KPK (karpatkey)

The research assessment is adverse because an eligibility question remains unresolved, not because of KPK’s quality as a firm. KPK is the 2025 rebrand of karpatkey, a genuinely established operator founded in 2020. It has served as GnosisDAO’s sole treasury manager since 2022 and has a multi-year public record of managing treasuries for ENS, Balancer, Aave, CoW Protocol, Lido, Uniswap, Arbitrum, Nexus Mutual, Safe, and dYdX. Its 2024 funding round was backed by protocol founders, including Stani Kulechov and the Gnosis co-founders. Its non-custodial Safe-plus-Zodiac-Roles design is a real, disclosed control model. GnosisDAO’s 2025 approval of KPK’s spin-off into an independent Cayman Islands foundation entity is public record. This is the strongest-credentialed operator in this batch. But this review could not confirm whether KPK’s retail-facing curated vaults exclude US persons or impose another eligibility limit. The protocol-specific legal disclaimer pages that would answer the question could not be rendered. The one detailed incident account available is KPK’s own account of how the April 2026 Kelp DAO/LayerZero exploit affected its curated vaults. No independent source confirmed whether any loss was realized. This registry does not leave eligibility open when it is genuinely unresolved.

Review triggers: events that reopen the verdict
• The protocol-specific legal disclaimer pages for each vault venue are rendered and confirmed not to exclude US persons
• Fund-product eligibility and accreditation requirements for direct end-user access are disclosed
• An independent, non-KPK-authored account of the Kelp DAO incident’s actual financial impact on KPK-curated positions is published
• A primary Cantina audit report is published and linked, resolving the discrepancy with DefiLlama’s zero-audit field

Watched nightly: a warning on its venues or files, or a cited document that changes, reopens the memo. The first confirmation is due 2026-11-19.

The research file

Mechanism

KPK runs three product lines on one non-custodial design that uses Gnosis Safe with a Zodiac Roles Modifier permissions layer. The lines are bespoke DAO Treasury mandates, the original 2020 business; curated Vaults on Morpho, Gearbox, and Euler, distributed through retail-facing aggregators including Jumper Earn, Superform, and Vaults.fyi; and tokenized Funds with per-block on-chain NAV calculations for institutional distribution. A Vaults depositor holds a standard ERC-4626-style share on the underlying protocol. KPK never takes custody. It holds only pre-scoped permissions to make whitelisted rebalancing and allocation moves. Vault redemption depends on liquidity in the underlying lending market. Fund shares redeem in proportion to per-block NAV, though this review found no worst-case illiquidity disclosure for either path.

Legal structure and the GnosisDAO spin-off

KPK’s Terms of Service name the operator as Karpatkey Foundation and state that Cayman Islands law governs it. This is a genuine, confirmed disclosure. According to KPK’s own history, GnosisDAO formally approved karpatkey’s spin-off into this independent entity in 2025. The approval followed karpatkey’s incubation under Gnosis in 2020 and its appointment as GnosisDAO’s sole treasury manager in 2022. This is a real, disclosed change of legal entity, not a gap in disclosure. It is the strongest legal-structure finding in this curator batch.

The unresolved eligibility question

KPK’s general Terms of Service do not expressly exclude US persons. But KPK’s own documentation points to protocol-specific legal disclaimer pages for each vault venue (Morpho, Gearbox, Euler, Symbiotic). Those pages are the most likely place for the actual jurisdiction and eligibility limits, and they could not be rendered during this review. KPK’s public site also does not say whether Funds require accredited-investor or qualified-purchaser status for direct end-user access, rather than distribution through an integrator. This registry has treated every other tokenized or curated product with an unconfirmed eligibility question the same way. Spiko, DigiFT, and others in this backlog were rejected on exactly this basis despite similarly strong regulatory profiles. The same standard applies here.

Control and the Kelp DAO incident

KPK sets risk-based allocation and exposure caps and uses automation to rebalance within pre-approved Zodiac Roles permissions. This is a genuinely disclosed control model. KPK’s own blog describes the 2026-04-18 Kelp DAO/LayerZero V2 bridge exploit, the same event this registry used in rejecting `layerzero-v2` and `aave-horizon-rwa`. It says markets curated by KPK and treasuries managed by KPK used rsETH as collateral, and claims that KPK’s response contained exposure across six client DAOs. The article presents a story of competence rather than a loss disclosure. It does not state whether any KPK-curated vault or treasury realized a loss. This review found no independent account, written by a source other than KPK, of the incident’s actual effect on KPK’s book.

Track record and comparison

Current tracked TVL is roughly $174M, with 94% on Ethereum. DefiLlama lists zero audits for the KPK entity. KPK’s own materials claim that Cantina audited its smart-contract infrastructure in December 2025, but they do not link to a report. K3 Capital and Hyperithm were both rejected in this batch. Compared with them, KPK provides meaningfully clearer legal disclosures and has a genuine, multi-year operating record that others can verify and that predates its retail vault products. That record does not resolve the gaps in eligibility and independent incident confirmation described above. Those gaps are the actual basis for this rejection.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• KPK — Terms of Service · primary · accessed 2026-08-19
  Supports: Karpatkey Foundation Cayman Islands entity, general eligibility clause with no explicit US-person exclusion
• KPK — about and company history · primary · accessed 2026-08-19
  Supports: 2020 founding, GnosisDAO treasury mandate history, 2025 spin-off approval, funding round and backers
• KPK — vaults product page · primary · accessed 2026-08-19
  Supports: Morpho, Gearbox, and Euler vault deposits, retail aggregator distribution
• KPK — inside the war room, Kelp DAO incident case study · primary · accessed 2026-08-19
  Supports: April 2026 Kelp DAO LayerZero exploit response, self-published incident narrative
• DefiLlama — KPK protocol data · secondary · accessed 2026-08-19
  Supports: current TVL and chain concentration, zero audits field, previousNames karpatkey confirmation

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.