Hook
We didn—
That's how the incident note began, and it ended the same way. With a fragment. A risk desk at a mid-sized Zurich fund ran a routine Sunday sweep across eleven analytics endpoints: three lending markets, four DEX depth feeds, two bridge flow monitors, a staking yield index, a stablecoin peg tracker. Ten returned JSON. The eleventh returned a schema-valid object with zero rows and an HTTP 200. No timeout. No revert. No alert fired, because no alert had ever been written for "successfully returned nothing."
The on-call engineer logged it as a quiet weekend and went back to brunch.
Six days later the same endpoint was still returning nothing. By then it didn't matter. The pool it was built to watch had already bled 40% of its liquidity providers — quietly, in slices small enough to stay under every threshold anyone had bothered to set.
The bug wasn't in the protocol. It wasn't in the contract that moved the money. It was in the layer that was supposed to tell someone the money had moved.
That's the whole thesis. Everything below is forensics.
Context
Crypto has rebuilt its observability stack three times and let it rot three times. The pattern is mechanical enough to model.
In 2017 the entire industry ran on Etherscan and a shared spreadsheet. That was sufficient because there were maybe forty things worth watching. In 2018 the winter arrived, tooling budgets evaporated, and the dashboards went stale — nobody noticed, because nobody was trading. In 2020, DeFi Summer forced the issue: The Graph, subgraphs, a thousand half-finished indexers, all thrown together in six months by people paid in tokens that were going up. In 2021 dashboards became status symbols. A fund's sophistication was measured by how many panels it could fit on a screen. In 2022, after Terra, analytics stopped being vanity and became triage.
Then 2025 happened. Regulatory frameworks solidified. I spent that year consulting for three Swiss banks entering the space, and what they wanted was not alpha. They wanted audit trails. They wanted every number in a board deck to have lineage — source, timestamp, transformation, hash. It was the most rigorous the observability layer had ever been, and it was funded by compliance budgets rather than conviction.
Now it's 2026. The compliance budgets survived. The conviction budgets didn't. The indexers are still running. The endpoints are still live. The people who built them were let go in the last two rounds.
The infrastructure of truth is now unmaintained infrastructure. And unmaintained infrastructure fails in the one way nobody is trained to look for.
Worth being concrete about what the stack actually is, because "the data" is a lazy phrase. There are three layers. A node or RPC layer that answers questions about state. A transform layer — indexers, subgraphs, ETL jobs — that turns answers into tables. And a presentation layer that flattens all of it into a number a human will act on. Failure can originate anywhere. Truth dies at the third layer, because that's where everything gets compressed into something that fits on a panel.
Core
Let's get precise about failure modes, because the distinction is the entire point.
A loud failure announces itself. A contract reverts, an RPC returns 500, a subgraph lags and a red banner appears. Loud failures are cheap, because they're legible — they map onto the human instinct to investigate things that look broken.
A silent failure looks like calm. It returns the right status code, the right content type, the right top-level keys. It is structurally indistinguishable from a genuinely quiet market. In a bear market, "genuinely quiet" is the default state, which means the disguise is perfect.
Here's the check almost nobody runs, and I've been writing versions of it since 2017:
def assert_absence_is_real(response, ctx, window="6h"):
if response.status == 200 and len(response.rows) == 0:
expected = ctx.baseline_activity(window)
if expected.p95 > 0 and response.endpoint.last_write > window:
raise SilentFailure(endpoint=response.endpoint,
expected=expected.p95,
observed=0)
return responseThe logic is trivial. The discipline is not. You have to assert that a null is wrong before you can trust that a null is true. Most stacks never encode that assertion, because in a bull market a null is rare enough that it looks like an error on its own. The bear market removes that accidental protection.
I have seen this exact class of bug before, and it cost real money.
In 2017 I spent a full day on forensic work over the Golem network's pre-sale contracts — an applied-math background, a copy of the distribution algorithm, and a lot of coffee. I found three logic flaws in the token distribution math. The output of that algorithm was arithmetically valid. Every number satisfied its constraints. It would have passed any schema check ever written. It would also have inflated supply in a way no dashboard would have flagged, because the dashboard would have been reading the same valid, well-formed, catastrophic numbers.
Code is law, but liquidity is truth. And liquidity doesn't announce its departure. It just stops showing up in the rows.
Terra is the same lesson at a thousand times the scale. For eleven days in May 2022 I watched the UST peg feed stay technically live while the mechanism underneath was already dead. The oracle wasn't lying. It was reporting a price a shrinking pool could still theoretically support. The failure was never in the feed. It was in the assumption layer — the shared belief that a live feed implies a live market. I wrote ten thousand words about it and titled it "The Mathematics of Delusion," and the core argument was never about stablecoin design. It was about how long a system can keep producing valid-looking outputs after it has stopped being true.
Behavioral data fails the same way, and it's harder to catch because there's no schema for it. In 2021 I built a Resonance Index for BAYC — not floor price, but social capital: how many verified celebrity wallets, how concentrated the holder graph was, how fast new entrants were being absorbed into existing clusters. It called the top weeks early. The reason it worked wasn't cleverness. It measured the thing that decays first — attention — rather than the thing that decays last, price. In a bear market, attention data goes toward zero long before volume does. An attention index returning near-zero is correct. An attention index returning exactly zero, for six days, across every cohort, is a pipeline problem. The difference is one decimal place, and it's worth more than every other number on the screen.
That's the thing about bear markets nobody puts in the risk framework. In a bull market, absence of data is loud, because absence is anomalous. In a bear market, absence of data is invisible, because absence is the baseline. Signal-to-noise collapses from the bottom, not the top. You don't lose the ability to see big moves. You lose the ability to distinguish "nothing happened" from "nothing is being recorded."
And the observability layer is thinning for the same reason the market is. Post-Dencun, rollups have been batching into blobs — cheap, elegant, and on current trajectory temporary. Blobspace saturates, and when it does, every rollup's gas economics gets rewritten again. Every time the cost structure of a chain changes, the analytics built on top of the old structure goes quietly wrong. Not broken. Wrong. The pipeline still runs. It just measures a world that no longer exists.
Liquidity pools don— that's the sentence I keep starting and never finishing, because the ending changes every cycle. Pools don't lie. They just stop being deep enough to mean anything. A TVL figure on a dashboard is a photograph of a subsidy. When the emissions taper, the photograph stays on the wall. The endpoint keeps returning rows. The rows keep getting smaller. Nobody alerts on "smaller."
Contrarian
Here's the angle that will get me argued with, which is how I know it's worth saying.
The consensus bear-market risk model is a price model. Drawdown, liquidation cascades, macro correlation, funding rates. All of it assumes the risk lives in the number going down.
The actual risk is that the number stops existing and nobody notices. This cycle's systemic exposure is not leverage. It's observability. The protocols that will hurt the most people are not the ones with the worst tokenomics. They're the ones whose monitoring was maintained by a team that got cut, sitting behind an endpoint that still returns 200.
And there's a second-order problem the decentralization crowd refuses to price. "Decentralized data" is a slogan, not an architecture. A handful of RPC providers and indexer operators serve the overwhelming majority of reads across the industry. The chain is decentralized. The view of the chain is not. When four entities can return a null and nobody holds a second source to compare against, you have not decentralized truth. You have distributed the illusion of it.
I said something adjacent in 2020, when I was modeling Uniswap V2's geometric mean and arguing that permissionless liquidity made traditional market makers obsolete. I was right about the mechanism and naive about the measurement. The mechanism was permissionless. The data about the mechanism was, and remains, permissioned by whoever runs the indexer.
Takeaway
So build the boring thing. Write the alert that fires on absence, not on error. Assert that a null is wrong before you accept that it's true. Cross-source every number a human will make a decision with, and treat a single-source feed as an unhedged position.
The question worth sitting with isn't "is my protocol safe." It's this: if my protocol stopped being safe tonight, what would I actually see — and who built the thing that shows me?
If the answer is "a dashboard someone stopped paying for," you already know the answer.