DeFi Developer Liability After Ooki DAO: Protocol Builder Responsibilities Under US Law in 2026

If you write smart contracts that power a DeFi protocol, you may be personally liable under US law — even if the protocol is governed by a DAO and runs on immutable code. That is the central lesson of CFTC v. Ooki DAO, and every DeFi developer, governance participant, and protocol founder operating in or serving the US market needs to understand its full implications.

The default judgment in CFTC v. Ooki DAO, No. 3:22-cv-05416 (N.D. Cal. June 9, 2023), established three principles that restructured the DeFi developer liability landscape: a DAO can be treated as a legal person subject to federal enforcement, governance token holders can bear personal liability for the DAO’s regulatory violations, and “decentralization” does not immunize protocol operators from the Commodity Exchange Act. Since that ruling, federal prosecutors, the CFTC, private plaintiffs, and state regulators have continued expanding the legal theories under which DeFi developers face exposure — creating obligations that demand serious legal attention.

Key Takeaways

• Developers face personal liability across multiple legal theories. Building and deploying smart contracts that facilitate regulated financial activity can trigger liability under the Commodity Exchange Act (7 U.S.C. § 1 et seq.), federal securities laws (15 U.S.C. §§ 77a, 78a et seq.), the Bank Secrecy Act (31 U.S.C. § 5311 et seq.), and state money transmission statutes — regardless of whether a legal entity exists.
• Without a legal wrapper, DAOs default to general partnerships. Under the Revised Uniform Partnership Act, adopted in most US states, a group of persons carrying on a business for profit is presumed to be a general partnership. RUPA § 202(a). Every partner faces joint and several liability for partnership obligations. RUPA § 306(a).
• The “I just wrote the code” defense is legally insufficient. Both Ooki DAO and the Tornado Cash criminal prosecution (United States v. Storm, No. 1:23-cr-00430, S.D.N.Y.) demonstrate that courts and prosecutors look at conduct — designing, deploying, maintaining, marketing, and profiting from a protocol — not merely at whether a person “controlled” the code post-deployment.
• The regulatory posture is shifting but not retreating. The SEC under Chairman Paul Atkins has signaled a more constructive approach, but the CFTC remains aggressive on DeFi enforcement, private class action plaintiffs face no such constraints, and state regulators continue pursuing unlicensed money transmission claims independently.
• Proactive compliance is the only viable risk-reduction strategy. Legal wrappers, regulatory function analysis, contributor agreements, and — where full compliance is not feasible — effective geographic restrictions are baseline requirements, not optional precautions.

What Did CFTC v. Ooki DAO Actually Hold?

The Ooki DAO case originated as a CFTC enforcement action against bZx Protocol and its co-founders, Tom Bean and Kyle Kistner, who settled individually — paying civil monetary penalties and accepting trading bans. See CFTC Docket No. 22-31 (Sept. 22, 2022). The CFTC then took the unprecedented step of naming the DAO itself as a separate defendant, alleging that Ooki DAO operated as an unregistered futures commission merchant and offered illegal off-exchange leveraged and margined retail commodity transactions in violation of 7 U.S.C. §§ 6(a) and 6d(a).

The DAO did not appear or defend. Judge William Orrick of the Northern District of California entered default judgment, holding:

1. A DAO is a legal “person.” Ooki DAO operated as an unincorporated association under California Corporations Code § 18015 et seq., making it a legal person subject to the CEA. The court rejected the implicit argument that a DAO’s decentralized structure places it outside the reach of federal regulation.
2. Service via governance forum was constitutionally adequate. Under Fed. R. Civ. P. 4(h)(2), service on an unincorporated association may follow state law procedures. The court accepted that posting a notice in the DAO’s governance forum — the primary channel through which DAO members communicated — satisfied due process.
3. Governance participation creates liability exposure. Token holders who voted on governance proposals were participants in the unincorporated association. The court specifically noted that token holders voted to transfer the protocol from the corporate entity (bZx) to the DAO structure — a decision that itself constituted carrying on business as an association.

The court imposed a permanent injunction and ordered civil monetary penalties, effectively shutting down the protocol’s US-facing operations.

A critical caveat: Ooki DAO was a default judgment. The DAO never appeared, no adversarial briefing occurred, and the court’s legal conclusions were not tested by opposing argument. Future courts are not bound by this reasoning, and a contested case could produce different results. That said, the default judgment remains the most direct federal court statement on DAO liability, and regulators treat it as persuasive authority.

Federal Theories of DeFi Developer Liability

DeFi developer liability under federal law arises through several overlapping frameworks. Each creates distinct obligations and distinct risks.

Commodity Exchange Act (CFTC)

The CFTC has asserted jurisdiction over DeFi protocols that offer derivatives, leveraged trading, or margined transactions involving digital commodities. The CFTC considers Bitcoin, Ether, and most digital assets to be “commodities” under 7 U.S.C. § 1a(9). See CFTC Chairman Rostin Behnam, Statement on Digital Asset Commodities (Oct. 2022).

Developers who build protocols offering swaps, perpetual futures, or leveraged positions without registering as a designated contract market (DCM) under 7 U.S.C. § 7 or swap execution facility (SEF) under 7 U.S.C. § 7b-3 risk direct enforcement. After Ooki DAO, the CFTC has demonstrated willingness to pursue individual contributors, the DAO governance structure, and the protocol entity simultaneously.

Federal Securities Laws (SEC)

Developers who create and distribute governance tokens may face liability as issuers of unregistered securities under the Securities Act of 1933, 15 U.S.C. § 77e, if those tokens constitute “investment contracts” under SEC v. W.J. Howey Co., 328 U.S. 293 (1946). Beyond direct issuer liability, two additional theories are particularly relevant to DeFi developers:

• Control person liability. Under Securities Exchange Act § 20(a) (15 U.S.C. § 78t(a)), any person who “controls” a person liable under the Exchange Act is jointly and severally liable — unless the control person acted in good faith and did not induce the violation. Lead developers or founding teams may be deemed control persons of a protocol entity or DAO.
• Aiding and abetting. Under § 20(e) (15 U.S.C. § 78t(e)), any person who knowingly or recklessly provides substantial assistance to a securities law violation can be liable. A developer who writes smart contract code that facilitates an unregistered securities offering could face aiding and abetting claims from the SEC (though private plaintiffs generally cannot bring aiding and abetting claims under Central Bank of Denver v. First Interstate Bank, 511 U.S. 164 (1994)).

The Samuels v. Lido DAO class action (N.D. Cal., filed Dec. 2023) tested these theories in the private litigation context — alleging that Lido’s LDO governance token is an unregistered security and that DAO participants, including venture investors, are liable as members of a general partnership. While the SEC has moderated its enforcement posture under Chairman Atkins, private class actions face no such restraint.

Bank Secrecy Act and Money Transmission (FinCEN)

Under the BSA’s implementing regulations, a “money transmitter” includes any person who accepts and transmits currency or value that substitutes for currency. 31 C.F.R. § 1010.100(ff)(5). FinCEN’s 2019 guidance, FIN-2019-G001 (May 9, 2019), clarified that persons who operate convertible virtual currency systems may qualify as money transmitters even if the system is decentralized — looking at the “facts and circumstances” of operation, not the architecture.

The criminal prosecution of Tornado Cash developer Roman Storm — United States v. Storm, No. 1:23-cr-00430 (S.D.N.Y.) — tested the outer boundary of this theory. Among the charges: operating an unlicensed money transmitting business under 18 U.S.C. § 1960. The fundamental question raised was whether a developer who writes code that autonomously transmits value “operates” a money transmitting business. This case has direct implications for every DeFi developer building protocols that facilitate token transfers.

The Open Source Software Defense — and Its Limits

DeFi developers frequently argue that writing and publishing open source code is protected speech under the First Amendment, and that a developer who merely publishes code bears no responsibility for how third parties deploy or use it. This argument has intuitive force — nobody sues the author of a textbook on chemistry for a reader’s illegal synthesis — but its legal viability in the DeFi context is limited.

The distinction courts and regulators draw is between publishing code and operating a service. A developer who writes a smart contract, publishes the source on GitHub, and walks away occupies a very different legal position than a developer who deploys that contract, operates a frontend, markets the protocol, governs it through token voting, and collects fees. Most DeFi developers do the latter, not the former.

The Fifth Circuit’s decision in Van Loon v. Department of the Treasury, No. 23-50669 (5th Cir. Nov. 26, 2024), acknowledged this distinction in the sanctions context — holding that Tornado Cash’s immutable smart contracts are not “property” of a foreign national sanctionable under IEEPA (50 U.S.C. § 1705), because the contracts operate autonomously and no person controls them. But the court’s reasoning cuts both ways: it distinguishes the code from the persons who created and profited from it. Developers remain liable for their conduct even when their code is autonomous.

Developers who want to invoke an open source defense should ask: after deployment, did I maintain a frontend? Market the protocol? Participate in governance? Collect fees or token distributions? If the answer to any of these is yes, the open source defense is substantially weakened.

State Law Exposure

Federal enforcement captures the most headlines, but state law creates substantial additional exposure for DeFi developers:

• Money transmitter licensing. At least 49 US states and the District of Columbia require some form of money transmitter license. DeFi protocols that facilitate the transfer of digital assets may trigger licensing obligations in every state where users reside. Operating without a license is a felony in several states, including New York (N.Y. Banking Law § 641).
• General partnership and joint liability. As noted above, DAOs without legal wrappers default to general partnerships, exposing every participant — including developers who receive governance tokens — to joint and several liability for the DAO’s debts and obligations.
• Negligence and product liability. Smart contract exploits that cause user losses could give rise to negligence claims under state tort law. Whether a smart contract constitutes a “product” subject to strict liability under the Restatement (Third) of Torts: Products Liability § 19 remains an open question — but one that will inevitably be litigated as exploit losses mount.
• State consumer protection (UDAP). State attorneys general wield broad enforcement authority under unfair and deceptive acts and practices statutes. These statutes typically do not require proof of intent, making them a lower bar for regulators than federal fraud claims.

Practical Implications and What to Do Now

The DeFi developer liability framework is not hypothetical — it is actively enforced. The following steps represent baseline risk management, not optional best practices:

1. Form a legal entity before deployment. A Wyoming DAO LLC (Wyo. Stat. § 17-31-101 et seq.), Delaware LLC, or offshore foundation company (often a Cayman or BVI structure for international operations) should hold protocol IP, enter contributor agreements, and serve as the compliance interface. The Ooki DAO decision makes operating without any legal wrapper an unjustifiable risk.
2. Conduct a regulatory function analysis. Before deployment, analyze every protocol function against the CEA, federal securities laws, BSA/FinCEN rules, and applicable state money transmission statutes. Leveraged trading, swaps, lending pools, and token swaps each carry distinct regulatory triggers. Document this analysis — it demonstrates good faith and can negate the “willfulness” element of many federal penalty provisions.
3. Execute contributor agreements. Every developer, auditor, and material contributor should have a written agreement clarifying their role, scope of contribution, and relationship to the protocol’s operation. Properly structured, these agreements establish that contributors are independent contractors — not partners in an unincorporated association exposed to joint liability.
4. Separate governance from operations. Design governance so that token voting controls protocol parameters (fee rates, collateral ratios, deployment of reserves) rather than operational decisions that create agency relationships. Document the distinction. A governance token holder who votes on fee schedules presents a different liability profile than one who votes to deploy protocol funds to a specific counterparty.
5. Implement effective geographic restrictions if you cannot comply. If full US regulatory compliance is not feasible, implement IP-based geofencing, wallet screening against US-linked addresses, and clear terms of service prohibiting US person access. Geofencing alone does not eliminate liability — but it demonstrates compliance intent and can reduce enforcement priority.
6. Obtain written legal opinions. For any protocol function arguably within a regulated category, obtain a written opinion from qualified US counsel. A reasonable-basis legal opinion can negate willfulness and serve as a good-faith defense in enforcement proceedings.
7. Monitor legislative developments. The status of pending legislation — including any market structure bill that may clarify CFTC and SEC jurisdiction over DeFi — could materially change developer obligations. Stay current through counsel.
8. Evaluate D&O and professional liability insurance. Emerging insurance products tailored to DeFi operations can offset some litigation risk. Review coverage options as part of an overall risk management framework.

Conclusion

The era of building DeFi protocols in a US regulatory vacuum is over. CFTC v. Ooki DAO established that federal regulators can pursue DAOs, governance participants, and individual developers for violations of the Commodity Exchange Act. The Tornado Cash prosecutions extended that logic into criminal law. Private class actions like Samuels v. Lido DAO demonstrate that even if federal agencies moderate their posture, plaintiffs’ attorneys will not. And state money transmission laws create an independent layer of exposure that decentralization does not address.

DeFi developer liability is the current state of US law — not a theoretical risk. The developers and protocols that will survive regulatory scrutiny are those that treat compliance as an engineering requirement, form proper legal structures, and engage experienced counsel before deployment. Decentralization is a valuable design principle, but it is not a legal shield.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.