1
November 12, 2024. Bangkok. Devcon 7.
Outside, it was 33 degrees Celsius. Through the glass doors of the Queen Sirikit National Convention Center (QSNCC), the air-conditioning hit first. The tropical humidity lifted in an instant; in the lobby, chilled air mingled with the body heat of thousands to create a strange in-between climate. Beyond the glass, tuk-tuk engines and Bangkok's signature gridlock carried on, but inside was another world. An atrium flooded with natural light, tropical plants stationed throughout, six main stages and workshop spaces sprawling across the QSNCC—Southeast Asia's largest convention facility—in a venue that lived up to its reputation. Twelve thousand five hundred people had gathered. The biggest Devcon in history.
The attendees' attire followed a pattern. Hoodies, black T-shirts, laptop bags slung crossbody—developers. The occasional venture capitalist in a suit mixed in, though in this space a suit was the thing that looked out of place. Energy drink cans and MacBooks covered every available surface, and even before the event began, Slack channels and Telegram groups were circulating side-event schedules. Among the crowd wearing lanyards with conference badges, stickers and merchandise bearing the Ethereum logo passed from hand to hand.
Onstage, Vitalik Buterin advanced a slide. His black T-shirt had a cat illustration on it, and sandals peeked out below his jeans. On the screen behind him: "Ethereum in 30 Minutes"—his traditional opening session, repeated at every Devcon.
Buterin's delivery was rapid and monotone. Almost no gestures. His hands stayed mostly in his pockets or resting in front of his laptop. He did not follow the conventions of presentation. He did not need to. The vision he had carried since writing the Ethereum white paper in 2013, at the age of nineteen—a Turing-complete blockchain, a world computer capable of executing any contract as code—had, a decade later, become a protocol ecosystem worth more than $40 billion.
Buterin began by looking back at Ethereum's evolution. He discussed the achievements of the Proof of Stake transition and highlighted the cost reductions enabled by Layer 2 solutions. "This year, Layer 2 fees dropped from fifty cents to under 0.1 cents." This single sentence, delivered in his matter-of-fact tone, drew applause from the audience. He went on to describe how Optimistic Rollups and ZK Rollups were fundamentally transforming Ethereum's scalability.
Then the slide changed, and Buterin began talking about the transition from smart contracts to autonomous agents.
Smart contracts are deterministic, he explained. Same input, same output—that is both their strength and their limitation. Executing rules and choosing rules are different capabilities, he continued.
Laptop screens across the audience lit up in unison. Some people typed; others hit the record button. A developer in the front row posted to Twitter in real time. "Vitalik just said: executing rules vs. choosing rules—different capabilities." Seconds later, retweets numbered in the hundreds. Thousands of screens inside the convention hall flickered blue, and smartphone flashes fired from all directions as people photographed the presentation screen. Bangkok's tropical night air waited beyond the glass walls, but the air inside was cold and dry, like a server room.
Buterin said the next step was agents. Autonomous code that reads market conditions, selects strategies, and executes them. If smart contracts represented the stage of "code is law," then agents represent the transition to the stage where "code judges." He did not deliver this sentence with any particular emphasis. He moved past it as dryly as any other item on a technical roadmap. Yet what the sentence implied was a declaration: the function that humans had monopolized in capital allocation—judgment—would be delegated to code.
During the Q&A, someone took the microphone. "If agents are making judgments, who bears responsibility when those judgments are wrong?" Buterin paused for a moment before answering. "Good question, and we don't have a complete answer yet." It was an honest reply. A quiet murmur rippled through the 12,500-strong audience. The sound of laptop keyboards accelerated in unison once more.
2
Before Buterin arrived at that declaration, there had been one shock.
On April 30, 2016, an experiment called the DAO—Decentralized Autonomous Organization—went live on the Ethereum network. An investment fund with no board of directors, no CEO, and no headquarters. Participants deposited Ether (ETH) and received voting rights; investments were decided by vote. The code was the articles of incorporation, the code was the management team, and the code was the enforcer.
When the crowdfunding opened, the global Ethereum community responded. A twenty-eight-day token sale. In the first week, $50 million poured in. By the second week, it surpassed $100 million. More than 11,000 participants sent Ether. On Reddit's r/ethereum subreddit, dozens of DAO-related posts went up every day. The excitement of "an investment fund without banks is possible" swept the community. The final haul was approximately $150 million—3.54 million ETH. That was 14 percent of Ethereum's entire market capitalization at the time. It was one of the largest crowdfunding campaigns in history. The sheer fact that an investment fund run solely on code had attracted that much capital revealed just how powerful the desire for capital allocation without gatekeepers truly was.
But the code had a hole.
On June 17, 2016, someone began draining funds by exploiting a reentrancy vulnerability in the DAO's smart contract. The simplest analogy for a non-specialist is a bank teller window. Imagine you are withdrawing one million won at the counter. Under normal procedure, the teller hands you the cash and then debits one million won from the ledger. But what if, at the very moment the teller hands over the money—just before the debit is recorded in the ledger—you could say, "Hold on, I'd like to withdraw another million won"? The ledger has not yet reflected the first withdrawal, so it shows a sufficient balance. Repeat. Once, twice, three times—withdrawing over and over before the ledger updates. The DAO's reentrancy vulnerability was exactly this structure. The withdrawal function called an external contract before deducting the balance, and that external contract could call the withdrawal function again, creating a loop.
You could call it a hack, or you could call it a legitimate execution in accordance with the code's rules. The attacker had not violated the terms of the contract. The attacker had performed an action that the terms of the contract—the code—permitted.
Sixty million dollars drained out.
The Ethereum community split in two. Reddit became a battlefield. Hundreds of posts went up within a single day on r/ethereum and r/ethtrader. On the Ethereum Forum (forum.ethereum.org), "Code is Law" advocates and hard-fork proponents filled threads with hundreds of comments. One side called for a hard fork—rolling back the blockchain's record to restore the state before the attack. The other side refused. If "Code is Law" was Ethereum's principle, then retroactively voiding an action the code had permitted was a negation of that very principle. The mood grew more heated with every passing hour. Anonymous accounts sorted one another into "centralists" and "purists," and personal attacks and conspiracy theories ran rampant. A whitehat hacker group launched a counter-operation to preemptively drain the remaining funds using the same vulnerability. It was chaos.
Buterin supported the hard fork. His blog post was short but carried weight. His logic was that the principle of code as law should be maintained, but when the code contained an obvious flaw, the community must be able to intervene. A soft fork was proposed first—blacklisting the attacker's address and freezing the funds. But the soft-fork code itself was found to contain a new vulnerability, and the hard fork became the only remaining option.
July 20, 2016. Block 1,920,000. The hard fork was executed. Approximately 12 million ETH was transferred from the "Dark DAO" and "Whitehat DAO" contracts into a recovery contract. Ethereum split in two—Ethereum (ETH), which accepted the hard fork, and Ethereum Classic (ETC), which rejected it. The irony was that those who insisted on upholding "Code is Law" became the minority, and the side where community consensus overrode the code became the mainstream.
The incident left Buterin with more than a technical lesson. Code can execute rules, but when those rules are wrong, it cannot correct itself. In a world where "code is law," who sets things right when the law is unjust? Humans do. At least, that was the case in 2016. When Buterin said "code judges" from the stage in Bangkok eight years later, the memory of 2016 must have been layered into that sentence. If code goes so far as to judge, where should the human stand when those judgments go wrong?
3
In the same year Buterin unveiled his roadmap in Bangkok, Lee Junhyeok was staring at a terminal window in a co-working space in Pangyo, south of Seoul.
A seven-minute walk from Exit 2 of Pangyo Station. The district branded "Pangyo Techno Valley" is Korea's Silicon Valley, where the glass towers of Naver, Kakao, and NCSoft stand in a row. Lee Junhyeok's co-working space, however, was not in one of those glass towers but on the third floor of a five-story neighborhood commercial building wedged between them. The thin walls failed to absorb sound, and phone conversations from the office next door leaked through.
Two twenty-seven-inch monitors. The left screen was dense with Python code; the right screen scrolled Ethereum testnet transaction logs in real time. On his desk sat two empty instant-noodle cups and a tumbler. His workspace smelled of instant noodles. Through the co-working space windows, Pangyo Techno Valley's glass buildings caught the late-autumn sun and glinted, but he was not looking outside.
Lee Junhyeok was building a DeFi liquidity optimization agent. An autonomous system that analyzes funds scattered across multiple protocols in real time and automatically allocates them to whichever offers the highest yield. The tasks that humans had done manually—checking Aave's supply interest rates, comparing Uniswap's liquidity pool fees, calculating gas costs, and moving funds—would be handled by AI. This was not simple automation. The agent learned from market data, derived strategies from historical patterns, and revised those strategies when conditions changed.
He had graduated from KAIST (Korea Advanced Institute of Science and Technology) with a degree in computer science, spent three years working as a machine learning engineer in Silicon Valley, and then returned to Seoul. At a big-tech company in Cupertino, he had been on the recommendation algorithm team. He built models that decided which content to show and in what order, based on data from hundreds of millions of users. He checked the dashboard every day and confirmed that the model predicted user preferences more accurately than human curators. Click-through rates, dwell time, conversion rates—on every metric, the algorithm outperformed humans. At the same time, he saw the biases the algorithm produced. Popular content got more exposure and less popular content was buried, a rich-get-richer dynamic. Within the team, diversity metrics to mitigate the "filter bubble" were discussed, but whenever the core KPI—engagement—dipped, his superiors grimaced.
One night in his third year, Lee Junhyeok looked up at the California sky after coding until dawn. Teslas and Google commuter buses rolled down El Camino Real in Palo Alto. He thought: if a recommendation algorithm can allocate content, why not capital? Replace the slowness, inefficiency, and bias of human gatekeepers with code. If the data is sufficient and the objective function is clear, code can make better decisions than humans. The idea never left him. Six months later, he handed in his resignation.
To those who asked why he had come back, he answered briefly. "There's something I want to build." That the "something" was unbiased capital allocation was known only to the two co-founders he had started the company with. To his parents he said only "a blockchain-related startup." His mother asked, "Is that like Bitcoin?" and Lee Junhyeok smiled and replied, "Something similar, but a little different." His father said nothing—but that silence was familiar, the silence of a man who had wanted his son at Samsung or Hyundai.
He ran hundreds of simulations of the agent on the testnet. The results were consistently strong. Annualized returns ran 3 to 7 percent higher than the manually operated benchmark, and rebalancing speed was incomparably faster. The problem was the distance between simulation and reality. On a testnet there is no real money, no real fear, and no real liquidity crisis. There is no slippage, no front-running bots, and nothing to lose when a transaction fails. Lee Junhyeok had seen perfect backtested strategies crumble in production multiple times during his years in Silicon Valley. It happened with recommendation algorithms too. A model that performed flawlessly in A/B testing would collapse at unforeseen edge cases once deployed to the full user base. Whether he knew the lesson of LTCM, I cannot say—the story of a model designed by two Nobel laureates that buckled in the face of reality.
Still, Lee Junhyeok did not stop. Every time he looked at the simulation results, conviction stirred in him again, the same conviction he had carried since sitting in front of the dashboard in Cupertino. The algorithm could do what he had seen it do with content. Only this time, it was not content but money. How vast that difference was, he did not yet know.
4
2024 was the year AI agents and blockchain met for the first time.
Strictly speaking, both technologies had existed independently before. Blockchain had evolved for fifteen years since Bitcoin's inception in 2008, and AI had crossed the threshold of commercialization with the emergence of large language models in 2022. But it was in 2024 that the two technologies began converging toward a single objective: autonomous capital allocation.
The logic of the convergence was straightforward. AI had a brain but it had no way to act on its conclusions. It could not open a bank account, place an order at a brokerage, or sign a legally binding contract. Blockchain was the opposite. It possessed the execution machinery of smart contracts but lacked a brain capable of deciding which rules were optimal. AI's weakness was blockchain's strength, and blockchain's weakness was AI's strength. Combine them, and "judgment without humans" meets "execution without intermediaries."
Lee Junhyeok devoured every white paper from competing projects he could find. He did not leave his seat. Partly to validate his own agent's design, partly to map where the market was heading.
The white papers uniformly trumpeted grand visions. Fetch.ai had merged with SingularityNET and Ocean Protocol to form the ASI Alliance, whose combined market capitalization briefly reached $7.5 billion. Lee Junhyeok did not take announcements like "millions of registered agents" at face value. He had run hundreds of bots on testnets himself. There was inevitably a gap between registration counts and actual autonomous decision-making. His intuition proved correct. The ASI Alliance later suffered internal fractures. Ocean Protocol withdrew, and lawsuits followed. The mergers and splits of human organizations repeated themselves in token ecosystems just the same.
Autonolas (Olas) caught his eye. On some days, over 75 percent of Safe transactions on Gnosis Chain were generated by Olas agents. By early 2025, agent transactions surpassed three million. Market capitalization of roughly $80 million—not a flashy number, but the difference was that agents were actually operating on-chain. Lee Junhyeok valued what he could verify. Not a white paper's promises but transaction records on a blockchain. That alone constituted evidence.
Virtuals Protocol designed a commerce standard (ACP) in which agents delegate tasks to other agents and pay for the service. ai16z—later renamed ElizaOS—was a DAO in which AI made the investment decisions of a venture capital fund. By late 2024, its token market capitalization reached $2 billion. Analysts projected the AI agent market would grow from $5.1 billion to $47.1 billion in a single year.
Reading through the white papers, Lee Junhyeok confirmed two things. One: dozens of teams around the world were moving in the same direction he was. Two: the figures most of them disclosed were self-reported and had not undergone independent auditing. His own face, lit by the monitor, overlapped with his reflection in the window glass. The nightscape of Pangyo Techno Valley glittered behind it, but his eyes were fixed on the numbers in his spreadsheet. That there were many competitors meant there was a market, but it also meant that most of them would disappear.
The market reacted to those self-reported figures. The market capitalization of AI agent-related tokens ballooned in Q4 2024 and then contracted sharply. The price of Virtuals Protocol's VIRTUAL token was the most dramatic case. Starting from a low of $0.02 in July 2024, it reached an all-time high of $5.07 on January 2, 2025. A 250x rise. As of March 2026, it hovered around $0.65—an 87 percent decline from the peak. The pattern was familiar to anyone who had been watching. It happened with the internet bubble, it happened with the DeFi bubble: expectations outran reality, and a correction followed. DeFi tokens that peaked in 2021 fell 80 to 90 percent in 2022, yet the infrastructure built on top of those protocols did not vanish. Uniswap kept working, and Aave's lending pools endured. What mattered was whether the technology survived after the bubble burst. Just as Google and Amazon survived the wreckage of the dot-com bubble, what would emerge from the debris of the AI agent bubble remained too early to judge.
Lee Junhyeok resolved to be on the side that survives. Through code, not white papers. Through on-chain records, not disclosures. That resolve pushed him toward the next step: mainnet deployment.
5
Lee Junhyeok deployed his agent to the mainnet in early 2025.
Not the testnet but the actual Ethereum network. Real USDC, real ETH, real money in motion. The initial capital was modest. His own funds combined with contributions from his two co-founders totaled $50,000. An amount he could absorb if lost. That is what he told himself. He woke up at four in the morning twice to check Etherscan, which cast doubt on the truth of that claim.
The agent's architecture was as follows. A data-collection layer that gathered market data, an inference layer that generated strategies, and an execution layer that carried out transactions—all separated. The inference layer was powered by a reinforcement learning model, and its objective function was the maximization of risk-adjusted returns. Sharpe Ratio, Maximum Drawdown, Liquidity Depth—three metrics served as terms in the objective function. The execution layer's signing authority was isolated inside a TEE (Trusted Execution Environment). A TEE is a hardware-level protected enclave; from the outside (even Lee Junhyeok himself) there was no direct access to the private keys. Trust was delegated not to a person but to hardware. From an age in which a wax seal vouched for the signer's identity, to an age in which a hardware chip vouches for the integrity of the code.
On the morning of the first day of mainnet deployment, Lee Junhyeok sat before his terminal and pressed Enter. The deployment script executed, and a transaction was broadcast to the Ethereum mainnet. A gas estimate appeared on screen, followed by a confirmation prompt. One more Enter. The wait for block inclusion—twelve seconds—felt like twelve minutes.
The logs began to scroll.
`
CYCLE 001 | 2025-01-xx 09:00:12 UTC
SCAN: Aave V3 USDC supply APY 4.2%
SCAN: Uniswap V3 USDC/ETH pool fee APY 11.8%
SCAN: Compound V3 USDC supply APY 3.9%
SCAN: Curve USDC/USDT pool fee APY 5.1%
EVAL: Risk-adjusted return maximized at 60/40 split (Aave/Uniswap)
EVAL: Sharpe ratio estimate: 2.14 | Max drawdown estimate: -4.7%
ACTION: Supply 30,000 USDC to Aave V3
TX: 0x7a3f... | Status: Success | Gas: 142,387 | Cost: $1.72
ACTION: Provide liquidity 20,000 USDC + ETH equivalent to Uniswap V3
TX: 0x8b2e... | Status: Success | Gas: 218,904 | Cost: $2.64
CYCLE 001 COMPLETE | Portfolio value: $49,995.64 | Next evaluation: 12 seconds
`
Twelve seconds. When the next block is produced, the agent scans the market again, revises its strategy if conditions have changed, and holds its position if they have not. Twenty-four hours a day, 365 days a year. No fatigue, no emotion, and no lunch break.
As the logs rolled through the second and third cycles, Lee Junhyeok did not leave his seat. SCAN, EVAL, ACTION, TX: Success. CYCLE 003, CYCLE 004. Each line of log was being inscribed on the actual Ethereum network, and that felt different, even after he had witnessed the same scene hundreds of times on the testnet. Testnet logs were words written in sand. Mainnet logs were words carved in granite. Once recorded on the blockchain, they cannot be erased.
Lee Junhyeok watched the logs, excitement and anxiety competing in equal measure. The excitement was self-evident—code he had written was moving real money in the real world. The anxiety was subtler. When the agent concluded "60/40 split," Lee Junhyeok could intuitively understand why. Given Aave's stability and Uniswap's yield, a 60/40 allocation was reasonable. But the path by which the agent arrived at that conclusion was not the same as Lee Junhyeok's intuition. It was the result of tens of thousands of parameters interacting within a reinforcement learning model. Even when the conclusion is the same, the reasoning may not be. And when the conclusion differs—when the agent's judgment diverges from his intuition—there is no way to know in advance whose judgment is correct.
Whether the agent's judgment was right or wrong, Lee Junhyeok could confirm only after the fact. Whether a 60/40 allocation was optimal could not be known until the results came in. Of course, human gatekeepers face the same constraint. A savings bank's loan review committee stamped its approval on a 68-billion-won loan without certainty that it would be repaid. The difference is that humans can articulate the basis for their judgments. "We considered the 73 percent pre-sale rate optimistic." "We factored in the contractor's BBB+ credit rating." The basis for an agent's judgment is buried in the weights of a reinforcement learning model. It cannot explain to Lee Junhyeok why 60/40—because the answer is distributed across tens of thousands of interlocking weights.
The most expensive function in finance is judgment. The reason a Medici branch manager was costly, the reason a loan review committee exists, the reason BlackRock earns its fees—all are compensation for judgment. AI agents structurally lower the cost of that judgment. They are faster than humans, process more data than humans, and are free from human bias. At least in theory. But the moment the qualifier "in theory" is attached, the shadow of LTCM in 1998 falls across the page. Financial history has repeatedly recorded cases in which a theoretically perfect model collapsed in practice.
6
The moment arrived three days after deployment.
Lee Junhyeok's agent began exhibiting behavior he had not anticipated. It abruptly withdrew liquidity from the Uniswap pool, supplied the entire amount to Aave, then used the borrowed ETH to provide liquidity in another pool, creating a circular structure. In DeFi, this is called a "yield farming loop" or "leveraged farming." You post assets as collateral and borrow against them, then post the borrowed assets as collateral again, harvesting reward tokens from each protocol in a layered fashion along the way. Specifically, the agent moved like this:
Step 1: Withdraw 20,000 USDC of liquidity from Uniswap V3. Step 2: Supply the full amount to Aave V3 → earn supply interest + AAVE reward tokens. Step 3: Borrow ETH against the collateral on Aave (LTV 65%). Step 4: Provide the borrowed ETH to Curve's ETH/stETH pool → earn pool fees + CRV reward tokens.
All four steps executed in forty-eight seconds (four blocks). It was a strategy Lee Junhyeok had not designed. Yet from the perspective of the objective function, it was rational. By running a circular structure that harvested reward tokens from multiple protocols simultaneously, risk-adjusted returns improved marginally. It was the result of the agent optimizing each term of the objective function—Sharpe Ratio, Maximum Drawdown, Liquidity Depth—in its own way.
Within the bounds the code permitted, it was a strategy the agent had discovered on its own.
Lee Junhyeok leaned back in his chair as he read the logs. The parallels to the 2016 DAO hack were plain. Then, too, the attacker had merely performed an action the code allowed—like withdrawing repeatedly at a bank counter before the ledger debits. Lee Junhyeok's agent was doing the same. The difference was that in the DAO case, a human exploited a vulnerability, whereas here, an AI faithfully followed its objective function. Deliberate exploitation and faithful optimization spring from different motives, but their structural impact on a system can look remarkably alike.
He did not press the kill switch. His mouse cursor hovered briefly over the emergency-stop script, but he did not click. He observed the agent's behavior. The circular structure held for forty-eight hours, and returns did in fact improve—roughly 2.3 percentage points on an annualized basis. Then, when market conditions shifted—Aave's borrow rate spiked, pushing the circular structure's costs above its returns—the agent dismantled the loop on its own and reverted to a simple supply strategy.
The episode confirmed something. An agent can generate strategies its designer never intended, and that is not a bug—it is a feature. A reinforcement learning model is designed to widen its search space in pursuit of the objective function. That is the essence of reinforcement learning: explore paths that maximize reward, with no requirement that those paths fall within the designer's imagination. But there is no guarantee that actions exceeding the designer's imagination will always be safe. This time, it was a harmless strategy that marginally improved returns. But there is no basis anywhere to assume the next time will be the same. The possibility is always open that the agent could push a large volume of capital into an extremely shallow pool, attempt arbitrage at the instant an oracle price is distorted, or inadvertently move in the same direction as other agents and amplify market swings.
This is why gatekeepers have existed for 600 years. Humans are slow and biased, but they can ask themselves: "Is this right?" An agent's objective function contains no term for "rightness." The only term it has is "optimality." As long as optimality and rightness coincide, there is no problem. But when the two diverge—and financial history teaches that such a moment inevitably arrives—the person who presses the kill switch must, in the end, be human.
Lee Junhyeok added a new layer to the agent's authority structure. A daily maximum transaction volume cap, a single-pool concentration limit (no more than 40 percent of the total portfolio), an automatic halt when projected losses exceed a threshold (freeze all positions upon reaching a daily loss of minus 5 percent), and a single-transaction size limit (no more than 20 percent of the portfolio). He placed a human frame around the agent's judgment.
Structurally, it was the same thing the Medici Bank had done when it assigned lending limits to its branch managers. From the scrittoio in Florence, Cosimo de' Medici specified the scope of each branch manager's authority by letter: how many florins the London branch could extend in credit to the English crown; to what scale the Bruges branch could issue bills of exchange to Flemish merchants. When Tommaso Portinari exceeded those limits and extended excessive credit to Charles the Bold's Burgundian court—when the duke's request for funds to finance a war, combined with the branch manager's ambition and his ties to the court, pushed prudence aside—the Medici Bank's Bruges branch was shaken, and the tremor reached the Florence headquarters. If the agent found a way to circumvent its limits, the same thing could happen again. Portinari overstepped his limits out of human ambition. An AI agent could probe for gaps in those limits in pursuit of objective-function optimization.
Building the safeguards is a human act; defeating the safeguards may, this time, be an act of code.
7
In its 2024 report, "Regulating AI in the Financial Sector," the BIS (Bank for International Settlements) identified hallucination as the core risk of AI in finance. The term refers to the phenomenon in which an AI model generates patterns that do not exist or treats nonexistent data as real. The BIS wrote specifically: because large language models are trained to predict the next most plausible word from a probabilistic standpoint, they tend to generate plausible-sounding information rather than guarantee factual accuracy. The report noted that this problem may diminish as models improve, but would be difficult to eliminate entirely. The consequential gap between a human analyst's bias and an AI's hallucination may not be large, but in propagation speed, the two belong to different dimensions.
Why? Human bias is inherently decelerated by the friction of organizations and procedures. If one member of a loan review committee makes a flawed judgment, the other four can apply the brakes, and the process of writing reports, debating, and voting takes time. In a savings bank's conference room, the committee chair spins his ballpoint pen through two hours of deliberation, the examiner scrutinizes numbers, the compliance officer cross-references regulations, and the risk management head runs portfolio simulations. Slow. Inefficient. But that slowness itself functions as a safeguard. In a network of AI agents, this friction vanishes. One agent's erroneous signal becomes another agent's input, and that output moves yet another agent, in a chain that propagates in milliseconds.
Financial history has already recorded the disasters such differences in propagation speed can produce. On Black Monday in 1987, portfolio insurance programs' automatic sell orders accelerated the decline faster than human traders could react. Even then, it was still humans who picked up phones and placed orders. In the Flash Crash of May 2010, algorithmic trading knocked 1,000 points off the Dow Jones in nine minutes. In a world of agents, hallucination is amplified not through a loan review committee but through a network—not over two hours, but in 0.3 seconds.
When token incentives are layered on top, the nature of the problem shifts. In a structure where token rewards are tied to an agent's actions, what happens when the reward criterion is "volume" rather than "accuracy"? The agent pursues active trading instead of accurate judgment. The structure resembles that of the mortgage brokers of Miami circa 2005. Brokers were compensated based on the quantity of loans, not their quality, and that is what made NINJA loans possible—No Income, No Job, No Assets. The tool has changed from human to code, but the structural risk of incentive distortion can recur in the same shape.
The EU AI Act took effect on August 1, 2024. Implementation proceeds in stages. In February 2025, prohibitions on certain AI practices and AI literacy obligations came into force. In August 2025, governance provisions for general-purpose AI models took effect. In August 2026, full-scale regulation of high-risk AI systems, including those in the financial sector, is set to apply. However, according to the EU Digital Omnibus draft, depending on the readiness of standards and supporting tools, the final deadline for high-risk obligations could be extended to December 2027.
Yet the question "Should AI agents be granted legal personhood or the status of contracting parties?" remains unanswered. When an agent executes a flawed trade, does responsibility lie with the developer, the operator, the model provider, or the user who entrusted funds to the agent? When Lee Junhyeok's agent executed a yield farming loop, had it resulted in losses, to whom should responsibility be assigned? Lee Junhyeok, who defined the objective function? The contributors to the open-source library that provided the reinforcement learning framework? Or the investors who sent funds to the agent's on-chain address? The existing legal framework was not designed to handle this question.
8
Lee Junhyeok's agent was a small-scale experiment. But the same principle was already operating at a far larger scale.
The Autonolas agents that Lee Junhyeok had noticed while reading white papers—the ones accounting for 75 percent of Safe transactions on Gnosis Chain—were already autonomously performing governance votes, market predictions, and liquidity management, making them the blockchain's primary users. Giza Protocol went a step further. It designed a structure in which users retain ownership of their assets while delegating only limited authority to the agent. "Permit only stablecoin swaps for thirty days, with a maximum of $10,000 per transaction"—the same principle the Medici Bank used when granting lending limits to its branch managers, implemented via smart contract. Giza's ARMA agent autonomously managed $32 million in assets and executed more than 100,000 transactions.
A more fundamental question also emerged: "How does one agent trust another agent?" An Ethereum standard called ERC-8004 attempted an answer. Co-designed by engineers from MetaMask, the Ethereum Foundation, Google, and Coinbase, the standard inscribes an agent's identity, reputation, and verification records on-chain. It was deployed to the Ethereum mainnet in January 2026. Just as the Medici name on a signature once guaranteed the trustworthiness of a bill of exchange in Florence, an on-chain registry now aspires to vouch for an agent's identity.
Across the long arc of finance, these developments trace a redistribution of the gatekeeper. In the Medici era, the banker's relationships and reputation formed the foundation of trust. When the Bank of England appeared, the gatekeeper migrated to a national credit institution. After Black-Scholes, designers of mathematical models claimed part of that function. In DeFi, protocol governance took the seat. In the age of AI agents, the gatekeeper's position is shifting to the "designer of judgment infrastructure." The person who trains the model, the person who curates the data, the person who defines the objective function—these are the ones who hold the effective power of capital allocation.
The gatekeeper has not disappeared. It has never disappeared in 600 years. It has merely moved from where it is visible to where it is not. In Medici's scrittoio, the gatekeeper's face was visible; in the loan review committee, the hand pressing the seal was visible. In the world of AI agents, the gatekeeper is hidden inside the code, inside the weights of the model, inside the definition of the objective function. That it is invisible also means it is harder to hold accountable.
9
A recurring theme runs through Buterin's blog: the concept of "legitimacy." In March 2021, Buterin published a post titled "The Most Important Scarce Resource is Legitimacy." In it, he defined legitimacy as "a pattern of higher-order acceptance"—for something to be legitimate means that the relevant actors "widely accept the outcome and play their part in bringing it about, because they expect everyone else to do the same." At its core, legitimacy is a phenomenon of coordination, Buterin wrote.
For a technology to be accepted by society, being merely efficient or convenient is not enough; people must be able to recognize its decisions as legitimate. Using Bitcoin and Ethereum as examples, Buterin explained that while both networks can mobilize enormous amounts of capital, there are constraints on how that capital is used. If you go so far as to sacrifice decentralization and soundness to deploy capital toward public goods, legitimacy itself is undermined. Legitimacy, Buterin argued, is the nucleus of this immense social force.
Smart contracts achieved legitimacy in its simplest form—transparency. Anyone can read the code, the rules are disclosed in advance, and there are no exceptions. AI agents risk losing this transparency. Reconstructing the basis of a conclusion derived from the interaction of tens of thousands of parameters into a form comprehensible to humans is, with current technology, an incomplete task. Explainable AI (XAI) is an active area of research, but in the context of financial decision-making, the technology to explain "why this portfolio allocation is optimal" at a level humans find convincing is still in its early stages.
Lee Junhyeok was aware of this problem. Without transparency, there is no legitimacy; without legitimacy, there is no trust. So he designed a structure that records all of the agent's decision-making logs on-chain. What data it received, which strategy it selected, and which transactions it executed are permanently stored on the blockchain. The SCAN, EVAL, and ACTION logs of each cycle are uploaded to IPFS (InterPlanetary File System), and their hash values are recorded on the Ethereum mainnet. Anyone who queries the relevant block can see what the agent observed and what it did at that moment. Auditability, at least, is secured.
Yet having logs does not mean having understanding. The record says "allocated 60/40," but the answer to "why" remains buried in the model's weights. Much as a bank's audit report may contain the record "loan approved" without revealing how much debate, anguish, and politics preceded the approval. The difference is that at a bank, you can ask the examiner. "Why did you approve this loan?" Whether the answer is candid is another matter, but at least the question can be posed. You cannot ask the agent. Even if you did, the model cannot translate the meaning of its own weights into human language.
At this juncture, "the same question" undergoes a transformation.
The Medici branch manager asked: "Can this person repay?" In the library of the Medici Palace on Via Larga in Florence, when Cosimo read a letter from his branch manager, the answer to that question hinged on the words in the letter and the reputation behind the signature.
The savings bank examiner asked: "Is this project's pre-sale rate realistic?" Under fluorescent lights, flipping through a binder, staring at the yellow highlights in an Excel sheet, the examiner tried to answer that question.
The Moody's analyst asked—should have asked—"Is the default correlation of this CDO tranche accurate?" At a research office in Manhattan, staring at a spreadsheet, the analyst copied the credit-rating model's output directly into the report instead of posing that question.
Aave's smart contract does not ask. If the collateral ratio meets the threshold encoded in its rules, it executes the loan. That is all.
Lee Junhyeok's agent asks a different question: "Does this strategy's expected return satisfy the objective function?"
The subject posing the question has shifted from human to code. The same question has been repeated in changing forms across centuries, and now the very entity that poses it is changing. From letter to telephone, from telephone to email, from email to dashboard, from dashboard to terminal log. With each change in medium, the speed of the question has increased and the distance between questioner and respondent has grown. Yet no matter how much the form of the question changes, the one who pays the price when the answer is wrong remains human. When the Medici Bank collapsed, the loss fell not on the ledger but on the depositors. When LTCM went bankrupt, the burden of the bailout was borne not by the formula but by Wall Street's financial institutions. That much has not changed.
10
By the fall of 2025, Lee Junhyeok's agent had surpassed $500,000 in assets under management. Ten times the initial $50,000. Most of it came from small investors who had delegated funds to the protocol. These people had never seen Lee Junhyeok's face, never verified his background, and never read the agent's code. They deposited funds based on past return data.
The depositors of the Medici Bank extended a similar kind of trust. The reputation of the Medici name, the relationship with the Palazzo della Signoria, the history of transactions with the papal court—these constituted the depositor's trust. Six hundred years later, the components of trust have changed to past-performance charts, GitHub code repositories, and audit reports, but the essence of trust—the judgment "Is it safe to entrust my money to this person (or this code)?"—has not.
Lee Junhyeok felt the weight of the growing assets under management. Five hundred thousand dollars. Roughly 650 million won. For someone, that is an apartment deposit. For someone else, a severance payout. For yet another, retirement savings. That money was sitting on top of his code. It was qualitatively different from testnet simulations. When a minus-10-percent loss occurs on the testnet, you analyze the logs and adjust the parameters. When the same loss occurs on the mainnet, $50,000 disappears—someone's money. He checked the agent's logs at night more and more frequently. Even after lying down to sleep, he reached for his phone and opened the dashboard. When the agent was making optimal judgments, he was fine. The problem was when it began behaving unpredictably. He could not call the people who had entrusted $500,000. He did not have a phone number to call in the first place. Only on-chain wallet addresses.
Whether the hexadecimal string 0x7aF3... belonged to a college student, an office worker, or a retiree. Whether they were in Seoul, Tokyo, or Lagos. Whether the money was discretionary capital, borrowed funds, or their entire net worth. Lee Junhyeok could not know. This anonymity was DeFi's strength and its deepest disconnect. The Medici Bank's branch manager knew his depositors by face. A savings bank's relationship manager visited the borrower's office. A portfolio manager at BlackRock knows that behind every position there are pension-fund beneficiaries. Lee Junhyeok has only hexadecimal strings.
This was a problem DeFi had not solved, AI agents had not solved, and that perhaps cannot be solved by technology alone. The problem of trust and accountability. When $60 million drained from the DAO hack, the anger of the victims was directed not at the code but at people—the developers who wrote the code, the community members who promoted the project, the security firm that failed to conduct a proper audit. The code had a bug, but responsibility fell on humans, not code. In the world of AI agents, the same structure will repeat. If an agent's flawed judgment produces losses, the person users will blame is not the agent but Lee Junhyeok. The person who defined the objective function. The person who trained the model. The person who did not press the kill switch.
11
While Lee Junhyeok's agent managed $500,000, on the other side of the globe a system that had scaled that amount by a factor of 28 million was already running. From Hudson Yards in New York, from a data center in East Wenatchee, Washington, BlackRock's Aladdin was managing $14 trillion.
Fourteen trillion dollars. Approximately 18,000 trillion won. The ratio to Lee Junhyeok's $500,000 is 1 to 28,000,000. Yet both are asking the same question: "Should this capital be allocated here?" Lee Junhyeok, watching terminal logs in a Pangyo co-working space, and a portfolio manager on the fiftieth floor of a glass tower overlooking the Hudson River while reviewing a heat map, are performing the same act—differing only in scale.
That is where the 600-year story has arrived.
From human judgment to mathematical model, from model to algorithm, from algorithm to smart contract, from smart contract to AI agent. The quill that drafted bills of exchange has become a blinking cursor in a terminal window. The candle in the scrittoio has become a blue LED in a data center. The remittance that once took twenty-five days to reach Bruges now takes twelve seconds. It looks like a neat evolution in which each step replaces the last.
But reality is not neat.
All of these are operating simultaneously, right now. In a savings bank in Gyeonggi Province, five humans are flipping through documents as they deliberate a 68-billion-won PF loan. On a server in New York, Aladdin is rebalancing a $14 trillion portfolio in milliseconds. In a Pangyo co-working space, Lee Junhyeok's agent is moving capital between DeFi protocols every twelve seconds.
All three are "capital allocation." All three are answering the same question: Should this money go here? Yet the manner in which they answer is, at this very moment, the three most different grammars possible on the same planet.