On March 2, 2026, Judge Katherine Polk Failla of the U.S. District Court for the Southern District of New York dismissed with prejudice every remaining claim in *Risley v. Universal Navigation Inc.* — the four-year class action that sought to hold Uniswap Labs, founder Hayden Adams, and venture b...
"If you write open source smart contract code, and the code is used by scammers, the scammers are liable, not the open source devs." — Hayden Adams, Founder, Uniswap Labs
On March 2, 2026, Judge Katherine Polk Failla of the U.S. District Court for the Southern District of New York dismissed with prejudice every remaining claim in Risley v. Universal Navigation Inc. — the four-year class action that sought to hold Uniswap Labs, founder Hayden Adams, and venture backers including Andreessen Horowitz, Paradigm, and Union Square Ventures liable for investor losses tied to scam tokens traded on the protocol. The ruling is the most significant judicial statement on DeFi protocol liability to date.
The decision arrives at a pivotal moment. DeFi protocols collectively secure approximately $97.6 billion in total value locked, Uniswap alone holds $6.8 billion in TVL, and the protocol's fee switch — activated through the overwhelming UNIfication governance vote — positions it to capture $26–27 million in annualized protocol revenue at current run rates. A ruling that equated code deployment with brokerage liability would have constituted an existential legal threat not just to Uniswap, but to every permissionless protocol in the ecosystem. Instead, the court drew a line that will define DeFi's legal architecture for years to come.
This report analyzes the ruling's legal mechanics, its economic implications for protocol builders, and the critical limitations that prevent it from serving as blanket immunity for the sector.
The case began in April 2022, when a group of plaintiffs led by investor Nessa Risley filed a class action in the Southern District of New York. The complaint named Uniswap Labs (officially Universal Navigation Inc.), Hayden Adams, and several of the protocol's most prominent venture capital investors. The core allegation: that between 2021 and 2022, anonymous third parties used Uniswap's permissionless infrastructure to launch fraudulent tokens — rug pulls and pump-and-dump schemes — and that the protocol's creators should bear liability for those losses.
The lawsuit attacked from multiple angles simultaneously. At the federal level, plaintiffs argued that Uniswap operated as an unregistered securities exchange and that the defendants aided and abetted securities fraud. At the state level, they alleged aiding and abetting common-law fraud, unjust enrichment, and violations of New York consumer protection statutes.
Judge Failla dismissed the federal securities claims in August 2023, finding that the plaintiffs failed to identify which specific entity acted as a "statutory seller" of the allegedly fraudulent tokens — a fundamental requirement under Section 12(a)(1) of the Securities Act. The plaintiffs were given the opportunity to replead their state-law claims, which they did in a second amended complaint.
On March 2, 2026, Judge Failla dismissed the remaining state-law claims with prejudice — meaning the plaintiffs cannot refile. The case is permanently closed.
The ruling's significance lies not in the outcome alone, but in the legal reasoning Judge Failla articulated. Three core principles emerged:
1. Providing infrastructure is not substantial assistance. The court explicitly rejected the theory that building a decentralized trading venue makes developers liable for third-party fraud conducted on that venue. Judge Failla stated: "Simply providing the platform on which a fraud takes place is not the same as substantially assisting that fraud." She drew direct analogies to traditional finance: "Just as the NASDAQ and the New York Stock Exchange are not liable as facilitators of any fraudulent stock purchase on their exchanges, neither is Labs liable for creating access to an exchange that facilitates cryptocurrency token trades."
2. Actual knowledge, not red flags, is required. Under New York's aiding-and-abetting fraud framework, plaintiffs must demonstrate that defendants had actual knowledge of the specific underlying fraud. The court expressly rejected constructive knowledge, recklessness, willful blindness, and even what Judge Failla characterized as a "forest of red flags" as legally sufficient. The bar for proving liability against protocol developers is actual, specific knowledge of the particular fraudulent activity — a standard that is exceptionally difficult to meet against teams building general-purpose, permissionless software.
3. Code deployment is not misconduct. The court held that "drafting and publishing smart contract code does not make developers legally responsible for third-party misuse, absent concrete allegations of direct involvement." This principle — that writing and deploying open-source software is a protected activity unless accompanied by specific, knowing participation in fraud — is the ruling's most consequential contribution to DeFi jurisprudence.
Despite three attempts to construct a viable legal theory, Judge Failla concluded: "Despite three chances to get it right, Plaintiffs remain unable to allege plausible claims."
The Risley decision did not occur in an economic vacuum. Its implications must be understood against the scale of the economic activity it protects — or exposes.
DeFi's total value locked stood at approximately $97.6 billion as of March 10, 2026, representing a 4.44% weekly increase despite the Fear & Greed Index sitting at 13 (Extreme Fear). Leading protocols — Lido ($27.5B), Aave ($27B), EigenLayer ($13B), Uniswap ($6.8B), and Maker ($5.2B) — collectively secure the infrastructure on which billions of dollars in daily economic activity flows.
If the court had ruled the opposite way — equating code deployment with brokerage liability or finding that protocol builders have a duty to police every transaction on their permissionless platforms — the cascading effects would have been severe:
Uniswap itself is entering a new economic phase. The UNIfication governance proposal — which passed with over 125 million votes in favor versus just 742 dissenting — activated protocol fees and introduced a programmatic UNI token burn mechanism, including a retroactive burn of 100 million UNI tokens. At current activity levels, the fee switch positions the protocol to capture approximately $26–27 million in annualized protocol revenue. The legal certainty provided by the Risley dismissal is a precondition for this value-accrual mechanism to function without existential litigation risk.
Legal analysts and industry observers have been quick to point out that the Risley ruling does not confer blanket immunity on DeFi. Understanding its boundaries is as important as understanding its protections.
What IS protected under the ruling:
What is NOT necessarily protected:
The Risley dismissal closes one chapter of a multi-front legal battle that has tested Uniswap's legal architecture repeatedly:
| Date | Event | Outcome | |------|-------|---------| | April 2022 | Risley v. Universal Navigation filed | Class action launched | | August 2023 | Federal securities claims dismissed | Failla rejects securities fraud theory | | April 2024 | SEC issues Wells Notice to Uniswap Labs | Threatened enforcement action | | September 2024 | CFTC settlement: $175,000 fine | Leveraged token violations settled | | February 2025 | SEC drops investigation, no enforcement | Wells Notice withdrawn | | December 2025 | UNIfication governance vote passes | 125M+ votes in favor | | March 2, 2026 | Remaining state-law claims dismissed with prejudice | Case permanently closed |
This timeline illustrates a pattern: Uniswap has survived simultaneous attacks from private litigation, federal securities enforcement, and commodities regulation. The SEC's decision to drop its investigation in February 2025 — part of a broader shift under new leadership — combined with the Risley dismissal, leaves Uniswap in its strongest legal position since inception.
The Risley ruling will likely accelerate a design philosophy that was already emerging across DeFi: maximizing architectural decentralization not merely for ideological reasons, but as a deliberate legal strategy.
Decentralization as legal architecture. The ruling creates a clear economic incentive to minimize centralized control points. Protocols that can demonstrate genuine permissionlessness — no admin keys, no curated token lists controlled by a single entity, no ability to censor or prioritize specific transactions — will enjoy the strongest legal protection.
Front-end liability becomes the new frontier. As the back-end protocol layer gains legal clarity, regulatory and litigation attention will likely shift to front-end interfaces. The EU's MiCA regulation already contemplates front-end operator obligations, and U.S. regulators may follow suit. Protocol teams are increasingly separating front-end development from protocol maintenance, creating distinct legal entities with different liability profiles.
The "fee switch" becomes legally viable. Before the Risley ruling, activating protocol-level fees — where the protocol itself captures a share of trading revenue — carried an implicit risk: that fee extraction could be interpreted as evidence of operating a securities exchange or money transmission business. With the court affirming that providing trading infrastructure does not create brokerage liability, the legal path for fee-switch activation is significantly clearer.
Open-source as shield. The ruling reinforces that publishing open-source code is a fundamentally different activity from operating a business that controls how that code is used. This distinction will shape how teams structure their organizations, intellectual property, and governance frameworks.
The most important DeFi court ruling to date. Risley v. Universal Navigation establishes that protocol developers are not liable for third-party fraud on permissionless platforms absent actual knowledge — a precedent that protects the foundational architecture of DeFi's $97.6B economy.
Dismissed with prejudice means permanently closed. The plaintiffs cannot refile. Four years of litigation ended with every theory of liability rejected.
The ruling is narrow, not absolute. It is a district court decision from a single jurisdiction, not an appellate or Supreme Court ruling. Other circuits could reach different conclusions. Regulatory enforcement operates on separate tracks.
Front-end liability is the next battleground. The court acknowledged that users access protocols through centralized web interfaces. Regulation and litigation targeting front-end operators is likely the next phase of DeFi legal evolution.
Decentralization is now a legal strategy, not just an ideology. Protocols that maintain genuinely permissionless architectures will have the strongest legal defenses. Those with centralized control points — admin keys, curated listings, controlled governance — may not receive the same protection.
UNI responded. The token rose approximately 6% to $3.92 following the ruling, with spot volume surging 49% to $200.58 million — the market pricing in reduced litigation risk and the viability of the fee-switch value accrual model.
The Risley ruling draws a line in DeFi's legal landscape that will shape protocol design, venture investment, and regulatory strategy for years. Its core principle — that deploying open-source smart contracts does not create liability for how anonymous third parties use them — provides the legal foundation on which the next phase of decentralized finance can be built.
But this foundation has clear boundaries. The protection applies to genuinely permissionless architectures. It does not extend to centralized chokepoints, front-end operators who curate user experiences, or developers with actual knowledge of fraud. It is a district court ruling, not the law of the land.
For the DeFi ecosystem, the ruling offers clarity that was badly needed. It provides a framework for understanding what kinds of protocol architectures carry legal risk and which do not. For protocol builders, the message is unambiguous: genuine decentralization is not just a design philosophy — it is a legal strategy. And for the $97.6 billion in capital currently locked in DeFi protocols, the ruling reduces the most fundamental legal risk the sector has faced: that the act of building open infrastructure could itself be a crime.
The revolution, as it turns out, is not guilty. But it has been put on notice about where the lines are drawn.