thBILL — Risk Report

Elevated risk · 3.5/10

Read this first — thBILL is not a retail product any more. Theo has repositioned it as the reserve asset behind thUSD. You can check that without taking our word for it: the front-end routes new users to thUSD, the /thbill path redirects, the docs are written thUSD-first, and most thBILL outstanding now sits inside the thUSD reserve rather than in public hands.

What that means if you hold it, or are thinking about it. Primary redemption is KYC-gated and, on the evidence, closed — nothing has redeemed through it since 2026-07-09. The secondary market is a different question and it is open: you can buy and sell thBILL on a DEX today. The problem is the terms. Depth is under $1M against a roughly $87M fund, and the market has been trading persistently below NAV, in the region of 1.5% to 1.7% under — worse than the stress-peak band this report records for the April 2026 dislocation, in a quiet market with no stress event. Selling is possible; it means accepting that discount.

So read this page as a look-through, not a buy case. It exists because thBILL is what stands behind thUSD, and retail can hold thUSD. If you are deciding where to put money, the asset you can actually act on is thUSD — this report is here to tell you what backs it.

Yield	Exit method	Primary redemption	Age	Chains
about 3% APY	Sell on DEX at a NAV discount	KYC-gated, and not converting in practice	about 13 months	Ethereum, Arbitrum, Base, HyperEVM

On scoring: this page scores the retail experience — a holder with no primary-redemption access. See On the scoring rubric at the bottom for what each axis is doing.

What this asset is now (read first)

thBILL has been repositioned as a backing asset for Theo’s stablecoin product thUSD rather than a consumer-facing T-Bill wrapper. ⚠️ That repositioning is now close to complete, and it is measurable rather than descriptive. Read on 2026-08-23: 96.34% of thBILL sits in the thUSD reserve — against a 55–70% band earlier in the year — leaving an external float of about 2.14M tokens, roughly $2.2M. Supply fell 29% in the same window, from 84,059,152 on 08-19 to 58,480,001 on 08-22, and the reserve’s own holding barely changed: what disappeared was almost entirely the float retail could reach. For a holder that is the single most important number on this page, because everything below about exit, secondary depth and redemption is scoped to that $2.2M — against $621K of pool liquidity and about $4.4K of daily volume. What caused the move is not established: no redemption is recorded (the last was 2026-07-09), roughly 25.6M tokens left supply with nothing logged against them, and the mechanism is not visible in on-chain events. This report describes that shape without asserting a cause.

⚠️ This is now answered, and the counterparty is thUSD. Theo’s own stablecoin holds thBILL as its reserve, and on the same day thUSD’s on-chain reserves fell $24.99M while its supply did not change at all — matching the thBILL side to within about $7,500 on $25M. The thBILL was burned out of the thUSD reserve safe. There was no user redemption because there was no user: this was Theo moving its own backing. The effect on the other side was severe — thUSD’s verifiable on-chain coverage fell from 61% to 43% in a day, and it is re-rated accordingly in the thUSD report.

What is still not known: where that $25M of value went, and what now backs that share of thUSD. This report does not claim to know either. The dedicated theo.xyz/thbill page redirects to docs only and app.theo.xyz has migrated its primary mint and transparency UI to thUSD-first. Live holder-attribution split on the dashboard.

If you’re a new retail allocator looking for Theo yield, see the thUSD report instead. thBILL is now best read as either (a) a backing asset for thUSD, useful to understand if you hold thUSD; or (b) institutional T-Bill exposure for KYC’d allocators with primary-redemption access.

Summary

thBILL is Theo Protocol’s onchain wrapper around a regulated US Treasury bill fund. You buy the token, hold it, and the price slowly goes up — around 3% a year — because the underlying T-bills accrue interest. There are no rewards to claim, no rebases, no vesting. On paper, it’s one of the cleanest “onchain savings account” products available in DeFi today.

⚠️ Restated 2026-08-23: the basket holds three things, not two, and about a quarter of it is USDC. As the reserve now computes, the split is roughly ULTRA 43% / FILQ 33% / USDC 24%, not the “about 83% / about 17%” this report described. USDC was never listed here as a reserve asset at all. For a holder that cuts both ways: USDC is a more liquid, more readable instrument than either tokenised fund leg, so its presence is not a downgrade in quality — but if you bought this as pure tokenised-Treasury exposure, a quarter of it is a stablecoin, and the published description did not tell you that.

The fund legs themselves, as originally described: as of June 2026 the basket holds two underlying funds. The majority (about 83%) is the Singapore-regulated T-bill fund run by Wellington Management and Standard Chartered’s Libeara, reached through the tULTRA wrapper. In late June 2026 Theo added a second fund — Fidelity International’s tokenized dollar fund (FILQ, about 17% of the basket) — a Moody’s AAA-mf money-market fund, Fidelity-managed and tokenized by Sygnum. This is a modest positive: less reliance on a single fund, another household-name institution in the mix, and FILQ is actually the more transparent leg (thBILL holds it as a real, directly-readable on-chain token, whereas the tULTRA wrapper is synthetic — it holds no actual ULTRA and reports its value by attestation). Wellington, Standard Chartered and Fidelity are the strong part — household-name institutional players. Theo, the Panama-registered entity that issues thBILL, is the weak part: under a year old (launched July 2025), unlicensed, and your legal claim in the worst case is against a Panama corporation, not against the underlying T-bills directly.

Most retail allocators looking for Theo yield should look at thUSD instead. thBILL is now primarily a backing asset for thUSD; new retail mint flows have effectively migrated. This report remains useful for existing thBILL holders and KYC’d allocators evaluating institutional-grade T-Bill exposure.

I. Smart Contract Risk

One audit from Zenith Audits covering the vault and bridge contracts. No bug bounty program. About thirteen months of live operation with no reported exploits, forced pauses, or redemption failures — clean track record, but short.

The vault itself uses the standard ERC-4626 pattern (the common DeFi savings-vault interface), which is well-understood. Theo layers a proprietary “iToken” standard on top to handle pending-assets accounting across the 4-day off-chain settlement window. This is the novel part — it’s not battle-tested outside Theo’s own deployment.

Cross-chain model. thBILL uses LayerZero’s OFT (Omnichain Fungible Token) standard to move between Ethereum, Arbitrum, Base, and HyperEVM. Bridges are where recent attacks have concentrated — the rsETH exploit on 2026-04-18 ($292M loss) was a LayerZero OFT failure, the same architectural class thBILL uses. An on-chain audit across all four EVM deployments confirms thBILL is not structurally exposed to the same attack class. Every peered pathway across all four chains requires 3 independent DVNs — LayerZero Labs + Polyhedra/Google Cloud + Horizen Labs — an explicit upgrade above the 2-DVN default. rsETH’s exploit hit a pathway that only required 1 DVN; thBILL’s configuration would require compromising a quorum of independent providers across multiple operators, with no single-operator concentration. Zero exposed-and-peered pathways across all four chains. The admin Safe is the same Theo address on every chain (3-of-5 on Ethereum and Arbitrum, 3-of-4 on Base and HyperEVM). On Ethereum specifically, thBILL is structured as two contracts: the user-facing token vault (0x5FA487…DA0b, which is Pausable as an emergency lever) and a separate LayerZero OFTAdapter (0xfDD22Ce6…F55A5a) that handles cross-chain messaging.

The caveats: (1) Destination-chain adapter contracts were likely deployed after the single Zenith audit was completed, so that code surface is probably unaudited. A correct DVN config doesn’t protect against a buggy adapter. (2) No publicly confirmed kill-switch on the OFTAdapter itself (it’s not Pausable); pause control runs through the underlying token vault. The pauser identity on the vault is not publicly disclosed. (3) The Theo admin Safe at the same address operates with different thresholds across chains — 3-of-5 on Ethereum and Arbitrum, 3-of-4 on Base and HyperEVM. Small inconsistency worth confirming with Theo. (4) Several unpeered pathways have burn-address DVN defaults — not exploitable today (no peer set), but if Theo ever activates one of those chains the burn DVN would block message delivery until receive config is replaced.

Admin powers. A 2-of-4 multisig can pause the contract in emergencies. A 3-of-5 owner multisig controls upgrades and parameter changes. There is no timelock on admin actions — changes can take effect immediately. Signer identities are not publicly disclosed. Practically: if Theo decides to change how the protocol works tomorrow, there’s no notice period and no way for a holder to exit first.

What to watch: the Zenith audit report (publicly available) and any announcements of contract upgrades, parameter changes, or redemption-policy changes. Read them carefully before they take effect.

Clean track record so far, but single audit + no bug bounty + no timelock + novel iToken component + likely-unaudited bridge adapter = limited margin of safety.

II. Economic / Market Risk

How yield works

thBILL’s price goes up over time. At launch ($1.00), today (~$1.023), roughly +3% annualized. You pay nothing and claim nothing — yield is the difference between buy price and sell price. The underlying T-bills pay interest to the fund; the fund’s NAV ticks up; thBILL’s NAV ticks up with it.

Getting in and out

Getting in is easy — buy on a DEX. The deepest venues are typically Project X on HyperEVM (thBILL/USDT0) and Uniswap V3 on Arbitrum (thBILL/USDC); concentration between them shifts over time. The Ethereum Uniswap V3 pool exists but is thin; Base is a deployment chain with no live liquidity. The market price trades persistently below NAV by single bps to low hundreds of bps. The pre-Apr-2026 baseline ran around −20 bps; through April the discount widened to the −80 to −150 bps band following the April 27 stress event, then tightened back to a −20 to −60 bps daily-average regime by mid-May 2026 with intra-day prints crossing back to flat. The range and direction are not stable: a stress event can re-widen it materially, and recovery typically takes weeks rather than days because there is no competitive arbitrage market enforcing the peg.

The discount has broken out of that band entirely, and it widened further as the float collapsed. The market is at −2.58% to NAV at 2026-08-23, from −1.63% on 08-18, with the persistence flag on our tracker firing. Put that next to the history: the calm regime is −20 to −60 bps, and the worst readings after the April 27 stress event were −80 to −150 bps — so this is roughly 1.7× the worst stress-event print.

⚠️ But read it as a statement about how little market is left, not about stress. The float collapse explains what would otherwise look anomalous — a stress-level discount with no stress event: that band was calibrated in April against roughly 28M of external float, and the float is now about 2.14M. A price struck on $621K of pool liquidity and $4.4K of daily volume is not comparable to the same percentage struck on a market ten times deeper. The honest conclusion is that the old band no longer describes this token, rather than that thBILL is in distress. That is an interpretation of the timing rather than a proven link. What it means practically is unchanged and simple: the exit is thin, and getting thinner. Formerly: the market is now more dislocated than it was at the peak of a stress event, with no stress event. That is not a price signal about the T-Bills; it is what a market looks like when there is no arbitrageur left in it. The mechanism is covered under Getting out below — the people who could close this spread have stopped showing up. Live discount + per-chain peg history on the live dashboard.

⚠️ The reserve is held at single keys, and that is not what the admin section describes. Theo’s reserve treasury is a plain wallet — no multisig, no timelock, verified as an ordinary externally-owned account on both Ethereum and Arbitrum. Roughly $37M of backing sat there and moved on one signature on 2026-08-20. The second custody leg is the same shape: the $20.1M FILQ position sits at another plain wallet. The 3-of-5 multisig this report describes elsewhere governs the contracts, not the money — if you read that as covering custody of the backing, it does not.

Where the $37M went, and what is and isn’t known. It is located, not missing: a single contract now holds 35,211,770 ULTRA, 97.29% of that token’s supply, established by walking the token’s entire transfer history rather than sampling. That is the same concentration the reserve always had — it moved, it did not shrink. The move looks operational rather than hostile: someone sent one token along the full route first, waited, then sent the remaining 35.2M by the identical path under two hours later, and returned the test token. An operator rehearses a migration that way; an attacker does not.

That reading is now confirmed rather than inferred. The key that deployed the destination contract also deployed the ULTRA token itself, the waypoint used in the move, and a manager contract independently identified as Theo’s — and the contracts involved were created in July 2025, thirteen months before the transfer. The destination is Theo’s own infrastructure. So the money did not leave Theo; our own monitoring was reading the old address, which is a gap in our tooling rather than a problem with the reserve, and the fix belongs there.

⚠️ But closing that question opened a larger one, and it is the part worth your attention. The ULTRA token itself — the biggest single thing backing thBILL — is built on the same replaceable-logic pattern as the contracts above. The asset behind your holding is not a fixed contract; whoever holds its upgrade key can change what it does. And that key is not readable from the chain.

So there are three separate layers of control over this product, and this report has only ever described one:

• thBILL’s own contracts — governed by a 48-hour timelock with a 4-of-6 multisig proposing. ⚠️ Genuinely well built — with one carve-out described below.
• The reserve assets — the ULTRA and FILQ that actually back your holding sit at plain single-signature wallets with no delay. (thBILL tokens themselves are held by a 4-of-5 multisig; it is the reserve that sits at bare keys.)
• The reserve asset’s own logic — governed by one plain key, which has already used it twice.

⚠️ That key has now been identified, and it is one person’s signature. A single plain wallet — no multisig, no timelock, no contract of any kind — is the only holder of the top admin role on the ULTRA token and the only holder of it on the vault holding 97% of that token. Not one of several signers. One, on each.

And it has already been used. That key has replaced the logic of the ULTRA token twice this year — in March and again in April — sending the upgrade straight from the wallet to the contract with nothing in between. It did the same to the vault twice more.

This is the thing to take away from this report. Elsewhere in our coverage we mark issuers down for being able to do this. Here it is not a possibility, it is what has already happened, on the asset that backs your holding. If that key is compromised, or simply used badly, what thBILL is a claim on can change without warning and without anyone’s approval.

⚠️ And this is the part that changes how to read all of it. thBILL’s own product contracts are properly governed — a 48-hour timelock, self-administered, with a 4-of-6 multisig proposing. Theo migrated to that deliberately in May 2026 and it is the same timelock that runs thUSD. So Theo plainly knows how to do this.

One qualification, because it is not spotless. Alongside the timelock, a single plain wallet holds an “emergency” role on the vault — and the same wallet can also veto proposals made to the timelock, and sits on both of Theo’s multisigs. So the person who can block a delayed change also holds emergency powers over the thing the delay is protecting. What that emergency role can actually do is not something we have been able to establish — it may be a pause switch, which would be ordinary and sensible, or it may reach further. We are not guessing from the word “emergency”, and neither should you.

Which makes the reserve side a choice rather than an oversight. The asset that actually backs your thBILL is still administered by one plain key with no delay and no quorum, inside the same estate as the properly-timelocked vault, on the same chain. Not a legacy corner they haven’t got to — a practice they have, applied to one layer and not the other.

And it corrects something this report told you. It described a “3-of-5 multisig with no timelock” as the admin picture. The threshold is higher than that, there are two multisigs rather than one, and there is a timelock — just not over the reserve.

Both layers are now scored — Contract & Admin moves 4.5 → 3.5, a full notch, half for custody at single keys and half for the reserve asset’s upgrade path. Neither was counted before.

**Silent-supply mutation.****Silent-supply mutation.**Silent-supply mutation. thBILL’s contract emits zero on-chain events during mints and burns — direct polling of totalSupply() is the only way to see supply changes (same architectural pattern documented for tULTRA at the underlying layer). Practical implication: standard ERC-20 indexers (Etherscan, Dune, The Graph) cannot track thBILL flows. The live dashboard’s redemption-pulse panel surfaces these silent supply mutations directly.

Getting out is the catch — and it has got worse. Primary redemption (the official swap-back-to-USDC path) requires KYC and accredited-investor status, so for most retail DeFi users it was never available. What changed in 2026 is that the channel now looks closed rather than merely gated.

The evidence is on-chain and you can check it yourself. The last redemption of any kind through the primary path was 2026-07-09, and the last one not attributable to Theo’s own operator address was 2026-07-08 — roughly six weeks of nothing. Supply currently reads identical to its 24-hour-ago value to twelve decimal places. This sits alongside the repositioning described at the top of this report: Theo’s front-end routes new users to thUSD, the /thbill path redirects, and the docs are written thUSD-first. An issuer that has stopped offering an asset to outside holders does not have a functioning external redemption channel, whatever the contract still permits. That is the reason the Redemption axis is 2.0, and it is not a statement about the contract — the contract is fine.

Your practical exit is selling on a DEX.

The secondary market prices thBILL at a persistent discount to NAV. This discount is not a bug — it’s structural. The only participants who can close it via arbitrage are KYC’d institutions, and they only arbitrage when the spread exceeds their own costs (redemption fees at the underlying fund, gas, 4-day settlement carry). So the discount has a floor, and that floor is your real exit cost as a retail user. Empirically, primary redemption was historically dominated by a single Theo operator address; in May 2026 a recurring small-cadence redeemer (0x5e6f5946…, ~50K-thBILL bursts roughly weekly) became active alongside it — provenance not on-chain-disclosed. Even with a second burn-side participant, there is no competitive arbitrage market enforcing the peg, so the discount is not mechanically pulled back.

Exit sizing matters, and the market you would be selling into is very small. Live figures at 2026-08-18:

Aggregate DEX liquidity, all venues	$671,715
Fund size	about $60.6M (58,480,001.56 shares at NAV 1.0354, read 2026-08-23; was $87.0M on 08-18) — of which only about $2.2M is external float
Liquidity as a share of the fund	0.77%
24-hour secondary volume	$89,364
Where that volume happens	Arbitrum $69,567 · HyperEVM $19,614 · Ethereum $109

That liquidity does not run “in the low-single-digit-million range” against a fund “on the order of $130M+.” Both numbers have fallen, but they have not fallen together: the fund shrank by roughly a third while the tradeable float shrank by considerably more. The external float has contracted in absolute terms, which is the expected consequence of thBILL becoming an internal reserve asset — every share that moves into the thUSD reserve is a share that is no longer available to trade against.

Note the Ethereum line in particular. Ethereum is the canonical deployment and holds the majority of supply, and it turned over $109 in a day. As a venue it is effectively dead; the only live markets are Arbitrum and HyperEVM. The two-deepest-pools structure typically holds more stablecoin than thBILL, so selling thBILL for stables has more depth than the reverse, and for sized retail exits the binding constraint is buy-side depth (which is what KYC arbitrageurs would need in order to close the spread). Live 2% buy/sell depth per venue on the live dashboard.

Stress-event data point (positive — April 27, 2026). The fund processed a single $65.3M redemption (~33% of supply at the time, the largest on record) cleanly via Theo’s primary path — no contract failure, no bridge incident, no backing-ratio break. The structural plumbing held under the largest stress test thBILL has seen. The cost paid was on the secondary peg, not on the redemption rails. The secondary discount did widen materially in the weeks following (peaks in the −80 to −150 bps band) before tightening back to a −20 to −60 bps daily-average regime by mid-May — i.e. the post-stress repricing wasn’t permanent, but it took roughly three weeks to normalize. The multi-week recovery window is itself the exit-cost signal — anyone forced to exit during the dislocation paid materially more than baseline. The underlying mechanics held throughout.

Fee note. The underlying fund’s fee schedule isn’t publicly disclosed with confidence — public sources (rwa.xyz, stomarket.com) actually disagree on whether a 0.45% figure is a redemption fee or a management fee. Net: the underlying layer takes somewhere between 30 and 100 bps annually, and part of that probably comes out on redemption. This matters mostly for KYC’d holders; for retail it’s baked into the DEX discount floor.

Farming it

Three paths most retail users consider:

1. Hold for yield. Buy, sit, accrue NAV. The simplest path, with the least stacking risk. Net yield is ~3% after the DEX buy-side discount amortizes over your holding period. No gas after purchase, no rewards to claim, no maintenance.

2. Pendle PT-thBILL. Pendle offers a fixed-yield version — you buy PT-thBILL (the Principal Token) and at maturity (18-Jun-2026) it redeems to thBILL worth $1 USDC at NAV — not 1 whole thBILL, and not USDC. Pendle’s accounting unit on this market is USDC, but settlement is in thBILL: you receive an amount of thBILL whose NAV equals $1 (slightly less than 1 token, since thBILL’s NAV accrues against USDC over the term). So PT fixes a USDC-denominated yield, but you exit holding thBILL and still face thBILL’s retail exit path (DEX, with the structural discount) to actually convert that into USDC. The Pendle UI shows this as “1 USDC in thBILL” — that framing is correct. PT markets are on Arbitrum only. What stacks: Pendle’s own smart-contract risk on top of thBILL’s. Pendle is well-audited and battle-tested, but you’re now trusting two protocols instead of one. The fixed-rate mechanic also means you don’t benefit if the thBILL NAV-vs-DEX discount narrows during your holding period — that upside goes to the YT buyer.

3. Lending collateral (Euler). You can supply thBILL to an Euler market to borrow stablecoins, giving you leverage on the T-bill yield. This is advanced, and the oracle model is everything: if the market uses a DEX-priced oracle, a temporary DEX dislocation (thin liquidity + a forced seller) can liquidate you even when the fund is perfectly healthy. If it uses a NAV-priced oracle, you’re materially safer. Read the oracle config for the specific Euler market before supplying, and size assuming the oracle can and will misbehave during stress. Not recommended unless you understand the liquidation engine at the market you’re using.

High-quality underlying, reached through an exit that has stopped working for outside holders. For retail the picture is structurally bad on both counts: no primary access, a DEX market with about $670K of depth, and a price that sits further below NAV than it did during the asset’s worst stress event. By the numbers, thBILL’s market price tracks fair value far more loosely than crvUSD or OUSD — the gap is roughly an order of magnitude larger and, unlike those, it does not mean-revert, because the mechanism that would pull it back is gated to participants who are no longer active. That is why Liquidity and Redemption both score 2.0, and it is why they are the two axes carrying this report’s score down.

thBILL as backing for thUSD — practical implications

The repositioning covered at the top of this report (96.34% of thBILL held intra-protocol by the thUSD reserve as of 2026-08-23, against the 55–70% previously recorded; consumer-facing front-end migrated to thUSD; the relevant external float is materially smaller than the headline supply implies) has two retail-facing implications worth surfacing in the risk discussion specifically:

• The headline backing ratio surfaced on the live dashboard will periodically dip below 100% on the on-chain-only tier as Theo mints new thBILL ahead of the corresponding ULTRA arrival from Libeara (cyclic Stage A pattern, T+1 to T+7 settlement window). The economic tier (which credits the in-flight Libeara receivable) stays near 100%. This is structural, not a stress signal — escalation thresholds are a persistent dip past T+7 (warn) and past T+14 (escalate). The validator surfaces stage_a_warn / stage_a_escalate flags directly.
• A stress event in thUSD (e.g., a sized thUSD redemption rush) would propagate into thBILL via the reserve. thUSD’s “100% backed” claim relies on thBILL coverage at NAV, which itself relies on Libeara’s settlement infrastructure. Each layer attests honestly to the layer above, but the chain is only as resilient as its weakest link. For most use cases this works; in stress it’s a coupled system.

Live dashboard

A live monitoring view is available at tidresearch.com/dashboards/thbill — refreshed hourly from on-chain RPC reads, Libeara NAV attestation, and DEX depth probes. It surfaces the signals discussed above as standalone panels:

• Backing ratio (three tiers: physical / on-chain-only / economic — only the economic tier credits in-flight Libeara settlement, so the on-chain-only tier is the one that periodically dips during Stage A windows).
• Holder attribution (External float vs thUSD reserve vs OFT-adapter-locked) — answers “how much thBILL is actually accessible to retail vs intra-protocol?”
• Per-chain peg (VWAP vs NAV with 7-day premium/discount history, by chain).
• Pool depth and 2% buy/sell depth (the numbers you’d actually exit against).
• Redemption pulse (24h supply delta + days since last on-chain burn — catches the silent supply mutations that standard ERC-20 indexers miss).

For sizing decisions, the holder-attribution and per-chain peg panels are the two that bind first.

III. Project / Issuer Risk

thBILL sits on top of two very different counterparties, and the risk is concentrated in one of them.

The strong part: Wellington Management + Libeara (Standard Chartered), now joined by Fidelity International. The majority fund underneath everything (about 83%) — the Delta Wellington Ultra Short Treasury On-Chain Fund — is sub-managed by Wellington Management, one of the largest asset managers in the world (~$1.2T AUM). It’s tokenized by Libeara, Standard Chartered’s incubated RWA platform, and operated through FundBridge Capital, a MAS-regulated (Singapore) fund manager. Since late June 2026 about 17% of the basket sits in Fidelity International’s FILQ — a Moody’s AAA-mf money-market fund from another household-name manager, tokenized on the Swiss-regulated Sygnum stack. Custody and regulatory oversight on the actual T-bills and money-market instruments is institutional-grade. Adding FILQ modestly reduces the reliance on a single fund, though it also adds a new dependency on Sygnum’s custody and FILQ’s permissioning.

The weak part: Theo Protocol Corporation. Theo is the Panama-registered entity that issues thBILL and wraps tULTRA. Theo is not a licensed financial institution anywhere. The founders are public (ex-Optiver and IMC quant traders) and the protocol is backed by Hack VC with $20M raised in April 2025. Audits beyond the Zenith report are not publicly disclosed. The project is about thirteen months old.

What this means for your legal claim. When you hold thBILL, you do not own T-bills. You own a token issued by Theo that represents a contractual claim against Theo for a USDC-equivalent amount. If Theo becomes insolvent, your recovery depends on Panamanian corporate proceedings against a non-regulated issuer. There is no bankruptcy remoteness — no legal firewall between Theo’s other obligations and the assets backing thBILL. This is the structural gap between thBILL and its institutional peers (BUIDL, USTB, USYC), which use Cayman or 3(c)(7) fund structures that give holders direct legal claim on the fund’s assets.

The practical read: the T-bills backing thBILL are extremely safe, but the wrapper isn’t. Your risk is mostly about whether Theo (the Panama company) continues to exist and operate competently, not about whether US Treasuries default.

Strong asset quality undermined by a young, unlicensed, non-bankruptcy-remote issuer.

Bottom Line

Overall Risk	3.5/10 — Elevated	was 4.0
Stability	8.0/10	new axis
Contract & Admin	3.5/10	new axis
Redemption	2.0/10	new axis
Underlying	4.0/10	was 5.0
Liquidity	2.0/10	was 3.5
Issuer	4.5/10	held

Underlying moves to 4.0. The sponsors are bluechip — Wellington and Standard Chartered’s Libeara behind tULTRA, Fidelity International behind FILQ — but this axis is read on what can be verified about the collateral, not on the strength of the names. ⚠️ None of the three legs carries independent coverage or a published audit of its wrapper, and about a quarter of the basket is USDC, which appears in no published description of the reserve. ✅ The T-bill exposure itself is not in question, and this is not an exit finding — redemption and liquidity are scored separately at 2.0 each. What moved is how much of the axis can rest on measurement rather than on sponsor reputation.

On the scoring rubric — and why it changed. thBILL is a vault share: a unit in a fund, whose value tracks the fund’s NAV. This report used to score it on the stablecoin rubric (peg / backing / underlying / liquidity / issuer), which was the wrong lens and had a specific cost — that rubric has no redemption axis, so the most important thing a retail holder of this asset needs to know had nowhere to appear. It now scores on the same six axes as every other fund-share report on this site.

Where the old material went: the peg-mechanism content was never really about a peg — thBILL does not target $1, it tracks NAV — so the discount discussion now sits under Liquidity, which is where a price that will not converge to fair value actually belongs. The backing content merged into Underlying.

What each axis is doing here:

• Stability 8.0 — scores the NAV, not the market price. The NAV accrues smoothly at roughly 3% and has never misbehaved. Do not read this as “the asset is fine”; it is the only high number on the page, and the gap between NAV and what you could actually sell at is scored below.
• Contract & Admin 3.5 — cut a full notch on 2026-08-23, half for reserve custody sitting at bare single-signature wallets outside the multisig, and half for a single plain key holding sole admin over the ULTRA token that backs this product — a key that has already replaced that token’s logic twice this year. Neither layer was previously counted. Plus: one undisclosed audit, no timelock on admin actions, and a wrapper stack (thBILL → tULTRA → Libeara) in which the middle layer is an ERC-4626 vault that holds none of the asset it claims and reports its value by attestation. Both Theo-controlled layers can be upgraded with no notice period.
• Redemption 2.0 — the primary path is not just KYC-gated, it appears closed to outside holders; nothing has redeemed since early July.
• Underlying 5.0 — see below.
• Liquidity 2.0 — about $670K of tradeable depth against an $87M fund, with the discount outside its own stress band.
• Issuer 4.5 — a thirteen-month-old, unlicensed Panama company standing between you and some very good T-Bills.

Why Underlying stays at 5.0 while everything about access got worse. This axis scores the collateral itself, and none of this year’s evidence touches it — a market that has stopped trading says nothing about the quality of the Treasuries. The collateral is genuinely excellent: roughly 83% via Standard Chartered’s Libeara (Wellington Management as fund manager, FundBridge as MAS-regulated administrator) and about 17% via Fidelity International’s FILQ, a Moody’s AAA-mf money-market fund tokenized by Sygnum. On asset quality alone this would score in the high eights.

It sits at 5.0 because this axis has to answer a second question as well: can you verify the collateral is there? (Leg sizes below are the older ~83%/~17% figures; see the restated composition above — the direction of the argument is unchanged.) For the FILQ leg, yes — it is held as a real, directly-readable on-chain token. For the tULTRA leg, no: that wrapper holds zero of the ULTRA it names as its asset, and reports its value as an attested accounting figure reconciled off-chain against Theo’s treasury. So the honest read on this axis is excellent assets, most of which you are taking on trust rather than reading. That mid-point is what 5.0 encodes, and it is why the June 2026 FILQ addition mattered — it was the first leg of this basket a holder can actually check.

Who it’s for: Existing thBILL holders who want to understand current backing and exit dynamics. KYC’d allocators evaluating institutional-grade T-Bill exposure with primary-redemption access. Holders of thUSD who want to inspect the largest reserve component of that product. New retail allocators seeking Theo yield should look at thUSD instead — the consumer-facing front-end has migrated.

Who should avoid: Anyone who needs instant redemption, wants direct legal ownership of the underlying Treasuries, is risk-averse to issuers under one year old, or is sizing positions larger than DEX depth can clear without material slippage.

A note on what this report doesn’t cover. This analysis combines what we can verify on-chain with what’s publicly documented. Some attack classes — a recent example: the rsETH single-DVN bridge exploit in April 2026 — only become visible after they manifest in production; our methodology is retrospective on novel risks. We also cannot fully audit the underlying T-bill custody chain at Standard Chartered, Wellington Management’s portfolio composition, the MPC operator’s signer composition, or the Zenith audit report (acknowledged by Theo’s docs but not publicly linked). Sized positions should leave room for residual unknowns this analysis cannot enumerate.

Revision history

2026-08-18 update — Overall 4.5 → 4.0, and this report has moved onto the correct scoring rubric.

The rubric fix comes first, because it is why the re-rate was overdue. thBILL is a vault share — a fund unit whose price tracks NAV — but this page had been scored on the stablecoin rubric (peg / backing / underlying / liquidity / issuer). That rubric has no redemption axis, so thBILL’s single most important retail fact — that you probably cannot redeem through the primary path — had nowhere to land on the page retail readers actually see. It has now moved to the vault-share axes used for every other fund-share report on this site: Stability / Contract & Admin / Redemption / Underlying / Liquidity / Issuer. Nothing was rescored to make the numbers fit; the peg and backing material has moved into the Liquidity and Underlying discussions, where it belongs.

Two axes then fell, and both fall out of one fact: thBILL has stopped being a product and become plumbing.

• Redemption 3.5 → 2.0. An issuer that no longer offers an asset externally does not have a working external redemption channel, whatever the contract permits. Publicly checkable: the last redemption of any kind was 2026-07-09, and the last non-operator redemption was 2026-07-08 — about six weeks ago. Supply was, when this was written, identical to its own 24-hour-ago reading to twelve decimal places (84,059,152.134528): no mint, no burn. ⚠️ That stopped being true on 2026-08-22, and what replaced it strengthens this axis rather than softening it. Supply fell 29% to 58,480,001.56 — and still no redemption is recorded, the last of any kind remaining 2026-07-09. Roughly 25.6M tokens left supply with nothing logged against them, by a mechanism not visible in on-chain events. A holder looking for evidence of a working external redemption channel has less of it now, not more.
• Liquidity 3.5 → 2.0. As thBILL becomes an internal reserve asset there is progressively less of it outside the protocol to trade. Aggregate DEX liquidity is $671,715 against a fund of about $87.0M — 0.77%, on 24-hour volume of $89,364. That liquidity is best read against “$130M+”. The float has shrunk in absolute terms, not just relative.

Stability holds at 8.0, and it is important not to misread it. That axis scores the NAV, which is behaving exactly as a T-Bill NAV should — 1.035365, smooth accrual, no drama. The dislocation is between the market price and NAV, and it is priced under Liquidity and Redemption instead. It is now the only high axis on the page. The honest summary: the underlying T-Bills are genuinely safe, and almost everything about getting at them is not.

• 2026-08-23 — reserve composition restated, custody measured, scores cut. Overall 4.0 → 3.5. 96.34% of thBILL is held intra-protocol at the thUSD reserve, against a 55–70% band recorded earlier in the year: of 58,480,001.56 outstanding, 56,336,827.05 sits in the reserve Safe, leaving an external float near 2.14M tokens, about $2.2M. Supply fell 29% over the period, to about $60.6M at NAV 1.035365 from $87.0M on 08-18. ⚠️ The last redemption through the primary path was 2026-07-09, and the last not attributable to Theo’s own operator address was 2026-07-08. Reserve custody sits at bare single-signature wallets outside the multisig. The market discount reached −2.58% to NAV, outside the −80 to −150 bp band, which the float collapse explains rather than a stress event.
• 2026-08-23 — per-chain Safe thresholds measured. The same Theo Safe 0x94877640…01295 governs all four chains at 4-of-6 on Ethereum, 3-of-5 on Arbitrum, 3-of-4 on Base and HyperEVM. ⚠️ The owner sets are strictly nested — one signer set with three chains holding truncations of it, not four independent configurations. Ethereum’s sixth signer is 0x97f60fb7…. Separately, ROLE_ADMIN sits on a bare EOA 0xa04bddfb…9b2a alongside the 4-of-7 Safe 0xd6d4Bcde…a196.
• 2026-08-18 — rubric migration and re-rate. Overall 4.5 → 4.0.