The Null Feed: Inside the $2.1 Billion AI Oracle That Piped Empty Data Into a Live Bull Market

Hook

Here is the entire on-chain record of the moment it broke.

{
  "feed_id": "AXM-PERP-BASIS-01",
  "round_id": 8412909,
  "timestamp": 1781437267,
  "payload": null,
  "confidence": 0.0,
  "signers": ["0x9f...c1", "0x44...7a", "0x00...ff"],
  "attestation": "0x0000000000000000000000000000000000000000000000000000000000000000"
}

No revert. No InvalidData event. No circuit breaker trip. Three of five registered signers had attested to a payload that contained nothing, at zero confidence, and the on-chain adapter accepted it as a valid round. Thirty-one seconds later, the first liquidation fired. By the time a human at AXIOM-9 Labs opened the Grafana dashboard, $418 million in notional exposure across fourteen lending markets had been repriced against a number that never existed.

The token is up 240% year to date. The protocol raised $2.1 billion across two rounds in eleven weeks. And its oracle — the one the pitch deck calls "the autonomous truth layer for on-chain finance" — spent a Tuesday morning telling the entire DeFi stack that it did not know, and the entire DeFi stack heard "everything is fine."

Code doesn't panic. That is precisely the problem.

Context: What "AI Oracle" Actually Means in 2026

To understand how an empty payload became a nine-figure liquidation event, you have to understand what the 2026 vintage of "AI oracle" actually is, because it is not a faster Chainlink and it is not a chatbot with a price API.

The bull market has fused two narratives — machine learning and decentralized data — into a single product category, and that category now commands the most aggressive valuations in the sector. AXIOM-9 Labs is the loudest exemplar. Its thesis, stated plainly in its Series B memo (which I read twice, and which I will quote from throughout because the language matters), is that deterministic oracle aggregation is obsolete. The argument runs like this: a price feed that pulls from twelve exchanges and takes a volume-weighted median is a measurement system. But markets increasingly depend on data that cannot be measured by taking a median of anything — the probability that a specific real-world event resolves a specific way, the likelihood that a counterparty is solvent off-chain, the integrity of a sensor reading in a supply chain, the true state of a reserve that only reports through an opaque portal. For those, you need inference, and inference is what models do.

So AXIOM-9 built a four-layer stack, and every layer matters for what follows.

Layer one: the Model Ensemble. Off-chain, a committee of models — some fine-tuned open-weight networks, some proprietary, one that the team describes as a "probabilistic settlement engine" — ingest raw inputs and emit a structured output: a value, a confidence score between 0 and 1, and a provenance hash. The ensemble does not vote. It produces a distribution, and a meta-model collapses that distribution into a single attestable payload. This is the part the marketing sells. "Autonomous verification," the deck says. "No human in the loop."

Layer two: the Attestation Mesh. The payload is hashed, and a threshold of independent signers — registered node operators who have staked $AXM — sign the hash. Five signers are active on the flagship feed; the protocol's security model requires three. This is the layer that produces the attestation field in the JSON above. It is a threshold signature over a digest. It proves that three signers saw the same bytes. It does not prove the bytes mean anything.

Layer three: the Adapter Contracts. On-chain, a thin adapter contract receives the signed payload, verifies the signature against the registry, checks the round ID is monotonically increasing, and then writes the value into a storage slot that downstream protocols read. This is the layer where the incident happened, and I want to be surgical about it, because the adapter is where every AI oracle will eventually bleed.

Layer four: the Feed Registry. A governance-controlled mapping of feed IDs to adapter addresses, signer sets, heartbeat intervals, and — this is the crucial one — deviation thresholds and staleness windows. Downstream integrators configure how old a value can be before it is considered stale, and how far it must move before it triggers a re-read.

Now here is what nobody in the pitch deck says out loud, and what I have been writing about since 2020: an oracle is not a truth machine. It is a translation layer between a world that contains uncertainty and a virtual machine that contains only two booleans. Everything that has ever gone wrong in oracles — the 2020 flash-loan manipulations, the 2021 stale-price liquidations, the 2022 sequencer outages — is a failure to translate the space between true and false, which is where reality actually lives.

The 2026 AI oracle does not fix that. It industrializes it. Because now the thing on the left side of the translation is not a number from an exchange; it is a probability distribution produced by a model that can be wrong in ways no median can be wrong. And the thing on the right side is still a uint256.

I have audited this pattern before. In late 2017, when I was running line-by-line reviews of ERC-20 fundraising contracts in Auckland, the recurring bug was never the cryptography. The signatures were always valid. The bug was that "valid" and "correct" are different predicates, and Solidity only lets you check the first one cheaply. That lesson cost the ICO era about $4 billion. It has not been learned. It has been scaled.

Core: The 41-Minute Window

Let me reconstruct the incident from the transaction log, the adapter bytecode, and two conversations — one with a node operator who asked not to be named, and one with a risk lead at a lending market that took the hit. I am not naming the lending market because it is cooperating with a post-mortem and because, frankly, it did nothing wrong that a thousand other protocols would not also have done.

The timeline

T-minus 11 days. AXIOM-9 pushes model ensemble version 4.0 to the flagship feed. The changelog, which I obtained, is three lines long and describes "improved basis-trade inference for perpetual funding markets." It does not mention a schema change. It should have. This is the seed of the entire event, and it was a documentation failure, not a model failure.

T-minus 6 days. My own monitoring flags something odd on the AXM-PERP-BASIS-01 feed: the payload's basis_bps field, which historically populated with a signed integer, is arriving as undefined in the raw ensemble output. The on-chain value is still correct because the adapter is reading a cached value from the previous round. The feed looks healthy. It is not. I file this under "watch," because a schema drift with no price impact is not yet a story, and I do not publish a story until I can prove the causal chain. This is the discipline that keeps me from being wrong in public, and it is also the discipline that means I sometimes sit on a bomb for a week.

T-minus 2 days. The ensemble's basis_bps field has migrated, silently, to basis_points. The model is emitting correct, high-quality inferences. The field is simply named differently. Nothing in the model layer is broken. The model is doing exactly what it was trained to do.

T-0, 03:41:07 UTC. The adapter processes round 8,412,909. It reads the payload. The key it expects, basis_bps, is absent. It writes null into the feed's value slot and — this is the fatal decision — it does not revert. It emits a RoundUpdated event with a null value and a confidence of 0.0, and it advances the round ID. From the chain's perspective, a perfectly valid oracle round just completed.

Here is the adapter code, decompiled and simplified. Read the third line of the _settle function carefully, because the entire incident is encoded in it.

function _settle(
    bytes calldata payload,
    bytes calldata attestation,
    uint256 roundId
) internal {
    // 1. Verify threshold signature over payload digest
    require(_verifyAttestation(payload, attestation), "bad attestation");

// 2. Decode structured payload Payload memory p = abi.decode(payload, (Payload));

// 3. Extract the value — NO null check, NO schema check int256 value = p.basisBps; // <-- reads 0 when field is absent uint256 conf = p.confidence; // 0.0 when model returns zero-conf

// 4. Monotonic round guard passes, because roundId increased require(roundId > lastRoundId, "stale round");

// 5. Write and advance — no threshold on confidence feeds[feedId] = value; lastRoundId = roundId; emit RoundUpdated(feedId, value, conf, roundId); } ```

The signature check passes. It should — the signers signed honestly. The decode passes. The round guard passes. And the contract writes value = 0 into a feed that downstream protocols treat as a basis measurement in basis points. A basis point value of zero is not an error signal. It is a statement that the perp trades exactly at spot. In a bull market, on a feed whose entire purpose is to measure the premium of perpetual futures over spot, the oracle just announced that the premium had vanished to zero, with cryptographic proof.

03:41:38 UTC. The first liquidation fires. A leveraged basis-trade position on a perp DEX, sized against the assumption of a persistent positive basis, gets marked to a basis of zero. Its maintenance margin evaporates. Liquidators are bots; they do not hesitate.

03:44:12 UTC. The cascade. Fourteen lending markets, three perp venues, and one tokenized-treasury product all read the same feed. Each had configured its staleness window — the maximum age before a value is treated as invalid — at somewhere between 30 minutes and 2 hours, because the feed's published heartbeat was 15 seconds and nobody configures a 15-second feed to fail on a 3-minute gap. The value was 3 minutes old. It was fresh. It was null. It was read as zero.

03:52:00 UTC. A human notices. Not through a circuit breaker — there isn't one — but because the protocol's own treasury dashboard shows a margin ratio that looks like a typo.

04:22:00 UTC. Mitigation: the feed is paused by governance multisig. By then, $418 million in notional exposure has been repriced, $91 million in real liquidations have settled, and one lending market is sitting on a $23 million bad-debt hole that its risk committee will spend a month explaining to depositors.

Why the confidence field didn't save anyone

This is the detail that separates people who understand oracle design from people who repeat its slogans. The AI oracle did emit a warning. It emitted confidence: 0.0. It was, in a literal sense, honest. It said: I am not sure of this value.

And it did not matter, for three structural reasons.

First, confidence is advisory, not binding. Downstream protocols configure their collateral and liquidation logic around the value, not around the confidence. A confidence-weighted collateral factor exists in theory — you multiply the value's weight by its confidence — but almost nobody implements it, because implementing it means your protocol's risk parameters change every block, which makes liquidations unpredictable, which makes liquidation bots leave, which makes the market illiquid. Confidence is a beautiful idea that dies the moment it meets a liquidation engine that needs determinism.

Second, zero confidence is indistinguishable from zero change. A model that is uncertain and a market that is flat both emit low numbers. Downstream logic that says "if confidence < threshold, use last known value" would have saved every protocol here — but it would also have silently masked a genuine 100% move, so almost every integrator chose the opposite default: trust the value, ignore the confidence. I have now seen this exact trade-off made the same wrong way at six different protocols. It is not a bug. It is an equilibrium.

Third, the null was laundered into a plausible number. This is the deepest failure and the one I want you to remember. The ensemble emitted nothing. The adapter converted nothing into zero. And zero, on a basis feed, is a perfectly plausible market state. The system did not fail loudly. It failed into a value that looked like data. A null is obviously broken. A zero is a number. The adapter's abi.decode did the laundering, silently, in a single type conversion.

The affected surface

I mapped the blast radius by tracing every contract that read the feed's storage slot in the 24 hours around the incident. Here is the exposure table, anonymized where the counterparty asked.

| Venue type | Count | Notional exposed | Realized loss | Root trigger | |---|---|---|---|---| | Perp DEXs (basis trades) | 3 | $180M | $41M | Mark price → 0 basis | | Lending markets (recursive) | 14 | $190M | $38M | Collateral repriced | | Tokenized treasury product | 1 | $34M | $9M | NAV feed contamin. | | Structured vaults | 6 | $14M | $3M | Strategy mis-mark | | Total | 24 | $418M | $91M | — |

Notice the shape of this. The losses did not concentrate where the bug was. The bug was in one adapter on one feed. The losses sprayed across twenty-four venues that had each independently assumed the feed could not be wrong. Every integrator did the same risk calculus in isolation — "AXIOM-9 is a $2.1 billion protocol with a threshold of five signers; the feed is trustworthy" — and twenty-four independent trust decisions compounded into a systemic event. This is not a DeFi problem. It is a correlation problem. When everyone trusts the same oracle, everyone fails the same way, and diversification is an illusion.

What my audit found, and when

I want to be precise about my own position here, because the point of an audit is not to claim prescience. I flagged the schema drift at T-minus 6 days, as I said. What I did not do — what I could not do, on the evidence — was predict that the drift would manifest as a null rather than as a stale value. The distinction is the whole story, and it took the incident to expose it.

But I had seen the shape before. In 2017, auditing ERC-20 contracts during the ICO boom, I kept finding the same class of defect: a function that checked whether a call succeeded rather than whether the result was meaningful. A transfer that returned true while moving nothing. A balanceOf that returned a default. The code was valid. It was not correct. I wrote then that the most dangerous bugs are not the ones that crash; they are the ones that return a plausible default, and I have spent nine years watching that sentence come true at increasing scale. The ICO era lost money to true-returning no-ops. The DeFi Summer lost money to 0-returning division. The AI oracle era just lost money to 0-returning schema drift, and the only thing that changed is the sophistication of the mechanism that produces the default.

Contrarian: Latency Was Never the Enemy

Here is where I part company with almost everyone else covering this, and with the framing AXIOM-9 itself is quietly promoting in its post-incident comms.

The dominant narrative is going to be about speed and redundancy. "The oracle was too slow to fail over." "The signers should have caught the schema change." "The protocol needs more independent oracles." Every one of those fixes is a patch on a broken premise, and the premise is that the oracle's job is to deliver the right number fast enough. That is the latency model of oracles, and I have been arguing since the 2020 DeFi Summer that it is the wrong model entirely.

The oracle problem is not a latency problem. It is a semantics problem. And the specific semantic failure is the absence of an explicit UNKNOWN state.

Think about what a model ensemble is actually producing. It is not producing a truth value. It is producing a belief — a distribution over possible worlds, with a confidence weight attached. That belief has three meaningful outputs, not two: it can say yes (the value is X), it can say no (the value is not X), or it can say I don't know (the value is unrepresentable given available information). Classical logic calls this three-valued, or Kleene logic. Every honest measurement system in the physical sciences uses it. A thermometer that is broken reads unavailable, not zero.

Now look at the chain. The EVM has no null. It has no unknown. It has uint256, and uint256 has a zero, and zero is a value. So the entire burden of representing epistemic uncertainty falls on the integration layer, and the integration layer — as we just watched — converts uncertainty into the most convenient available number, which is zero, which is a lie, because zero means "the basis is flat" and the truth was "the basis is unknown."

The AI did not lie. The integration layer refused to admit ignorance, because the VM gave it no word for ignorance, so it used the only word it had.

This is why the standard fixes will not work. Adding signers does not add a word for unknown. Adding redundancy does not add a word for unknown. Making the feed faster — which is what every "oracle latency" article will recommend — makes the rate at which plausible lies propagate faster. You cannot out-engineer a missing state. You can only add the state.

And there is a second contrarian point buried here, one that the industry is even less ready to hear. The attestation was cryptographically valid, and that validity is exactly what made the failure worse. Three of five signers genuinely signed the digest. The signature verified. The round was, by every formal definition the protocol published, legitimate. So downstream protocols had no signal at all to distinguish this round from a healthy one — the cryptography was a certificate of form, not of substance. It certified that the signers agreed on the bytes. It said nothing about whether the bytes meant anything.

I have written about this pattern in a different context: the SEC's regulation-by-enforcement. The mechanism is identical. A rule that certifies procedure while remaining silent on substance produces compliance theater — entities that satisfy the letter while the spirit goes unexamined, and a system that cannot tell the difference because the only thing it measures is the letter. The 2026 AI oracle is the DeFi-native version of that pathology. It built a threshold signature — a procedural certificate — and called it truth. The certificate was valid. The truth was absent. Code doesn't do nuance; it does certificates, and it will happily certify a null.

There is a third angle, and it is the one that keeps me up at night as an editor. Everyone is going to frame this as an AI failure. It is not. The model performed correctly — it emitted a high-quality inference under a new schema. The failure was 100% in the deterministic, boring, non-AI adapter layer, written by a human, in ten lines of Solidity. We are building trillion-dollar trust infrastructure on top of brilliant probabilistic systems and then handing the last mile — the translation into the binary machine — to ten lines of abi.decode written on a Friday. The intelligence is at the top of the stack and the accountability is at the bottom, and the two never talk to each other.

The Regulatory Bridge: The Audit Trail That Proves Nothing

I spent 2024 dissecting the legal anatomy of the spot Bitcoin ETF filings, and I have maintained a standing editorial desk for exactly this reason: when a new class of instrument reaches institutional scale, the first thing that gets marketed is not the technology. It is the audit trail.

AXIOM-9's institutional pitch leans hard on the audit trail. Every inference is logged. Every attestation is on-chain. Every round has a provenance hash linking the payload to the exact model version that produced it. To a compliance officer, this looks like a dream: a fully deterministic, cryptographically sealed record of every number that ever moved a position.

It is a dream that just cost $91 million. Here is why, stated as plainly as I can.

An audit trail proves what happened. It does not prove that what happened was meaningful. The chain will show, forever, that round 8,412,909 contained a null payload attested by three signers. Every link in the trail is intact. The trail is a perfect record of a perfect failure. If you handed this to a regulator after a loss, it would confirm that the protocol did exactly what it said it would do — which is precisely the problem, because what it said it would do was insufficient.

This is the same trap the 2024 ETF approval process flirted with. The SEC spent a decade demanding surveillance-sharing agreements — procedural guarantees that the exchanges could see each other's order flow — and approved products on the basis of those procedures without ever adjudicating the substance of whether the underlying market was manipulation-resistant. The procedure was the deliverable. The substance was deferred. And when substance and procedure diverge, the market finds out the hard way, which is what happened in the first year of ETF trading when basis dislocations revealed how thin the arbitrage was.

I hold the view, and I have held it since the 2017 blueprint audits, that regulators regulate form because form is legible and substance is not. The SEC does not withhold clear rules out of ignorance of the technology. It withholds them because a clear rule requires an adjudication of what a number means, and no regulator has the vocabulary for that. So it regulates the certificate — the disclosure, the filing, the attestation — and leaves the meaning unregulated, because meaning is the one thing that cannot be filed.

The AI oracle has now imported that exact pathology into the technical layer. It built a filing system — a beautiful, immutable, cryptographically sealed filing system — and then discovered that a filing system is not a truth system. The industry just paid $91 million to learn that an attestation is a certificate of form, not of substance, and the lesson arrived in the same week the SEC is drafting its framework for "algorithmic data intermediaries," a category that will almost certainly be defined by the paperwork it produces rather than the correctness it delivers.

If you are an institutional allocator reading this, the takeaway is not "avoid AI oracles." It is: stop treating the audit trail as a risk control. A trail tells you what a system did. It does not tell you what a system should have done when it knew nothing. No filing, no attestation, and no threshold signature can encode a state that the underlying machine does not have a symbol for. That is a design obligation, and it belongs to the engineers, not the lawyers — and right now, neither group believes it is theirs.

Pre-Mortem: Three Ways This Kills You Next

My habit since the Terra/Luna collapse has been to write the post-mortem before the collapse — to enumerate the failure modes while the market is euphoric and the incentives are still pointed the wrong way. Here are the three I am watching, in order of how soon I expect them.

Failure mode one: the silent null in a perp DEX mark price. This is the direct sequel to what just happened. A perp venue reads an AI oracle for its mark price. The adapter emits a null, the null decodes to zero, and zero is a plausible mark price for an asset whose true price is small. The liquidation engine fires on a mark of zero, and because perp liquidation engines cascade by design — liquidating one position moves the mark, which liquidates the next — the loss is a function of open interest, not of the oracle's error. Timeline: weeks, not months. The AXIOM-9 incident is a live exploit template now, and it is sitting in every integrator's backlog as "we should add a null check."

Failure mode two: model drift across an L2 deployment race. Here is where my Layer2 read matters, and it is not the technical one people expect. The real competition between the rollup stacks in 2026 is not proving systems. It is deployment velocity — which stack convinces more projects to ship a chain. That race creates a specific hazard for oracles: the same feed gets deployed to a dozen chains, each with its own adapter, each adapter maintained by a different team, each team reading a slightly different schema because the model ensemble ships updates on its own cadence. The schema drift that caused this incident is a race condition between the model layer's release schedule and a dozen independent adapter codebases. Multiply the AXIOM-9 incident by every chain that hosts a copy of the feed, and you get a failure that is not one null but a synchronized null — the same model version, upgraded on the same day, breaking the same field across every deployment at once. That is a correlated failure across a whole ecosystem, and no amount of per-chain testing catches it, because each chain tested its adapter against the old schema and shipped before the new one landed.

Failure mode three: the slashing that never happens. AXIOM-9's security model promises that misbehaving signers get slashed. But here is the thing — the signers did nothing wrong. They attested honestly to a payload that happened to be empty. There is no slashing condition for "signed a valid null," because the protocol's designers never imagined that a valid null was possible. So the economic security — the staked $AXM that is supposed to align incentives — provides exactly zero protection against the one failure that actually occurred. The bond is collateral against lying. It is not collateral against ignorance. You cannot slash a signer for failing to know something the model told it to be true.

Run the pre-mortem forward. The pattern in all three is the same: a protocol builds an economic and cryptographic security model against bad actors, and then discovers that its actual threat model is honest systems producing meaningless data. The stake, the threshold, the attestation — all of it is aimed at malice, and none of it is aimed at the null.

Takeaway: What to Watch

The next six months will tell you whether this industry learned anything, and the tell will be a single question: does the next generation of oracle standards ship an explicit UNKNOWN state?

I have already seen two draft proposals — one from an independent research collective, one circulating quietly inside a major rollup's ecosystem fund — that propose exactly this: a feed that can return a first-class UNKNOWN, with downstream contracts required to handle it, with liquidation engines that halt rather than mis-mark when the state is unknown. If those proposals get traction, this incident becomes a turning point. If they get filed next to the 2017 "return value" audits and the 2020 confidence-weighted collateral designs — good ideas that died because they made liquidations unpredictable — then the industry will keep building certificates of form and calling them truth, and it will keep discovering, at increasing cost, that the certificate and the truth were never the same thing.

I will be watching one number specifically: the adoption rate of require(value != UNKNOWN) in production liquidation engines. Not in whitepapers. In deployed bytecode. Because code doesn't read the roadmap. It reads the last commit, and the last commit is the only place a real design decision lives.

The bull market will paper over this for a while. The token is still up. The raise closed. The next AI oracle will launch with a bigger model, a bigger attestation threshold, and a bigger audit trail, and it will market all three as safety. And somewhere in its stack, ten lines of adapter code written on a Friday will be waiting to translate I don't know into a number that looks like it knows.

The question worth asking is not whether your oracle is fast enough. It is whether your oracle has a word for the moment it stops knowing — and whether anything downstream is listening when it says it.