The CLARITY Act Isn't a Bank vs. Crypto Fight. It's a Test of America's Ambition
The CLARITY Act isn't banks vs. crypto — it's about whether the U.S. builds digital financial infrastructure that works for everyone, including community banks.
ZKsync Blog > The Wire That Couldn't Be Reca...
Published Apr 30, 2026
The Wire That Couldn't Be Recalled
On April 18, 2026, $290 million walked out of a treasury at Kelp DAO. There was no exploited bug. No flaw in the code. The team that built the underlying messaging system, LayerZero, released a statement that contained one of the more remarkable sentences in the history of financial-infrastructure incident reports:
"the protocol itself functioned exactly as intended throughout this event."
Two things are true at once. The protocol worked. And $290 million is gone.
That sentence — and the paradox underneath it — is the entire argument banks need to understand before they finish deciding what kind of tokenized infrastructure to put their balance sheets on.
A thought experiment about banking
Imagine, for a moment, that you stripped the modern banking system of every legal contract, every recall window, every settlement hold, every reconciliation cycle, every sanctions screen, every dual-control rule. What would be left?
The wires. Messages between banks would still arrive. They would still carry signatures. The receiving bank would still verify those signatures and act on them.
In this stripped-down world, a properly signed message saying "transfer $290 million to an account in Dubai" would be honored. The signature would check out. The money would move. And if the credentials behind that signature had been stolen, no one would catch the theft until well after the funds had cleared, because there would be no second layer in which to catch it.
This is not a hypothetical reconstruction of how banking works. It is, more or less, what the wire layer actually does. SWIFT, card networks, securities depositories, correspondent banking — at the wire layer, all of these are systems that act on properly signed messages from a defined set of trusted operators. The wire trusts the signer. Full stop.
The reason this has not collapsed civilization is everything that isn't the wire. When attackers stole SWIFT credentials from Bangladesh Bank in 2016 and authorized $951 million in fraudulent transfers from the Federal Reserve Bank of New York, the wire did exactly what it was designed to do. It honored signed messages. The reason most of that money never moved is that the controls around the wire — sanctions screening, manual review, settlement holds, contractual recall — assumed the wire could be breached and caught the forgery before most of it cleared.
Decades of bank engineering can be summarized in one sentence. The wire fails open. The architecture above it is how the system survives.
What people think blockchains are
When most executives encountered blockchains for the first time, the pitch went something like this: you don't have to trust an operator anymore. The network protocol is the rule.
The pitch was largely accurate, for Bitcoin and Ethereum. What these systems do — and what makes them a different category from anything that came before — is enforce a global rule set against the global state, automatically, on every transaction. Validity is not a matter of who signed. It is a matter of whether the transaction satisfies the protocol's logic given everything else the protocol has ever accepted. Every node on the network independently checks that, and a transaction that fails the check is rejected before it becomes part of the ledger — including a transaction signed by a compromised node, even if that node is your own. Blockchains fail closed.
What does it mean to enforce a rule on a financial network? In the system banks have today, it means writing the rule into a contract and trusting that everyone honors it, with auditors and regulators following behind to catch the ones who don't. On a cryptographically enforced network, it means something stricter. An asset issuer can encode a hard cap on issuance, and the protocol checks every new mint against the entire supply already in existence. A lending protocol can encode collateral requirements, and the protocol checks every loan against every position, every block. These are not rules the parties agree to honor. They are rules the network refuses to let anyone violate.
This is a different category of system from the wire. Forged transactions don't get committed and then recovered. They don't get committed at all. There is nothing to detect, contain, or unwind. The fraud doesn't reach the state.
What is actually being sold to banks
If that were the whole story, the choice facing banks today would be straightforward. It is not, because a third category has emerged in the last decade — a category of systems that wears the language of blockchains while keeping the trust model of the wire.
LayerZero is one of these. Canton is another.
These systems are described, sold, and integrated as if they were members of the second, fails closed, category. They are not. Underneath the marketing, they are wires. A defined set of operators signs messages. The receiving side checks the signatures. If the signatures are valid, the message is acted on. There is no global verifier independently checking that the underlying state transition followed the rules. Operator attestation is the protocol.
The catch is that, unlike SWIFT, these systems don't sit underneath a century of contracts, industry standards, recall windows, and settlement holds. The whole point of the architecture is that settlement is irreversible and the system runs continuously. The wire-layer trust model has been transplanted into an environment where the layers that historically contained its failures don't exist.
The first architecture is a permissioned chain connected to other networks through cross-chain bridges. A bridge, stripped of the marketing, is a small set of servers that watch one chain and sign messages telling another chain what they saw. The receiving chain trusts the signature. Whatever security the source chain had — its consensus, its verification, its validator set — does not travel with the message. What travels is the operators' word. Most bridges in production today are built this way by design.
That is the architecture that lost $290 million on April 18.¹ It is also the architecture that lost $625 million at Ronin, $100 million at Harmony, and $126 million at Multichain, by the same mechanism, four times.² The operator was different each time. The signing keys were stored differently each time. What was constant was the model: signed message, no global verifier, settlement before any other layer could catch a forgery — because there was no other layer.
The instinct is to bring the operator in-house: LayerZero was a third party, a bank is not. But the failure mode is a property of the architecture, not of who runs it. Bringing the bridge in-house moves the signing keys onto the bank's servers, and with them every assumption that broke at LayerZero — that the keys stay secret, that the operators stay clean, that the production environment never sees a compromised dependency. Across a decade of incidents, those assumptions have broken on third parties, consortiums, and protocol teams alike.
The same diagnosis applies, with a different surface, to the mediated messaging architecture institutions are most often shown as the conservative alternative — Canton being the canonical example. The headline feature is privacy between counterparties. Underneath, validity comes from signatures by the participants to a given transaction.³ There is no global verifier with a view of network-wide state.⁴ The operators party to the transaction are the protocol.⁵
And privacy makes the failure mode strictly worse, because the forged state is visible only to the parties to the transaction that produced it. The detection layer that contained the Kelp DAO loss before a second attempt could execute is gone on Canton.⁶
What these architectures have in common is that they took the part of blockchains that resembles a wire, and left behind the part that doesn't.
The real blockchain breakthrough
The thing that makes Bitcoin and Ethereum a different category isn't that they're decentralized, or that they use cryptocurrency, or that they're distributed across many computers. Those are mechanisms. The breakthrough is that they replaced operator attestation with cryptographic enforcement at the point of validity. A transaction is valid if and only if the math and code say it is. The architecture rules out a class of failures rather than reacting to them.
Every bank already runs hundreds of internal limits — position limits, exposure limits, issuance caps. Today, those limits live in software the bank operates and trusts itself to enforce. Cryptographic enforcement lets the limit live somewhere else: in the network itself, where breaking it isn't a matter of policy but of math.
Take the simplest case: an issuer capping how much of its own asset can be created. On Ethereum, an asset issuer can bind its own issuance in code: per-key caps, daily limits, multi-party authorization to change those parameters, the authorizing key held in cold custody. The protocol independently checks the cap on every transition. If the hot signing key is compromised tomorrow, the protocol still rejects the unauthorized issuance, because the cap is enforced by the math regardless of what the compromised key signs.
The same control has nowhere to live on an operator-attested network like Canton. There is no shared state for the network to enforce a cap against. The signatory group is the only thing standing between the attacker and the balance sheet. Compromise the issuer’s signatory group, and the protocol will mint unlimited counterfeit supply for you.⁷ There is no second layer.
This is the difference, in one cleanly stated case: on a cryptographically enforced network, an attacker has to break the math; on an operator-attested network, an attacker has to break the operator. Across the last decade of incidents, breaking the operator has been the easier of the two, by a margin that does not appear to be narrowing.
The privacy problem, and why it no longer applies
The reason banks have not historically run their tokenized assets on cryptographically enforced chains is not security. It is privacy. A bank cannot operate on infrastructure that exposes every transaction and counterparty to every observer.
Zero-knowledge proofs solve this without compromising the architecture. The mathematical claim a ZK proof lets you make is: a transaction satisfied the protocol's rules, without revealing what was in the transaction. It is the central technical move that makes cryptographic enforcement compatible with institutional privacy.
Prividium is the architecture that operationalizes this for institutions. Each institution runs a permissioned zone inside its own infrastructure, with full operational control over what is visible and to whom. Transactions, balances, and counterparties stay inside the zone by default. What leaves the zone is a ZK proof that the zone's state transition followed the protocol's rules. Ethereum's verifier accepts the proof if the math holds and rejects it otherwise.
Cross-zone settlement and settlement to Ethereum proceed through verification of those proofs. Operator signing committees remain in the architecture as a redundant line of defense, but their compromise alone cannot unwind settlement — the math has to break first.⁸
What the post-mortem will say
Within the next decade, a tokenized-asset incident large enough to become a solvency event is, by the math of how fast these books are growing, likely. The architecture chosen this year is the one that will be defended in the post-mortem.
The question worth answering, before that architecture is committed to, is not which option is fastest to integrate or most familiar to the existing engineering team. It is the older question: which class of failures does the architecture rule out, and which can it only react to? An architecture that fails open at the wire and has no layers underneath is a worse version of what banks already have. An architecture that fails closed at the math is something genuinely new, and is what the rest of the financial system will eventually be rebuilt on.
The Kelp DAO statement, read carefully, is not a description of an unfortunate exception. It is a description of the design.
Disclosure: Matter Labs develops ZKsync and Prividium, a proof-based institutional blockchain architecture discussed below. We have a commercial interest in this discussion.
－
¹ The attackers compromised the two off-chain servers behind LayerZero's verifier and used them to sign attestations to events on the source chain that had never occurred. The receiving side could verify the signatures but had no independent view of the source chain to detect the forgery.
² Ronin (March 2022, $625M), Harmony (June 2022, $100M), Multichain (July 2023, $126M), Kelp DAO (April 2026, $290M).
³ Canton has no global re-execution. A transaction's validity is checked only by the participant nodes hosting the stakeholders of that specific sub-transaction. Each required confirming participant decrypts the projection it is entitled to see, re-executes the relevant Daml logic against its local view, and signs a confirmation response. The mediator counts those signatures against the required confirmation threshold and finalizes the transaction once the threshold is met — it does not see the transaction or check what the signers signed for, it tallies votes. For any sub-transaction whose stakeholder set is hosted entirely on confirming participants controlled by a single entity, that entity's participants are the sole executors and the sole signers. Validity reduces to what the required threshold of those participants chooses to sign — and a malicious threshold quorum can approve transactions that violate the contract's own rules.
⁴ Canton synchronizers do not validate transaction contents. The sequencer orders encrypted messages it cannot decrypt and forwards them to recipients. The mediator receives a blinded informee tree — all contract contents hidden — and uses it only to identify which confirming participants must respond and to count their signed responses against the required threshold. It does not execute Daml logic, does not see contract state, and enforces no invariant over balances or supply, because no balance or supply state is visible to it. At the synchronizer layer, Canton prevents the same existing contract ID from being archived twice, a property Canton describes as double-spend prevention. In the conventional meaning of the term — used on Bitcoin, Ethereum, and every cryptographically enforced ledger — double-spend prevention means the protocol verifies that the value being spent does not exceed the value the spender holds. Canton's check verifies neither. It confirms only that a given contract identifier has not previously been marked consumed. A compromised issuer's confirmation threshold minting counterfeit assets is not consuming any existing contract twice; it is creating fresh contracts with fresh IDs, and nothing in the synchronizer or mediator path examines them.
⁵ In Daml, contract creation requires signed authorization from every signatory of the template, with each signatory's authorization satisfied by the required confirmation threshold among that party's confirming participant nodes. For an issuance contract whose only signatory is the issuer, the issuer's confirming participants — at the configured threshold — are the sole authority required to bring new state into existence, and the sole layer that re-executes the issuance against the contract's logic. The credential that authorizes issuance and the executor that verifies it are the same participants. No global supply exists at the protocol layer to be checked against, because Daml's ledger is segmented by design: each party stores only its own projection, and there is no shared register of total supply for any asset.
⁶ Canton's privacy model exposes a sub-transaction only to its informees and their participants. If the issuance contract has no independent informee — no observer, no maintainer, no cap-enforcing party outside the issuer's control — forged state created by a compromised confirmation threshold of the issuer's participants is visible only to those participants. There is no public supply, no public state root, no globally replicated ledger at the protocol layer against which the forgery could be observed. Outside observers see encrypted, ordered, undecryptable traffic on the sequencer and nothing else.
⁷ Caps, supply limits, and similar invariants can be written into Daml contract logic. Their enforcement reduces to re-execution by the participants hosting the parties whose authorization the cap-bearing transaction requires. If the cap's enforcement path runs entirely through the issuer's confirmation threshold — no independent informee, no separate cap-control party, no quorum outside the issuer's control — then a compromise of that threshold is, by construction, a compromise of the only layer that would execute and reject a cap violation. The cap becomes a rule the compromised executor agrees to follow; when it stops following the rule, nothing in the protocol notices.
⁸ The correctness of cross-zone settlement is conditional on governance of the contract code on both sides. Several configurations satisfy this requirement. In a shared governance model, both zones route upgrades through a single governance contract, so neither side can deploy code the other has not authorized. In an independent governance model, each zone's upgrade history is committed to Ethereum, and the receiving contract must check at settlement time that the counterparty sits on an approved code lineage — any deviation, including a malicious version that was immediately reverted, causes settlement to be rejected.
Share the article
More from ZKsyncView all
Why and How We're Sunsetting ZKsync Lite
ZKsync Lite sunsets on May 4, 2026. Block production stops, but your funds are safe — withdraw via L1 claim contract. First 100K withdrawals sponsored.
$ZK Now Live on Revolut: Expanding Access to 15M Users Across Europe
$ZK is now live on Revolut, giving 15 million users across the UK and EEA direct access to the native token of ZKsync — the institutional privacy and settlement network on Ethereum — with 0% FX fees through one of Europe's most trusted fintech platforms.