Phala Network

What it does

Phala runs a cloud computing service where your data stays private even from the people running the servers. It does this using Trusted Execution Environments (TEEs): hardware-enforced sealed environments on the processor itself. You submit a workload (typically AI inferenceInferenceRunning a trained AI model to produce an answer. Inference is what happens when you type a prompt into ChatGPT and get a response. The model takes your input, computes a best guess, and returns it.Like asking an expert for their opinion. The training was the decades they spent becoming an expert. The inference is the 30 seconds it takes them to answer your specific question.Read more → or an autonomous agent), the TEETEETrusted Execution Environment. A hardware-secured region of a CPU or GPU where code runs in isolation, so even the machine's operator can't read what's happening inside. TEEs give decentralised AI inference privacy guarantees.Like a bank vault inside a bank. The bank owns the building, staffs the lobby, and runs the security cameras. But what's inside the vault is invisible to everyone, including the bank staff, unless the customer opens it.Read more → processes it in an enclaveEnclaveAn isolated region of CPU or GPU memory protected by hardware. Code and data inside the enclave are inaccessible to the operating system, the hypervisor, or even the machine's physical owner.Like a secure room inside a much larger office building. The building's caretakers have keys to every other room but not this one. What happens inside is invisible to them by design.Read more → that nobody can peek into, and cryptographic attestation proves the code ran correctly without tampering.

Concretely: you deploy Docker containers that run as confidential VMs on NVIDIA H100, H200 or B200 GPUs paired with Intel TDX processors. The managed service (Phala Cloud) charges $3.50/hr for an H200, with $20 free credits for new users. For developers who want to self-host, the open-source dstack SDKSDKSoftware Development Kit. A collection of code libraries, documentation, and tools that lets developers integrate a service into their applications without writing everything from scratch. SDKs are how projects become easy to build with.Like a plug-and-play kit for building furniture. You don't have to mill your own wood, forge your own screws, or design the joinery from scratch. The kit gives you pre-cut parts and instructions so you can assemble the thing in an afternoon.Read more → converts standard containers into confidential VMs. dstack has been donated to the Linux Foundation’s Confidential ComputingConfidential ComputeHardware-enforced computation where data and code are encrypted in memory and only the authorised application can access them. The machine's operator cannot read what the application is doing even though they own the machine.Like renting space in a bank vault. The bank owns the building and runs the security, but what you put in the vault is invisible even to the bank staff. Only you have the key.Read more → Consortium, which is a meaningful credibility signal. Open-source donations to established foundations are harder to fake than partnerships.

Founded in 2018 by Marvin Tong (ex-Tencent, ex-Didi), Hang Yin (ex-Google, Bitcoin Gold co-founder) and Zhe Wang (serial entrepreneur, 20+ patents). The team is roughly 25 people. Entity structure is Hashforest Technology Pte. Ltd. in Singapore with a subsidiary in California. Originally a Polkadot parachain (since 2022), Phala migrated to an Ethereum L2 (Op-Succinct rollupL2Layer 2. A blockchain that runs on top of an L1 to provide cheaper or faster transactions while inheriting the L1's security. L2s batch many transactions and post compressed proofs back to the L1.Like an express lane built on top of a busy motorway. The express lane handles its own traffic at high speed, but it still feeds back into the main motorway and uses the motorway's bridges and tolls for security.Read more → via Conduit) in November 2025 and rebranded from phala.network to phala.com in September 2025.

The project sits in the DeAI-adjacent category. Phala is general-purpose confidential computing that has pivoted toward AI as its primary use case. The TEE technology is horizontal: it runs trading bots, healthcare analytics and LLMLLMLarge Language Model. A neural network trained on vast amounts of text to predict the next word in a sequence. Modern LLMs (GPT, Claude, Llama, Qwen, DeepSeek) generate human-quality text and are the foundation of most modern AI products.Like an autocomplete that read every book ever written. It has no memory of individual texts but it has absorbed the patterns of language so deeply that it can generate paragraphs that sound human. The skill is statistical, not conscious.Read more → inference on the same infrastructure. AI is the highest-demand workload, not the founding thesis.

Value proposition

Privacy at the computation layer is the core differentiator. Most “privacy” projects protect data at rest or in transit. Phala protects data during processing. The TEE ensures that even the infrastructure operator cannot observe what is happening inside the enclave. Remote attestationAttestationA cryptographic proof that a piece of code is running on a specific hardware enclave in an unmodified state. Attestation lets remote users verify that a service is genuinely running what it claims to be running.Like a tamper-evident seal on a medicine bottle. The seal itself doesn't make the medicine safe, but it gives you a way to verify that nobody opened the bottle and swapped the contents before you bought it.Read more → provides cryptographic proof that specific code ran on genuine, unmodified hardware.

SOC 2 Type I and HIPAA compliance certifications open doors that most crypto projects cannot reach. Healthcare, finance and enterprise clients need these compliance boxes ticked before any conversation about adoption begins. Phala is the only TEE cloud in the decentralised space with both certifications.

The ElizaOS V2 integration means AI agent swarms can run on Phala Cloud with TEE security out of the box. The NEAR partnership provides another concrete usage channel. These are real integrations generating actual usage, not vaporware announcements.

Phala reports 398 paid users and a claimed $2M+ annual recurring revenue, which represents early commercial traction. That’s more than most DePINDePINDecentralised Physical Infrastructure Networks. Protocols that use token incentives to coordinate real-world physical infrastructure like GPU compute, wireless networks, storage, mapping sensors, or bandwidth.Like crowd-sourced ride-sharing but for physical hardware. Uber incentivises drivers with dollars. DePIN incentivises hardware operators with tokens. The network grows because individuals choose to contribute capacity in exchange for rewards.Read more → projects can demonstrate. But context matters: the “$2M ARR” is partially verified: treasury spending in 2024 was $2.1M but Phala Cloud revenue is not separately disclosed. And 398 paid users, while real, is a thin base for a cloud infrastructure business.

The counter-narrative is the gap between the privacy promise and the decentralisation reality. The L2 is Stage 0 on L2Beat: centralised sequencer, permissioned proposer, instantly upgradable contracts. The team can change the rules at any time with no exit window for users. You are trusting the operator, which is exactly what decentralisation is supposed to eliminate. The TEE privacy guarantee applies within the enclave but the network itself is centralised.

Tokenomics

PHA launched via private sale and airdropAirdropDistributing tokens for free to eligible wallets, usually to reward early users, bootstrap a community, or decentralise token ownership away from a small group of insiders at launch.Like a supermarket handing out free samples to people who already shop there. The samples cost the supermarket nothing to print. The goal is to convert casual shoppers into loyal customers by giving them something tangible to talk about.Read more → in 2020. Total raise across all rounds: approximately $11.43M ($10M strategic led by IOSG Ventures, $1.4M and $28K in private rounds, plus an undisclosed amount from DWF Labs in January 2024). Notable backers include IOSG Ventures, SNZ Holding, Waterdrip Capital and DWF Labs. Alameda Research (defunct) was also an early backer.

Total supply is fixed at 1 billion PHA. Long-term distribution:

• MiningProof of WorkThe original blockchain consensus mechanism where miners compete to solve computationally expensive puzzles. The winner proposes the next block and earns the rewards. Proof of Work secures Bitcoin and most pre-2020 chains.Like a lottery that runs every 10 minutes where the tickets cost electricity. Whoever spends the most electricity buying lottery tickets has the best chance of winning that round's prize. Nobody can fake the result because the proof of their work is verifiable by everyone.Read more → / compute rewards: 70%
• Private sale: 15% (zero lock-up – 100% at TGETGEToken Generation Event. The moment a project's token first becomes tradeable. TGE is when vesting clocks usually start, when liquidity hits exchanges, and when public price discovery begins.Like the IPO day for a startup. Everything that happened before TGE was private valuations and paper agreements. Everything after is the public market deciding what the thing is worth in real time.Read more →)
• Airdrop: 9%
• Team and founding devs: 5%
• Other rewards: 1%

The 70% allocation to mining rewards is genuinely generous, and 5% team allocation is notably low by industry standards. The knock is the zero lock-up on the 15% private sale; early investors could sell immediately at TGE. All investor vestingVestingA schedule that locks up tokens allocated to insiders, investors, and team members, releasing them gradually over months or years. Vesting prevents insiders from dumping on public buyers immediately after launch.Like a new employee's stock options at a startup. You don't get all the shares on day one. They unlock over four years so you stick around and do the work rather than cashing out and leaving.Read more → is now fully complete. 83.1% of supply is circulating.

The emission modelModelA trained neural network that takes inputs (text, images, audio) and produces outputs (more text, classifications, generated content). In DeAI the model is the thing that actually does the work.Like a very experienced apprentice who has spent years watching thousands of masters make furniture. They can't explain how they know when a joint is right, but they can make a chair that looks and functions like a Chippendale. The training is invisible. The output is what matters.Read more → is disinflationary, with a 25% reduction every 180 days per the published tokenomics. Current daily emission is approximately 135,000 PHA, producing roughly 5% annual inflationEmissionsNew tokens created and distributed by a blockchain protocol over time as rewards to validators, stakers, or miners. Emissions fund network security and participation at the cost of diluting existing holders.Like a company that pays employees partly in newly printed shares. Every year the total number of shares goes up, which means existing shareholders own a slightly smaller slice of the same company unless the company grows faster than the printing.Read more → at current circulating supplyCirculating SupplyThe number of tokens currently in circulation and tradeable on the open market. Differs from total supply (which includes locked or unvested tokens) and max supply (the upper limit, if there is one).Like the number of cars on the road today versus the number ever produced. Some are in showrooms, some in junkyards, some still at the factory. Only the ones on the road count toward what people are actually driving.Read more →.

StakingStakingLocking up a cryptocurrency to help secure a blockchain network, usually in exchange for rewards. The locked tokens act as a security deposit that can be taken away if the staker misbehaves.Like putting down a large rental deposit for an apartment. You get the money back if you behave, you earn interest while it's locked, and the landlord takes it if you trash the place.Read more → converts PHA to vPHA on Ethereum. The Phala staking interface shows a nominal APY of approximately 8.31%, but real yield after inflationInflationThe annual rate at which new tokens are created and added to the circulating supply. Most networks use inflation to pay validators, stakers, and infrastructure providers from freshly minted tokens rather than real revenue.Like a landlord who raises the rent every year. If your salary goes up at the same rate, you break even. If it doesn't, you get poorer without noticing, because the number on your payslip hasn't changed but the ground under it has shifted.Read more → is roughly 3.3%. Unstaking requires a 21-day waiting period. Gatekeepers can be slashed; GPUGPUGraphics Processing Unit. Originally designed to render video game graphics, GPUs turned out to be exceptionally good at the massively parallel math that AI models need. Modern AI training and inference runs almost entirely on GPUs.Like a factory with 10,000 workers doing the same simple task in parallel, versus a CPU which is more like 10 workers each doing different complex tasks. AI training involves doing simple math a million times per second on a million numbers, which is exactly what the GPU factory is designed for.Read more → workers are removed for non-compliance.

DWF Labs is both investor and market maker. DWF’s reputation for market manipulation is well-documented in the industry. Their dual role warrants scrutiny of trading patterns.

PHA is down 97% from its all-time high (May 2021). Listed on Binance, Kraken, OKX, Coinbase and Bybit, strong liquidityLiquidityHow easily a token can be bought or sold without moving the price. High liquidity means you can enter or exit large positions quickly at the quoted price. Low liquidity means even small trades can swing the market.Like the difference between selling a house and selling a share of Apple stock. The house might be worth more on paper, but finding a buyer at that price takes weeks. The Apple share converts to cash in one click.Read more → coverage across major exchanges. Live price data is displayed above.

How to participate

Stake PHA. Convert PHA to vPHA via liquid staking on Ethereum. Earn approximately 8.31% nominal APY per the Phala staking interface (roughly 3.3% real after inflation). The 21-day unstaking period is the main friction. Available through the Phala staking interface.

Run a GPU worker. Requires an NVIDIA H100, H200 or B200 GPU with an Intel TDX-capable CPU. Collateral: 1,250–2,250 vPHA per GPU. Hardware acquisition costs are substantial, and onboarding requires email registration. This is not self-service. The technical barrier and capital requirement make this a serious commitment.

Build on Phala Cloud. Deploy Docker containers with $20 free credits. The @phala/cloud npm package provides 60+ methods for programmatic access. Documentation runs to 100+ pages. A legacy Builders Program offered grants up to $50K, though its status post-L2 migration is unclear. Monthly Builders Challenges offer $2,500 prizes.

Use as a consumer. APIAPIApplication Programming Interface. A structured way for one piece of software to talk to another. In DeAI, APIs let applications request inference from a model without running the model themselves.Like a waiter in a restaurant. You don't walk into the kitchen and cook your own meal. You tell the waiter what you want, they tell the kitchen, the kitchen cooks it, and the waiter brings it back. The API is the waiter.Read more → access for confidential AI inference at $3.50/hr for H200 on-demand. No staking or hardware required.

Honest assessment

What works

TEE confidential computing is real and differentiated. This isn’t a whitepaper promise; hardware enclaves exist, remote attestation works, and the technology genuinely prevents infrastructure providers from seeing user data. SOC 2 Type I and HIPAA compliance position the project for enterprise adoption that most crypto projects cannot access. The ElizaOS V2 integration and NEAR partnership provide concrete usage channels. dstack in the Linux Foundation is a genuine credibility signal. The WireTap security response was competent: when academic researchers demonstrated an SGXSGXIntel Software Guard Extensions. The first widely-deployed TEE technology, introduced in 2015. SGX creates encrypted memory regions (enclaves) where code and data are protected from the operating system and the machine's owner.Like a safe deposit box at a bank. The bank owns the safe room and can see who comes in and out, but they can't see what's inside the boxes. SGX gives applications a private box on a shared computer.Read more → key extraction attack, the team shut down all SGX workers and migrated to Intel TDX. Transparent handling of a real vulnerability.

What doesn’t work yet

398 paid users is early commercial traction, not product-market fit. The L2 has minimal total value secured, with near-zero economic activity on the actual chain. Legacy metrics do heavy lifting in Phala’s marketing: “758,000 daily agent executions” were on the now-retired Polkadot parachain, not the current infrastructure. “35,000+ workers” are mostly decommissioned SGX miners. “42,900 DAU” are on-chain addresses including worker nodes, not distinct human users. The governance model downgraded from Polkadot’s on-chain referenda to Snapshot voting plus a Safe multisig. That’s a step backwards, not forwards. No HuggingFace presence is notable for a project positioning itself as AI infrastructure.

The risk

The L2 is Stage 0, with instantly upgradable contracts and no exit window. This is the single largest centralisation risk. The dstack codebase has 87.4% commit concentration in a single developer (kvinwang). If that person leaves, the core SDK is at serious risk. The entire security model depends on Intel TDX and NVIDIA Confidential Computing remaining trustworthy: two hardware vendors hold the keys to Phala’s privacy guarantee. Multiple simultaneous migrations (Polkadot to Ethereum, SGX to TDX, Phat Contracts to dstack, phala.network to phala.com) compound the execution risk. The California subsidiary means US regulatory exposure through Hashforest Technology LLC.

My position

I do not hold PHA. I covered Phala extensively in What Counts as Decentralised AI? as a DeAI-adjacent project: genuine technology serving AI workloads from a general-purpose privacy infrastructure base. The TEE technology is credible. The decentralisation isn’t. At 97% below ATHATHAll-Time High. The highest price a token has ever reached. ATH is usually quoted as a reference point for how far the current price has fallen (or risen) since the peak.Like the record lap time on a racetrack. It tells you what the car has been capable of at its absolute best, not what it will do today. Whether that record gets broken again depends on conditions that may or may not come back.Read more →, the market has already expressed scepticism. Whether Phala converts its enterprise compliance positioning into meaningful adoption beyond 398 paid users is the core investment question.

Freedom Score: 55/100

Phala scores 55/100 (C grade). Full methodology at Freedom Score Methodology.

Infrastructure decentralisation (8/20). The L2 is Stage 0 on L2Beat: centralised sequencer, permissioned proposer, instantly upgradable contracts with no exit window. GPU worker registration requires emailing the team (not self-service). 87.4% single-developer concentration on the dstack codebase is an extreme bus factor. 29,478 active devices provides hardware distribution, but chain-level infrastructure is heavily centralised. The migration from Polkadot removed the shared security of a decentralised relay chain.

Governance decentralisation (7/20). Governance downgraded during the L2 migration. Polkadot-era on-chain governanceDAODecentralised Autonomous Organisation. A way to coordinate decisions and manage a treasury using token-weighted voting instead of a traditional company structure. Token holders propose and vote on changes directly.Like a shareholder-run company where every shareholder can vote on every decision, the votes are public, and the company can't do anything the shareholders don't approve. The coordination is messier than a normal company but nobody has unilateral control.Read more → (referenda, council) was replaced with Snapshot voting plus a Safe multisig controlled by the team. Snapshot votes are non-binding signals; the multisig executes. The forum has 617+ topics, but decision-making is team-led. No evidence of community override ability. This is a material regression from the previous governance model.

TokenTokenA digital unit of value or access rights tracked on a blockchain. Tokens can represent ownership in a project, a right to use a service, a share of future revenue, or simply a tradable asset with no underlying claim.Like a physical poker chip a casino issues. The chip itself has no value. What makes it worth something is what it lets you do at the casino, what the casino has promised, and how much other people will pay you for it.Read more → distribution fairness (10/15). The 70/15/9/5/1 split is genuinely favourable: 70% to mining rewards and only 5% to the team is rare. All investor vesting is fully complete. 83.1% circulating. Total funding of approximately $11.43M is modest, suggesting limited VCVCVenture Capital. Private investors who fund projects at an early stage in exchange for equity or token allocations. VC rounds are typically pre-launch, at steep discounts to any future public price, with multi-year vesting.Like angel investors in a startup who buy shares before the company goes public. They take more risk because the company might fail, so they get a better price. Once the company IPOs they can sell, and the public market pays whatever price it thinks is fair.Read more → overhang. The knock is the zero lock-up on the 15% private sale allocation. DWF Labs serving as both investor and market maker is a concern.

Censorship resistance (8/15). TEE computation-level privacy is the real deal: data genuinely cannot be observed during processing. However, the centralised sequencer can censor L2 transactions. GPU worker onboarding is gated (email-based registration). California terms of service apply via the US subsidiary. The privacy guarantee applies within the enclave but not at the network access layer.

Data sovereignty (11/15). TEE enclaves are hardware-enforced, meaning the compute provider provably cannot read data during processing. This is a fundamentally different guarantee from policy-based “we don’t store your data” claims. Remote attestation provides cryptographic proof of computation integrity that consumers can verify before sending sensitive data. The self-hosted dstack option means you can run the entire stack without relying on Phala’s managed service. SOC 2 Type I and HIPAA compliance add institutional credibility. Gaps: the sequencer has metadata visibility (knows who is transacting, if not what), Phala Cloud registration requires account creation, and the centralised L2 architecture means the privacy guarantee applies within the enclave but not at the network access layer.

Open source and transparency (11/15). Apache-2.0 licensed across core repositories. dstack donated to the Linux Foundation for neutral governance. Two professional audits completed (zkSecurity for dstack, Code4rena for Phat Contract runtime) plus an EtherAuthority token contract audit. Annual transparency reports published. The gap is the instantly upgradable L2 contracts: regardless of how transparent the code is, contracts that can change without notice undermine the “don’t trust, verify” principle.

Path to improvement

Three changes would materially increase Phala’s score:

1. Progress the L2 beyond Stage 0. Add a timelock to contract upgrades. Introduce a permissionless proposer. Decentralise the sequencer. Every Stage 0 L2 claims it will decentralise eventually. The ones that earn trust do it on a published timeline with measurable milestones.
2. Reduce dstack bus-factor risk. 87.4% commit concentration in one developer is untenable for infrastructure that enterprises are supposed to trust. The Linux Foundation donation is a governance fix, not a contributor fix. The project needs more core contributors to dstack, urgently.
3. Separate Cloud revenue from treasury spending. If Phala is claiming $2M+ ARR, publish the breakdown. External customer revenue and treasury-funded spending are fundamentally different metrics. Transparency here would strengthen the commercial traction narrative considerably.

Returns Score: 50/100

PHA scores 50/100 (D grade). Full methodology at Returns Score Methodology.

Token utility (14/20): PHA has genuine, multi-layered utility. It covers payment for confidential compute on Phala Cloud, staking collateral for validators (converted to vPHA), and bonding collateral for GPU workers (1,250-2,250 vPHA per GPU). The staking-to-vPHA conversion with a 21-day unstaking period creates meaningful lock-up dynamics. These are real demand sinks tied to actual infrastructure operation, not speculative governance-only utility. The deduction comes from the narrow user base: 398 paid users means the demand generated by these utility functions is still modest in absolute terms.

Value accrual (8/20): A fee mechanism exists. Phala Cloud charges $3.50/hr for H200 on-demand compute, and protocol fees flow through the token economy. However, the centralised Phala Cloud service dominates revenue generation, and the relationship between Cloud revenue and on-chain token value is not transparently documented. Treasury spending of $2.1M in 2024 muddies the picture further: it’s unclear how much revenue comes from external customers versus ecosystem-subsidised activity. The claimed $2M+ ARR is partially verified at best. The value accrual mechanism works in principle but lacks both transparency and scale.

Supply dynamics (10/20): One billion PHA with a fixed cap and disinflationary emission (25% reduction every 180 days) is a reasonable supply model. Current daily emission of approximately 135,000 PHA produces roughly 5% annual inflation, which is manageable. The 83.1% circulating supply means most unlock events are behind us. No looming cliffCliffA waiting period at the start of a token vesting schedule during which no tokens unlock at all. After the cliff ends, tokens begin releasing according to the vesting schedule.Like a probationary period at a new job. You don't get your stock options on day one. You wait 12 months to prove you'll stick around, then everything starts unlocking normally.Read more → to worry about. The 70% mining allocation and 5% team allocation are notably fair. The knock is the zero lock-up on the original 15% private sale, and DWF Labs serving as both investor and market maker introduces price manipulation risk that is well-documented in the industry.

Revenue sustainability (10/25): The product is real. Confidential computing with TEE hardware, SOC 2 Type I and HIPAA compliance, and enterprise-grade certifications create a credible addressable market. The ElizaOS V2 integration and NEAR partnership are concrete usage channels generating actual workloads. 398 paid users and partially verified $2M+ ARR is early-stage traction, not product-market fit. The legacy metrics doing heavy lifting in marketing (758,000 daily agent executions on the retired Polkadot parachain, 35,000+ mostly decommissioned SGX workers) undermine confidence in the growth narrative. But the compliance credentials (SOC 2, HIPAA) open enterprise doors that competitors simply cannot access, and real revenue, however modest, exists.

Liquidity and access (8/15): PHA is listed on Binance, Kraken, OKX, Coinbase, and Bybit, strong exchange coverage for a project of this size. However, the 97% decline from ATH and moderate daily volume suggests thin effective liquidity despite the tier-1 listings. DWF Labs as market maker adds a layer of uncertainty about organic versus manufactured liquidity. Any new position is buying into a deeply distressed asset with unclear catalysts for recovery.

Path to improvement

Three changes would materially increase Phala’s returns score:

1. Scale paid users beyond 398. The SOC 2 and HIPAA compliance credentials open enterprise doors that competitors cannot access. Converting that compliance advantage into meaningful customer growth (thousands, not hundreds) would validate the revenue model and create genuine token demand through compute payments. The product works; the distribution doesn’t yet.
2. Publish transparent revenue breakdowns. Separating external customer revenue from treasury-subsidised activity and ecosystem grants would let investors assess whether the business model is self-sustaining. The current opacity around the $2M+ ARR claim invites scepticism that transparency would resolve.
3. Reduce DWF Labs dependency. Having the same entity act as investor, market maker, and liquidity provider creates conflicts of interest with a paper trail across DWF’s portfolio. Transitioning to an independent market maker or transparent on-chain liquidity provisioning would improve market confidence in PHA’s price discovery.

Score change log