TL;DR
World Liberty Financial is two assets and a front end. WLFI is the governance token, USD1 is the stablecoin, and WLFI Markets turns out to be an interface that routes into Dolomite rather than running lending code of its own. DeFiLlama files the protocol under Lending but holds zero TVL data points for it, so there is no protocol TVL to quote and we do not print one. USD1 circulation is $4.029B today, down 25.2% from its February peak.
One thing genuinely improved this month and it deserves to be said plainly. BitGo changed its attestation firm: Crowe LLP signed the May 2026 reserve report, and KPMG LLP signed June, with an unmodified opinion and redemption assets exceeding redeemable tokens. That is a move up in tier, and it is one report old.
The admin picture did not improve. We re-read both contracts on chain today and simulated the calls against live state. One externally owned address can freeze any USD1 holder. A different externally owned address can mint USD1 with no cap, and unlike the freezer key that one is funded and has already sent sixteen transactions. The WLFI token owner can blacklist a wallet, move its balance in batch, burn it and remove its votes. Nothing sits behind a timelock. Two reds, both on surfaces where you lose the money.
Checklist
Audits & contracts. Weak documentation rather than a proven defect, but weak enough to notice. The WLFI docs index carries pages for attestations, proof of reserves, minting, tokenomics, a MiCA whitepaper and risk disclosures, and no page at all for audits or security. DeFiLlama's protocol entry lists an audits value of 0. The only named engagement is Cyfrin's review of the WLFI Lockbox, a peripheral token-distribution contract, reported in several secondary write-ups but with no primary audit-firm link reachable this run. Exchange education pages name other firms as platform auditors; those are marketing pages, not reports, and we treat them as unverified. One trap worth flagging: a public "World Liberty Financial" smart contract audit exists at Cyberscope for the domain wlfi.club, which is not this protocol. Do not cite it. Both tokens are upgradeable proxies, so whatever was audited is not necessarily what runs tomorrow. Full audit trail stays refresh.
Admin control. The first red, and re-verification made it sharper rather than softer. USD1 (0x8d0d...8b0d) still points at implementation 0x694a...1f08, unchanged since the July check. Its owner is a controller contract, 0xee9b...61c2, whose default admin is a 3-of-6 Safe. That much reads reassuringly, and the controller does separate its powers properly. The problem is where two of them landed.
We simulated the calls. A freeze of an arbitrary address sent from 0x6802...ee66 succeeds; the identical call from an unprivileged address reverts with AccessControlUnauthorizedAccount carrying the contract's own FREEZER_ROLE hash. That address has no contract code behind it. A mint of one trillion USD1 to an arbitrary address sent from 0x87e0...246e returns true, and so does a mint of one quadrillion. There is no cap, and no second signature. That address has no code either, but it holds ETH and its nonce is 16, so it is a live operational key, not a dormant one. The freezer key, by contrast, has never sent a transaction and holds no gas at all, which means the authorization is armed but unused.
Give the contract its due on the rest. Draining a frozen account, reallocating a balance and passing arbitrary calldata through to the token all require DEFAULT_ADMIN_ROLE, which is the 3-of-6 Safe alone. Recovery is its own role. The proxy admin is a separate 3-of-5 Safe. The one delay we found, three days, covers handing over the admin role and does nothing to slow the use of any power. The mint surface is also wider than two keys: alongside the Safe and the funded EOA, MINTER_ROLE is held by a 45-byte minimal-proxy clone, and two further bridge contracts hold BRIDGE_MINTER_OR_BURNER_ROLE. The token implementation additionally declares renounceOwnership as a view function, meaning ownership cannot actually be given up through it.
The WLFI token tells the same story with a different vocabulary. 0xda5e...ef6 is itself an upgradeable proxy whose owner, a 3-of-5 Safe that also owns the proxy admin, can call ownerSetBlacklistStatus, ownerBatchReallocateFrom, burnFrom, ownerPause, ownerSetMaxVotingPower and ownerSetVotingPowerExcludedStatus. We simulated blacklisting, vote exclusion and pause from that Safe: all three succeed, and all three revert with OwnableUnauthorizedAccount from anyone else. A separate guardian layer can blacklist and pause without being the owner, and there is no on-chain enumerator for who the guardians are.
Oracle. Materially better than last month, and still not clean. The reserve question finally has a named answer, and the name changed. Crowe LLP, Oakbrook Terrace, signed the May 2026 report on 2026-06-29. KPMG LLP, San Francisco, signed the June 2026 Independent Accountants' Examination Report on 2026-07-31, covering BitGo Bank & Trust's assertion for June 16 and June 30, 2026 under the AICPA 2025 criteria for asset-backed fiat-pegged tokens. Both opinions are unmodified. At June 30 the report shows 4,634,410,387 redeemable tokens against $4,634,586,966 of redemption assets.
Composition is where our own dependency map has been loose, so be precise: this is not a Treasury bill portfolio. At June 30 it is $3.456B in government money market funds at net asset value (74.6%) and $1.179B in bank demand deposit accounts (25.4%), with the report noting those deposits may at times exceed the $250,000 FDIC limit. Short-term Treasuries and reverse repo are eligible under the terms; they simply were not what was held. Read the two dates together and something moves: two weeks earlier, on June 16, the split was 84.9% money market and 15.0% bank deposits. Uninsured bank exposure grew by ten points of the reserve inside a single report.
Two scope caveats a reader deserves. The report's background section, which is where the redemption terms live, and its summary table are both footnoted "Not subject to the Independent Accountant's Examination Report"; KPMG's opinion attaches to the assertion in Notes A, B and C. And the July report has not published, so the freshest attested number is six weeks old and 13.1% above today's circulation. On the oracle itself, the WLFI docs say the proof-of-reserves dashboard reads from a Chainlink oracle on Ethereum, but that dashboard is Cloudflare-blocked to non-browser clients and no USD1 Proof-of-Reserve feed appears in Chainlink's public mainnet reference directory, which does list 24 reserve feeds. A USD1/USD price feed does exist there and read $0.99934 as of 2026-08-10 14:50 UTC. Feed identity for the reserve dashboard stays refresh. WLFI Markets contributes no oracle of its own, since it is a Dolomite interface.
Liquidity & exit. WLFI turns over about $37.7M a day against a $1.755B cap, roughly 2.2% of market cap, which is workable for its tier, and about 68.2% of supply remains locked on a schedule we could not confirm. USD1 is the more interesting leg, and BitGo's own terms say the quiet part out loud: minting and redemption are available only to registered BitGo clients in good standing, and holders without an account "may transfer USD1 on supported networks but do not have direct redemption rights with the Company." The same document adds that redemption rights are contractual and do not constitute a security or property interest in any specific reserve asset. So a DeFi holder's exit is secondary liquidity, not redemption at par, and the freeze power above can close that address in the middle of it. Circulation has fallen from $5.389B on 2026-02-11 to $4.029B today. On our watchlist the exposure is indirect through Dolomite, whose USD1 pool sat near 93% utilization in the April and May window.
Yield: real vs emission. No native yield on either asset. Interest on the money market funds accrues to the issuer's reserve, not to USD1 holders, which is the ordinary fiat-backed model and not a criticism by itself. A USD1 Points Program appears in the docs; that is an incentive, not revenue share, and we did not read its terms this run. Any APR quoted on USD1 or WLFI at a lending venue is that venue's borrow demand or emissions, sitting on top of issuer risk, not underneath it.
Holder concentration. The second red. Reuters reported on 2026-06-09 that Trump family entities netted about $2.3B from four crypto ventures as of the end of April 2026, while outside investors lost roughly the same amount across those projects, with WLFI holders alone facing about $674M of losses. The family is entitled to 75% of WLFI token-sale proceeds against a raise of roughly $1.4B for 30 billion tokens. Reporting on the exact dollar figure attributable to WLFI specifically is inconsistent between the gross raise and the family's take, so we do not print a single number for it. Circulating supply is 31.776B against a 100B cap, so about 68% sits outside the market with an unlock schedule we still cannot confirm. Wallet-level top-holder data was paywalled again on both Etherscan Pro and Nansen, the second month running, so the on-chain distribution stays refresh.
Track record. Better than most, and not the clean sheet last month's draft implied. The daily peg record is genuinely good: across 470 daily observations since April 2025, exactly two closes fell below $0.995, both in May 2025, and today reads $0.99945. But the daily series is the wrong instrument for what happened on 2026-02-23. On that day USD1 traded below its peg intraday during what the company described as a coordinated attack that involved unauthorized access to co-founders' X accounts, paid amplification and short-selling of WLFI. World Liberty stated that zero smart contracts were affected and that reserves remained fully backed, and we found no evidence against that. The reported depth varies by outlet, from about $0.997 to about $0.980, and the lowest February close in our series is $0.99837 on 2026-02-01, so the move never printed as a daily close. Call it what it is: a brief loss of peg plus a social-account compromise, no contract exploit, no reserve loss. Circulation peaked twelve days before it and has fallen 25% since.
The other item on the record is governance. The September 2025 blacklist of more than 270 WLFI wallets has become live two-way litigation. Justin Sun sued in late April 2026, with CoinDesk placing the filing in the U.S. District Court for the Northern District of California and describing claims of unlawful seizure of property, fraudulent misrepresentation and omission, threats and defamation. World Liberty countersued for defamation on 2026-05-04 in the Eleventh Judicial Circuit Court for Miami-Dade County, Florida. The complaint alleges World Liberty added a blacklisting function to the WLFI contract in August 2025 without disclosure or a governance vote, and that Sun was threatened with having his tokens burned. Those are allegations, but the functions they describe are ones we can read in the deployed contract today. WLFI itself is 83.3% below its first-day high.
Worst case
Three ways to lose, ranked by what we verified rather than what we fear.
First, a key compromise on the issuance side. One externally owned address can mint USD1 without a cap, and that key is funded and in active use. 2026 has already priced this risk twice. In March, an attacker with a compromised key minted 80 million unbacked USR and extracted roughly $23M to $25M from Resolv, collapsing the peg and leaving Fluid to absorb over $10M of bad debt. In May, StablR lost about $2.8M when a minting multisig that required just one of three signatures was compromised, and both its stablecoins depegged. USD1's mint path is not a multisig at all on that leg.
Second, seizure. Your address is frozen by a single key, and the balance can then be drained or reallocated by the 3-of-6 Safe; for WLFI it can be blacklisted, batch-reallocated, burned, and its votes removed. There is no appeal layer you control and no timelock to give you a head start.
Third, the slow version. Reserves stay sound, but the attestation cadence slips or changes firms again, a quarter of the reserve continues to sit in uninsured bank deposits, redemption remains closed to anyone without a BitGo account, and USD1 sells off in secondary markets while whatever is collateralized by it downstream unwinds into bad debt. No insurance fund on any leg.
Bottom line
Avoid for direct exposure. The reserve story improved this month and the report should say so: the attestor moved from Crowe to KPMG, the opinion is unmodified, assets exceed tokens, and the peg has held for fifteen months with one intraday exception. None of that reaches the two reds. A stablecoin where one key can mint without limit and another key can freeze you, behind proxies with no timelock, is not a thing we hold. A governance token whose issuer can blacklist, reallocate and burn a balance while litigating against the holder it froze is not either. Our sanctioned touchpoint stays indirect through Dolomite, where the USD1 and WLFI pools are already flagged do-not-lend, and it is worth knowing that WLFI Markets is now a front end onto that same protocol. Re-rate if the mint and freeze roles move behind a multisig with a real timelock, or if the OCC charter lands and KPMG signs two or three more reports on schedule.
Data appendix
- TVL: No protocol TVL exists. DeFiLlama lists
world-liberty-financial(id 7571, category Lending, chain Ethereum) with an emptytvlarray and an emptycurrentChainTvls;api.llama.fi/tvlreturns "Protocol not found" forwlfi,usd1,wlfi-usd1andworld-liberty-financial-usd1, and returns HTTP 200 with an empty body forworld-liberty-financial. Do not quote a protocol TVL for this name. - USD1 supply and price: circulating $4,028,861,364 at $0.99945 (DeFiLlama stablecoins list endpoint, id 262). The per-chain series on the same source sums to $4,031,071,793, a 0.05% endpoint difference. Chain split: Ethereum $1,529,689,730, BSC $1,413,324,601, Solana $1,043,293,564, Abcore $18,523,855, Aptos $16,072,306, Tron $10,062,605, Monad $103,969, Plume $1,162. Peak circulation $5,388,851,574 on 2026-02-11, so down 25.2%; down 13.4% from $4,654,829,989 on 2026-07-02.
- WLFI market: $0.055236, mcap $1,755,193,586 (rank 44), FDV $5,523,627,392, circulating 31,776,104,031 of 100B max (31.78%), 24h volume $37,652,534 (2.15% of cap), ATH $0.331336 on 2025-09-01, now 83.3% below it (CoinGecko, 2026-08-11).
- Contracts, all read on Ethereum today at block 0x188a194: USD1 proxy 0x8d0d000ee44948fc98c9b98a4fa4921476f08b0d, implementation 0x694aa534bdef8ed63244eb902e7914e527891f08 (unchanged since 2026-07-02), ProxyAdmin 0xa032fe6c496732bdfc0d235066f55f171fa4aece owned by 3-of-5 Safe 0x6a8dc6dbf909f542f2536edf8676d52630cf59e1. USD1 owner is controller 0xee9b1a09aedaced9dcda74964ea447feb93861c2; its defaultAdmin and sole DEFAULT_ADMIN_ROLE holder is 3-of-6 Safe 0x0d190b74308669e8f4fe7dbce3466169b285289d; defaultAdminDelay 259200s covers admin handover only, and pendingDefaultAdmin is empty. getChecker() returns the zero address. Ethereum USD1 supply 1,529,689,729.64. Not paused. WLFI token 0xda5e1988097297dcdc1f90d4dfe7909e847cbef6 is a transparent upgradeable proxy, implementation 0x59a3293c71769363068b4c1e8906e364763b3195, ProxyAdmin 0x7f533afa9e994b7e44673188034f9ce52886a0c0; the token owner and the proxy-admin owner are the same 3-of-5 Safe 0x5be9a4959308a0d0c7bc0870e319314d8d957dbb; Ethereum supply 96,742,743,250.50; not paused. No timelock found on any path.
- USD1 role enumeration (controller getters, live): DEFAULT_ADMIN and RECOVERY and CHECKER_ADMIN: the 3-of-6 Safe only. FREEZER and UNFREEZER: the Safe plus EOA 0x6802744c90ffb2045de9790527b446d663f1ee66 (zero code, nonce 0, zero ETH). MINTER and BURNER: the Safe, 0x0f33afb00334ea05f6f0e64fc919920ecd4bd16c (a 45-byte EIP-1167 clone delegating to 0xe5dcdc13b628c2df813db1080367e929c1507ca0), and EOA 0x87e0017503560a655309c470666645472c66246e (zero code, nonce 16, 0.056 ETH). PAUSER and UNPAUSER: the Safe plus the clone. BRIDGE_MINTER_OR_BURNER: 0xf9e47d3720d5142930444ae6773c7f6d05696228 and 0x36a72ed0096b414521c45e3ddc9ed657d1d9c141, both large contracts. Identity of the clone and the two bridge contracts: refresh. Who controls the two EOAs: refresh.
- Admin powers, simulated by eth_call against current state: freeze of an arbitrary address from 0x6802...ee66 succeeds; the same call from an unprivileged address reverts 0xe2517d3f AccessControlUnauthorizedAccount carrying role hash 0x92de2777..., which matches the contract's FREEZER_ROLE(). mint(address,uint256) of 1e12 USD1 from 0x87e0...246e returns true, and so does 1e15 USD1, so no cap was encountered; from an unprivileged address the same call reverts 0xc7ccc1ca OnlyMinterOrBridge. On the WLFI token, ownerSetBlacklistStatus, ownerSetVotingPowerExcludedStatus and ownerPause all succeed from Safe 0x5be9...7dbb and revert 0x118cdaa7 OwnableUnauthorizedAccount from anyone else. Source review of TokenGovernor confirms freeze and batchFreeze are onlyRole(FREEZER_ROLE) while drainFrozenAccount, batchDrainFrozenAccounts and executeTokenFunction (an arbitrary-calldata passthrough to the token, the route to reallocate) are onlyRole(DEFAULT_ADMIN_ROLE). The USD1 implementation also exposes drain (event FrozenAccountDrained), reallocate (event FrozenFundsReallocated), pause, and a renounceOwnership declared view. Simulation proves the authorization path is open, not that anyone intends to use it.
- Audits: No audit or security page in the WLFI docs index; DeFiLlama audits field is 0. Cyfrin / WLFI Lockbox (Aug 2025) is reported by multiple secondary sources with no primary link this run: refresh. Firms named only on exchange education pages: unverified, do not cite. A Cyberscope audit page exists for "World Liberty Financial (wlfi.club)", a different project from this one; do not cite it.
- Reserves and attestation: BitGo publishes 15 reports, April to December 2025 and January to June 2026. Crowe LLP (Oakbrook Terrace, Illinois) signed the May 2026 report on 2026-06-29, unmodified, showing 4,725,094,306 tokens against $4,734,684,613 at May 31. KPMG LLP (San Francisco) signed the June 2026 Independent Accountants' Examination Report on 2026-07-31, unmodified, AICPA 2025 criteria Part I. At 2026-06-30: 4,634,410,387 redeemable tokens against $4,634,586,966 redemption assets, surplus $176,579, held as government money market funds at NAV (CUSIP 31607A703) $3,455,973,922 and demand deposit accounts $1,178,613,044, with $0 in the BitGo Bank & Trust account. At 2026-06-16: 4,550,638,680 tokens against $4,550,815,251, surplus $176,571, money market $3,864,794,493 (84.9%) and deposits $682,022,558 (15.0%). Deposits may at times exceed the $250,000 FDIC limit per the report. The background and summary sections, which contain the redemption terms and the headline table, are footnoted "Not subject to the Independent Accountant's Examination Report". Issuer of record is BitGo Bank & Trust, N.A., itself OCC-chartered; World Liberty Financial, Inc. and SC Financial Technologies, LLC own the USD1 brand. Networks named: Ethereum, BNB Smart Chain, Solana, Tron, Aptos, Tempo. The July 2026 report is not published (its URL 302-redirects to bitgo.com). Fund identity behind the CUSIP: refresh.
- Redemption terms, same report: minting and redemption only for registered BitGo clients in good standing; holders without an account may transfer USD1 on supported networks but have no direct redemption rights; redemption rights are contractual and do not constitute a security interest in, or direct property interest in, any specific reserve asset.
- Oracle: No protocol oracle of its own. WLFI docs state the proof-of-reserves dashboard reads from a Chainlink oracle on Ethereum; the dashboard returned HTTP 403 behind Cloudflare even with a browser user agent, and no USD1 Proof-of-Reserve feed appears in Chainlink's public mainnet reference-data directory (which lists 24 reserve feeds). The directory does list USD1 / USD price feed 0xF0d9bb015Cd7BfAb877B7156146dc09Bf461370d, reading $0.99933638 last updated 2026-08-10 14:50 UTC, and a SUSD1+/USD1 exchange rate feed. WLFI Markets is a non-custodial interface on Ethereum mainnet where, per its own docs, "all core functionality available through WLFI Markets is provided by the Dolomite protocol", and it directs users to Dolomite's audits and security page.
- Holder concentration: Reuters investigation published 2026-06-09: Trump family entities netted about $2.3B from four crypto ventures as of end-April 2026 while outside investors lost roughly the same, with WLFI holders facing about $674M of losses; the family is entitled to 75% of WLFI token-sale proceeds against a raise of about $1.4B for 30 billion tokens. Circulating 31.78% of the 100B cap. Wallet-level top-holder snapshot: refresh, Etherscan Pro and Nansen both returned paywall errors this run, as in July.
- Peg record: 470 daily observations from 2025-04-28 to 2026-08-11 (DeFiLlama, series key usd1-wlfi). Only two closes below $0.995: 2025-05-18 at $0.990667 and 2025-05-20 at $0.993758. The lowest February 2026 close is $0.998373 on 2026-02-01, so the 2026-02-23 intraday move never printed as a daily close; daily series do not cover intraday moves.
- Incident record: 2026-02-23, USD1 traded below peg intraday. World Liberty attributed it to a coordinated attack involving unauthorized access to co-founders' X accounts, paid amplification and short-selling, and stated zero smart contracts were affected and reserves remained fully backed. Reported depth varies by outlet from about $0.997 (The Block) to about $0.980, and reported outflows of about $270M and a WLFI drop of 3% to 8% are inconsistent across sources: exact magnitude refresh. No hack of WLFI or USD1 contracts or wallets found in a June to August 2026 scan.
- Litigation: Justin Sun sued in late April 2026 (CoinDesk article dated 2026-04-21, describing a filing in the U.S. District Court for the Northern District of California) alleging unlawful seizure of property, fraudulent misrepresentation and omission, threats and defamation, and alleging a blacklisting function was added to the WLFI contract in August 2025 without disclosure or a governance vote. World Liberty countersued for defamation on 2026-05-04 in the Eleventh Judicial Circuit Court for Miami-Dade County, Florida. Sun's investment is reported as $30M in November 2024 by Banking Dive and $45M in 2024 by CoinDesk: exact figure refresh. Token status: reported still frozen, not independently confirmed this run.
- Regulatory: OCC national trust charter application filed 2026-01-05 as World Liberty Trust Company, N.A., reported near approval in June 2026 with no announced decision found as of 2026-08-11: refresh. For contrast, Circle's OCC trust charter was reported granted in July 2026.
- Comparable 2026 mint-key failures: Resolv, March 2026, compromised private key minted 80M unbacked USR and the attacker extracted roughly $23M to $25M; USR depegged and Fluid absorbed over $10M of bad debt. StablR, 2026-05-24, minting-contract compromise extracted about $2.8M and depegged EURR and USDR; the minting multisig required only one of three signatures.
- Cross-reference: Dolomite report in this repo (apps/showcase/content/research/dolomite.md, researched 2026-07-01): WLFI about $458.9M, roughly 55% of $835.7M supplied collateral, USD1 pool about 93% utilization with about $12.5M idle, Liquidity & exit red there. Those figures come from the April and May 2026 window (source CoinDesk 2026-04-09) and were not re-measured this run: refresh.
Maintained monthly. Methodology: DeFi Research Instruction v2.