Crypto Was Supposed to Level the Playing Field. It Didn't.
One-third of the people controlling $106 billion in DeFi assets cannot be publicly identified. That's not a talking point it's a finding from the European Central Bank. And it matters for every M&A deal touching crypto.
I want to start by correcting a statistic you’ve probably seen.
“Two percent of Bitcoin addresses control 95% of the supply.” That claim is everywhere Bloomberg ran it, it’s been repeated across financial media, and it sounds damning enough that nobody stops to check it.
Here’s the problem: it’s measuring the wrong thing.
When Glassnode, one of the most respected on-chain analytics firms, adjusted for the fact that a single exchange address can hold funds belonging to millions of users, the number dropped substantially. The corrected finding: approximately 2% of network entities control about 71.5% of circulating Bitcoin supply. Still striking. Still a concentration problem worth taking seriously. But not 95%, and that distinction matters when you’re doing due diligence rather than writing a headline.
This is the first lesson for M&A and PE professionals evaluating crypto-adjacent companies: raw blockchain data is not the same as beneficial ownership data, and anyone presenting you with address-level concentration metrics without that caveat is either sloppy or selling something.
With that correction on the table, let’s look at what the data actually shows because the real concentration story is worse than the headline number, just in different places.
The Number That Should Concern Your Deal Team
In March 2026, the European Central Bank published Working Paper No. 3208, authored by Antonella Pellicani and colleagues. The paper analyzed governance structures across four major DeFi protocols: Aave, MakerDAO, Ampleforth, and Uniswap protocols collectively underpinning more than $106 billion in total value locked.
The headline finding: the top 100 governance token holders control more than 80% of voting supply across all four protocols. The top five holders in Aave and Uniswap control nearly 50%. In Ampleforth, the top five control approximately 60%.
That’s the token ownership picture. The voting picture is even more concentrated, because smaller holders delegate their votes rather than participate directly. In Ampleforth, the top 20 voters control 96% of all delegated voting power. In MakerDAO, the top 10 control 66%.
The finding I keep coming back to: approximately one-third of top voters across these protocols cannot be publicly identified.
Think about what that means in a deal context. If you’re acquiring a company with material DeFi exposure, or evaluating a target whose treasury or product depends on one of these protocols, a significant portion of the governance power shaping that protocol sits with anonymous entities. You cannot assess their interests, their stability, or their incentives. From a due diligence standpoint, that’s a structural blind spot — not a theoretical one.
The ECB paper adds a regulatory layer that makes this immediately practical. The EU’s MiCA framework, fully enforced since December 2024, offers a “fully decentralized” exemption from licensing requirements. The ECB’s position is clear: given documented governance concentration at these levels, major DeFi protocols cannot credibly claim that exemption. Over €540 million in MiCA non-compliance penalties have already been issued. For any target company with European operations and DeFi protocol exposure, that’s a live liability question, not a future one.
Where Else Concentration Appears And What It Actually Risks
The governance token problem is specific to DeFi. Bitcoin’s concentration risk looks different.
As of May 2026, seven mining pools including Foundry USA, AntPool, and F2Pool control approximately 75% of Bitcoin’s total network hashrate. Foundry alone holds roughly 30%. The top two pools combined represent over 48% of hashrate, which puts them uncomfortably close to the 51% threshold required to reorganize the blockchain.
The April 2024 halving, which cut block rewards by 50%, accelerated this. Smaller miners operating at thin margins can’t compete, so they join large pools to smooth income which concentrates block construction decisions with pool operators. Currently, an estimated 20% of Bitcoin miners operate at a loss.
In May 2026, the seven largest pools jointly committed to adopting the Stratum V2 protocol, which shifts block template construction authority from pool operators to individual miners. This is a meaningful governance improvement. But it does not change who controls the hashrate. The same seven entities still represent three-quarters of Bitcoin’s computing power.
For your deal work, the practical risk here is transaction censorship. A sufficiently concentrated pool coalition could theoretically exclude specific addresses or transactions from blocks. This is unlikely given economic incentives, but it is not zero and for any deal involving sanctions-adjacent counterparties or crypto assets under regulatory scrutiny, it’s a risk that belongs in the threat model.
Putting Numbers in Context
One more number that needs correcting before we go further.
The raw address data shows 2% of Bitcoin addresses controlling 95% of supply. We’ve already established that’s the wrong metric. The entity-adjusted figure — 2% of network entities controlling 71.5% of supply — is the right starting point for due diligence work. But even that number has a further adjustment: when you strip out exchange custody and institutional holdings representing millions of individual users, beneficial ownership concentration falls to an estimated 55-60% controlled by the top 2%.
That’s still extraordinary inequality. But it’s the honest number, and honest numbers are what your deal work requires.
Now the Gini coefficient — the standard measure of distribution inequality — sits above 0.92 for Bitcoin and above 0.89 for Ethereum, per Glassnode data cited by Oxford Journal analysis. One important caveat your readers should understand: crypto Gini coefficients measure address balance distribution, not human wealth distribution. Traditional economy Gini figures like the U.S. household income Gini of approximately 0.49 measure post-tax income after transfers. These are not directly comparable metrics.
With that caveat stated clearly: even after adjusting for custody aggregation and methodological differences, crypto wealth distribution runs roughly twice as unequal as the most unequal traditional economies. The adjusted Bitcoin Gini falls to approximately 0.87, compared to 0.49 for U.S. household income. That gap doesn’t close it just gets slightly less dramatic when you use the right data.
There’s academic evidence this may be structural rather than temporary. Research published in May 2026 on what its authors call “bosonic wealth statistics” analyzing Bitcoin UTXO data across 63 denominations and 72 monthly snapshots from 2018 to 2023 found that Bitcoin ownership follows geometric distributions consistent with digital money naturally producing enhanced inequality. The implication: this isn’t a market immaturity problem that resolves as crypto matures. It may be a feature of how digital, fungible assets accumulate.
A parallel study from the same period found that Bitcoin markets move from relatively equal states toward “rich-get-richer” dynamics over time, with attention and price shocks making concentration worse, not better.
For M&A analysts: when a target company’s pitch deck describes crypto as a democratizing technology, these numbers belong in your counter-briefing.
What Good Due Diligence Looks Like
Raw address metrics are insufficient for deal work. Here’s the framework I apply when evaluating crypto-adjacent targets.
First, demand custody-adjusted concentration data. Request entity-adjusted reports with exchange and custodian filtering from analytics providers Glassnode, Chainalysis, and Coin Metrics all offer this. A concentration metric without custody context is like assessing a bank’s risk without distinguishing retail deposits from interbank exposures.
Second, separately assess governance risk for DeFi-exposed targets. Token ownership metrics and voting power metrics tell different stories. Ask specifically about delegated voting concentration, not just holder distribution. And ask who the top voters are if one-third are unidentifiable, that’s material to your risk assessment.
Third, apply liquidity filters to concentration data. An estimated 3 to 4 million Bitcoin are permanently inaccessible — lost keys, early miner coins that will never move. These inflate concentration metrics. Filter for addresses with activity in the last five years to assess active, functional concentration rather than theoretical distribution.
Fourth, track custody migration trends over time. Rising institutional custody — regulated custodians holding assets on behalf of identified clients may actually reduce systemic risk even when raw Gini coefficients appear unchanged. The direction matters as much as the number.
Fifth, check MiCA exposure for European operations. If the target has EU customers or operations touching DeFi protocols, the ECB’s analysis creates a direct compliance liability. Governance concentration at the levels documented in Working Paper No. 3208 undermines the “fully decentralized” exemption. That’s not a future regulatory risk it’s a current enforcement environment with over half a billion euros already in penalties issued.
What’s Coming Next — And Why I’m Investigating It
The concentration problem I’ve described above is structural and documented. But it doesn’t stay abstract.
The GENIUS Act signed into law on July 18, 2025, the first comprehensive federal stablecoin legislation in U.S. history requires 1:1 reserve backing, monthly public attestations, and annual third-party audits for U.S.-domiciled stablecoin issuers. It passed the Senate 68 to 30 and the House 308 to 122. The stablecoin market it governs now exceeds $300 billion.
Here’s the problem: Tether, which controls roughly 60% of that market and operates from El Salvador, sits outside the GENIUS Act’s audit requirements. The DOJ is currently investigating Tether for money laundering and sanctions evasion. An estimated $8 billion in Russian sanctions circumvention has allegedly moved through USDT.
And the U.S. Commerce Secretary whose office helps set the regulatory environment for that investigation Howard Lutnick transferred his multi-billion-dollar stake in Cantor Fitzgerald, which has served as Tether’s reserve custodian since 2021, to a family trust benefiting his four children. The day after that transfer, Tether lent an undisclosed amount to that same trust. A convertible bond backing the loan entitles Cantor to a 5% stake in Tether.
Senators Elizabeth Warren and Ron Wyden have now opened four separate conflict-of-interest inquiries. The response deadline for their most recent letter was May 13, 2026.
This isn’t a case where concentration risk is theoretical. It’s a case where the documented concentration of power in the stablecoin market appears to have direct lines into regulatory decision-making and those lines run through a family trust whose beneficial owners are children.
In my next piece, I’m going to run a full OSINT investigation into the Lutnick-Tether-Cantor triangle. Public records, corporate filings, entity relationships, timeline analysis. The goal is to map what’s actually verifiable versus what’s alleged and what that means for any deal team evaluating stablecoin counterparty exposure right now.
All investigation work follows Red Dog Security’s published Research Ethics and Methodology Policy passive OSINT only, publicly available sources, no engagement with any party under investigation.