Settling an agent in a stablecoin imports that coin's run-and-depeg risk straight into its treasury — and the safe-looking instinct, pick the most transparent coin, can be exactly backwards when reserves are weak.
A team has done the spend-rails homework. The agent’s hot wallet holds a few hundred dollars in a major dollar stablecoin, the per-call ceiling is set, the treasury sits in a separate wallet the agent cannot reach, and the circuit breaker is armed. The payment design is, by the usual checklist, complete. Then on a Friday the stablecoin in that hot wallet trades at 86 cents, and the agent’s next payments settle every counterparty short — because nobody wrote a rule for “the money is real, the rail worked, and the unit of account just moved fourteen percent.”
That is the failure this post is about, and it is a different one from anything the spend-rails literature covers. Choosing a stablecoin rail is a sound, structurally-forced decision — the card rail genuinely cannot do sub-cent, no-cardholder, no-merchant-account settlement. Isolating the treasury and ceiling-ing the spend genuinely bounds what a compromised agent can lose. But both treat the settlement asset as a fixed dollar. It is not. A stablecoin is a claim on a reserve, and the moment the agent settles in it, the treasury inherits that claim’s run risk: the coin trading below par exactly when the agent needs to pay, and a redemption queue forming in front of the agent’s own exit. The rail moved the money; it did not promise the money would still be worth a dollar.
Start with what a depeg mechanically is, because the intuition that a stablecoin “is” a dollar is the thing the rest of this post dismantles. The work on reserve-portfolio control puts it precisely: in Optimal Control of Reserve Asset Portfolios for Stablecoins (arXiv 2508.09429), “peg deviations arise when immediate cash coverage is insufficient relative to outstanding supply, and the market price relaxes toward this liquidity-coverage fair value.” The price is not pinned to a dollar by assertion; it tracks the issuer’s instantly-redeemable cash divided by coins outstanding. When that ratio drops below one, the price drops with it, and the agent holds the lower number — not the dollar on the label.
This is not a property of exotic designs only. The same paper names the tension inside every stablecoin treasury, fiat-backed ones included: “issuers must balance immediate liquidity against yield on reserves to keep the peg credible.” An issuer that reaches for yield has, by definition, less instantly-redeemable cash relative to supply — and even the cash leg of that balance is only as reachable as wherever it sits, which in a real event meant a major fiat-backed coin’s reserves parked somewhere they could not be reached over a weekend. The lesson the control model draws is operational, not structural: good reserve management “preserves most bill carry in calm markets, builds cash quickly when stress emerges, and avoids unnecessary rotations under transitory signals.” Peg stability is an active discipline the issuer performs, not a static fact of “being backed” — and a treasury that settles in a coin is trusting that discipline with no way to verify it from inside the wallet.
The next instinct is to wave the whole problem away with “well, all stablecoins are risky.” That is also wrong, and the way it is wrong is the most useful finding here, because the risk is not uniform across designs. Stability Anchors and Risk Amplifiers: Tail Spillovers Across Stablecoin Designs (arXiv 2602.18820) studies eight major stablecoins on daily data from 2021 to 2025 with a quantile vector-autoregression, plus minute-level event studies on three more coins that suffered major depegs, and the headline is that the stabilization mechanism — not the label — dictates tail behavior: “fiat-backed stablecoins function as ‘stability anchors’ with near-zero net spillovers across quantiles, while algorithmic and crypto-collateralized designs become risk amplifiers specifically under extreme market conditions.” The split only appears in the tail. In calm markets every coin looks like a dollar; the difference is entirely in what happens under stress — exactly the regime an agent treasury cares about, and exactly the one a demo never exercises.
The contagion behavior splits the same way. The paper’s Forbes-Rigobon tests across four depeg events find heterogeneous transmission: “after adjusting for volatility, algorithmic stablecoins exhibit significant residual contagion while fiat-backed coins show flight-to-quality effects.” That phrase — flight-to-quality — is the operative one for treasury design. In a panic, an agent settling in an anchor holds the asset others are buying; an agent settling in an amplifier holds the asset others are dumping, and the dumping is contagious rather than idiosyncratic.
The size of that difference is quantified, and it is large enough to change a design decision. The same study concludes that “regulatory capital buffers for extreme losses should be 2-3x higher for non-fiat-backed stablecoins than median-based measures indicate.” Translate the regulator’s language into the treasury’s: the tail loss you should reserve against for an algorithmic or crypto-collateralized settlement asset is two to three times what its median-based risk measures suggest. A treasury that sizes its buffer off normal-day behavior is under-reserved against the only day that matters — and specifically for the amplifier designs, whose calm-market behavior looks reassuringly identical to the anchors’.
A second-order finding closes the “just hold a non-dollar hedge” escape hatch: “the theoretical risk isolation between fiat and crypto markets breaks down during stress: direct volatility channels emerge between the US Dollar Index and Bitcoin that bypass stablecoin intermediation.” A treasury that imagined it could sit in crypto and route around dollar-stablecoin risk discovers, under stress, that the channels it assumed were insulated are suddenly live. The crisis is exactly when the correlations it planned around stop holding.
Here is the finding most likely to be acted on wrongly, because it inverts a rule that is correct everywhere else in engineering. The obvious move, once you accept a stablecoin is a claim on a reserve, is to demand the most transparent reserve — best disclosure, most frequent attestations, clearest published holdings. More information is safer. Except, for stablecoin run risk, it is conditionally not.
The global-game analysis in Information Structures in Stablecoin Markets (arXiv 2408.07227) states the paradox directly: “precise public knowledge reduces (increases) the probability of a run when fundamentals are strong (weak).” Parse the parenthetical carefully, because it carries the whole result. When the reserve is strong, more public information lowers run risk — disclosure reassures. When the reserve is weak, more public information raises it — disclosure confirms the weakness, and confirmation is what coordinates a run. Transparency has no fixed sign; it amplifies whatever the fundamentals already are. Pointed at a strong coin it is a stabilizer; pointed at a weak coin it is an accelerant.
The same model explains a phenomenon that looks like a contradiction until you have the result: opaque stablecoins can be more run-resistant, not less. “More precise private signals increase (reduce) the probability of a run when fundamentals are strong (weak), potentially explaining the stability of opaque stablecoins.” A coin that reveals little gives the marginal holder less to coordinate a run around when the underlying is shaky. This is not an argument for opacity — it is a warning that “I picked the transparent one” is not the guarantee it sounds like, and that reasoning purely from disclosure quality can select into more run risk precisely when you need the opposite.
This is not one paper’s idiosyncrasy; the result has independent, peer-grade confirmation. The BIS working paper on public information and stablecoin runs finds, from its own coordination-game setup, that “public information disclosure increases (reduces) run risk for sufficiently low (high) holders’ priors about reserve quality.” Same shape, derived independently: when holders already doubt the reserve — low priors — disclosure makes the run more likely. And the BIS paper names the trade-off a treasury should internalize: “transparency and quality of reserve assets have distinct effects on issuer failure risk. Our results point to a trade-off between peg stability and issuer fragility.” Transparency and reserve quality are two levers, not one; “more disclosure is more safety” collapses them into one and gets the direction wrong on a weak coin.
A treasury cannot manage this risk as a single blob called “depeg.” The global-game paper decomposes it, and the decomposition is the actionable part: the total run probability “can be decomposed into components representing risks from large sales and poor collateral.” Two different threats, two different mitigations. A coin can have impeccable collateral and still be tipped by a single large exit, because — the same paper shows — “the selling pressure on stablecoin holders increases in the presence of a large sale.” The pressure on remaining holders is not constant; it rises when a big holder leaves. That is how one large redemption tips a coin into a run, independent of whether the reserve was any good.
The second component removes the comfort of “but it’s fully backed.” Even high-quality reserves do not guarantee the peg under a large shock: “par convertibility is resilient to small shocks but fails with large negative public shocks to reserve asset values, even if they are initially high.” A treasury reasoning “this coin is fully reserved, therefore it cannot break” has assumed away exactly the tail event the run literature is about. Full backing is necessary and not sufficient; under a big enough shock to the reserve assets, par convertibility fails regardless.
The anchor-versus-amplifier split is real and load-bearing, and it would be dishonest to let it harden into “settle in a fiat-backed coin and you are fine.” The cleanest counter-evidence is a real event involving a real fiat-backed coin — an anchor by the taxonomy above. The Federal Reserve FEDS note on the Silicon Valley Bank failure and its impact on stablecoins documents the March 2023 USDC episode, and the numbers are the argument. “At its trough, USDC traded at 86 cents to the dollar” — roughly fourteen cents off par, in a single weekend, on a fiat-backed coin. The trigger was not bad collateral or an algorithmic spiral; it was that “Circle was unable to withdraw $3.3 billion of USDC reserves from SVB (around 8% of total reserves at the time).” A small slice of the backing became inaccessible, and that was enough to break the peg. The flight-to-quality finding and this loss are not in tension: anchors attract flight-to-quality relative to amplifiers, and can still take a double-digit hit in absolute terms.
The same event makes the contagion plumbing concrete. The depeg propagated through on-chain mechanisms: “over 400 million USDP were withdrawn from the PSM over this period, representing over half of USDP’s total outstanding supply.” A peg stability module one coin used to hold its own peg became the channel that drained a second coin — over half its entire supply pulled through another’s depeg. A treasury holding what it thought was an unrelated coin can be hit through smart-contract channels it never chose to be exposed to. And speed matters for an agent settling continuously: “redemption requests in the primary market for USDC rose sharply after the announcement that SVB was taken into receivership,” and they did so “ahead of Circle’s public acknowledgment that it was unable to access deposits at SVB.” The move is faster than the issuer’s own press release.
Two honest qualifications, so the argument is not read as more than it is. First, this is a description of a risk surface, not portfolio advice — nothing here recommends a specific coin, allocation, or hedge, and the right answer depends heavily on jurisdiction, counterparty, and the operator’s risk tolerance. Second, the scale is what makes it worth engineering against: the risk-mitigation work on the monetary ecosystem (arXiv 2510.10469) notes aggregate stablecoin market capitalization “surpassing USD 250 billion in 2025” — the size of the surface, not a forecast that any particular coin will break. The point is not “stablecoins are doomed.” It is that a treasury settling in one has taken on a measurable, design-dependent run risk the spend-rails checklist does not name.
The last temptation is to treat this as something a treasury can react to — watch the peg, exit when it slips. That does not work, for the same reason a bank run is not something you out-run from inside the queue. The risk-mitigation model is explicit that runs are an ex-ante structural problem: a workable architecture “integrating liquidity backstops and eliminating maturity-transformation channels… addresses run dynamics ex ante rather than through ad hoc intervention.” The failure mode — maturity transformation and missing backstops — has to be designed out before stress, not patched after a depeg starts. By the time the peg visibly slips, the queue has formed and the agent settling continuously is somewhere in it.
That same model, calibrated to the 2023 USDC event, shows the failure mode is a queue rather than only bad collateral: a properly-backstopped design “reduces peak peg deviations, shortens stress persistence, and stabilizes redemption queues under high redemption intensity.” Even a fiat-backed coin carries liquidity-run risk under stress unless it is backstopped. So for an agent the implication is not “monitor the peg and bail.” It is that the choice of settlement asset, and the buffer held against its tail, are design-time decisions made before any stress — the same posture the spend-rails layer takes toward a compromised agent. You do not negotiate with a run once you are in it; you size the exposure so being in one is survivable, with the anchor-versus-amplifier split and the 2-3x tail buffer already priced in.
So the settlement-asset decision belongs in the payment spec next to the spend ceilings, not in an ops runbook. Which coin the hot wallet settles in is a design choice with a tail attached: an amplifier design needs the larger buffer the capital-charge finding quantifies; reserve transparency is not a monotone safety signal; full backing does not make the peg unbreakable under a large shock; and continuous settlement means the agent cannot beat a slip it is too slow to react to. None of that is a research program — it is a handful of facts that change how the asset line of the design is reasoned about, from “stablecoin, therefore a dollar” to “a claim on a reserve, with a design-dependent tail the treasury now holds.”
Settling an agent in a stablecoin is the right call for the reasons the rail literature gives, but it quietly rewrites one line of the treasury: the unit the agent holds is a claim on a reserve, not a dollar, and that claim carries a design-dependent run risk — anchored for fiat-backed coins, amplified for the rest, breakable even when fully backed, and not made safer by transparency when fundamentals are weak. The spend ceilings bound what a compromised agent can lose; none bound what a depeg does to the asset every payment is denominated in. Put the settlement asset on the design page next to the ceilings, size the tail before the stress, and stop treating the dollar on the label as the dollar in the wallet.
A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.
17 min →
Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.
14 min →
The EU AI Act requires AI output to be marked in a robust, reliable way. A formal impossibility theorem says strong watermarking cannot exist. Five words in the statute carry the collision.
13 min →