structural rule change.
Institutional Origin: Dodd-Frank Title VII. Title VII of the Dodd-Frank Wall Street Reform and Consumer Protection Act (7 U.S.C. § 1a et seq.), passed in 2010, responded to the G-20 commitment in September 2009 regarding central clearing of OTC derivatives. Its core structural product is the three-tier architecture: DCM (Designated Contract Market) as the execution venue, DCO (Derivatives Clearing Organization) as the central counterparty, and FCM (Futures Commission Merchant) as the intermediary and clearing member between clients and the DCO [4]. The CFTC's final adoption of the LSOC rule in 2012 eliminated "fellow customer risk" [5].
March 2022 LME Nickel Contract Suspension and Cancellation of Trades. LME three-month nickel closed at $50,300/ton on March 4, 2022; at $48,078/ton on March 7; and surged to $101,365/ton within hours of opening on March 8. The LME suspended trading at 08:15 GMT on March 8 and decided at 12:05 GMT to cancel all nickel trades executed after 00:00 GMT that day, with cancelled trades totaling approximately $12 billion [33]. The market remained suspended until resuming on March 16.
Regulatory response: the FCA, PRA, and Bank of England issued a joint statement on April 4, 2022, launching a review [34]; the LME commissioned an independent review by Oliver Wyman, with the Final Report published on January 10, 2023 [35]. On March 3, 2023, the Bank of England publicly announced Bank of England announces supervisory action on LME Clear, identifying shortcomings in LME Clear's governance, management, and risk management across multiple areas and, under section 166 of the Financial Services and Markets Act 2000, appointing a skilled person to oversee LME Clear's remediation on an ongoing basis [36]. The FCA announced the same day that it had commenced an enforcement investigation against the LME—the first time UK regulators publicly announced enforcement action against an exchange [37].
Settlement-layer data (based on Office of Financial Research Working Paper No. 24-09) shows: in Q1 2022, LME Clear's cumulative margin breach amount was $23.3 billion, two orders of magnitude higher than previous quarters; the single largest account breach was $2 billion, itself exceeding LME Clear's $1.1 billion default fund; variation margin calls on March 3, 4, and 7 contributed about 65% of the excess breach volume [38]. These figures illustrate: even with LME Clear's institutionalized default waterfall, the single-day maximum breach in the nickel event had already rendered the default fund insufficient. The LME therefore chose to invoke Trading Rule 22 to cancel executed trades—an unconventional tool for a CCP when the default fund is insufficient.
Legal challenge: Elliott Associates and Jane Street Global Trading filed for Judicial Review in 2022, arguing the LME's decision breached its public law obligations as a Recognised Investment Exchange and violated the right to "peaceful enjoyment of possessions" under the Human Rights Act 1998; combined claims amounted to approximately $472 million [39]. The Divisional Court dismissed all claims on November 29, 2023; the Court of Appeal upheld the ruling on October 7, 2024; the UK Supreme Court refused permission to appeal on January 29, 2025 [39][40]. The core of the court's view was: the LME has expert discretionary space in judging a "disorderly market," and the cancellation power granted by Trading Rule 22 is a legitimate market maintenance tool compatible with MiFID II [40].
April 20, 2020 CME WTI May Futures Contract Negative Price Settlement. The CME NYMEX WTI May contract (CL, May 2020) opened at $17.73/barrel on April 20, 2020, with a settlement price of −$37.63/barrel at 2:30 p.m. New York time, having intraday traded as low as −$40.32/barrel [41]. This was the day before contract expiration. The E-mini WTI (QM) and ICE Europe's cash-settled WTI, referencing the CL settlement price, also settled at −$37.63 [41].
Preceding rule changes: CME issued Testing Opportunities in CME's "New Release" Environment for Negative Prices and Strikes for Certain NYMEX Energy Contracts (Clearing Advisory Chadv20-160) regarding supporting negative prices on April 8, 2020; it had previously notified CFTC staff on April 1, 2020, and issued multiple public notices on April 3, 8, 13, and 15 [42]. The CFTC issued an Interim Staff Report on NYMEX WTI Crude Contract Trading on and around April 20, 2020 in November 2020 (CFTC Press Release 8315-20) [43].
Broker loss example: Interactive Brokers incurred losses that day as the company covered margin for some clients holding long positions in May QM/WTI that settled negative, with an estimated maximum loss of approximately $109.3 million [44]. The CFTC penalized Interactive Brokers $1.75 million in 2021 (CFTC Press Release 8432-21), finding its electronic trading system was not configured pre-April 20 to recognize negative prices and did not correctly enforce internal minimum margin requirements pre-trade, resulting in approximately $82.57 million in initial client losses [45].
Settlement-Layer Conclusion. Model 5 is the most institutionalized architecture at the settlement layer, but history also shows that CCPs are not "infallible" under stress: mass cancellation (LME) and negative-pricing structural rule change (CME) are two unconventional tools CCPs have employed when default funds are insufficient or contracts face physical delivery collapse. The settlement-layer question is not "will Model 5 fail" but "are the tools Model 5 activates under stress anticipated and priced by market participants."
Chapter 9: Five Watchlists
This section lists the structural indicators that need to be monitored for each of the five counterparty risk holders. This is not a prediction of which architecture will fail but provides the observable signals corresponding to the historical failure modes of each architecture. The Q4 2026 Signal Tracking Composite Report should continue to strictly respond to the three reversal signals defined in Chapter 9 of the preceding work; the five watchlists proposed here are a new observation dimension that can be incorporated into ongoing tracking as supplementary signals in a Market Insights issue following the Q4 report.
Model 1: Stablecoin Issuer. Monitor: The proportion of commercial paper, corporate bonds, secured loans in the reserve composition in major stablecoin issuers' quarterly attestation reports; rolling changes in the proportion of short-term Treasury holdings; stability announcements regarding the issuer's banking corridors (USD on/off-ramp paths); the spread and frequency of primary market redemptions for major stablecoins against the dollar. Two historical baselines for primary market redemption pressure: during the May-June 2022 LUNA/UST collapse, USDT briefly traded at a discount to around $0.95 [46]; during the March 2023 SVB incident, USDC briefly depegged to around $0.88 before recovering within days [47].
Model 2: CFD Broker Balance Sheet. Monitor: Emergency financing announcements from major B-book brokers following tail events; enforcement status of negative balance protection by jurisdictional regulators; evolution of client money segregation rules in offshore jurisdictions like Mauritius FSC, Seychelles FSA; consolidated audit disclosures of major brokers' client assets vs. company proprietary funds. The historical baseline is the compliance restructuring of multiple brokers within 6 to 24 months following the 2015 SNB event.
Model 3: Off-Chain Custodian and Transfer Agent Chain. Monitor: Specific language regarding asset ownership in the Terms of Use of crypto yield account providers; the legal status of bankruptcy remoteness declarations by off-chain custodians (BNY Mellon, State Street, etc.); operational continuity of SEC-registered transfer agents; bankruptcy precedents for tokenized RWAs in BVI, Cayman, Liechtenstein, and other SPV legal environments. Chief Judge Glenn's January 4, 2023, ruling on Earn assets in Celsius is the historical anchor for this watchlist item [22].
Model 4: DEX Insurance Fund and ADL. Monitor: Rolling changes in the insurance fund balance of major DEX perpetual protocols; frequency of ADL triggers and the proportion of positions force-liquidated post-trigger; degree of multi-source oracle price feeds and open position limits on single oracles; the ratio of open interest on DEX perpetuals for long-tail assets (YFI, SUSHI-type) relative to their spot circulating supply. Both GMX V1 and dYdX v3 events occurred on long-tail assets [29][32].
Model 5: Regulated CCP. Monitor: Quarterly default fund size and margin breach disclosures from major CCPs (CME, ICE, LME Clear, LCH, Eurex Clearing); CCPs' pre-emptive disclosure of tools for negative prices, mass cancellation, forced liquidation in contract rules; announcements of supervisory actions by CCP regulators (CFTC, Bank of England PRA, ECB) regarding CCP governance and risk management. The precedent of LME Clear being placed under a skilled person for remediation oversight by the Bank of England on March 3, 2023, is the historical anchor for this watchlist item [36].
The five watchlists do not constitute investment advice or specific probability estimates of future events. They are structural indicators intended to classify new stress events back into existing failure modes, rather than treating each event as unprecedented.
Methodology and Disclosure Statement
Research Scope and Limitations. This companion piece builds upon the five TradFi-on-crypto architectures defined in the preceding work, elevating the "counterparty risk holder" dimension from within the architectural fingerprints to the main analytical axis. This report does not construct new architecture classifications, predict which architecture will fail first or ultimately, assess the specific solvency probability of any single issuer or exchange under stress, nor expand into unit economics comparisons at the exchange level or financial modeling of single issuers across the five architectures. Each architecture's failure modes occurred under different market structures, macroeconomic environments, and regulatory maturity levels, and do not constitute an extrapolatable failure probability ranking. This companion piece does not treat the FTX collapse (November 11, 2022) as a single archetypal case, as FTX's architectural hybridity (exchange + Alameda proprietary market maker + client fund misappropriation) gave it partial characteristics across Model 1, Model 3, and Model 4; FTX is mentioned in this report only in the context of BlockFi's related exposure.
Data Timeliness. The historical case data, regulatory documents, bankruptcy court filings, official post-mortem reports, and official academic working papers cited in this report are based on publicly available information as of April 23, 2026. The data cut-off date for this companion piece is consistent with the preceding work to maintain comparability. New events occurring between the publication of the preceding work and the writing of this piece are not incorporated into the analysis, to avoid conflict with the mandate of the Q4 2026 Signal Tracking Composite Report. Readers should treat this report as an analysis of a specific point-in-time snapshot.
Research Independence. This report was independently authored by Bitbase Research. Its analytical conclusions are based on publicly available primary sources and the independent judgment of the research team. The "five counterparty risk holders" analytical axis adopted is a research construct and not an official classification by any regulatory or standard-setting body. The specific institutional names mentioned in this report (including Tether, Bitfinex, Wells Fargo, Crypto Capital Corp., FXCM, Alpari UK, KPMG, Leucadia, Effex Capital, Gain Capital, Celsius Network, BlockFi, Ankura Trust Company, Jenner & Block, BlackRock, Securitize, BNY Mellon, PricewaterhouseCoopers, WisdomTree, Hashnote, Ondo, GMX, dYdX, SUSHI, YFI, Genesis Trading, Chainlink, LME, LME Clear, CME, CME Group, ICE, ICE Europe, LCH, Eurex Clearing, Oliver Wyman, Elliott Associates, Jane Street Global Trading, Interactive Brokers) are included solely as objective references for describing the industry landscape. Inclusion does not constitute endorsement, and omission does not constitute a negative signal.
Conflict of Interest Disclosure. Bitbase operates a centralized exchange that may offer products falling within the scope of Model 1 (CEX-native stablecoin-settled perpetual contracts) analyzed in this report. Readers should take this fact into account when interpreting this report's analysis of Model 1 and its comparison with the other four models. The analytical framework in this report is independent of any specific product development plans; this report makes no statements regarding any existing or upcoming specific products from Bitbase. The report's arguments and watchlists apply symmetrically to all five models, including the one potentially occupied by Bitbase.
Tools and Generative Assistance. This report used large language models as research assistance tools during the stages of data collection, cross-source fact-checking, structured argumentation, and initial draft writing. All primary data, regulatory documents, bankruptcy court filings, attestation reports, and market indicators have been manually verified against original sources. Specific numbers, direct quotations from regulators and judges, case numbers, ECF document numbers, and Press Release numbers have been manually traced back to primary sources by human effort. The central thesis and core judgments were independently made by Bitbase Research team members. The self-critical review paragraphs were human-authored. We acknowledge the inherent risk of errors in AI-assisted research, particularly in long-tail data processing, which we have mitigated through multiple rounds of fact-checking but cannot entirely eliminate. The methodological dimension of this companion piece was inspired by an observation from a reader in public LinkedIn discussions from late April to early May 2026; we do not name the reader but have documented the source and first appearance date in an internal Editorial Note.
Non-Investment Advice Disclaimer. This report does not constitute investment advice, a recommendation to buy/sell/hold any financial instrument, nor a solicitation for any financial product or service. The five counterparty risk architectures and five watchlists identified are a research framework, not an investment portfolio construction methodology, and make no representations regarding the expected returns, risks, or suitability of any product within any architecture. Readers should consult independent, licensed financial, legal, and tax advisors before taking any action based on any information in this report. Trading crypto assets carries substantial risk, including but not limited to market volatility, liquidity risk, technical risk, regulatory risk, and the potential for total loss of principal.
Forward-Looking Statement Risk. Statements in this report regarding the evolution of stablecoin issuer reserves, jurisdictional regulatory paths for CFD brokers, institutionalization of off-chain custody and transfer agency, DEX insurance fund and ADL design, and the activation of tools by regulated CCPs under stress are forward-looking and subject to uncertainty. Regulatory outcomes depend on rulemaking processes, enforcement decisions, and political developments, which are not within the control of any single entity. Readers should treat forward-looking statements as judgments conditioned on publicly available information as of April 23, 2026, subject to revision.
Signal Tracking. The five watchlists proposed in this companion piece do not replace the three reversal signals defined in Chapter 9 of the preceding work. Bitbase Research commits to publishing a "Signal Tracking" follow-up report in Q4 2026, re-examining the then-available data against the three reversal signals defined in Chapter 9 of the preceding work. The five watchlists listed in this companion piece, as a new observation dimension, can be incorporated into ongoing tracking as supplementary signals in a Market Insights issue following that composite report.
