Crypto, the CLARITY Act, and the Reality

Before any of this is about computers, it is about bookkeeping. A ledger is a record of who owns what and what changed hands. A bank keeps a ledger. So does a corner shop with a notebook under the counter.

The whole point of a ledger is to settle disagreement. If two people both claim the last dollar in an account, the ledger decides who is right. Everything that follows is, at bottom, an argument about how to keep that ledger and who gets to write in it.

A bank's ledger lives on the bank's computers. The bank is in charge of it, and you trust its answer about your balance.

A distributed ledger is the same record, but copies of it live on many computers at once. Each holds the full history. When something changes, every copy is updated. There is no single keeper to ask; you compare copies, and if they agree, the answer is the answer.

The reason for doing this is to remove the need to trust any one party. The cost is that getting all those copies to agree is a hard, expensive problem.

A blockchain is one particular way of building a distributed ledger. New entries are grouped into batches called blocks. Each block contains a list of new entries, a timestamp, and a reference to the previous block. Strung together in order, the blocks form a chain. Hence the name.

Each block is cryptographically linked to the one before it, so tampering with an old entry would break the link and every other computer would notice. The ledger is append-only and tamper-evident: you can add to the end, but you cannot quietly rewrite the middle.

Everything that moves around on a blockchain is, in the end, an entry on the ledger. A token is what we call one of those units of account. It might represent currency, a share in something, a collectible, or simply a number that someone has decided to assign value to.

The blockchain itself does not care what a token "means." It just tracks who holds how many, and updates the count when they move. The meaning is layered on top by the people using it.

A token does not sit in a physical place. It sits in the ledger, recorded against an address, a string of letters and numbers. To prove the address is yours and authorize a change to its balance, you need a secret private key. A wallet is software or a physical device that holds the private key and signs on your behalf. Whoever has the key can move the tokens. Lose the key, and the tokens are stuck at that address forever. Tell someone the key, and they can drain it.

A transaction is an instruction to change the ledger: move tokens from one address to another, or do something more complicated that we will get to shortly. The instruction is signed with the sender's private key, broadcast to the network, and (if accepted) recorded in the next block.

Transactions are final. Once one is in a settled block, it cannot be reversed by anyone, including the sender, the recipient, or any operator of the network. There is no chargeback. There is no customer service line that can undo a mistake. This is the design.

"Not your keys, not your coins" is the slogan. It is correct and it is the source of an enormous amount of grief, because losing keys is easy and recovery is impossible.

Every computer that holds a copy of the ledger is called a node. Nodes store the chain, relay transactions and blocks to other nodes, and check that incoming transactions and blocks follow the rules. Anyone, in principle, can run one. You download the software, sync the history, and you are part of the network.

Most nodes only observe. A validator is a node that also proposes new blocks. Validators decide, in practice, which transactions get included next and in what order. They are paid for the work, usually in newly issued tokens of the chain they validate.

The big question for any blockchain is: how do you decide who gets to be a validator, and how do you stop them from cheating? Different chains answer this differently.

The two common answers to that question.

Mining

Validators race to solve a computational puzzle. The first to solve it gets to propose the next block. The puzzle is expensive in electricity, which is the point: cheating is unprofitable because you would have to spend more electricity than honest work earns. Bitcoin uses this.

Staking

Validators lock up a quantity of the chain's own tokens as collateral. They are chosen to propose blocks roughly in proportion to how much they have staked. If they cheat or go offline, some of the staked tokens are taken from them. Ethereum uses this.

Mining is sometimes called proof of work; staking is sometimes called proof of stake. The names describe what the validator is risking.

A cryptocurrency is a token whose primary intended use is to be money: a means of payment, a store of value, a unit of account. Bitcoin is the original example. The cryptocurrency is what miners and stakers are paid in, and what users move around when they transact on that chain.

Whether any given cryptocurrency actually functions as money (whether anyone prices things in it, or accepts it without immediately converting to dollars) is a separate question from whether it is labeled as such.

A smart contract is a program that lives on a blockchain. It has its own address, holds its own tokens, and runs automatically whenever someone sends it a transaction. The code defines what it does when called.

This is what makes a blockchain more than a payment ledger. A smart contract can hold tokens in escrow, run an auction, distribute rewards, swap one token for another, or impose any rule its author wrote. The chain enforces the code. There is no operator who can override it.

"Smart contract" is a misleading name. They are neither smart nor contracts in any legal sense. They are programs. If the code has a bug, the bug is what runs.

Cryptocurrency prices move sharply, which makes them awkward to actually use for payments. A stablecoin is a token designed to hold a fixed value, almost always one US dollar, so it can serve as a steady unit of account inside the crypto system.

There are two main ways to try. A reserve-backed stablecoin works like a bank: the issuer holds real dollars (or short-term Treasuries) for every token issued, and promises to redeem at par. An algorithmic stablecoin tries to use code, incentives, and a second token to maintain the peg without holding equivalent reserves.

The first works as long as you trust the issuer to hold the reserves and honor redemptions. The second has a poor historical record, which we will return to.

When a new project wants to launch a new token, it needs to get the token into the hands of users and raise money to fund development. The usual mechanism is a token sale: the issuer creates the supply, keeps some portion for the team and investors, and sells the rest to the public.

The early form of this, around 2017, was called an initial coin offering, or ICO. The name was a deliberate echo of "initial public offering," and the resemblance to securities offerings is the central reason this field is being legislated about now. Most projects sold tokens with the implicit pitch that they would appreciate as the project succeeded, which sounds a great deal like selling a share of a company.

An exchange is a platform where tokens are bought and sold, usually for dollars or for other tokens. Coinbase, Binance, and Kraken are exchanges. So was FTX. Most are centralized: a company runs them, holds users' tokens on its own systems, matches buyers and sellers internally, and shows balances on a website. From the user's perspective it looks like a stock brokerage. The ledger of who owns what on the exchange is the exchange's private database, not the blockchain.

Holding tokens on behalf of someone else is called custody. An exchange that holds your tokens is acting as a custodian, as is any service that controls the private keys to addresses holding your assets. The alternative is self-custody: you keep the private keys yourself, usually in a hardware wallet. Self-custody is harder (lose the keys, lose the money) but removes the risk that the custodian fails or steals.

When you "buy bitcoin on an exchange," you typically do not get bitcoin. You get a number in the exchange's database that the exchange promises is redeemable for bitcoin. A great deal of crypto regulation is about what custodians are allowed to do with the assets they hold and what they have to disclose.

Smart contracts can do more than move tokens. They can lend, borrow, swap one token for another, pay interest, and run derivatives. A collection of smart contracts performing these functions, without a company in the middle, is called decentralized finance, or DeFi.

The pitch is that you can get the services of a bank or a brokerage from a piece of public code, with no operator to refuse you, no account application, and no business hours. The reality is more complicated, because someone always wrote the code, someone usually controls upgrades, and the front-end website that most users actually interact with is a normal company with normal failure modes.

One of the most common DeFi building blocks. A liquidity pool is a smart contract that holds a reserve of two tokens (one cryptocurrency and one stablecoin, for example) and lets anyone swap one for the other at a price determined by the ratio of what is in the pool.

Users called liquidity providers deposit pairs of tokens into the pool and earn a cut of the trading fees. The pool replaces the order book of a traditional exchange with a formula. This is how most DeFi token-swap platforms work under the hood.

There is not one blockchain. There are many, and they do not natively talk to each other. A bridge is a system that lets you move a token from one chain to another. Typically the bridge locks your token on the first chain and issues a synthetic version on the second, redeemable for the original.

Bridges concentrate large pools of tokens in single smart contracts, which makes them attractive targets. They are responsible for some of the largest single losses in the history of the field.

Most tokens are fungible: one is interchangeable with any other, the way one dollar bill is interchangeable with another. A non-fungible token, or NFT, is a token where each unit is distinct and identified individually. An NFT can be associated with an image, a sound file, a piece of text, or a record of ownership of some off-chain thing.

What an NFT actually conveys legally (copyright, licensing rights, possession of the underlying file) is usually whatever the seller wrote in the terms, which is usually very little. The blockchain records that this specific token belongs to this specific address. The rest is convention.

When a smart contract or a chain needs to be upgraded or have its parameters changed, someone has to decide what changes. A decentralized governance system is a process for making those decisions that does not rely on a single person or company.

The usual form: holders of a particular token vote on proposals, with each token counting as one vote. Sometimes this is called a DAO, short for decentralized autonomous organization. The "autonomous" is doing a lot of work, since in practice the votes are usually dominated by whoever holds the most tokens, which is usually the founders and their backers.

This is the concept the legislation we are about to discuss leans on most heavily. The question of whether a project is truly governed by a decentralized system, or just claims to be, turns out to be where most of the legal weight gets placed.

You have now read descriptions of seventeen different kinds of crypto and blockchain construct. Before we move to how the law tries to regulate them, an honest question is worth asking: what are any of these things actually for? Not what they are designed to be for, but what people in fact use them to do.

The answer that emerges from the historical record is awkward for the field. The vast majority of crypto activity by dollar volume is trading crypto for other crypto, or converting dollars into crypto in order to trade. Most of the volume on most of the platforms is the platform's own users moving tokens between themselves. Use cases that connect this activity to anything happening outside the ecosystem (payments, real-world lending, productive investment, anything you could not already do faster and cheaper through a bank) remain narrow, and have remained narrow for fifteen years.

In June 2022, the Flatiron Health co-founder Zach Weinberg appeared on a podcast called Cartoon Avatars and debated several crypto investors on whether the field had real use cases. He summarized his view this way:

The argument is not that there are zero use cases. The argument is that the use cases that do exist are small enough that they do not justify the size of the financial machine built on top of them, the number of ordinary people exposed to that machine's failures, or the amount of investor and engineering attention the field absorbs that could be deployed elsewhere.

The clearest sign of the use case problem is how circular most of the activity is. A user buys ETH to participate in a DeFi protocol whose purpose is to lend ETH. They earn yield denominated in another token they cannot spend at any normal business, and they pay fees denominated in a third token they also cannot spend at any normal business. The "yield" is paid by other users borrowing the same tokens to do the same thing. Nothing leaves the system. No goods are produced. No external service is rendered. The system is, in the end, a market for itself.

This is not nothing. Financial markets are markets for themselves too, in a sense, and they still serve a purpose. But the purpose a stock market serves is to channel capital into companies that produce goods and services in the wider economy. The corresponding link from DeFi to the wider economy, after fifteen years, remains thin. Not absent, but thin.

To be fair, there are uses that genuinely connect to things outside the ecosystem. The honest list, after fifteen years, is short enough to write down.

Stablecoins move dollars across borders faster and more cheaply than the wire system. People in countries with unstable currencies or restrictive capital controls use them to preserve purchasing power, sometimes to send remittances home. Reserve-backed stablecoins specifically (not algorithmic ones) have become a real piece of cross-border payment infrastructure, particularly in Latin America and parts of Africa.

Bitcoin and similar fixed-supply cryptocurrencies serve as a censorship-resistant store of value in jurisdictions where the local currency is being actively destroyed by inflation, or where the holder of the asset is a target for state seizure. This is a real benefit for a small population of users and a marketing pitch for everyone else.

A handful of projects use blockchain rails to do things at least plausible outside the bubble: storage networks that pay providers for hard drive space, wireless networks that pay people for running hotspots, lending protocols that fund small businesses in developing countries. These are real. They are also small relative to the size of the industry around them.

Inside the ecosystem, the use cases feel more substantial than they appear from outside. This is because, inside the ecosystem, the existence of other crypto products is treated as proof that the underlying technology is useful. The fact that there is a thriving market in tokenized cartoon monkeys is, from inside the system, evidence that NFTs work. From outside the system, it is evidence that some people will pay for tokenized cartoon monkeys.

The point worth keeping in mind, as we move into the legal section, is that the law is not regulating a set of products that have proved themselves indispensable. It is regulating a set of products that have produced a great deal of money, a great deal of loss, and a much smaller amount of demonstrable benefit. The legislation is real either way. But the question "is this a good regulatory framework for an important industry" and the question "is this an industry that should exist at this scale at all" are different questions, and the bill answers only the first.

So far the primer has described what these things are. The legal system has to do something different. It has to decide which existing category each of these things falls into, because almost everything described in Part One was invented after the existing rules were written.

The two relevant existing categories in US law are securities (stocks, bonds, and other investment instruments) and commodities (raw materials and the things that trade on commodity markets, like wheat, oil, or gold). They are regulated by different agencies, under different statutes, with very different rules.

For decades the US has decided whether something is a security using a test from a 1946 Supreme Court case called SEC v. W. J. Howey Co. Something is a security (specifically, an "investment contract") if there is an investment of money, in a common enterprise, with an expectation of profit, derived from the efforts of others. A token sale fits this pattern almost perfectly. Money goes in, a project promises to build something, buyers expect the token to rise in value as the project succeeds.

The industry's complaint is that Howey gives no clear line. A token that looks like a security on day one might function like a commodity by day one thousand, once the network is up and no central team is driving its value. The legislation tries to draw the line that case-by-case enforcement has not.

Two federal agencies sit on either side of that line, and the difference between them is where the bill's central distinction lives.

SEC

The Securities and Exchange Commission. Regulates securities: stocks, bonds, investment contracts. Concerned with disclosure to investors, registration of offerings, and conduct of brokers.

CFTC

The Commodity Futures Trading Commission. Regulates commodities and derivatives. Smaller, less well-funded, historically focused on futures markets in things like grain and oil.

If a token is a security, the SEC has jurisdiction. If it is a commodity, the CFTC does. Until the CLARITY Act, there was no statutory definition that put any particular token clearly in either bucket for spot trading. That is the gap the bill is meant to fill.

The Digital Asset Market Clarity Act of 2025 (the CLARITY Act) was passed by the House in July 2025 and is now working its way through the Senate. Its central idea is simple: define a new category called digital commodity, give the CFTC primary jurisdiction over it, and let tokens move into that category once they meet a test for being sufficiently decentralized.

Tokens that have not met the test remain in SEC territory, sold under a new exemption from full securities registration with its own disclosure rules. Stablecoins get their own category and largely sit outside both regimes. DeFi protocols and developers get a broad carve-out from registration requirements.

The bill's new category. A digital commodity is a digital asset that is intrinsically linked to a blockchain and whose value comes from the use of that blockchain. The definition is built to include the native tokens of working networks (Bitcoin, Ethereum, and so on) while excluding things that look like equity, debt, or stablecoins. A digital commodity is explicitly not a security. It is not a deposit at a bank. It is not a swap or a futures contract. It falls under the CFTC's authority.

What about a token sold as part of an investment contract, the Howey scenario? The bill creates a paired category called an investment contract asset: a digital commodity that was sold under an investment contract, but that itself is not a security. This separates the legal status of the sale (which can be a securities offering, requiring disclosure) from the legal status of the token itself (which is not a security and trades on commodity markets). The buyer of an ICO gets an investment contract asset and can later resell it without that resale being a securities transaction.

The word "commodity" here is doing legal work, not economic work. Nobody seriously claims a token is like wheat. The label simply slots it into the CFTC's regulatory perimeter rather than the SEC's.

The bill's central legal test. A blockchain is a mature blockchain system if it is not controlled by any person or group of persons under common control. The certification process: the project files a statement with the SEC declaring the chain mature. If the SEC does not rebut the certification within sixty days, it stands. Once certified, ongoing disclosure obligations for the original issuer drop away, insider sale restrictions loosen, and the token is treated as a fully-fledged digital commodity.

The bill spells out concrete criteria. A chain qualifies if, among other things, no single person or group can control or materially alter the system, no person can direct the voting of twenty percent or more of the governance power, and no insider beneficially owns twenty percent or more of the supply. That twenty percent threshold appears in two places: voting control and token ownership. It is the legal mechanism by which decentralization is operationalized.

Critics argue twenty percent is too lenient, that a single party with nineteen percent of the supply and matching governance influence is still effectively in control. Defenders argue you need a fixed line and twenty percent is a reasonable one.

The bill's category for stablecoins. A permitted payment stablecoin is a digital asset designed to be used for payment or settlement, denominated in a national currency, issued by a regulated entity, and either redeemable at par or representing a stable value against a fixed amount of monetary value.

This excludes deposits, securities, and national currencies themselves. It also implicitly excludes algorithmic stablecoins, which do not have a regulated issuer holding redeemable reserves. Stablecoins that meet the definition sit outside SEC jurisdiction for most purposes and are regulated through banking and prudential rules under a separate law called the GENIUS Act.

The biggest unresolved fight inside the bill, mostly a Senate-side issue. Some exchanges offer users a percentage return for holding stablecoins on the platform, effectively interest on a dollar-equivalent balance. Banks see this as competition for deposits without bank regulation, and want it prohibited.

The compromise reached in May 2026 between Senators Tillis and Alsobrooks would prohibit yield on idle stablecoin balances (the deposit-like case) while permitting activity-based rewards tied to actually using a stablecoin for payments, transfers, staking, or loyalty programs. The American Bankers Association sent over eight thousand letters to Senate offices in the week before the May markup arguing this compromise still leaves a loophole.

The House-passed bill does not contain this provision. If the bill becomes law in something like the current Senate form, expect a multi-year regulatory fight over what counts as an "activity" versus a passive return.

How does a new project legally launch and sell tokens? Today, by avoiding the SEC or by registering as a full securities offering. The bill creates a middle path: a new exemption that lets a project sell investment contracts involving its tokens with disclosure but without full registration.

The terms: up to seventy-five million dollars in any twelve-month period. No single buyer can end up with more than ten percent of the supply. The issuer must be a US entity. And the issuer must intend the blockchain to be mature within four years of the first sale. In exchange, the project files an offering statement covering source code, transaction history, tokenomics, plan of development, ownership disclosures, and material risks. Every six months it files an update until maturity.

One of the most common failure patterns in token launches is the founding team dumping their allocation onto the market shortly after launch, crashing the price. The bill restricts this directly.

Before the chain is mature, an insider (defined as anyone who held a senior role or acquired five percent or more of the supply from the issuer) must hold their tokens for at least twelve months, may sell no more than fifteen percent of what they acquired in any twelve-month window, and may sell no more than fifty percent of what they acquired in total. After the chain is mature, the cap loosens to eight percent of total supply or twenty-five percent of acquired supply, whichever is larger, per twelve months.

These are limits on what insiders are allowed to do. They do not prevent insiders from doing it anyway; they make doing it anyway a violation of the Act, with enforcement consequences.

Any platform that operates a spot market in digital commodities must register with the CFTC as a digital commodity exchange. Registration carries fifteen core principles covering listing standards, monitoring of trading, customer protection, recordkeeping, capital requirements, governance, and system safeguards.

The listing requirement is notable: an exchange may only list a token if the relevant disclosure statements have been filed and made public, or if the chain has been certified mature. This effectively forces issuers through the disclosure regime in order to get exchange listings.

The single most consequential provision for the kind of failure that took down FTX, Celsius, Voyager, and others. A registered exchange must treat customer money, assets, and property as belonging to the customer. It may not commingle customer funds with its own. It may not use customer funds to margin, secure, or guarantee any other account or any trade of the exchange. In bankruptcy, customer assets go back to customers ahead of general creditors of the failed exchange. An exchange that wants to use customer tokens (for instance, to stake them and earn rewards) must get explicit written waiver from each customer who agrees, and cannot make that waiver a condition of using the exchange.

The exchange also does not get to hold customer tokens just anywhere. They must be held by a qualified digital asset custodian: a federally supervised bank, the exchange itself if it meets bank-like custody standards, or a state-supervised trust company that has been examined for custody and safekeeping. Foreign custodians qualify only if their home regulator provides comparable oversight.

This is the structural answer to the "what happened to our coins" question that has dogged every collapsed exchange. The point is that a regulator has eyes on the actual assets, and the assets are walled off from the operating company's liabilities.

Most retail crypto activity goes through an intermediary that is not, strictly, an exchange. It is a broker that places orders, or a dealer that quotes prices and trades against customers. The bill creates registration categories for both: digital commodity broker and digital commodity dealer.

The obligations mirror those of exchanges: capital requirements, books and records, business conduct standards, daily trading records, conflicts-of-interest policies, customer segregation, qualified custody, chief compliance officer with annual reports. Brokers and dealers must also be members of a registered futures association, which adds a self-regulatory layer.

This is where the bill draws its sharpest line. None of the registration requirements above apply to people who are merely interacting with a blockchain in non-custodial ways. The carve-out covers validating transactions, running a node, providing a user-interface that lets people read blockchain data, publishing or maintaining a blockchain system or a DeFi trading protocol, operating a liquidity pool, and distributing wallet software. A developer who writes and publishes a smart contract that lets people swap tokens, and never takes custody of those tokens or controls the protocol's funds, is not a broker, not a dealer, not an exchange, and does not have to register with anyone.

Relatedly, the bill preserves the right of individuals to hold their own digital assets in their own wallets and to send tokens directly to other individuals, peer to peer, without going through a regulated intermediary. This is one of the few provisions written as an affirmative right rather than as a regulation of something.

Both carve-outs are subject to the usual exceptions for sanctions, money laundering, illicit finance, and anti-fraud. You can publish a smart contract or hold a wallet; you cannot use either to defraud users or evade sanctions.

Two cleanup provisions worth knowing together.

The bill changes how a failed crypto exchange is wound down. Customer assets are classified as customer property under Section 761 of the federal bankruptcy code, the same protection that customers of a futures commission merchant get when a futures broker fails. In the existing regime, customers of a failed crypto exchange are typically general unsecured creditors, standing behind everyone the company owes money to. With this provision, they get priority access to the segregated pool of assets that should have been kept apart from the exchange's other liabilities.

The bill also treats digital commodities as covered securities for purposes of state securities law, which means individual states cannot impose their own registration or disclosure requirements on top of the federal regime. The preemption does not extend to state gambling laws, anti-fraud laws of general application, or state oversight of money transmitters. States retain authority in those areas.

Threaded through the House version of the bill is a separate piece of legislation called the Anti-CBDC Surveillance State Act. A central bank digital currency, or CBDC, would be a digital dollar issued directly by the Federal Reserve. The provision prohibits the Fed from issuing one to retail users or using one for monetary policy.

The argument from supporters is that a retail CBDC would let the government monitor every transaction. The argument from critics is that it would also let the government do things like rapidly distribute emergency payments without bank intermediaries, and that the surveillance fears are overstated. Either way, the provision is in the bill and is one of the easier pieces of it to explain politically.

The bill is a market structure bill, not a comprehensive crypto law. Several things sit outside its scope. It does not regulate DeFi lending or borrowing protocols, beyond requiring a study. It does not address prediction markets or event contracts. It does not create a federal licensing regime for stablecoin issuers (that is in the GENIUS Act). It does not regulate NFTs beyond requiring a study. It does not preempt state gambling laws. It does not address how digital assets are taxed.

Notably, the House version contains no new ethics provisions on government officials' crypto holdings or business ties, beyond a savings clause confirming existing rules still apply. This is one of the central Democratic objections to the bill.

The bill itself is structure. Most of the operative detail comes from rules the SEC and CFTC must write after enactment. The default timeline is 360 days for most rules; some are tighter (180 days for delisting procedures, 270 days for portfolio margining and for the SEC's offering rules).

Meanwhile, the bill includes a provisional registration system: existing exchanges and brokers file a statement within 180 days of enactment, become deemed registered, and operate under interim disclosure requirements until the agencies finish their rulemakings. The interim period could easily last two to three years. Even if the bill is signed tomorrow, the full regulatory framework will not be operational for years.

The writer Molly White has maintained, since the start of 2021, a public database of crypto disasters at web3isgoinggreat.com. As of May 2026 her running total of money lost to hacks, scams, fraud, and other failures sits at eighty-one billion dollars. The database understates the real number, because it relies on her manual compilation of news reports.

This is the context in which any regulatory proposal should be read. The question is not "will crypto have failures." It has had a great many. The question is which failures the proposed framework is designed to prevent and which it leaves untouched. The next few entries walk through the categories.

The single largest category by dollar value. FTX (~$8.7 billion), Celsius (~$1.7 billion shortfall), Genesis (~$5.1 billion in liabilities), Voyager (~$430 million), BlockFi, Three Arrows Capital, Babel Finance, Hodlnaut, Coin Cloud. All variations on the same theme: a centralized company holding customer crypto used it for its own purposes (lending, trading, paying for expenses) and lost it.

The technical term for what went wrong is commingling. Customer balances were displayed on a website, but the actual tokens were not held separately. When the company's own bets went bad, the customer pool went with them. In FTX's case, the customer pool funded a sister hedge fund's losing positions.

This is the failure mode the bill's segregation, qualified custodian, and bankruptcy provisions are most directly aimed at. If FTX had been a registered digital commodity exchange under the bill, the Alameda loan would have been a violation on day one. Whether enforcement would have caught it before the collapse is a separate question.

The largest single event in the database is the collapse of TerraUSD and its sister token Luna in May 2022, listed at forty billion dollars. TerraUSD was an algorithmic stablecoin: it had no reserves, and its dollar peg was maintained by a code-driven arbitrage relationship with Luna. When confidence broke, the relationship unwound in a vicious spiral that took both tokens to near zero in days.

Under the bill, TerraUSD would not qualify as a permitted payment stablecoin, because it lacked a regulated issuer holding redeemable reserves. The bill does not ban algorithmic stablecoins, but it removes them from the category that gets safe treatment, which means exchanges that want to remain registered would need to think carefully about listing them.

The forty-billion figure is also a reminder that most of the loss in a token collapse is mark-to-market: it reflects price decline against prior peaks, not literal cash disappearing. Real-money losses to Terra were closer to the few billion dollars actually paid in. But the price collapse cascaded through other balance sheets. Three Arrows, Celsius, and Voyager all held Terra-related positions, turning a stablecoin failure into a wave of exchange failures.

The Terra collapse was an algorithmic stablecoin failing because it had no reserves. The more common worry, in the parts of the market that did not blow up, is the opposite question: when a reserve-backed stablecoin claims to hold a dollar for every token it issues, how do users know the dollars are actually there?

The answer most stablecoin issuers provide is a quarterly attestation, a report by an outside accounting firm performing "agreed-upon procedures." The issuer says here is what we hold on this date, the accountant verifies that the numbers tie to the underlying account statements, and the accountant signs off that the snapshot is accurate. An attestation is not an audit. An audit is broader: the auditor designs procedures to look for risks the issuer did not flag, tests internal controls over time, and issues an opinion on the financial statements as a whole. In December 2022 the accounting firm Mazars suspended its crypto work entirely, citing "concerns regarding the way these reports are understood by the public," meaning users were reading attestations as if they were audits, and they are not.

The specific issuer the debate has centered on is Tether, the company behind USDT, the largest stablecoin in circulation by a substantial margin. USDT has roughly $184 billion outstanding as of early 2026. For most of its existence Tether has used quarterly attestations from a small accounting firm affiliated with the international network BDO, and has not commissioned a full audit by any of the four large global accounting firms that audit comparable institutions.

Two distinct concerns sit alongside each other here. The first is the reserve question: are the dollars there. Tether's attestations report that they are, and that reserves modestly exceed liabilities. Skeptics note that an attestation cannot, by design, answer the harder question of whether reserves are continuously sufficient or whether the assets are of the quality the firm describes. The second concern is the minting process. Tether issues new USDT when authorized purchasers send it dollars; it destroys USDT when they redeem. The on-chain side is visible, but the dollar side (who is sending what to whom and on what terms) is not public. Molly White's Citation Needed has noted that Cantor Fitzgerald, the financial services firm tied to Commerce Secretary Howard Lutnick, holds a stake in Tether and custodies a portion of its reserves; a Cantor executive separately runs a super PAC funded substantially by Tether.

In March 2026 Tether announced that it had engaged one of the four large global accounting firms for its first full audit. The firm's name has not been publicly disclosed as of this writing, and no audit report has been released. Until one is, the public information about Tether's reserves remains the attestation regime.

Where this fits in the legislation: the bill's permitted payment stablecoin category, and the separate GENIUS Act, would impose disclosure and reserve requirements considerably more stringent than the attestation regime provides. Tether is incorporated in El Salvador and would have to either restructure to qualify as a US-regulated issuer or accept that USDT will not be a permitted payment stablecoin under US law, though it could continue to be used in jurisdictions that do not require US registration.

The Axie Infinity bridge ($625 million), Poly Network ($611 million), Binance bridge ($586 million), Wormhole ($320 million), Nomad ($190 million). Smart contract bridges that hold large pools of tokens have proven to be the single most exploitable structure in the field. The losses come from bugs in the contract code or from compromise of the keys controlling the bridge.

The bill does almost nothing about this. Smart contracts and the developers who write them sit inside the DeFi exclusion. The bill mandates a study of DeFi cybersecurity but does not impose code audit requirements, capital requirements, or operational standards on protocols. Anti-fraud authority is preserved, but anti-fraud reaches deceit, not poorly-written code.

This is a deliberate choice. The view in the bill is that DeFi developers are publishing software, not running a regulated business, and treating them as the latter would either drive development offshore or impose obligations that cannot be met by a project with no central operator. The cost of the choice is that hundreds of millions of dollars in user assets remain at the mercy of code quality.

A rug pull is the crypto term for a scheme where the people behind a project sell their token allocation into the market, pocketing the proceeds and leaving buyers with worthless tokens. Sometimes the project never had real plans. Sometimes it did, but the founders decided cashing out was more attractive than building.

Examples on the database: Freeway ($160 million), the Waves protocol ($530 million), the dog noseprint Ponzi ($127 million), and a long tail of smaller schemes.

The bill addresses this directly through the insider lockup provisions described earlier. Founders and large early holders cannot legally dump in the first twelve months, are capped at modest percentages thereafter, and have to disclose their holdings. Violating these limits is a violation of the Act, giving the SEC and the Justice Department a clean enforcement hook.

This works against the projects that are still in the US legal system. The largest rug pulls historically have been operated from outside the US by people who were never going to register anything. Those continue.

Africrypt ($3.6 billion), Thodex ($2 billion), HyperVerse ($1.3 billion), JPEX ($191 million), NovaTech and AWS Mining ($1 billion combined). Schemes operated from outside the US that collected money from American victims through online marketing, and then disappeared. In many cases the operators are still at large.

The bill extends the Bank Secrecy Act (the federal anti-money-laundering law) to digital commodity exchanges, brokers, and dealers serving US persons, including foreign platforms that permit direct customer access. It also requires the Government Accountability Office to study the risks of foreign-based intermediaries.

What the bill does not do, and cannot do, is reach the operators of these scams once they have moved themselves and the money outside US jurisdiction. The recovery rate on the foreign exit scams in the database is approximately zero. Regulation reduces the surface area where these scams can recruit US victims through ostensibly-legitimate channels; it does not stop the scams themselves.

One thing worth noticing about the failure modes just described: the most thorough public investigations of them did not come from the SEC, the Justice Department, or the financial press. They came from two independent people with YouTube channels and blogs.

The first is Molly White, whose database we have already used. The second is Stephen Findeisen, who works under the name Coffeezilla. Findeisen has spent the better part of a decade publishing video investigations of crypto scams, including the FaZe Clan's Save the Kids pump-and-dump (a token promoted as a children's charity that turned out to have had its anti-dumping protections removed at the last minute so insiders could sell into retail demand), Logan Paul's CryptoZoo NFT project, and the SafeMoon collapse. After FTX failed, Findeisen recorded a series of Twitter Spaces conversations with Sam Bankman-Fried in which, by most readings, Bankman-Fried admitted to fraud on tape weeks before his arrest.

The CryptoZoo investigation is worth pulling out. In late 2022 Findeisen published a multi-part series on Logan Paul's NFT-based game in which buyers had purchased animal NFTs that were supposed to be breedable, tradeable, and integrated into gameplay. The game was never built. Buyers had paid roughly $2.5 million for tokens that could not be used for anything. Paul's initial response was to threaten to sue Findeisen for defamation. He then apologized publicly, announced a refund program, and then in mid-2023 actually filed the suit. As of early 2026 a magistrate judge has ruled that Findeisen's use of the word "scam" was specific enough to constitute a defamatory statement of fact rather than protected opinion, and the case is moving toward trial.

The structural point: when a celebrity-launched crypto project failed, the person who lost money was the retail buyer, the person who paid no consequence was the celebrity, and the person now facing legal exposure is the journalist who reported on it. The CLARITY Act does not change this dynamic. In an industry where assets are global, operators are pseudonymous, and regulators have until recently lacked a clear statutory mandate, the closest tracking of what actually happens to retail investors is done by citizen journalists with Patreon accounts.

Adding up the categories where the bill provides a real structural answer: centralized exchange and lender failures (roughly seventeen to twenty billion dollars of the historical losses), exchange hacks attributable to poor custody (roughly two to three billion), and rug pulls by US-organized issuers (a meaningful fraction of the rug-pull total, hard to pin down precisely). That is somewhere between twenty and thirty billion dollars of the eighty-one billion cataloged. About a quarter to a third. The framework targets the failure modes that have done the most concentrated damage to ordinary users of regulated US-facing platforms.

The rest is structurally outside what the bill regulates. The forty billion in the Terra collapse, because the bill regulates structure not price. The DeFi exploits, because DeFi developers are explicitly excluded. The foreign exit scams, because foreign jurisdiction is foreign jurisdiction. The phishing and social engineering attacks against individual users, because no platform regulation reaches an attacker who calls a user pretending to be from their wallet vendor.

This is not a criticism. A reasonable framework for one country's intermediaries cannot solve every problem with a global, partly-anonymous, code-driven system. But it is honest to say that even with full enforcement, the floor under retail crypto losses would not be zero. It would be lower.

The crypto industry has spent more money on the 2026 election cycle than any other industry except real estate. The vehicle is a political action committee called Fairshake and two affiliated PACs called Defend American Jobs and Protect Progress, which together held one hundred ninety-three million dollars in cash going into the cycle.

The top three donors are Coinbase, Ripple Labs, and the venture capital firm Andreessen Horowitz, each at roughly twenty-four to twenty-five million dollars. Twelve of the twenty-two original co-sponsors of the CLARITY Act have been backed by the Fairshake network. The commercial banking industry, which opposes the stablecoin yield provisions, spent fifty-six million dollars on federal lobbying in 2025 across all issues.

This does not invalidate the bill. Industries lobby for laws that affect them. But it is the financial backdrop against which the bill is being negotiated, and a reader trying to make sense of which provisions made it in and which did not should know that the people who would benefit most spent very large sums on the politicians voting.

In 2024, the Trump family launched a crypto project called World Liberty Financial. It issued its own governance token called WLFI and its own stablecoin called USD1. The Trump family entities collectively hold a significant share of the WLFI supply and earn fees from USD1 in circulation. In September 2025 World Liberty Financial froze tokens belonging to one of its largest backers, the crypto entrepreneur Justin Sun, after a public dispute, the same kind of "debanking" the project was ostensibly founded to oppose.

Separately, in January 2025 a token called $TRUMP was launched on the Solana blockchain. It is a memecoin: a token with no underlying utility, traded purely on speculation and on the cultural significance of the name. The token's launch documentation listed entities controlled by the Trump family as holding the majority of the supply. An exclusive dinner with the President was offered to top holders. According to research by Molly White, of the approximately thirty-four wallets that bought more than a million dollars of the token, most appeared not to be US-based. The price spiked around the dinner and has since fallen substantially.

The arithmetic that concerns critics: the President is in a position to sign legislation that affects the regulatory treatment of stablecoins and digital commodities, and his family is among the people whose financial outcomes depend on how that legislation is written. Existing federal ethics rules generally bar senior officials from holding interests that conflict with their official duties, but enforcement against a sitting president is limited.

What this means for the legislation: the legal status of memecoins under CLARITY is unsettled. They might qualify as digital commodities or might fall into a catch-all "tradable asset" category that gives the CFTC authority to prohibit tokens whose primary purpose is fraud or manipulation. Either way, the bill would not have prevented the launch of $TRUMP, and adds no new restrictions on the conflict of interest involved when a sitting president sells access to himself through a token he controls.

This is why ethics provisions are the central Democratic objection to the bill and the main reason it has not yet passed the Senate with broader bipartisan support. Senator Chris Van Hollen has proposed amendments that would prohibit senior government officials, including the executive branch, from holding business ties to crypto firms while in office. Senator Elizabeth Warren has filed similar provisions, including a prohibition on federal banking approvals for entities tied to the president's family.

The Republican response is that ethics provisions fall outside the Banking Committee's jurisdiction and that existing Office of Government Ethics rules are sufficient. The Democratic response is that the existing rules have visibly failed to prevent the World Liberty Financial situation, and that statutory bright lines are needed.

The committee advanced the bill in May 2026 on a 15-9 vote with two Democrats joining all Republicans. Most Senate Democrats remain opposed pending ethics changes. The fight will continue on the floor and at any conference with the House.

Even where the bill applies, enforcement depends on agency capacity. The CFTC, which would take on supervision of the spot crypto market, has historically been one of the smaller financial regulators. The bill funds new fees on registrants to pay for additional staff, but only for four years, and the bill's joint rulemakings require coordination between the CFTC and the SEC at a level the two agencies have not historically achieved.

The same agencies have, since 2025, also been operating under an administration that has dropped a number of pending crypto enforcement cases. The SEC dismissed its case against Coinbase. The CFTC withdrew enforcement against several DeFi protocols. The Justice Department disbanded its National Cryptocurrency Enforcement Team. Whether the agencies will actively enforce the new framework when it lands is partly a function of who is running them when it does.

A law on paper is not a law in practice. The CLARITY Act provides a framework. Whether that framework reduces the eighty-one billion dollar number over the coming decade depends on rules that have not been written and enforcement that has not been demonstrated.

The CLARITY Act is a real attempt to do what the industry, its critics, and a long line of failed companies have all agreed needed doing: write rules. Categorize the assets. Tell the exchanges what they may and may not do with customer funds. Give the bankruptcy courts a clean answer when the next FTX fails.

The bill does this for the parts of the system that have central operators with US addresses. It does not, and cannot, do it for the parts that do not. It exists in an environment of substantial industry money, visible conflicts of interest at the highest level of the executive branch, and an enforcement apparatus whose recent direction has been the opposite of more enforcement.

A reasonable reader can hold all of these at once. The bill is better than no bill in the specific ways described above. It is also not a guarantee against future losses, and the political environment in which it is being passed reduces the likelihood of vigorous enforcement at least in the near term. The next FTX is probably possible. The next FTX is probably less likely to look exactly like the last FTX. That is roughly what regulation accomplishes when it works.

H.R. 3633, Digital Asset Market Clarity Act of 2025, full text as reported by the House Financial Services and Agriculture Committees: govinfo.gov/content/pkg/BILLS-119hr3633rh/html/BILLS-119hr3633rh.htm. Congress.gov bill page with status: congress.gov/bill/119th-congress/house-bill/3633. House Rules Committee package: rules.house.gov/bill/119/hr-3633.

DeFi Rate CLARITY Act fact sheet, the timeline source used here: defirate.com/clarity-act-fact-sheet. Latham & Watkins US Crypto Policy Tracker: lw.com/en/us-crypto-policy-tracker/legislative-developments. Congressional Research Service overview: congress.gov/crs-product/IN12583. Senate Banking Committee fact sheets: banking.senate.gov/newsroom/majority/the-facts-the-clarity-act.

CoinDesk on the 15-9 vote: coindesk.com/policy/2026/05/14/clarity-act-clears-u-s-senate-committee-on-its-way-to-a-final-test-in-congress. CoinDesk on the DeFi tweak risk: coindesk.com/news-analysis/2026/05/18/amid-the-clarity-act-fanfare-is-some-worry-how-a-last-minute-deal-may-punch-defi. CoinDesk on the Tillis-Alsobrooks text: coindesk.com/policy/2026/05/01/clarity-act-text-lets-crypto-firms-offer-stablecoin-rewards-while-shielding-bank-yield.

Web3 is Going Just Great database of crypto disasters, source for the $80B figure and the failure-mode categories: web3isgoinggreat.com. Leaderboard with running total and per-event detail: web3isgoinggreat.com/charts/top. Citation Needed newsletter: citationneeded.news. TRUMP memecoin dinner research: citationneeded.news/trump-memecoin-dinner-guests. Issue 104 on World Liberty Financial: citationneeded.news/issue-104.

YouTube channel with the long-form scam investigations: youtube.com/@Coffeezilla. Background on methods and notable cases (Save the Kids, CryptoZoo, SafeMoon, the SBF Twitter Spaces): beincrypto.com/learn/who-is-coffeezilla. On the pending Logan Paul defamation suit: decrypt.co/312505/logan-paul-cryptozoo-lawsuit-coffeezilla.

BeInCrypto on the attestation-versus-audit distinction and the Mazars departure: beincrypto.com/tether-q2-avoids-full-audit. John Reed Stark (former SEC) on why attestations are not audits: x.com/JohnReedStark/status/1849924874950922744. Tether's March 2026 announcement of a Big Four audit engagement (firm undisclosed at time of writing): coverage at mexc.com/news/979263. Molly White's Citation Needed on the Cantor Fitzgerald and Tether super PAC relationships: citationneeded.news.

Original Zach Weinberg tweet, June 20, 2022 (quoted in section 18): twitter.com/zachweinberg/status/1538705680118472705. The Cartoon Avatars podcast episode and surrounding debate are summarized in Packy McCormick's response essay: notboring.co/p/web3-use-cases-today.

The structure and stylesheet of this primer are adapted with thanks from Matt Reider's OpenTelemetry Primer: otel-primer.mreider.com. Source at github.com/mreider/otel-primer.