A Closer Look at Derive V3 and the Promise of Distribution

Preamble

On October 6, 2026 at 18:00 UTC, Derive switched off Derive Chain, the blockchain it had launched less than three years earlier. Bridges were frozen four hours ahead of time, trading stopped five minutes before the cutoff, a snapshot was taken, and accounts were recreated on a new architecture. Trading resumed the next day with no reported incident.

The market reacted immediately. Citrini Research's coverage had plenty to do with it, but DRV still ran to $0.575 on October 10, an all-time high, on six times its usual daily volume, which at the peak put it up more than 1,000% since January and around 260% in the past month alone. The deployment vote, DIP 322, had passed with 107.1 million DRV in favor against roughly 654,000.

For a protocol that captures 88% of on-chain options premiums and has handled $16.4 billion in notional since January, walking away from your own blockchain is a major upgrade, probably the biggest one since the protocol changed its name. It's the nature of Derive itself that's shifting.

In this piece, we want to lay out in plain terms what V3 actually changes: the architecture, the risk universes, the margin engine and the trust model. And along the way, we'll get to something the technical announcements don't say outright but that matters to us, which is that this release is built less for the traders using Derive today than for the ones who will build on it tomorrow.

→ For the broader thesis on where Derive sits in on-chain options, see the second article in this series:

---

What is Derive V3?

What V2 ran into

Back in December 2023, Derive dropped its AMM for an order book and deployed its own blockchain on the OP Stack. That call wasn't about order book speed, which is handled off-chain anyway, but about needing somewhere to host a risk engine too heavy to run on Ethereum.

The architecture did its job, but it came with a list of constraints. First, funds sat on a separate blockchain, so you needed a bridge to reach them, which meant any outside app had to integrate with an environment cut off from the rest of the Ethereum ecosystem.

Then there was the fact that Derive had to maintain an entire blockchain, with its sequencer, its contracts and its data availability. On top of that, every asset shared the same risk pool, which made listing anything exotic expensive, meaning anything with a small market cap, an altcoin for instance. And finally, lending was capped at USDC, so the rest of the collateral just sat there.

The new model

V3 flips the logic. Instead of running a specialized blockchain, Derive chose to specialize execution and bring settlement back to Ethereum. In practice, all the heavy computation happens off-chain, in an environment designed for computation rather than consensus. That covers the risk engine, which has to replay dozens of scenarios on every trade, but also settlement and permission handling. All of it gets compiled into a single program, executed outside of any blockchain.

For each batch of operations, that program produces a cryptographic proof. The proof attests that the computation was performed, and that it followed the protocol's rules: the same margin parameters, the same liquidation rules, the same permissions. That proof, and only that proof, is what gets published to Ethereum.

The point of this design is that Ethereum never needs to redo the computation. It only has to check that the proof is valid, which is dramatically faster and therefore dramatically cheaper. Ethereum becomes the verification and settlement layer while holding user funds in its own contracts.

That leaves one last question: where do you store the data needed to reconstruct the protocol's state, say to audit the books yourself or take over if the operator stops? That data availability role isn't Ethereum's here, it's Celestia's, where Derive publishes the state diffs for every batch.

V2 vs V3

Matching stays off-chain, and that isn't some concession on decentralization. A performant order book can't run on-chain under decent conditions, and that was never the problem Derive set out to solve. What changes is everything around it.

Risk computation leaves the smart contracts of a dedicated blockchain for an environment built for computation. Funds come back into contracts on Ethereum, which kills the bridge and puts Derive much closer to the rest of the ecosystem. And state data keeps going to Celestia, which already handled Derive Chain's data availability, except that Derive now publishes there directly instead of going through its own blockchain.

As for the last two rows, those are pure V3 additions, since neither per-universe risk isolation nor generalized lending existed in V2. Both are possible because the protocol is no longer boxed in by the execution limits of its own blockchain. Which makes the shift a one-liner: V2 was a blockchain you had to connect to, V3 is an application you can call.

---

The V3 architecture

The zkVM and the proofs

Protocol logic is compiled into a RISC-V binary, then executed and proven off-chain with the SP1 Hypercube zkVM. Operations are grouped into batches, and each batch is verified on Ethereum by a PLONK proof.

That buys Derive two big things. First, execution is no longer capped by a blockchain's compute budget, which matters enormously for a risk engine replaying dozens of scenarios on every trade. Second, and this is the economically important one, the cost of verifying on Ethereum is fixed. Roughly 400,000 to 500,000 gas per batch, whether that batch holds a single trade or a million.

Put differently, the more volume goes up, the lower the unit cost of settlement. That's the opposite of ordinary on-chain execution, where every operation is paid for separately, and it's a real economic edge for Derive. Margins improve as volume grows.

The settlement contracts

Unlike V2, the contracts that matter are now deployed on Ethereum mainnet, and their addresses are public. At the center sits the VAPP contract, which anchors the protocol's state root and verifies the proofs validating each transition.

From there, SPOT_VAULT holds the funds. WITHDRAWAL_OUTBOX processes finalized withdrawals and carries the escape hatch, the emergency exit if the operator stops working. ACTION_MANAGER lets you interact with the protocol straight from Ethereum, notably for deposits and for accounts held by a multisig or a smart contract.

That last one matters more than it looks, because it means a Derive account can now be owned and operated from a multisig on Ethereum, which was impractical when everything lived on a separate blockchain.

On the same logic, V3 removes the Derive Wallet, the intermediary smart contract wallet you had to go through in V2. Users sign their actions and move their funds straight from their EOA or multisig, and the migration moved subaccount ownership to those addresses automatically.

Data availability

The data needed to reconstruct state gets published to Celestia rather than Ethereum. That isn't new to V3: Derive Chain already posted its own data there, with Ethereum as a fallback if Celestia went unavailable. What changes is that Derive now publishes the state diffs of each batch there directly, with no blockchain in between. The choice cuts costs substantially, but the direct consequence is the interesting part: anyone can rebuild the protocol's state and, if the sequencer stops, step in to process withdrawals.

Worth noting that this choice could complicate the stated goal of reaching L2Beat's Stage 1, whose definitions lean on data availability anchored to Ethereum. L2Beat still ranks Derive below Stage 0.

For an outside developer, the takeaway from this whole section is simple: settlement cost becomes marginal as volume climbs, and above all there's no bridge and no blockchain to join. The main integration friction just disappeared.

---

The risk universes

The idea

Introducing risk universes is the most important change V3 brings. And it's somehow the one nobody is talking about right now. To get why, you have to go back to how V2 worked.

In V2, there was one single asset pool, with a standard margin manager and a portfolio margin manager per market. In V3, every asset, every instrument and every subaccount belongs to exactly one risk universe, and nothing mixes between them.

A universe, in other words, is a fully self-contained domain. It has its own markets, its own accepted collateral, its own settlement asset, its own margin managers and its own security fund.

The consequence that matters most shows up in a crisis. If a loss ate into one universe's security fund, it would only be socialized across the accounts of that same universe. Risk is genuinely walled off by market and by asset, where V2 pooled it.

The four universes

Each universe has its own caps, covering options open interest, perp open interest, how much of an asset can be held as collateral and how much can be borrowed.

One more point deserves clearing up, because it had stayed vague until now. Derive's options are European, meaning they can only be exercised at expiry, and they're cash-settled. The price used at settlement is a 30-minute time-weighted average of the underlying, which limits what you can do by manipulating the exact moment of expiration. Settlement happens in the settlement asset of the relevant universe, which is USDC for all four at launch, and the furthest expiry is capped at 400 days.

What nets and what doesn't

Inside a universe, portfolio margin computes each currency's risk on its own scenario grid, then adds up the worst losses. So a gain on BTC does not offset a loss on ETH. What does help is "risk cancelling" collateral, which genuinely reduces the risk of the currency it tracks: a short BTC call can be offset by cbBTC posted as collateral.

Between universes, nothing nets. A Prime subaccount's excess doesn't backstop an Alt subaccount's deficit, even for the same trader, and USDC deposited in one universe doesn't fund borrows in another.

For the user, that turns into a concrete constraint: a subaccount belongs to a universe through the manager it picks, so trading two universes means opening two subaccounts and splitting your capital between them.

This isolation isn't just engineering hygiene. It's what makes it possible to list assets quickly that centralized venues don't cover, or cover too late, without putting their risk on top of the major markets. Derive had already listed HYPE options ahead of Deribit, then tokenized gold; the universes industrialize what used to be a bet taken market by market. Which is to say they supply raw material competitors don't have.

---

Capital efficiency

Portfolio margin

Derive offers two margin modes. Standard margin, on by default, values each position in isolation. Portfolio margin, which you have to turn on, values the whole portfolio, runs it through a series of scenarios and keeps only the worst modeled loss.

The main grid holds 23 scenarios combining price and volatility shocks, from −14% to +14% for BTC. On top of that come eight extreme scenarios, shocks that deform the volatility surface, and a forward base scenario. The worst of those four results becomes the collateral requirement, plus add-on margins meant to cover what the scenarios don't capture.

The effect is the one we described in our previous articles: a fully collateralized BTC call seller locks up $100,000 to collect $1,800 in premium, or 1.8% over the month, whereas an engine that only covers the worst plausible move brings that requirement down to a fraction of notional and the yield to around 12%.

Lending on every collateral

This is another very significant V3 addition, and probably the most tangible one for users. In V2, lending was capped at USDC: only holders of long options or underlying assets could borrow USDC by pushing their cash balance negative.

In V3, the mechanism extends to other assets, with a two-sided pool specific to each universe: you earn a yield on what you deposit, and you can borrow against that deposit. The documentation does specify that the exact list of eligible assets will be published shortly, so the extension is locked into the architecture but not fully shipped yet.

What lending unlocks

One consequence is worth calling out: a subaccount can now hold a negative balance on a base asset, which is to say short it. That makes it possible to express short spot or cash-and-carry strategies without touching a perp, which V2 couldn't do. An asset is only borrowable if it's authorized in its universe, and within that universe's borrow cap.

Also worth noting that each universe's security fund takes 20% of the interest paid to lenders, a share that goes to 100% if that fund were ever depleted. It's an automatic recapitalization mechanism, funded by lending activity itself. In exchange, a lender should keep in mind that during heavy borrowing they may not be able to withdraw immediately: interest rates then spike hard to push for repayment.

Put all of that together with portfolio margin and it genuinely changes what collateral is. The same deposited dollar now covers portfolio margin, earns a lending yield and backs a borrow. Where V2 made you choose between putting capital to work and leaving it as collateral, V3 lets you do both at once.

And this is capital efficiency that doesn't only benefit market makers. That freed-up capital is also extra capacity to quote more markets, more strikes and more expiries, which means tighter spreads and depth where there wasn't any. That's exactly what an advanced user wants out of execution quality, and it's also what a third-party app will resell to its own users. More on that in the next section.

Market data points the same way. In the third quarter of 2026, Derive captured 90.4% of on-chain options premiums, and the cost per dollar of exposure paid by buyers fell 25.6%. The protocol handled more volume while making it cheaper to execute, which is precisely what you'd expect from better-deployed capital.

---

Opening up to developers

What went away for builders

V2 made a builder request access before it could create accounts. In V3, creation is programmatic: subaccounts get created automatically on the first deposit, and a user no longer has to go through Derive's own interface before using a third-party app. This is probably the most important point in the whole section, because it's what lets an app onboard its user end to end without ever sending them back to Derive.

The rest follows the same logic. Since the contracts now sit on Ethereum, any bridge gets you to L1 before depositing, where V2 forced its own bridge to Derive Chain. Two deposit flows are available, a direct contract call and a deposit-address flow that works like a centralized exchange.

Derive also ships contracts and keepers for gasless onboarding, which its own interface uses and any team is free to reuse. The user deposits by simply sending funds to an address, no signature and no approval, and withdraws straight to another chain. The docs put it that way themselves: like on a centralized exchange. Two limits, though. Withdraw addresses only work for tokens that have a custom bridge, today HYPE, SOL and FXRP, and the keepers only process addresses whitelisted by the factory owner.

Permissionless vaults

V3 builds vaults natively into the protocol. A curator deploys a strategy through the interface or programmatically, the docs claim three minutes, and the vault shows up immediately with no manual approval. They then collect a management fee capped at 3% a year and a performance fee capped at 50%, the latter only on gains above the vault's high-water mark.

The "anyone" does deserve some qualifying. Creation costs 500 dollars, the minimum initial deposit is 10,000 dollars, and the curator has to lock up the greater of 10,000 dollars or 1% of vault value, checked against their own withdrawals. The economic parameters are immutable after launch. So it's permissionless in the sense that nobody approves you, but it isn't free.

This is the piece that lets you wrap options strategies into products people can actually understand. A depositor doesn't need to know they're selling a covered call, they see a yield and a risk.

The mechanism is very close to what Hyperliquid did, which we covered in the previous article in this series. It's further proof that Derive is running the same playbook: position yourself as the infrastructure and liquidity base for on-chain options, then let other teams build on top. Every new app adds features the protocol wouldn't have built itself, brings its own flow, and reinforces the liquidity everyone trades against.

Worth noting that session keys get granular: an admin can separate whoever trades spot from whoever manages vaults from whoever only has read access. V3 also adds transfers to a subaccount owned by someone else, with recipient whitelists. Details for a retail user, prerequisites for a desk or a company building a product on Derive.

Builder Codes and revenue sharing

Builder Codes have been around since February 2026. An app submits its users' orders with its identifier and an optional extra fee, which gets paid back to it every four weeks. There's no exclusivity, no prior approval and no minimum volume. On top of that sits the API Broker program, which pays back 10% to 50% of net fees depending on 28-day volume and stDRV held.

For now, two teams are genuinely committed. Dream, a mobile app that hides the complexity of options entirely, to the point that DefiLlama now tracks its builder fee revenue as its own line item. And LEVR, which is building a 0DTE experience and timed its launch to when V3 trading resumed. Derive is also courting teams building yield vaults, structured products and agent strategies, and Nick Forster has publicly set the bar at roughly one hour to integrate.

Everything above converges here. The architecture removes the bridge, the universes supply exclusive markets, the risk engine supplies execution, and Builder Codes supply the business model. Which leaves the only question that really matters: how many teams will show up? As of today, the answer is two names long.

---

The limits and the trust model

Whether a protocol is actually decentralized was one of the great debates of decentralized finance for a long time. The topic has lost weight over the past few years, to the point that people now say on-chain finance more often than DeFi, and most users judge a protocol on its execution rather than its degree of decentralization.

In Derive's case the question is still worth asking, because the zero-knowledge argument can leave the impression that there's no trust involved at all. Reality is more nuanced, and the governance proposal itself describes it without dodging.

The exchange API, which runs the order book, matching, RFQ and access controls, is a fully centralized backend operated by a company, Lyra Technologies Corp. It decides who gets to trade, and US persons remain excluded.

The sequencer, designated by the foundation, groups transactions into batches. It can neither forge an order nor extend margin beyond the protocol's parameters, since the proof won't let it. What it can do is ignore a transaction. That's exactly what the escape hatch is for: actions submitted from Ethereum have to be processed in order, within a maximum delay initially set at two weeks, after which anyone can take over.

Finally, the contracts themselves have an owner, who can replace the state root and the proof verification key. At launch, that ownership is exercised by the multisig of a foundation subsidiary, with a path to bypass the delay at six signatures out of eight. Handing it to stDRV holder governance is deferred to a later proposal.

On a smaller scale, the keepers behind gasless onboarding only process addresses whitelisted by the factory owner, which adds an operational dependency for teams leaning on that flow.

Add to that two risks specific to the new system: the dependency on a proving infrastructure that has to hold up at exchange scale, and the risk engine itself, where a parameter error would produce losses even if the proofs work perfectly.

So the line to remember is this: a validity proof guarantees the operator applied the rules, not that it didn't censor anyone. For a user, that's already a considerable step forward on custody. For a developer about to hand their users over to this infrastructure, it's a dependency to evaluate with eyes open.

---

Conclusion and what to watch

V3 doesn't make Derive faster, and it doesn't add a flashy product for the trader already there. What it does is turn an exchange that lived on its own chain into an Ethereum application other people can call.

Every piece points that way. Settling on Ethereum removes the bridge and the integration friction. Programmatic account creation and gasless onboarding let an app onboard its users without sending them back to Derive. Fixed verification cost pushes unit cost down as volume climbs. Risk universes make it possible to open markets fast that nobody else quotes. The margin engine and generalized lending free up capital, which improves execution. Vaults and Builder Codes give developers something to build and a way to make a living.

Derive, in other words, is building distribution infrastructure. Which fits the thread running through this series: the main obstacle to options adoption was never liquidity alone, it's that a normal user doesn't want to learn to read an options chain. If somebody is going to solve that interface problem, it probably won't be the exchange itself.

The natural extension is on the real-world asset side. Risk isolation is precisely what was missing to list products whose liquidity, market hours and oracles look nothing like crypto's. Tokenized gold already has its universe, and nothing technically prevents opening more.

Three indicators will tell you whether the bet is working: how many third-party apps actually launch on V3, what share of volume runs through Builder Codes, and the pace at which new markets open in the Alt and RWA universes.

On the protocol side, DIP 324 passed with 47.69 million DRV in favor and not a single vote against. It takes the share of fees going to DRV buybacks from 35% to 50%, effective October 14, with the remaining 50% feeding the insurance fund. Cumulative buybacks now top 28 million DRV.

That figure has to be read against two others, though. On one side, weekly emissions run at 150,000 DRV, 100,000 of it in staking rewards and 50,000 in trading incentives, although DIP 324 floats a plan to fund staking rewards from the buybacks themselves, which would cut that dilution accordingly. On the other, DefiLlama counted roughly $575,000 in revenue over the 30 days before early October, while the token values the protocol at around $550 million. So the market is pricing the execution of this bet, not current revenue.