A stablecoin lost most of its value over a single weekend. Nobody has yet shown that its reserves were ever missing.

IN BRIEF

• Main Street Finance’s msUSD fell as much as 88% on June 20th–21st after Accountable, its proof-of-reserves provider, walked away — before any reserve shortfall was ever proven.
• For days beforehand, the msY/USDC market on Morpho sat fully borrowed at a ~137% rate with borrowers calmly refusing to repay: perhaps the on-chain signature of informed money exiting at par before the news broke.
• A pausing, par-priced oracle and an 86% liquidation threshold turned that market into a free option — borrow dollars against potentially worthless collateral, default, and leave ~$18m of vault depositors holding the loss.
• Even a flawless reserve proof answers only half the question. It shows assets exist; it cannot show that holders legally own them, unencumbered, ahead of other creditors.
• The next standard is not proof of reserves alone. It is proof of solvency and proof of rights.

For a few hours before dawn on Sunday June 21st, a token that advertised itself as a dollar could be bought for around six cents. Main Street Finance’s msUSD, an Ethereum stablecoin that had traded placidly at par for months, fell as much as 88% in a single day. By the time its issuer published a lengthy reassurance to its followers, the damage was done: the price had already cratered, and would spend the following days limping back to somewhere near 27 cents — still a long way from the dollar it was built to be.

What makes the episode instructive is not the size of the loss. msUSD was a minnow, its market value never much above $30m and its deposits, at their peak earlier in the year, around $70m. What makes it instructive is the cause. No reserve was proven missing. No vault was drained. No oracle was tricked. The token collapsed because a single company stopped vouching for it — and, it would emerge, because a handful of others had quietly stopped believing it some days earlier.

 

The break

That company was Accountable, a venture-backed verification outfit that supplies real-time “proof of reserves” to crypto firms — continuous, cryptographically signed attestations that an issuer holds what it claims, without forcing it to bare its books in public. Backed by Pantera Capital, Accountable says it has verified north of $1bn in client assets, names such as Galaxy and Amber Group among them. Main Street had wrapped itself in that imprimatur, running a public dashboard, powered by Accountable, that purported to show msUSD’s collateral in real time.

On Saturday, Accountable pulled the plug. Main Street, it said, was unable to meet its verification standards, and the agreement was terminated with immediate effect. The dashboard went dark. With nothing left to confirm the reserves, the market did the confirming itself — by selling. Main Street, for its part, insisted it remained fully backed and called the affair a reporting problem rather than a solvency one. Both statements may be true at once. The market did not wait to find out, and in my opinion rightly so. If it is true that Main Street is indeed solvent, why would they ever refuse to give the required data/APIs to Accountable? 

It is worth dwelling on the architecture, because the architecture is the story. msUSD was the shop window: a dollar token, nominally redeemable one-for-one for USDC. Stake it and you minted msY, a yield token paying a tempting ~12% by harvesting “box spreads” — an options trade dressed in the language of institutional, market-neutral finance. The whole edifice rested on two struts: the verification feed that signalled solvency, and the integrations with larger venues that gave msY somewhere to live. Both proved load-bearing in the worst way.

 

The run

Chief among those venues was Morpho, one of DeFi’s largest lending markets. Main Street had cultivated an msY/USDC market there, and leveraged users had looped into it for yield. When confidence broke, the market seized: utilisation hit 100%, borrowing rates spiked, and roughly $18m of a third-party vault’s assets were left stranded, unable to exit. On-chain sleuths at PeckShield flagged the freeze as it happened. Elsewhere, a HyperEVM yield vault run by Altura wound itself down amid a run due to guilt by exposure to Accountable, with some $8.5m pulled before the wind-down was announced and its own vault token slipping 11%.

Altura was at pains to stress it had never touched Main Street’s strategies. The disclaimer is itself the lesson: in a composable system you do not have to hold the bad asset to catch the panic. Contagion travels along the plumbing, not the balance sheet — and, worse, along mere resemblance. Altura shared no exposure with Main Street, only a business model, a class of vendor and a style of dashboard. That was enough. In a market that cannot yet tell one off-chain yield product from another, “we have no exposure” is not the reassurance it sounds like; fear moves across a whole category at once.

 

The exit

Here the story turns from carelessness to something colder. For several days before Accountable said a word, the msY/USDC market was already drained dry of liquidity — fully borrowed out, utilisation pinned at 100%, and the borrowers calmly declining to repay even as the interest rate climbed past 137% APY. That last fact is the tell. A rate that high exists to force a decision: repay and reclaim your collateral, or be drawn in, as a lender, by the yield. A borrower who believes the msY behind his loan is sound does not sit and absorb 137%; he repays in minutes and walks away with his good collateral. The only world in which paying that rate is irrational is the one in which the collateral is already worth less than the debt. By refusing to repay, the borrowers were not panicking. They were telling the market, in the only language a blockchain records, that they had already marked msY to near zero — while the market’s own oracle was still pricing it at a dollar.

The mechanism that let them do it is worth spelling out, because most accounts wave at “100% utilisation” without saying who got hurt or how. On this market msY was the collateral and USDC the loan, with liquidation set at 86% of value and an oracle that held msY at par and was built to pause, rather than mark down, if the dashboard went dark. Stack those together and you have written a free option. Post msY while the oracle still calls it a dollar; borrow 86 cents of clean USDC against it; withdraw the USDC; and never come back. When msY collapses the position ought to be liquidated — but liquidation needs a live oracle to mark the loss and a liquidator willing to pay good money for worthless collateral, and the design removed both. So the loan simply sits there, unpaid, and the loss lands not on the borrower but on the USDC lenders: the roughly $18m of depositors in a single Morpho vault that had concentrated itself in this one market. The borrowers converted soon-to-be-worthless msY into hard dollars. 

There is a bitter elegance to it. That 137% was not only a cost the borrowers ignored; it accrued, on paper, as yield to the very depositors who were being robbed. Their dashboards would have shown a fattening return right up to the moment they understood that the principal beneath it was unrecoverable. The headline rate was the sound of the meter running on their own loss.

Note what this does to the timeline. The wire-service version runs: feed pulled, panic, liquidity gone. The onchain activity tells a different story. The pool was empty for days before the announcement; full utilisation was a leading indicator, not an aftershock. Panic is fast and reactive and arrives after the bad headline. Patient, maximum-leverage borrowing, held calmly under a punitive rate, in the days before any headline, is not panic. It is a worked-out trade. Whether the hands behind it were insiders tipped to the coming termination or merely sharp operators who had read April’s transparency doubts and shorted a token through the lending market changes the morality and not the mechanics. Either way, informed money was already gone before the public was told there was a reason to leave. This is, almost exactly, the wound that felled Stream finance’s XUSD last year. 

 

Who verifies the verifier?

Accountable’s own conduct has not escaped scrutiny. In distancing itself from the wreckage, the firm described itself as neutral infrastructure and conceded that it had not maintained an ongoing, source-level view of Main Street’s reserves. That is an awkward admission for a proof-of-reserves business, and the obvious question followed within hours: if not Main Street, who else has been feeding the verifier numbers it could not independently see? The crueller commentators reached for the analogy of Three Arrows Capital’s serene asset statements, issued shortly before that hedge fund detonated in 2022.

This is the uncomfortable core of the matter. An attestation is a promise about a promise. At its best — continuous, privacy-preserving, cryptographically anchored — it is a genuine advance on the quarterly PDF and the auditor’s annual blessing. But it inherits every weakness of the data fed into it, and it concentrates trust in a single counterparty who can withdraw at a moment’s notice. When that counterparty leaves, the market is handed an information vacuum and, reasonably enough, fills it with fear. The absence of a green light is not proof the engine has failed. From the outside, it is simply indistinguishable from exactly that.

 

A pattern, not an accident

Main Street did not happen in a vacuum, either. It is the latest tremor in a season of them, and the family resemblance is not the collateral but the bookkeeping. A fortnight earlier apxUSD wobbled below par — a stablecoin whose sibling yield token, apyUSD, is fed by apxUSD positions that holders had levered and looped through Pendle and Morpho to mint yet more apxUSD, as much as five times over. Strip away the labels and much of the value piled on top was the token’s own claims, stacked on themselves: a structure that counts the same dollar several times and calls the sum collateral. Further back lies the genuine catastrophe of Stream Finance, whose xUSD sat at the centre of a daisy-chain of vaults borrowing against one another, inflating reported value far above any real stablecoin reserve — until a $93m hole surfaced and xUSD fell 75% in a day.

The throughline is not opacity in general but a particular kind of it. Each of these structures was, on paper, attested or audited in some fashion; each took the system’s own word for what stood behind the token. When backing is recursive — claims pledged against claims — a dashboard that counts those claims at face value certifies a number, not a fact, and a self-reported or partial attestation merely notarises the circle. Main Street could still be solvent, however a single vendor vouching for an off-chain book admitted it could not see to the source of its funds. The collateral changes — preferred-share loops, daisy-chained vaults, box spreads in a broker account no one can audit in real time — but the lesson does not. An attestation that is not fully transparent, and that rests on what the issuer chooses to report, is not proof. It is a more expensive way of taking the issuer’s word for it.

 

Reserves are not rights

Step back from Main Street and a larger inadequacy comes into view. Even a flawless proof of reserves answers only the shallower of the two questions that matter. It can show that assets exist, somewhere, in the right quantity. It cannot show that those assets belong to the people holding the tokens — that they are ring-fenced from the issuer’s own balance sheet, unpledged to any other lender, free of liens, and that the tokenholder is a secured creditor whose redemption rights would survive the issuer’s bankruptcy rather than an unsecured one queuing behind everyone else. A dashboard reading $100m of reserves tells you the money is there. It does not tell you it is yours, or that you would see a cent of it if the lights went out for good.

For products like msUSD the gap is not academic. The reserves, such as they were, sat off-chain in broker and options accounts, executing a strategy the chain never saw; the token was a claim against an issuer, mediated by whatever legal wrapper the issuer chose, and worth precisely as much as that wrapper’s promise to hand real, segregated assets to real holders first. Most RWA tokens prove, at best, that there are assets somewhere. Few prove that those particular assets are legally reserved for those particular holders. msUSD failed the first, shallow test — the reserve proof itself went dark. 

 

What “verified” should mean

None of this is an argument against tokenised real-world assets, which remain among crypto’s most promising ideas. It is an argument against treating verification as a badge to be displayed rather than a system to be engineered — and against the binary, single-lamp “verified or not” signal that let a vendor’s resignation become a market-wide run.

The remedies are not exotic. A single green light should give way to a panel of them: separate, timestamped statuses for assets, liabilities, legal structure, encumbrance, redemption capacity and data freshness, so that a protocol can be honestly described as asset-verified but not legal-claim-verified, or liability-verified but not liquidity-verified. Encumbrance deserves its own lamp: reserves that are pledged, borrowed against, rehypothecated or margin-locked are not the same as reserves that are free and clear, and users are owed the distinction.

Verification should also fail gracefully. A feed that can only flip from “verified” to “gone” hands the market a cliff; one that degrades through explicit states — verified, stale, limited-scope, disputed, in breach, terminated, each with a reason and a list of affected assets — gives integrators something to respond to short of a stampede. And respond they should: lending markets and vault curators ought to wire the verification state directly into their risk parameters, so that a stale or disputed feed could potentially make automatic cuts loan-to-value, pauses new borrowing, raises haircuts or opens a withdrawal queue, rather than leaving a dashboard to serve as a social signal that everyone watches and no one acts on. Had the msY market done any of this — frozen new borrowing when transparency doubts first surfaced in April, or stopped pricing collateral at par the moment the feed was disputed — the free option at its centre would never have existed.

Finally, no single verifier should be a single point of confidence. High-value products should carry more than one independent attestor, or at least a defined process for a backup to step in, so that one firm’s exit is a yellow light rather than a detonation. Risk parameters should respect that real-world assets settle on real-world clocks; circuit breakers and redemption buffers should assume liquidity vanishes precisely when it is most needed. And methodology should be public and versioned: what is checked, what is excluded, how often, from which sources, and what changed since last time.

 

The Apollo View

The most quietly damning fact of the weekend is that, days later, nobody can say for certain whether msUSD’s reserves were ever short. They may well be intact, exactly as Main Street insists. That is the point. A dollar that loses most of its value on the strength of a cancelled service contract was never really a dollar; it was a bet on one company’s willingness to keep vouching for another. And the wallets that quietly borrowed it dry, and declined to repay it at any price, had stopped taking that bet days before retail investors.

The lesson reaches past Main Street. Proof of reserves, even done perfectly, proves only that assets exist. It says nothing about who owns them, who can redeem against them, who gets paid first when the structure fails, or what is meant to happen when the verification layer itself breaks. The next standard cannot be proof of reserves alone; it has to be proof of solvency and proof of rights — the assets are there, and they are yours, with an enforceable claim ahead of the issuer’s other creditors.