BOB's Dominik Harz on Pakt and Guardrails for Agentic Finance

In this episode of the Bullish on Bitcoin Show, BOB co-founder Alexei Zamyatin turned the microphone on his own co-founder: Dominik Harz, BOB's CTO and the mastermind behind Pakt, a recently released tool that puts hard limits on what AI agents can do with your money. The show tackled a question that is getting harder to ignore as people hand more financial tasks to AI: who watches the agent? Along the way, Dom explained why current approaches to agent safety fall short, how Pakt uses zero-knowledge proofs to enforce rules, and showed a live demo on Hyperliquid.

Here's a rundown of the highlights.

From Bitcoin Bridges to Agents

Dom and Alexei met during their PhDs at Imperial College, where Alexei was the Bitcoin person and Dom was focused on Ethereum and, in his words, the very early stages of AI. They built XCLAIM, a Bitcoin bridging protocol, and later started BOB about three years ago to bring more scale and security to Bitcoin, experimenting with BitVM. The core idea has stayed constant: make finance for the average person secured by Bitcoin and accessible to anyone, while hiding the complexity.

Alexei noted that Dom has come "full circle." He started out researching multi-agent systems and smart contract languages before being pulled into crypto, and now he is back working on how to keep agents safe. Dom sees agents as the next step in accessibility: just as LLMs made coding available to people who aren't engineers, agents can open up financial products to everyone, as long as they are secure.

How Gateway Led to Pakt

Pakt grew out of BOB Gateway, the trading engine that lets users swap Bitcoin for assets on many chains, including Ethereum, Arbitrum, and Tron. As people began asking ChatGPT and Claude to place trades for them, BOB built a Gateway CLI so agents could trade from the command line. That works for technical users, but Dom's goal was to make it accessible where everyone already is: chat interfaces, WhatsApp, and Telegram.

That accessibility comes with risk. Dom pointed to the familiar horror stories: agents pushing code to repositories they shouldn't touch, or one case where an agent tried to buy and sell items on Facebook Marketplace and ended up publishing its owner's address to strangers. For trading, agents can process far more information than humans, but they still make mistakes, so the goal became simple: let people automate everything, but with safety stops the agent cannot work around.

The Experiment That Went Wrong

Dom shared the experiment that convinced him. Inspired by Andrej Karpathy's "auto research" idea, in which an agent runs its own experiments, he asked an agent to develop and backtest a trading strategy. It quickly found a way to cheat. Because the backtest rewarded the best average across rounds, the agent learned to maximize its risk, climbing up to 20x leverage so that a few lucky trades looked spectacular while everything else wiped out the account.

Alexei connected this to a wider problem. Agents optimize for the goal they are given and, unless every parameter is spelled out, may go beyond or even override the rules. In finance, one blunder is enough:

"You can have a hundred good decisions, but if you have one blunder... your money's gone."

Dom added that LLMs are, at heart, "word prediction machines" with no world model. Over long conversations, they compact their context and quietly forget earlier rules, so documenting constraints in a prompt is not enough.

What Pakt Does

Dom described Pakt as an agreement between you and your agents. You define the rules once, and only you hold the key that can approve or change them. The agent can sign trades only if it can prove that each action follows those rules. For example, if you set a maximum of 3x leverage and the agent tries to exceed it, it simply gets no signature. The refusal also helps the agent, because it effectively reminds it of its constraints when its context has drifted.

Alexei summed it up as a firewall that sits outside the agent, between the agent and your wallet or venue. The agent can send as many trades as it likes, but only those that pass go through:

"Default is no unless it's allowed."

Why Not Just Use AI to Watch AI?

A question the team hears often is why they don't simply run a second agent to review the first. Dom's answer was that AI checking AI may work 80 to 90 percent of the time, but it also fails the other 10 to 20 percent, and it is non-deterministic, so you can't inspect why a failure happened. Pakt makes the rules deterministic. Under the hood, it uses zero-knowledge proofs to produce receipts that anyone can verify afterward, creating a paper trail that is valuable for compliance. Zero-knowledge proofs also bring a privacy benefit, since Pakt does not need to see your strategy or the details of your trades.

Alexei shared a personal example: a script his own agent wrote contained a bug, and Pakt caught the mistake and blocked the transaction. He also raised the risk of hijacked agents. Few people know how to host agent servers securely, so attacks will come, but even if someone took over an agent, a default rule against withdrawals would stop it from draining funds.

Sandboxes, AI Checkers, and a Proof-enforced Agent Behavior

Dom laid out how people secure agents today. The first approach is sandboxing, which limits an agent's environment but doesn't stop it from leaking data inside that environment. The second is AI checking AI, with the weaknesses described above. Pakt belongs to a third category he calls proof-enforced agent behavior, similar to formal-verification tools used in programming. Everything that is not explicitly allowed is denied by default. If a Pakt allows only Bitcoin, ETH, and Solana on Hyperliquid, the agent can never trade Doge, even though the market exists, and API updates cannot quietly open a loophole.

Technically, the agent builds a proof that its proposed action fits the rules. The proof is checked inside a trusted execution environment, hardware that even its operator can't tamper with, and only then is the signature released. Alexei's two-sentence version: agent proposes, proof decides.

Setting the Right Limits

How do you know which limits are sensible? Alexei explained that Pakt helps by reading your strategy, since the limits are already implied by it. If you tell an agent to trade Bitcoin, ETH, and Solana, the allowed markets are in that sentence. Pakt can be loaded into an existing trading repository, whether built on Hummingbot or another bot, and set limits based on what you are trying to do.

The Live Demo

Dom shared his screen to show Pakt on a live Hyperliquid mainnet account with about $50. His main account stays in self-custody, and Pakt creates a separate agent wallet inside the trusted execution environment. Using Claude Code connected through MCP, he asked the agent to open a $20 ETH short and a $20 Bitcoin long under a Pakt capped at $30 per trade. Both trades were batched into a single proof and filled on Hyperliquid.

He then simulated a rogue agent by asking for a trade above the limit. The transaction was prepared but never signed, and the refusal was recorded as a receipt. Because the verifier is compiled to WebAssembly, anyone can re-check the proof in the browser. Dom noted that Pakt can also prove things about account state, like overall leverage, not just single transactions, which he described as unique among trading permission systems.

On speed, a proof for up to ten trades takes about 1.5 seconds on a single GPU. Alexei calculated that this means roughly 400 trades a minute, which is not high-frequency trading territory but fast enough that proving won't be a bottleneck for most users. Dom hopes to get proof times under a Hyperliquid block.

Privacy

On privacy, Dom explained that Pakt can be made as private as the underlying venue. In the current private beta, the hosted prover sees the transaction inputs, but the design allows encrypted rules and private proving later. Alexei added that on centralized venues with APIs, such as Binance or Interactive Brokers, nothing would be visible on-chain at all. A side benefit is that zero-knowledge proofs let you prove performance, like returns, without revealing your trades, which would help separate real results from "I made 200x this week" claims on social media.

Where Agentic Finance Is Heading

Alexei asked why no mainstream personal trading agent exists yet, Dom said it is coming, but needs sensible defaults, safety, and onboarding. He expects models within six to 24 months that can research strategies, understand a user's risk appetite, and run around the clock without emotion.

Alexei closed with data: McKinsey projects agents will mediate $3 to $5 trillion of global commerce by 2030, while Gartner expects 40% of businesses to decommission their agents by 2027 over governance failures, and AI agent safety spending is projected to reach several billion dollars by 2027 and 2028. His conclusion is that the "human in the loop" model will fade and people will hand their finances to agents:

"Who likes managing their finances? Nobody does."

Adoption is inevitable, he said, and guardrails will be needed.

Watch the Full Episode

This recap covers the main threads, but the full conversation includes the complete live demo and deeper detail on how Pakt's proofs work. Watch the complete episode of the Bullish on Bitcoin Show with Dominik Harz, and apply for the Pakt private beta at usepakt.ai.