Crypto: is anyone regulating the thing that actually failed?

What it's actually for: real payments are under 1% of the volume

Both sides of the crypto argument assert the use question; this filing measured it. Two independent methodologies — BCG with Allium's wallet-behavior data, McKinsey with Artemis's infrastructure-tagging — converge on $350–550 billion of actual bilateral payments for goods and services in 2025: real, fast-growing, and well under 1% of gross on-chain volume. The famously irreconcilable "adjusted volume" figures partly reconciled under inspection: one widely-quoted "$21.5 trillion annualized" figure was a single hot month multiplied by twelve, and the dashboard's actual trailing year, pulled live for this filing, reads $14.6 trillion — against BCG's $4.2 trillion for calendar 2025, measured eight months earlier and growing fast. About a third of that remaining gap is explained by the window; the other two-thirds is not. One number would not reconcile at all: Chainalysis's $28 trillion of "real economic activity" rests on a methodology confirmed unpublished as of this filing — and that figure is absent from the one vendor-independent academic study of this exact question, whose own finding (almost six in ten transfer events sit inside complex, bundled transactions rather than standalone payments) supports the filters that shrink the number, not the headline that inflates it.

Corrected 2026-08-10: this said BCG and Visa "turn out to use the identical bot filter" and that their gap "is largely a measurement-window artifact." Neither holds at the deepest source. BIS Working Paper 1359 — the vendor-independent study cited above — attributes the specific numeric threshold we called shared (wallets over 1,000 transactions or $10 million in 30 days) to Visa alone, and describes BCG's method separately as "a three-step, behavior-based approach." We never read BCG's own paper; it blocked automated retrieval. And the window arithmetic is strained: at the 133% annual growth rate this filing itself cites, eight months carries $4.2 trillion to roughly $7.4 trillion, not $14.6 trillion. The filters point the same way; they are not the same filter, and the window explains about a third of the gap rather than most of it — ($7.4T − $4.2T) ÷ ($14.6T − $4.2T) = 3.2 ÷ 10.4 ≈ 31%, leaving roughly two-thirds unexplained. Corrected again 2026-08-10: this paragraph first said "about half," which was itself an arithmetic error in the correction. The "six in ten" figure is confirmed verbatim (59.96%), but the paper's category is complex, bundled transactions — trading, lending, arbitrage — not "bot-and-bundle," which imported the vendors' framing into the one finding that is supposed to be independent of it.

Second denominator added 2026-08-10 (Phase 2 steelman): "under 1% of volume" is a true ratio, and the strongest case against this filing is that we chose its denominator badly. Gross on-chain volume is not a payments aggregate — the vendor-independent study we lean on above establishes that most of it isn't payments at all — and no other payment system on earth is measured by dividing its payments into the trading volume of the asset it settles in. Measured against a real-economy payment flow instead: the World Bank records $856.6 billion in global personal remittances received in 2024 (indicator BX.TRF.PWKR.CD.DT, pulled 2026-08-10). Our own $350–550 billion is 41–64% the size of every recorded remittance flow on earth. Same number, both times. The two aggregates are not subsets of each other — ours includes business-to-business payments and theirs doesn't — so this is a scale comparison, not a share; and it does not touch Part 2's finding that only 1–3% of American adults use crypto to pay for anything. We publish both denominators because the small one alone is the kind of framing this filing exists to catch.

Who actually holds it — measured from the government's own surveys

This filing tabulated the federal microdata directly — Fed SHED 2025 and the FDIC's 2023 household survey, committed pipelines with identity checks — rather than quoting the survey war. The apparent chaos in circulating adoption numbers is mostly people comparing four different questions: about 19% of adults have ever touched crypto (Pew, flat since 2021), 8.8% held any in the past year, roughly 14% report current ownership (Gallup), and the share who actually used it to buy something or send money is 1–3% and has never exceeded 3% in five years of Fed surveys. The inclusion argument fares worst against the data: unbanked households — the population the financial-inclusion case invokes — use crypto at 1.2%, a quarter the rate of fully banked households.

Precision note added 2026-08-10: the 1.2%/5.0% split was previously quoted from the FDIC's published report; it has now been computed directly from the CPS microdata this project already downloads, and it holds — banked 4.99%, unbanked 1.21%, the unbanked rate 24% of the banked rate. But the unbanked figure rests on 13 unweighted households out of 29,377, against 1,304 for the banked figure. The direction is solid; the "1.2%" itself carries a wide interval, which the bare number above does not convey. We report it because computing a figure shows you things quoting it does not.

The 105% recovery that wasn't — and the loss data that can't say who lost what

FTX's bankruptcy "made customers whole" — and paid a BTC depositor roughly 30 cents on today's dollar. Both are true. Recoveries of 103–120% (verified from the estate's own July 2026 distribution release) are measured against claims frozen in dollars at the November 2022 petition date, when bitcoin traded under $17,000; paid in cash against a coin that has since risen about 3.7×, that "full" recovery is 27–32% of in-kind value. FTX's own communications never mention the petition-date basis. The deeper problem fired one of this filing's pre-registered kill conditions: no federal instrument — not the FBI's IC3, not the FTC's fraud database, not the CFPB — can distinguish money lost to exchange failures from money lost to price declines from money lost to fraud. They are crime-complaint systems, categorized by scam type and payment method, not by cause. The consumer-protection debate is running on loss numbers that cannot answer its own first question.

The boring failure: three collapses, zero crypto-native causes

Traced through bankruptcy examiner reports and federal complaints, the three defining collapses of 2022 share a mechanism, and it is not a novel one. FTX's terms of service promised in writing that customer assets were not FTX's property — while its engineers built a special flag letting Alameda alone draw unlimited negative balances, exempt from the liquidation engine that policed everyone else. Celsius's "Custody" accounts were marketed as segregated and were, per its examiner, commingled with company funds, shortfalls papered over from other pools. Voyager pooled customer crypto into one enormous uncollateralized loan to a single opaque counterparty, then concealed the default while still soliciting deposits. Commingling, undisclosed leverage, concentration, concealment: every one of these is a failure bank regulation has a hundred-year-old vocabulary for. No smart contract was exploited. No oracle was manipulated. And the sharpest detail cuts at the standard remedy: two of the three had written custody promises that functioned exactly like a segregation rule — and were defeated by concealment. The fix isn't writing the rule. It's the mandatory independent audit that forces the books to match it — the check Congress has since written into law for stablecoin reserves, and for nothing else.

Strengthened 2026-08-10 (Phase 2 steelman): "and for nothing else" was too narrow, and the thing it missed makes this section's argument better than we made it. American law has run exactly this experiment. Federal statute has required futures brokers to keep customer money "separately accounted for" and un-commingled since 1936 — and Peregrine Financial Group defeated that statute by lying about the balance in the reports it filed, telling an examiner in July 2012 that it held over $220 million of customer funds when it held about $5.1 million. Forty dollars reported for every one that was there, and the rule had been on the books since 1936. A written rule, a federal supervisor, and nobody checking the vault. The fix Congress and the CFTC actually adopted after that and after MF Global's $900 million shortfall is the one this section argues for: since January 2014, a futures broker may only hold customer money at a bank that reports the balance straight to the regulator, with standing read-only access the broker cannot switch off. Our claim that verification rather than the rule is the load-bearing part is not a derivation. It is the documented history of the last institution that tried it.

The bills vs. the losses: Washington is solving a different problem

Five years of regulation-by-enforcement ended with two judges in the same courthouse disagreeing about the core legal test — Ripple's judge carved out exchange sales, Terraform's judge explicitly rejected the carve-out — and no appeals court ever resolved it, because the big cases were dropped, dismissed, or abandoned after the 2025 administration change collapsed SEC crypto enforcement by 60% (penalties fell from $4.98 billion to $142 million: the clearest proof in the record that anything administrative is one election from reversal, in either direction). The legislative response is two bills aimed somewhere else. The GENIUS Act regulates stablecoin reserves — enacted, then stalled: every implementing agency missed the one-year rulemaking deadline, and its perimeter excludes algorithmic stablecoins, the class behind the largest adjudicated stablecoin loss on record. The CLARITY Act resolves which agency regulates which token — the industry's actual ask — but its custody title governs who may hold customer assets, not whether anyone checks that those assets are still there. The jurisdictional question is real. It is also not the question FTX, Celsius, or Voyager turned on.

This section said something absolute, and the statute says otherwise. It read that "this filing could not find a proof-of-reserves or audit-cadence mandate in [the CLARITY Act] at all," and the panel above counted "0 audit-cadence mandates found in either flagship bill." We had never fetched either bill's text. We have now, and the count was wrong.

The GENIUS Act hires accountants, monthly. Section 4(a)(3) of the enacted law requires that "each month" a stablecoin issuer have its month-end reserve report "examined by a registered public accounting firm," with the CEO and CFO personally certifying it and a criminal penalty under 18 U.S.C. §1350(c) for knowingly certifying falsely. Section 4(a)(10) requires issuers above $50 billion outstanding to publish a PCAOB-standard audited annual financial statement. That is an audit cadence, it is independent, and it is already law. The CLARITY Act requires qualified digital asset custodians to "submit financial statements and audited financial statements to the applicable supervisor," bars exchanges, brokers and dealers from commingling customer property, and makes compliance officers file annual reports.

What survives is narrower, and sharper. Searched literally, the CLARITY Act contains the phrase "proof of reserves" zero times, the word "reconcile" in any form zero times, and the word "concentration" — the Voyager mechanism — zero times. Nothing in either bill requires anyone to verify, on any schedule, that the customer assets an exchange says it holds are actually there. Congress built the audit machinery and pointed it at stablecoin reserves; the 2022 losses happened at exchanges and custodians, where it isn't pointed. That is the finding, and it is a better one than the sentence it replaces, because it survives the text.

A second pass read further into the same bill, and one more of our sentences didn't survive it. Part 10 said the approach we rank first — make exchanges keep customer assets separate and prove it to auditors — "is the one thing no bill proposes." The CLARITY Act proposes the first half of it, in terms. Section 404 requires a digital commodity exchange to treat all customer money, assets and property "as belonging to the customer," "separately accounted for," with commingling expressly prohibited; section 406 puts the identical duty on digital commodity brokers and dealers — which is what Celsius and Voyager actually were. That language is lifted almost word for word from the statute that has governed futures brokers since 1936, and section 402 of the same bill amends that statute directly. The bill also makes holding segregated customer funds the trigger for mandatory membership in the futures industry's self-regulatory organization, and says the CFTC "shall require" that body to write the rules needed to enforce the segregation duty.

What still holds is the half we should have been pressing all along. Searched literally, the bill sets no cadence, no proof-of-reserves standard and no method for confirming that customer assets are actually there — it creates the duty, names the supervisor, and hands the verification design to a rulemaking that hasn't happened. That is a real and specific gap, and it points at a bounded, drafting-level fix: put the confirmation cadence in the statute instead of delegating it. The last time this Congress delegated a crypto verification rule, five agencies missed the deadline. The last time it built a market-structure regime by delegation, it took a decade.

Illicit finance, honestly: both sides are right, about different things

The illicit share of crypto volume is around 1% and roughly flat — but that figure is a moving lower bound from commercial vendors who revise every year's estimate sharply upward the year after, and the 2025 dollar surge is a specific story: sanctioned-state actors. North Korea stole $2 billion (the Bybit hack alone was ~$1.5 billion); a Russian ruble stablecoin moved $93 billion in under a year. Meanwhile the crime that made crypto infamous is receding on the one number two independent vendors agree on: the share of ransomware victims who pay has collapsed from 79% to 28%. And the comparator both sides skip: a Financial Times investigation found $90 billion of sanctioned Russian oil moving through ordinary shell companies — the same order of magnitude as the crypto rail. Crypto is neither uniquely dirty nor basically clean; it is one channel among several, with a better paper trail than most.

The sovereign-sized stablecoin — big enough to rank, small enough to ignore, growing too fast for either

Stablecoin issuers now hold more US Treasuries than most countries — roughly $175–190 billion, which would slot around 15th among foreign holders, by Norway and India. This filing's own prior said "$100–150B, mid-sized"; the verified figure broke it upward. Against the banking system it is still a rounding error: about 1% of deposits. But the 2023 bank failures are the wrong reassurance and the right warning — regulators' own post-mortems found crypto was the proximate cause only at Silvergate (which wound down paying everyone), while Signature and SVB died of old-fashioned uninsured-deposit concentration. That mechanism is exactly what the Fed's own research now models for stablecoins: under high adoption with the wrong plumbing, $600 billion to $1.26 trillion in displaced bank lending. The asset is new; the transmission channel is the oldest one there is. And the disclosure regime meant to watch it isn't running yet: Tether has still never completed a full audit, and the GENIUS rules that would force one are unwritten.

The lopsided fight: $133 million vs. nobody

This filing summed the FEC filings itself: $133.0 million in independent expenditures by the crypto industry's PAC network in 2024 — the second-largest single-sector political operation on record, achieved in one cycle, with 2026 fundraising already past it and two-thirds of that cycle's spending still to come. Across the table: the two most engaged consumer-finance advocates operate on combined budgets 25–45 times smaller — total budgets, not lobbying lines. And the constituency you'd expect to exist, doesn't: despite billions in documented losses, there is no FTX-victims PAC, no Celsius-creditors lobby, no registered advocate — the one time victims' stories reached a Senate floor argument, an industry-aligned senator was using them to argue for the industry's bill. The money's partisan pattern is subtler than a team jersey: Fairshake funded both parties' friendlies, spent $13.5 million against crypto-skeptical Democrats, and spent zero against any Republican — discipline enforced on one side of the aisle only.

Corrected 2026-08-10: this said "2026 spending already past it." On the measure this filing uses for its own $133.0 million — independent expenditures, summed from the committees' FEC filings — 2026 is not past it. Through the June 30, 2026 coverage date, Fairshake and Defend American Jobs had spent $42.7 million between them; even crediting the third committee at its full 2024 level, the cycle stands around $77 million against 2024's $133.0 million. What has already passed 2024 is fundraising: $166 million in receipts across just those two committees. That is the same spent-versus-raised confusion this filing corrected in the other direction for 2024, and we made it ourselves. The $133,006,906.56 figure was re-summed from the FEC's own data this pass and is exact to the cent.

What other places prove — and what nobody has proven

Japan wrote custody rules after Mt. Gox, and its two big post-reform exchange failures both ended with customers whole — but through ad hoc parent-company rescues (one funded, ironically, by FTX), a sample of two, and rules that reallocate losses rather than prevent breaches. The cleanest data point anywhere: FTX's own Japanese subsidiary, ring-fenced by Japan's segregation rules, paid customers back two years before the global estate. Europe's MiCA is comprehensive and only fully in force since July 2026 — it demonstrably forced issuer behavior (Tether left rather than comply), while the consumer-outcome statistics circulating for it trace to no regulator this filing could find. El Salvador made bitcoin legal tender and usage fell every year until the IMF unwound the experiment — while the government's claimed daily bitcoin buying is contradicted by the IMF's own program reviews. And China ran the prohibition experiment with tools no democracy has — capital controls, a national firewall — and still hosts one in ten of the world's crypto users and 14% of bitcoin mining. Bans lose to VPNs even for authoritarians. The last precedent is procedural: when Congress last built a market-structure regime from statute (Dodd-Frank swaps), the core took three years and the full build a decade — against which the current bill's 270-day deadlines are a wish.

The scorecard, corrected: a leader with no wins, a tie nobody wanted

Eight architectures, the protocol's five objectives, six weightings, every cell cited or held at a disclosed neutral. Custody-with-audit-teeth leads five of the six weightings — the do-nothing comparator takes the sixth — but the red team corrected what that means: it leads by being the only architecture with no documented failure, not by proven success; the segregation half is evidenced in Japan, and the audit half — the part that actually matters, per Part 4 — has never been implemented anywhere for an exchange holding customer assets. The harder finding is the tie: on project-verified evidence, neither flagship bill, nor SEC-led disclosure, nor enforcement-only can be distinguished from doing nothing anywhere in the score matrix. Their cases rest on mechanism arguments, not outcomes. Restriction is the only architecture the evidence actively scores down. And one risk class remains genuinely unowned — the fully decentralized, no-issuer protocol, which nothing on the board reaches even after the fact, and which hasn't produced its mega-loss yet.

This said custody-with-audit-teeth "leads every weighting under every sensitivity reading." Our own table says otherwise. Under the enforceability-first weighting the do-nothing comparator leads outright, 3.25 to 3.15 — the scorecard has said so in print since August 6, in the same document that carried the "leads every weighting" line. The claim was true of an earlier version of the board and was never recomputed after adjudication raised the do-nothing row's enforceability score.

And the lead is one cell wide. Custody-with-audit-teeth holds the board's only above-neutral score anywhere — a 4 on consumer protection, reached by restoring a cell the red team had cut to 3. Read that cell the red team's way and this architecture leads nothing outright: it ties the GENIUS-shape row across five weightings and loses the sixth. That sensitivity had never been published; it is now. What does not move: restriction finishes last under every weighting in every reading, and the tie between the marquee instruments and doing nothing is untouched.