# Phala Network

> A confidential computing cloud using hardware TEEs. Your data stays private even from the infrastructure provider. The tech works, but the 'decentralised' label needs heavy qualification.

- Scores: Freedom 5.5/10 (grade C), Returns 5.2/10 (grade D)
- Category: compute · Token: PHA
- Published: 2026-03-05 · Updated: 2026-10-04
- Canonical: https://ownyourmind.ai/projects/phala/
- Data (scores + integrity verdicts, JSON): https://ownyourmind.ai/api/projects/phala.json
- Cite as: Own Your Mind (ownyourmind.ai), licence CC BY 4.0. Link the canonical URL.

Charts and interactive widgets are omitted here; their data is in the JSON above.

---

## What it does

Phala runs a cloud computing service where your data stays private even from the people running the servers. It does this using Trusted Execution Environments (TEEs): hardware-enforced sealed environments on the processor itself. You submit a workload (typically AI inference or an autonomous agent), the TEE processes it in an enclave that nobody can peek into, and cryptographic attestation proves the code ran correctly without tampering.

Concretely: you deploy Docker containers that run as confidential VMs on NVIDIA H100, H200 or B300 GPUs paired with Intel TDX processors, per Phala's site. The managed service (Phala Cloud) charges $3.50/hr for an H200, with $20 free credits for new users. For developers who want to self-host, the open-source dstack SDK converts standard containers into confidential VMs. dstack has been donated to the Linux Foundation's Confidential Computing Consortium, which is a meaningful credibility signal. Open-source donations to established foundations are harder to fake than partnerships.

Founded in 2018 by Marvin Tong (ex-Tencent, ex-Didi), Hang Yin (ex-Google, Bitcoin Gold co-founder) and Zhe Wang (serial entrepreneur, 20+ patents). The team is roughly 25 people. Entity structure is Hashforest Technology Pte. Ltd. in Singapore with a subsidiary in California. Originally a Polkadot parachain (since 2022), Phala migrated to an Ethereum L2 (Op-Succinct rollup via Conduit) in November 2025 and rebranded from phala.network to phala.com in September 2025.

The project sits in the DeAI-adjacent category. Phala is general-purpose confidential computing that has pivoted toward AI as its primary use case. The TEE technology is horizontal: it runs trading bots, healthcare analytics and LLM inference on the same infrastructure. AI is the highest-demand workload, not the founding thesis.

## Value proposition

Privacy at the computation layer is the core differentiator. Most "privacy" projects protect data at rest or in transit. Phala protects data during processing. The TEE ensures that even the infrastructure operator cannot observe what is happening inside the enclave. Remote attestation provides cryptographic proof that specific code ran on authentic, unmodified hardware.

SOC 2 Type I and HIPAA compliance certifications open doors that most crypto projects cannot reach. Healthcare, finance and enterprise clients need these compliance boxes ticked before any conversation about adoption begins. Few projects in the decentralised space hold both.

The ElizaOS V2 integration means AI agent swarms can run on Phala Cloud with TEE security out of the box. The NEAR partnership provides another concrete usage channel. These are working integrations generating usage, not vaporware announcements.

Phala reports 398 paid users, which represents early commercial traction, and that is more than most DePIN projects can demonstrate. Separate out the $2M+ ARR figure attached to Phala everywhere, because Phala doesn't publish it: it comes from third-party company profiles, and a search of Phala's own site, blog and 2025 report finds no revenue number. Treasury spending in 2024 was $2.1M, which is the figure people reach for in its place, and it measures what Phala spent rather than what customers paid. 398 paid users is a thin base for a cloud infrastructure business whatever the revenue behind them.

The counter-narrative is the gap between the privacy promise and the decentralisation reality. The L2 is Stage 0 on L2Beat: centralised sequencer, permissioned proposer, instantly upgradable contracts. The team can change the rules at any time with no exit window for users. You are trusting the operator, which is exactly what decentralisation is supposed to eliminate. The TEE privacy guarantee applies within the enclave but the network itself is centralised.

## Tokenomics

PHA launched via private sale and airdrop in 2020. Total raise across all rounds: approximately $11.43M ($10M strategic led by IOSG Ventures, $1.4M and $28K in private rounds, plus an undisclosed amount from DWF Labs in January 2024). Notable backers include IOSG Ventures, SNZ Holding, Waterdrip Capital and DWF Labs. Alameda Research (defunct) was also an early backer.

Total supply is fixed at 1 billion PHA. Long-term distribution:

- **Mining / compute rewards:** 70%
- **Private sale:** 15% (zero lock-up, 100% at TGE)
- **Airdrop:** 9%
- **Team and founding devs:** 5%
- **Other rewards:** 1%

The 70% allocation to mining rewards is generous, and 5% team allocation is notably low by industry standards. The knock is the zero lock-up on the 15% private sale; early investors could sell immediately at TGE. All investor vesting is now fully complete. The current circulating supply is shown above.

The emission model is disinflationary, with a 25% reduction every 180 days per the published tokenomics. These emissions release PHA from the pre-minted mining allocation rather than creating new tokens: the Ethereum contract minted all 1 billion at deployment and has no mint function. At the ~135,000 PHA a day recorded in March 2026, the release added roughly 5% of supply a year to circulating supply, and the schedule has cut the rate since.

Staking converts PHA to vPHA on Ethereum. The Phala staking interface shows a nominal APY of approximately 8.31%, but net yield after the release of new supply into circulation is roughly 3.3%. Unstaking requires a 21-day waiting period. Gatekeepers can be slashed; GPU workers are removed for non-compliance.

DWF Labs is both investor and market maker. DWF's reputation for market manipulation is well-documented in the industry. Their dual role warrants scrutiny of trading patterns.

PHA is down more than 95% from its all-time high (May 2021). Listed on Binance, Kraken and OKX, strong liquidity coverage across major exchanges, though Coinbase and Bybit carry no PHA pair. Live price data is displayed above.

## How to participate

**Stake PHA.** Convert PHA to vPHA via liquid staking on Ethereum. Earn approximately 8.31% nominal APY per the Phala staking interface (roughly 3.3% net of the supply released into circulation). The 21-day unstaking period is the main friction. Available through the Phala staking interface.

**Run a GPU worker.** Requires an NVIDIA H100, H200 or B200 GPU with an Intel TDX-capable CPU. Collateral: 1,250 to 2,250 vPHA per GPU. Hardware acquisition costs are substantial, and onboarding requires email registration. This is not self-service. The technical barrier and capital requirement make this a serious commitment.

**Build on Phala Cloud.** Deploy Docker containers with $20 free credits. The @phala/cloud npm package provides 60+ methods for programmatic access. Documentation runs to 100+ pages. A legacy Builders Program offered grants up to $50K, though its status post-L2 migration is unclear. Monthly Builders Challenges offer $2,500 prizes.

**Use as a consumer.** API access for confidential AI inference at $3.50/hr for H200 on-demand. No staking or hardware required.

## Honest assessment

### What works

[TEE confidential computing](https://ownyourmind.ai/why-deai/private-ai-inference/) is working and differentiated. This isn't a whitepaper promise; hardware enclaves exist, remote attestation works, and the technology prevents infrastructure providers from seeing user data. SOC 2 Type I and HIPAA compliance position the project for enterprise adoption that most crypto projects cannot access. The ElizaOS V2 integration and NEAR partnership provide concrete usage channels. dstack in the Linux Foundation is a strong credibility signal. The WireTap security response was competent: when academic researchers demonstrated an SGX key extraction attack, the team shut down all SGX workers and migrated to Intel TDX. Transparent handling of a serious vulnerability.

### What doesn't work yet

398 paid users is early commercial traction, not product-market fit. The L2 has minimal total value secured, and its fee vaults held under 0.01 of the chain's gas coin in lifetime fees on 21 September 2026, with every sampled block carrying only the protocol's own system transaction.  Legacy metrics do heavy lifting in Phala's marketing: "758,000 daily agent executions" were on the now-retired Polkadot parachain, not the current infrastructure. "35,000+ workers" are mostly decommissioned SGX miners. "42,900 DAU" are on-chain addresses including worker nodes, not distinct human users. The governance model downgraded from Polkadot's on-chain referenda to Snapshot voting plus a Safe multisig. That's a step backwards, not forwards. No HuggingFace presence is notable for a project positioning itself as AI infrastructure.

### The risk

The L2 is Stage 0, with instantly upgradable contracts and no exit window. This is the single largest centralisation risk. One developer (kvinwang) accounts for over 90% of commits to the dstack codebase, per GitHub's contributor count on 24 September 2026.  If that person leaves, the core SDK is at serious risk. The entire security model depends on Intel TDX and NVIDIA Confidential Computing remaining trustworthy: two hardware vendors hold the keys to Phala's privacy guarantee. That trust has already been tested. In October 2025 the TEE.fail researchers used a DDR5 memory interposer costing under $1,000 to extract Intel TDX attestation keys, and showed a server operator running a dstack workload outside any enclave while forging the attestation, so the user still believes it ran in a TDX CVM. NVIDIA's GPU attestation isn't bound to a specific VM, so it can be borrowed from another machine. The attack needs physical access to the server, but it means a passing attestation proves less than it appears to. Multiple simultaneous migrations (Polkadot to Ethereum, SGX to TDX, Phat Contracts to dstack, phala.network to phala.com) compound the execution risk. The California subsidiary means US regulatory exposure through Hashforest Technology LLC.

### My position

I do not hold PHA. I covered Phala extensively in [What Counts as Decentralised AI?](https://ownyourmind.ai/why-deai/what-counts-as-decentralised-ai/) as a DeAI-adjacent project: credible technology serving AI workloads from a general-purpose privacy infrastructure base. The TEE technology is credible. The decentralisation isn't. At more than 95% below ATH, the market has already expressed scepticism. Whether Phala converts its enterprise compliance positioning into meaningful adoption beyond 398 paid users is the core investment question.

## Freedom Score: 55/100

Phala scores 55/100 (C grade). Full methodology at [Freedom Score Methodology](https://ownyourmind.ai/resources/freedom-score-methodology/).

**Infrastructure decentralisation (8/20).** The L2 is Stage 0 on L2Beat: centralised sequencer, permissioned proposer, instantly upgradable contracts with no exit window. GPU worker registration requires emailing the team (not self-service). Over 90% single-developer commit concentration on the dstack codebase is an extreme bus factor. The 29,478 active devices Phala reports provide hardware distribution, but chain-level infrastructure is heavily centralised. The migration from Polkadot removed the shared security of a decentralised relay chain.

**Governance decentralisation (7/20).** Governance downgraded during the L2 migration. Polkadot-era on-chain governance (referenda, council) was replaced with Snapshot voting plus a Safe multisig controlled by the team. Snapshot votes are non-binding signals; the multisig executes. The forum has 617+ topics, but decision-making is team-led. No evidence of community override ability. This is a material regression from the previous governance model.

The space is current and it is nearly empty. Four proposals closed between December 2025 and 4 September 2026, with turnout in single figures on every one.  One closed with no votes cast at all and still resolved. The consequential one transferred the treasury to Phala Ltd. as a mandate-limited operating vehicle, and it passed on three voters with none against. A live venue with that turnout is a weaker check on the team than a dead one would be honest about.

The newest, closed 4 September on seven voters, [backs a Foundation plan](https://snapshot.box/#/s:phala-network.eth/proposal/0x4fcf36d1b00ec172d9239683034d910e8e7f8e9034d3a3d7bec4a7bbf6855238) to pay out the 160M PHA already in the GPU mining contract evenly over 15 months, to close the yield gap with Bittensor. The proposal says implementation work starts after the vote. A second proposal, for a monthly buyback and burn funded from revenue, was still open on 4 October and closes on 5 October.

**Token distribution fairness (10/15).** The 70/15/9/5/1 split is favourable: 70% to mining rewards and only 5% to the team is rare. All investor vesting is fully complete. Most of the supply is now circulating (see the live figure above). Total funding of approximately $11.43M is modest, suggesting limited VC overhang. The knock is the zero lock-up on the 15% private sale allocation. DWF Labs serving as both investor and market maker is a concern.

**Censorship resistance (8/15).** TEE computation-level privacy holds: data cannot be observed during processing. However, the centralised sequencer can censor L2 transactions. GPU worker onboarding is gated (email-based registration). California terms of service apply via the US subsidiary. The privacy guarantee applies within the enclave but not at the network access layer.

**Data sovereignty (11/15).** TEE enclaves are hardware-enforced, so a compute provider without physical access to the server can't read data during processing. This is a fundamentally different guarantee from policy-based "we don't store your data" claims. Remote attestation lets consumers check computation integrity before sending sensitive data, though the TEE.fail research (October 2025) showed an operator with physical access can forge it for dstack workloads. The self-hosted dstack option means you can run the entire stack without relying on Phala's managed service. SOC 2 Type I and HIPAA compliance add institutional credibility. Gaps: the sequencer has metadata visibility (knows who is transacting, if not what), Phala Cloud registration requires account creation, and the centralised L2 architecture means the privacy guarantee applies within the enclave but not at the network access layer.

**Open source and transparency (11/15).** The core monorepo is Apache-2.0, though 140 of Phala's 205 own public repositories carry no licence file (GitHub API, 18 September 2026).  dstack donated to the Linux Foundation for neutral governance. Two professional audits completed (zkSecurity for dstack, Code4rena for Phat Contract runtime) plus an EtherAuthority token contract audit. Annual transparency reports published. The gap is the instantly upgradable L2 contracts: regardless of how transparent the code is, contracts that can change without notice undermine the "don't trust, verify" principle.

### Path to improvement

Three changes would materially increase Phala's score:

1. **Progress the L2 beyond Stage 0.** Add a timelock to contract upgrades. Introduce a permissionless proposer. Decentralise the sequencer. Every Stage 0 L2 claims it will decentralise eventually. The ones that earn trust do it on a published timeline with measurable milestones.
2. **Reduce dstack bus-factor risk.** Over 90% of commits from one developer is untenable for infrastructure that enterprises are supposed to trust. The Linux Foundation donation is a governance fix, not a contributor fix. The project needs more core contributors to dstack, urgently.
3. **Publish a Cloud revenue figure.** A $2M+ ARR number circulates through third-party company profiles with nothing from Phala behind it, which serves the company badly in both directions. External customer revenue and treasury-funded spending are fundamentally different metrics, and only Phala can separate them. A published figure would strengthen the commercial traction narrative considerably.

## Returns Score: 52/100

PHA scores 52/100 (D grade). Full methodology at [Returns Score Methodology](https://ownyourmind.ai/resources/returns-score-methodology/).

**Token utility (14/20):** PHA has multi-layered utility. It covers payment for confidential compute on Phala Cloud, staking collateral for validators (converted to vPHA), and bonding collateral for GPU workers (1,250-2,250 vPHA per GPU). The staking-to-vPHA conversion with a 21-day unstaking period creates meaningful lock-up dynamics. These are demand sinks tied to actual infrastructure operation, not speculative governance-only utility. The deduction comes from the narrow user base: 398 paid users means the demand generated by these utility functions is still modest in absolute terms.

**Value accrual (8/20):** A fee mechanism exists. Phala Cloud charges $3.50/hr for H200 on-demand compute, and protocol fees flow through the token economy. However, the centralised Phala Cloud service dominates revenue generation, and the relationship between Cloud revenue and on-chain token value is not transparently documented. Treasury spending of $2.1M in 2024 muddies the picture further: it's unclear how much revenue comes from external customers versus treasury-subsidised activity. Phala publishes no revenue figure, so the $2M+ ARR attached to it is a third-party number with nothing behind it.  The value accrual mechanism works in principle but lacks both transparency and scale.

**Supply dynamics (12/20):** The supply is fixed in code. The PHA contract on Ethereum (`0x6c5bA91642F10282b576d91922Ae6448C9d52f4E`) minted all one billion tokens in its constructor and has no mint function, and totalSupply reads exactly 1,000,000,000. Emissions release existing tokens from the mining allocation on a falling schedule (25% less every 180 days), roughly 5% of supply a year at the March 2026 rate, and 86% of supply already circulates. Most scheduled releases are behind us, with no looming cliff. (figures as of 2026-10-19)

The GPU proposal that passed on Snapshot on 4 September would replace that path for the 160M PHA in the GPU mining contract with an even release over 15 months, about 128M a year and faster than the current rate. Phala says the change still has to be implemented.

The 70% mining allocation and 5% team allocation are notably fair. The knock is the zero lock-up on the original 15% private sale, and DWF Labs serving as both investor and market maker introduces price manipulation risk that is well-documented in the industry.

**Revenue sustainability (10/25):** The product ships. Confidential computing with TEE hardware, SOC 2 Type I and HIPAA compliance, and enterprise-grade certifications create a credible addressable market. The ElizaOS V2 integration and NEAR partnership are concrete usage channels generating actual workloads. 398 paid users is early-stage traction rather than product-market fit, and the $2M+ ARR attached to Phala is a third-party figure the company itself has never published. The legacy metrics doing heavy lifting in marketing (758,000 daily agent executions on the retired Polkadot parachain, 35,000+ mostly decommissioned SGX workers) undermine confidence in the growth narrative. But the compliance credentials (SOC 2, HIPAA) open enterprise doors that competitors simply cannot access, and paying customers exist, however few.

**Liquidity and access (8/15):** PHA is listed on Binance, Kraken and OKX across 43 venues, decent coverage for a project of this size, though Coinbase and Bybit carry no PHA pair, checked at both. Volume is not the problem: a third of the market cap or more changes hands daily in September 2026 readings. The book is led by second-tier venues such as LBank rather than by any of the majors, which is where the thin-effective-liquidity worry actually lives, alongside the decline of more than 95% from ATH. DWF Labs as market maker adds a layer of uncertainty about organic versus manufactured liquidity. Any new position is buying into a deeply distressed asset with unclear catalysts for recovery.

### Path to improvement

Three changes would materially increase Phala's returns score:

1. **Scale paid users beyond 398.** The SOC 2 and HIPAA compliance credentials open enterprise doors that competitors cannot access. Converting that compliance advantage into meaningful customer growth (thousands, not hundreds) would validate the revenue model and create token demand through compute payments. The product works; the distribution doesn't yet.
2. **Publish transparent revenue breakdowns.** Separating external customer revenue from treasury-subsidised activity and ecosystem grants would let investors assess whether the business model is self-sustaining. A $2M+ ARR figure circulates through third-party profiles with no Phala publication behind it, and the opacity invites scepticism that transparency would resolve.
3. **Reduce DWF Labs dependency.** Having the same entity act as investor, market maker, and liquidity provider creates conflicts of interest with a paper trail across DWF's portfolio. Transitioning to an independent market maker or transparent on-chain liquidity provisioning would improve market confidence in PHA's price discovery.

## Score change log

| Date | Score | Change | Reason |
| - | - | - | - |
| 2026-10-04 | Data | N/A | Added the Snapshot vote (passed 4 Sep, 7 voters) to release the 160M PHA GPU-mining allotment evenly over 15 months, still to be implemented, and the open buyback-and-burn vote closing 5 Oct. Scores unchanged. |
| 2026-09-26 | Data | N/A | Phala Cloud hardware is H100/H200/B300 per Phala's site (B200 stays for workers). Added TEE.fail: physical-access attacks forged TDX attestation for dstack, so attestation claims are softened. Scores unchanged: TEE.fail applies to every TEE project we score, not Phala alone. |
| 2026-09-25 | Score | Returns 50 → 52 (D held) | Supply Dynamics 10 → 12: the PHA contract has no mint function and totalSupply is a fixed 1B, most of it circulating, with rewards releasing existing tokens on a falling schedule. |
| 2026-09-24 | Data | N/A | Emissions reframed: the contract has no mint path, so they release pre-minted supply rather than inflate it. dstack concentration refreshed to over 90% (GitHub), L2 fee-vault reading added, "only TEE cloud with both" superlative, ATH and venue lines softened. Scores unchanged. |
| 2026-09-23 | Data | N/A | Integrity records re-cut: 1 claim now quotes Phala's own pages verbatim and 7 are our own measurements. Scores unchanged. |
| 2026-09-17 | Data | N/A | Withdrew the `outdated` on-chain revenue verdict: it graded Phala against a ~$2M Cloud ARR figure Phala has never published. The measurement is unchanged and the row is now `unverifiable`; scores unchanged. |
| 2026-09-06 | Data | N/A | WS3b governance rail: the Snapshot venue is live, which our evidence did not say, and the turnout is what supports the score. Four proposals since December 2025 with 7, 3, 0 and 2 voters; the treasury transfer to Phala Ltd. passed on three voters, and one proposal closed with no votes cast. Governance 7/20 held, supported. |
| 2026-09-06 | Data | N/A | WS3b distribution rail: on-chain top-10 verdict added and it supports the score. Infra-excluded top-10 is 21.57% across 37,437 holders, with half the raw top-10 exchange custody (Binance 27.93% across two wallets) and only one unlabelled address. Token Distribution Fairness 10/15 held. |
| 2026-09-06 | Data | N/A | WS3b liquidity rail: Coinbase returns NotFound for PHA-USD and PHA-USDC and Bybit spot has no PHAUSDT, so two of the five tier-1 listings are removed from both surfaces. Volume is not dampened either: turnover is a 34.62% 7-day median, led by LBank at 20.6% with Binance third. Liquidity & Access 8/15 flagged for October. |
| 2026-08-12 | Data | N/A | WS3 on-chain reconciliation (1->4 verdicts). PHAToken supply fixed 1B (constructor-only mint, no mint path; match). Token-admin anchor: pausable (freezes all non-owner transfers), owned by a single un-renounced deployer EOA with PauserRole (established). Open-source confirmed (phala-blockchain Apache-2.0 active; match). Scores unchanged. |
| 2026-05-03 | Data | N/A | Removed hardcoded circulating supply figures from prose and TokenFactsStrip. Live figure now served by CirculatingSupply component (CoinGecko). |
| 2026-03-14 | Freedom | 60 → 55 | Governance downgraded during L2 migration (referenda → Snapshot + multisig). Net calculation correction. |
| 2025-03-06 | Both | N/A | Initial publish. Freedom 60/100, Returns 48/100. |