Last week, 300 trillion PYUSD (PayPal’s stablecoin issued by Paxos) was minted on Ethereum. For a brief moment, PYUSD was the most valuable asset on earth. To put it in perspective: that’s worth more than 10x the value of every ounce of gold ever mined.

It was a glitch, obviously. And after 22 minutes, the 300 Trillion in question was burned, just as easily as it was created.

Ironically, this isn’t PayPal’s first brush with astronomical numbers. In 2013, the payment app mistakenly credited a user’s account with $92 quadrillion, then reversed the error before the user even noticed.

In a centralized database, errors like that are mostly harmless. The user can’t actually move that kind of money out of PayPal, and even if they could the risk is contained to Paypal only.

On-chain issuance is a different story, however. The ability to mint a deeply-integrated, deeply liquid asset like PYUSD out of thin air is a systemic risk to DeFi, and 22 minutes is plenty of time to do real damage.

This one was a mistake and it was fixed fast. But it does expose a bigger issue: asset issuance still lacks basic guardrails.

If mint authority is compromised, the outcome will be catastrophic.

Which brings us to this piece’s theme: how issuance works for centralized stablecoins and what a safer issuance stack should look like.

Fiat stablecoins are supposed to be fully backed by their underlying fiat currency. For example, for every dollar on-chain, there should be a matching dollar (or dollar-equivalent) in dedicated reserves.

So how did Paxos end up minting 300 trillion PYUSD when there clearly weren’t enough off-chain reserves to back it? Because the mint function was executed without consulting off-chain reserves first.

Most fiat-backed issuance designs used today rely heavily on trust ( and monthly attestations). On-chain mint/burn is gated by issuer permissions, not by querying off-chain reserve balances.

That means there are no safety measures at the protocol-level to halt mints if that control is compromised or is triggered with the wrong parameters, which is what happened with PYUSD.

Stablecoins have clearly hit escape velocity. PayPal’s PYUSD is only the beginning. Multiple Web2 businesses announced plans to explore or issue their own stablecoins because the rails offer structural advantages for moving and storing value.

But if businesses are coming on-chain at scale, the issuance infrastructure has to level up in order to meet this demand. For this to happen, protocol-level verifiability of off-chain reserves is a must.

The good news: @m0 saw this coming years ago and built accordingly.

I think this is a good moment to dig into their issuance mechanism, among other features, and why it matters.

Before we get into M0’s design, let’s quickly recap how things work with centralized issuers:

1. Distributor submits mint instructions (stablecoin, chain, destination address)

2. Distributor wires funds to the issuer’s bank

3. Issuer mints tokens and transfers them to the distributor’s wallet

This design works but it comes with real drawbacks for distributors:

• Issuer-absolute mint power: A privileged signer can mint. Distributors can’t constrain it on-chain.

• Trust-heavy, off-chain operations: With the exception of mint/ burn functions, everything else (reserves proofs, branded issuance, profit sharing) is coordinated off-chain.

Now, how does M0 address this?

M0 isn’t a company, it’s a protocol. A coordination layer that enforces a set of parameters for all actors to abide by.

Governance-Approved Actors:

• Minters (issuers): Qualified entities with mint power proportional to eligible collateral held in Special Purpose Vehicle (SPV) that meet M0 governance-adopted requirements.

• SPV Operators (custody): Independent operators of the SPVs that control the custody accounts and enforce protocols designed to protect the stability of issued assets.

• Validators (auditing): Independent firms engaged by Minters to verify eligible collateral and post regular proofs.

• Earners (distributors): Holders of M0 stablecoins (and branded extensions) who share in earnings generated by off-chain collateral.

  Note: Minters, Validators and Earners have to be approved by governance and are bound by M0's Adopted Guidance in order to participate in the protocol's activities.

M0 tightens issuance by separating duties and defining how Actors interact, even off-chain:

→ Minters do not control custody. Instead, they sign a legally binding agreement with an SPV Operator, who manages collateral to protect the stability of issued assets in all conditions.

→ Validators have read access to Custody Accounts and are required to publish regular proofs on Eligible Collateral.

Note: $M refers to M0’s dollar-pegged stablecoin and the protocol’s canonical unit.

With the custody and attestations design in place, issuance on M0 is reserve-aware and challengeable at the protocol-level:

Minting basically boils down to two moves:

1. Update collateral: Every ~30 hours, Minters publish their Eligible Collateral on-chain with a valid Validator proof. Failure to do so incurs a penalty fee.

2. Request mint: Minters request the amount of $M to issue. The request is checked against on-chain Eligible Collateral and held for a delay window during which Validators can halt the mint if something looks off.

This architecture would have halted the 300T $PYUSD mint event if Paxos was leveraging the M0 stack:

M0’s custody design means Minters don’t control the SPV’s custody accounts.

So how do they pull out free collateral (e.g., after burning $M)? Via an on-chain, validator-gated retrieval flow:

→ Deducting the proposed amount immediately from on-chain collateral ensures the Minter remains adequately collateralized throughout the process.

→ On-chain logic initiates the flow, the SPV Operator executes the transfer and Validators attest to the validity.

→ Just like mints, outflows are reserve-aware and challengeable.

With reserve-aware issuance and protocol-level safeguards, M0 makes issuance verifiable instead of trusted. Which is critical, in order to reduce the attack surface and operational error risk.

But that's not all. The M0 stack innovation extends beyond issuance to unlock the best building experience for Apps wanting to issue their own stablecoins: fully customizable, yield-bearing, branded stablecoins with interop and liquidity baked in.

I'll be writing about it on my next article.