Arbitrum

Every Crypto Coin Show story tagged Arbitrum, newest first, alongside the guides and interviews that give it context.

Guide: How do AI agents pay each Guide: What is restaking? EigenLayer, liquid restaking Newsletter

From the interview archive

How Bitcoin OS is bringing institutional BTCFi to BitcoinNov 24, 2025 · Interview
Lumerin launches Bitcoin mining hashpower marketplaceOct 5, 2023 · Interview
Roseon Finance expanding perpetual derivatives DEX to ArbitrumMar 17, 2023 · Interview

2h ago

DeFi

Arbitrum launches USDG stablecoin with 100M ARB DAO vote pending

Crypto Coin Show News Team DeFi, Layer 2, Stablecoins Arbitrum, Global Dollar Network, Paxos, Stablecoins, USDG

Layer 2Crypto Coin Show News Team·October 6, 2026·3 min read

Arbitrum has launched Global Dollar (USDG), a Paxos-issued stablecoin regulated in Singapore and the EU, as its ecosystem’s preferred dollar. The move gives Arbitrum builders a stake in stablecoin economics that previously flowed to other networks, with six major protocols live on day one and a proposal before ArbitrumDAO seeking 100 million ARB tokens to fund adoption.

USDG launches with integrations from Fluid, Uniswap, GMX, Morpho, Maple and Kraken
Arbitrum Foundation seeking DAO approval to commit 100 million ARB plus treasury assets
More than $10 million in DRIP incentive program already funded for USDG adoption

$4B stablecoins currently held on Arbitrum, none previously tied to ecosystem growth
150+ members in Global Dollar Network including Kraken, Paxos, Robinhood and Mastercard
$3B USDG in circulation across all networks

USDG went live on Arbitrum One today with liquidity pools on Fluid and Uniswap, lending vaults on Morpho, and direct exchange support from Kraken. The stablecoin is issued by Paxos and backed 1:1 by US dollar reserves, with regulatory approval in Singapore and the EU. Arbitrum’s $4 billion in existing stablecoin holdings previously generated no direct economic benefit for the network or its builders.

Day-one integrations position USDG for rapid adoption

Six major protocols activated USDG support on launch day. Fluid and Uniswap provide decentralized exchange liquidity, while GMX’s Dollar Vault lets holders earn trading fees from BTC, ETH and SOL markets on USDG deposits. Morpho offers two curated lending vaults starting with Gauntlet’s USDG Premium vault, with a Steakhouse-managed vault to follow.

Kraken deposits and withdrawals on Arbitrum One let traders move between dollars and USDG without bridging. Stargate, built on LayerZero, bridges USDG across chains, and LI.FI supports single-step swaps from other networks directly into USDG on Arbitrum.

ArbitrumDAO vote seeks 100 million ARB plus treasury deployment

A proposal published today on the Arbitrum governance forum asks token holders to designate USDG a core strategic objective and commit 100 million ARB tokens plus treasury assets to liquidity pools. The move follows a year of work by Entropy Advisors, Offchain, the Arbitrum Foundation and Arbitrum OpCo to evaluate which stablecoin the ecosystem should adopt.

“With USDG, Arbitrum and builders across the platform now have a stake in the growth upside, which is what these integrations, liquidity and investments are for.”

Brendan Ma, Head of Investment Strategy at the Arbitrum Foundation

The $10 million DRIP incentive program is already funded and live. As a Global Dollar Network partner, Arbitrum will share in rewards generated by USDG demand across its ecosystem and redirect those rewards toward adoption and builder support.

Economics flow back to ecosystem for first time

Arbitrum has hosted roughly $4 billion in stablecoins for years, but the network captured no direct revenue or economic participation from that activity. USDG changes this by letting Arbitrum share in the stablecoin’s reserve economics as supply grows.

Previous stablecoin ecosystems operated under models where growth economics benefited the issuer and host chains that adopted the dollar early. USDG’s structure ties network rewards to the partners creating demand for it, meaning Arbitrum’s size and liquidity depth directly determine its economic participation.

The Arbitrum Foundation is accepting applications for its USDG on Arbitrum integration program, which provides eligible builders hands-on support. Entropy Advisors will track USDG supply and adoption on Arbitrum at arbdata.com/usdg.

The CCS read. Arbitrum is betting that centralizing around one stablecoin lets the ecosystem extract value from activity that was always there. Whether 100 million ARB successfully drives USDG adoption above competing stablecoins depends on execution by integrators and on user preference for reserve economics alignment over price stability alone. The real test is whether builders actually redirect existing activity to USDG or whether the incentive pool simply attracts new activity that would have occurred elsewhere.

The ArbitrumDAO vote on the 100 million ARB commitment has no announced date. Arbitrum One currently hosts USDC, USDT and other stablecoins; the document does not say whether the DAO will reduce support for competing dollars or merely add USDG alongside them.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

4d ago

Blockchain

Arbitrum Security Council halts new Stylus contracts over AI attack risk

Crypto Coin Show News Team Blockchain, Layer 2, Legal & Crime Arbitrum, ArbOS, BoLD, Security Council, Stylus

Layer 2Crypto Coin Show News Team·October 2, 2026·3 min read

The Arbitrum Security Council completed an emergency protocol upgrade on Friday, October 2, 2026, that halts activation of new Stylus contracts on Arbitrum One and Nova while installing a permissionless safeguard for the One-Step Proof settlement system. The moves address growing AI-assisted attacks on hand-coded WebAssembly programs and potential proof vulnerabilities, though the council stated no user funds are currently at risk.

Stylus activation gas requirement raised to 2^64 – 1, making new contract deployments prohibitively expensive on both chains
Permissionless guard deployed allowing anyone to pause Arbitrum One settlement if conflicting proofs pass simultaneously
Already-active Stylus contracts continue to run; existing Solidity deployments unaffected by the emergency action

The Security Council announcement described the upgrade completed at 11:30 EST on Friday, October 2, 2026. The two-part emergency action targets distinct attack vectors that have accelerated with AI-assisted tooling: one class exploits bugs in Arbitrum One’s one-step proof settlement mechanism, and another targets hand-crafted WebAssembly code that bypasses standard compiler protections.

Stylus pause: new deployments blocked indefinitely

New Stylus contracts cannot be activated on either Arbitrum One or Nova during the pause, and neither can upgraded versions of existing applications requiring reactivation. The Security Council achieved this by calling ArbOwner.setWasmActivationGas(2^64 – 1), a configuration change that sets the gas cost for activation to the theoretical maximum, making the operation economically infeasible.

The pause is narrowly targeted: users can continue calling already-active Stylus contracts through August 20, 2027. The ArbOS 61 upgrade in prior months renewed all active contracts, so no running Stylus program faces immediate expiration. Renewal via keepalive mechanisms remains permissionless and is unaffected by the pause. Solidity (EVM) contracts face no restrictions.

Known bugs for Stylus primarily impact chain liveness (e.g., denial of service attacks) and do not put any user funds at risk.

Arbitrum Security Council forum post, October 2, 2026

One-Step Proof guard opens settlement pause to permissionless activation

The second component installs a permissionless guard contract (OspSoundnessGuard) that can pause Arbitrum One’s settlement to Ethereum if it detects a specific class of attacks on the one-step proof mechanism.

Anyone holding two conflicting answers to the same proof step that both pass validation can trigger the guard to pause outbound messages, including user withdrawals, while the Security Council deploys a permanent fix.

The guard does not pause normal chain operation. Arbitrum One continues processing transactions; only cross-chain messages to Ethereum are held. This architecture assumes that the one-step proof vulnerability, if exploited, would produce detectable contradictions in the settlement process rather than covert theft.

What the document does not disclose

The announcement does not name any specific incident, test case or proof-of-concept that triggered the emergency action. It also does not state whether the Security Council discovered these vulnerabilities internally, through external reporting, or through observation of active attacks.

The timeline for re-enabling Stylus activation, described only as subject to future discussion with ArbitrumDAO, remains open.

The document confirms an external audit was conducted for the One-Step Proof Guard contracts but does not name the auditor, publish the audit report, or disclose any findings. For the Stylus deactivation, it states no audit was required because only a configuration parameter was modified, not ArbOS itself.

Practical impact: Stylus builders face indefinite freeze

Developers with Stylus applications in production can continue deploying updates that do not require activation (parameter changes, data updates). Those seeking to launch new WebAssembly contracts or update existing ones to new Stylus compiler versions cannot do so until the Security Council and ArbitrumDAO jointly decide to restore activation and the pause is lifted.

This emergency pause does not reverse prior governance decisions but suspends their implementation at the execution layer. No vote is required to lift the pause; the process is governed by future negotiation between the Foundation and the DAO.

The CCS read. The Arbitrum Security Council treated AI-assisted code generation as an imminent enough threat to halt one of its most-promoted features hours after the decision was made. The move signals that Stylus’ marketing appeal, permissionless WebAssembly execution, now conflicts with the security model required to protect it. The indefinite pause, without a lift timeline, is a material setback for Stylus adoption and may force a redesign of how Arbitrum certifies safe contract code before activation.

The Security Council and ArbitrumDAO must jointly determine the process and timeline for restoring Stylus activation. Watch for a governance proposal or Foundation announcement in the coming weeks on audit plans, compiler hardening, or alternative activation mechanisms. The Ethereum transaction and Arbitrum One transaction implementing the guard are on-chain; no further action is required from users or node operators.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Ostium launches Gateway trading system three months after $23.75M exploit

4d ago

Blockchain

Ostium launches Gateway trading system three months after $23.75M exploit

Crypto Coin Show News Team Blockchain, DeFi, Legal & Crime Arbitrum, DeFi Security, Exploit Recovery, Gateway, Oracle Attack, Ostium, Trading Stack

BlockchainCrypto Coin Show News Team·October 1, 2026·4 min read

Ostium is rebuilding its trading infrastructure with a new system called Gateway three months after a $23.75 million exploit exposed operational weaknesses in its oracle and credential management. The move signals that institutional crypto platforms face a critical test: delivering speed and capital efficiency without sacrificing the operational security that protects tens of billions in leveraged positions.

Ostium announced Gateway on October 1 (Thursday), offering faster execution, unified margin, and enhanced security infrastructure for Arbitrum-based trading.
An attacker stole $23.75 million in July using two compromised credentials, an authorized oracle-signer key and a registered PriceUpKeep forwarder, to submit false price reports and repeatedly open-close positions.
The exploit exposed a structural vulnerability: Ostium’s verifier validated signer identity but not price accuracy, a pattern repeated across major 2026 breaches at Drift and KelpDAO.

$23.75M stolen in eight transactions to a single wallet via Ostium’s OLP vault
76% of crypto losses in H1 2026 came from infrastructure and operational breaches, despite being only 15% of incidents
$5.34B in open interest across 1,037 real-world asset perpetuals markets as of October 1

Ostium announced on October 1 that it is revamping its trading setup using Gateway, a new system designed to deliver sub-100-millisecond execution, unified margin management, and strengthened infrastructure security. The announcement came roughly three months after the theft of $23.75 million from its Ostium Liquidity Pool (OLP) vault, the pool that backs all leveraged perpetual positions and settles trader profit-and-loss onchain in USDC. Gateway represents more than a technical patch; it reflects institutional pressure on Arbitrum to prove the platform can support high-stakes trading without operational blind spots. Marco Antonio Ribeiro, Ostium’s co-founder and CTO, framed the system around latencies under 100 milliseconds, a threshold that matters for institutional hedging flows competing against centralized exchanges.

Attacker compromised oracle credentials to submit false prices and drain vault

According to Galaxy Research analysis, the hacker obtained two legitimate credentials: an authorized oracle-signer key and a registered PriceUpKeep forwarder, the keeper role responsible for fulfilling pending orders. Using both, the attacker submitted a correctly signed price report bearing a future timestamp, had it verified, and then repeatedly opened and closed trading positions against the false price to extract USDC without real market exposure. The eight transactions all routed to the same wallet; the largest used a single atomic batch of open-and-close cycles.

The core failure was not in Ostium’s trading logic or smart contracts, which functioned as designed, but in how its oracle system validated incoming price data.

Ostium’s verifier checked whether a signer held authorization for a transaction but never validated whether the price itself was accurate.

The credentials the attacker used were meant to be granted only by Ostium governance and timelock and were designed to be non-self-assignable, meaning the exploit required the attacker to obtain legitimate credentials through breach or social engineering rather than to bypass code-level controls.

Infrastructure breaches now drive three-quarters of crypto losses despite being minority of incidents

TRM Labs data for H1 2026 recorded 207 hacking incidents and $972 million in total losses, a shift in the composition of risk. Infrastructure and operational breaches represented only about 15 percent of all incidents but accounted for approximately 76 percent of losses. This pattern, where a smaller number of highly damaging attacks concentrate in operational and credential management layers rather than smart contract logic, repeats across major 2026 exploits: Drift Protocol, where social engineering led to a pre-signed admin takeover; and KelpDAO’s rsETH bridge, where poisoned RPC infrastructure enabled the theft.

Galaxy Research argues that fixing these vulnerabilities requires hardening signer-key management, implementing verifier redundancy, and deploying longer admin timelocks, not adding throttled withdrawal mechanisms.

Throttling withdrawals introduces censorship risk at the application layer and sets a regulatory precedent. Once a protocol builds the technical capability to delay or cap deposits and withdrawals, regulators can point to it as evidence the platform already possesses tools for compliance with freeze orders or KYC gating.

Users facing friction will also route around it, creating secondary markets for deposit claims that introduce new oracle and contract risks independent of the application they were meant to protect.

Real-world asset perpetuals hit $3.16 trillion in volume as Ostium faces test in $5.34 billion open-interest market

Ostium operates within a rapidly scaling market. Total volume in RWA perpetuals reached $3.16 trillion as of August 31, 2026, with stocks accounting for 62.3 percent of that volume and August alone representing $799.5 billion. As of October 1, open interest across 1,037 RWA perpetual markets stood at $5.34 billion according to DefiLlama’s tracker.

Centralized exchanges have begun capturing larger market share in RWA perpetual trading, but decentralized platforms like Ostium remain critical venues for institutional hedging of forex, commodities, indices, and tokenized equities.

Gateway’s test case is now clear: deliver the speed and capital efficiency that institutional traders require while hardening the operational infrastructure that 2026’s data shows is the actual target of attack.

The CCS read. We see Gateway less as a competitive product refresh and more as a market signal about where institutional custody and execution risk has migrated. The $5.34 billion in open interest and $3.16 trillion annual volume show that decentralized RWA perpetuals have become significant enough that platform failures now carry spillover risk for spot markets and collateral chains. Ostium’s rebuild matters because it will test whether Arbitrum’s ecosystem can retain institutional flow after an exploit rooted in credential compromise rather than code, a shift that raises hard questions about operational due diligence in on-chain infrastructure.

Ostium’s recovery plan, disclosed in a post on X on September 30, tied Gateway deployment to repayment of drained OLP funds. Watch whether liquidity providers rejoin the pool post-deployment and whether institutional traders migrate execution back to Arbitrum, or whether the September-October volatility shifts more hedging volume to centralized exchanges, a shift that would signal lasting institutional skepticism about decentralized trading infrastructure’s operational maturity.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Jul 12, 2026

DeFi

Uniswap hits $5.2M in daily fees as Robinhood Chain drives the surge

Crypto Coin Show News Team DeFi Arbitrum, DeFi Fees, DEX Trading, Hayden Adams, Robinhood Chain, UNI Token, Uniswap

BlockchainJuly 12, 2026·5 min read

Uniswap’s daily fee collection has surged to $5.2 million, with Robinhood Chain, which launched just two weeks ago, capturing 85% of that flow and generating nearly $11 million in weekly fees across the protocol. For institutional investors, this concentration of volume on a single nascent blockchain tests Uniswap’s multi-chain strategy while a governance vote on expanded token burns could reshape tokenomics, but the critical question remains whether Robinhood Chain’s explosive early adoption will sustain beyond its honeymoon phase.

Robinhood Chain generated $4.38 million of Uniswap’s $5.16 million in 24-hour fees, compared to $296,000 from Ethereum and $288,000 from Base.
Over seven days, Robinhood Chain accounts for $10.98 million of Uniswap’s $20.1 million in total weekly protocol fees.
A governance snapshot vote through July 12 shows over 93% approval to extend fee-and-burn mechanisms to v4 pools, with binding on-chain votes expected July 13.

$5.2M Daily protocol fees collected by Uniswap across all 47 deployed blockchains
85% Share of daily fees attributed to Robinhood Chain versus Ethereum and other networks
July 1 Launch date of Robinhood Chain, built on Arbitrum technology stack

Uniswap, the largest decentralized exchange by volume, is experiencing a sharp spike in fee generation driven almost entirely by trading activity on Robinhood’s newly launched blockchain.

According to data confirmed by both Uniswap founder Hayden Adams and independent blockchain analytics firm DefiLlama, the protocol collected $5.16 million in fees over a 24-hour period, with Robinhood Chain contributing $4.38 million, an outsized share that reflects the chain’s explosive adoption since its July 1 launch.

The concentration is striking when compared to Uniswap’s performance on established networks. Ethereum, which has historically been Uniswap’s primary venue, generated only $296,000 in daily fees. Base, Coinbase’s layer-2 network, contributed $288,000.

Over a weekly timeframe, Robinhood Chain’s dominance widens further: the chain accounted for $10.98 million of Uniswap’s $20.1 million in total weekly fees, representing 55% of all protocol fee generation across 47 deployed chains.

Robinhood Chain achieved this scale in record time, reaching 220,000 daily traders and $1 billion in cumulative DEX volume within nine days of launch.

Robinhood Chain captures 85% of Uniswap daily fees in two-week surge

Robinhood Markets’ blockchain, built on Arbitrum’s technology stack, launched on July 1 with Uniswap integrated as its primary automated market maker from inception. All four versions of Uniswap, v2, v3, v4, and UniswapX, were deployed at launch, positioning the exchange as the default liquidity layer for the network.

The strategic integration, combined with Robinhood’s retail customer base and aggressive market-making incentives, created immediate traction.

The trading volume metrics underscore this momentum. Within nine days, Robinhood Chain had processed $1 billion in cumulative DEX volume, with 220,000 daily active traders participating. By comparison, established layer-2 networks like Base and Optimism took weeks or months to reach equivalent volume levels.

This velocity suggests either strong organic adoption or substantial incentive-driven activity, a distinction that matters for assessing sustainability.

For Uniswap’s multi-chain strategy, the Robinhood Chain surge presents both opportunity and risk. The protocol now operates across 47 separate blockchains, generating $2.112 billion in 24-hour DEX volume globally, more than five times PancakeSwap’s volume. Yet 85% of current daily fee revenue flows from a single chain that is only two weeks old, introducing concentration risk.

If trading activity on Robinhood Chain moderates as initial incentives wind down or user retention falters, Uniswap’s headline fee generation could contract sharply.

UNI token up 35% from July lows but remains 92% below 2021 peak

UNI, Uniswap’s governance token, has recovered to approximately $3.62, representing a 35% gain from its early-July low of $2.70. The rally correlates with Robinhood Chain’s launch and Uniswap’s elevated fee generation, suggesting investor optimism about the protocol’s growth trajectory.

However, the token’s current price remains approximately 92% below its all-time high of $44.97 reached in May 2021, reflecting the broader crypto market’s volatility and the structural challenge of governance token valuation.

The distinction between fee generation and actual token holder value is critical for institutional investors. While Uniswap collects $5.2 million in daily fees, the protocol’s actual revenue to the treasury is only $73,454 per 24 hours, a 98% gap that reflects the mechanics of Uniswap’s fee structure.

The bulk of collected fees flow directly to liquidity providers as compensation for capital deployment, not to the protocol’s treasury or to UNI token holders directly. This separation between gross fees and protocol economics constrains UNI’s direct earning power and explains why token price appreciation depends primarily on governance expectations and network effects rather than cash flow.

Uniswap is now out-earning every other crypto protocol except stablecoin issuers USDC and USDT in gross fee terms, a position that underscores the DEX’s market dominance despite the modest token valuation.

Governance vote shows 93% support for extending token burns to v4 pools

A Snapshot governance vote running from July 7 to July 12 is seeking approval to extend Uniswap’s fee-and-burn mechanism to version 4 pools. This mechanism, approved in December 2023 as part of the “UNIfication” program, requires users who wish to claim fees from the protocol to first burn an equivalent value of UNI tokens, permanently removing those tokens from circulation.

Extending this mechanism to v4 pools, which represent the protocol’s latest technological iteration and are likely to concentrate future volume and fees, would increase the burn mechanics’ impact on token supply.

Early Snapshot results show overwhelming support: over 93% of votes favor the extension, with approximately 13.9 million UNI votes cast in favor. Snapshot votes are non-binding temperature checks on community sentiment, but they typically precede formal on-chain votes that execute governance decisions with actual contract authority.

The proposal’s architects expect binding on-chain votes to occur during the week of July 13, meaning a final decision and implementation could occur within days of this reporting.

If approved and implemented, the extended burn mechanism would create an economic friction point for fee collection on v4 pools, potentially directing a portion of protocol growth toward token supply reduction. This mechanism differs from traditional revenue models where fees accrue to a treasury or stakeholders; instead, it ties value capture to active token destruction.

For UNI holders, sustained token burns could theoretically reduce supply and increase per-token value, but only if trading volume and fee generation remain elevated. The mechanism’s effectiveness depends entirely on continued transaction volume and user demand for fee-claiming functionality, both of which are not guaranteed, particularly if Robinhood Chain adoption normalizes.

The binding on-chain vote expected July 13 will determine whether Uniswap’s burn mechanics activate across v4 pools. Institutional investors should monitor whether Robinhood Chain’s trading volume sustains beyond July’s launch phase, as any material decline in daily fees would undermine the rationale for tokenomics changes and create downside pressure on UNI valuation independent of governance decisions.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Jun 26, 2026

Ethereum

Autheo Presents ETHToronto 2026, Bringing Builders Together to Shape the Future of Web3 & AI

Crypto Coin Show News Team Editor's Choice, Ethereum, Web3 Arbitrum, Autheo, Canada Crypto Week, Ethereum Foundation, ETHToronto, Solana Foundation, Web3 Developers

ETHToronto 2026 Press Release – Autheo

For Immediate Release

Autheo Presents ETHToronto 2026, Bringing Builders Together to Shape the Future of Web3 & AI

Date July 22, 2026

Location Toronto, ON

Edition 5th Annual

Part of Canada Crypto Week

The 5th Annual ETHToronto returns on July 22, 2026, bringing together builders for an afternoon of sessions, panels, and networking. Presented by Autheo and held as part of Canada Crypto Week, the event is designed to connect the people building the future of Web3 and AI.

Program

ETHToronto opens with Whitepaper Reading Club, a discussion-first session exploring blockchain whitepapers and the technical concepts shaping the future of Web3. This is followed by a full slate of speaker sessions.

Featured Speakers

Edward Johnson

Autheo

Ben Greenberg

Arbitrum

Arman Mamyan

Animoca Brands

Jerry Qian

OPTN Labs

Matthew Glezos

Toronto DAO

Elizabeth McFaul

Solana Foundation

Charles St. Louis

Ethereum Foundation

Top Sponsor

Autheo joins ETHToronto as the Top Sponsor, supporting the developers driving the next generation of Web3. Autheo is a Layer-0 Operating System with an integrated Layer-1 blockchain that combines identity, compute, storage, developer tooling, and AI capabilities into a single interoperable platform.

“Builders and developers are the foundation of every major innovation in Web3. We’re proud to support ETHToronto and help bring together the community creating the next generation of sovereign decentralized applications, infrastructure, and AI-powered technologies.”

— Edward Johnson, Chief Product Officer, Autheo

Evening Program

Following the sessions, attendees are invited to Devs & Bevs, an evening networking event designed to bring together developers, founders, and builders for meaningful conversations and new connections.

World Boss Media will also be onsite conducting live interviews with leaders throughout the event. As a leading Web3 marketing agency, World Boss Media helps companies grow through branding, influencer marketing, and community-driven campaigns.

ETHToronto takes place on July 22, 2026, as part of Canada Crypto Week and alongside Blockchain Futurist Conference — Canada’s largest Web3 and AI event.

Apply for a free ticket to ETHToronto 2026

About ETHToronto

ETHToronto is an annual gathering of developers, founders, and innovators building the future of Web3. Held as part of Canada Crypto Week, the event brings together the builder community through technical discussions, networking opportunities, and collaborative learning in the city where Ethereum was born.

About Autheo

Autheo is a Layer-0 Operating System with an integrated Layer-1 blockchain that unifies identity, compute, storage, developer tooling, and AI capabilities into a single interoperable environment. By simplifying infrastructure and providing powerful tools for builders, Autheo is helping accelerate the next generation of Web3 innovation.

Apr 21, 2026

Ethereum

Arbitrum’s Security Council Seizes $71M in Stolen ETH After KelpDAO Bridge Hack

Crypto Coin Show News Team DeFi, Editor's Choice, Ethereum, Layer 2, Legal & Crime, Regulation & Policy, Web3 Arbitrum, Bridge Hack, DeFi Security, EigenLayer, KelpDAO, LayerZero, Lazarus Group, rsETH

Arbitrum’s Security Council Seizes $71M in Stolen ETH After KelpDAO Bridge Hack

BREAKING · APRIL 21, 2026 · ARBITRUM · DEFI ANALYSIS

Arbitrum’s Security Council Seizes $71M in Stolen ETH After KelpDAO Bridge Hack

Arbitrum’s Security Council just immobilized $71 million in stolen ETH. One emergency vote. Nine signatures. And a question that won’t go away: can a “decentralized” network really freeze your funds?

ETH Frozen 30,766 ETH ≈ $71M

Original Exploit $292M rsETH

Council Vote 9 of 12 in favor

Suspected Actor Lazarus Group (DPRK)

$292M Total Exploit Value

$71M ETH Frozen by Arbitrum

18% rsETH Supply Drained

$230M Potential Aave Bad Debt

§ 01 — The Attack

How 116,500 rsETH Materialized Out of Thin Air

On Saturday, April 18, 2026, at precisely 17:35 UTC, someone did something extraordinary: they minted 116,500 rsETH tokens on Ethereum mainnet with zero legitimate backing behind them. Worth roughly $292 million at the time, this wasn’t a flash loan attack or a smart contract reentrancy bug. The contracts ran exactly as written. The verification layer was the weapon.

KelpDAO is a liquid restaking protocol built on EigenLayer. Users deposit ETH, which earns compounding yield across EigenLayer’s Actively Validated Services, and receive rsETH — a tradeable liquid restaking token representing their position. To enable rsETH to move across the multi-chain ecosystem, KelpDAO deployed a LayerZero-based bridge architecture using the OFT (Omnichain Fungible Token) standard. As of the exploit, that bridge held the backing reserve for rsETH deployed across more than 20 networks — Arbitrum, Base, Linea, Blast, Mantle, Scroll, and more. The protocol had roughly $1.07 billion in total value locked, making it the second-largest participant in EigenLayer’s ecosystem. This was the reserve that was drained.

        // Attack flow — on-chain forensics (Blockaid / DeFiPrime)

        LayerZero EndpointV2: 0x1a44076050125825900e736c501f859c50fE728c

        KelpDAO rsETH OFT Adapter: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3

        Attacker address: 0x8B1b6c9A6DB1304000412dd21Ae6A70a82d60D3b

        // Forged origin packet → EID 30320 (Unichain)

        → 116,500 rsETH released from escrow

        → Single Transfer · One OFTReceived · One PacketDelivered

        → ~$292,000,000 exited the protocol

The Technical Root Cause: A 1-of-1 DVN

LayerZero’s security model is built on Decentralized Verifier Networks (DVNs) — independent entities that verify and attest to the authenticity of cross-chain messages. When a message travels from Chain A to Chain B, one or more DVNs must observe the packet on the source chain and deliver a signed attestation to the destination. The critical configuration choice is how many DVNs must agree.

KelpDAO’s rsETH bridge was configured with a 1-of-1 DVN setup — LayerZero Labs itself as the sole verifier. A single signature was all that stood between the bridge’s escrow and the open internet. The attackers, preliminarily attributed to North Korea’s Lazarus Group (TraderTraitor unit), exploited this exactly.

April 18 · 10:20 AM PT

RPC Node Compromise Begins

Attackers compromise two of LayerZero’s downstream RPC nodes, swapping out op-geth binaries with malicious versions engineered to selectively lie to the DVN while reporting accurate data to all other querying IP addresses.

April 18 · ~11:30 AM PT

DDoS Triggers Failover

Attackers DDoS the uncompromised RPC nodes, forcing LayerZero’s DVN to failover to the poisoned endpoints. The malicious nodes confirm fraudulent cross-chain transactions that never occurred on the source chain.

April 18 · 17:35 UTC

The Drain — 116,500 rsETH Released

A forged LayerZero packet claiming origin from KelpDAO’s Unichain deployment passes the single compromised DVN. The OFT Adapter releases 116,500 rsETH from escrow to the attacker’s address. ~$292M exits in a single transaction.

April 18 · 18:21 UTC

KelpDAO Emergency Pause (46 Minutes Later)

Kelp’s emergency multisig freezes core contracts. Two subsequent follow-up attacks at 18:26 and 18:28 UTC — each attempting another 40,000 rsETH (~$100M) — both revert. The pause held.

April 18–19

DeFi Contagion Spreads

Attackers weaponize stolen rsETH as Aave v3 collateral, borrowing $196M in WETH. Aave WETH markets hit 100% utilization. Aave, SparkLend, and Fluid freeze rsETH markets. $6.6B in TVL collapses within 48 hours across affected protocols.

§ 02 — The Intervention

Arbitrum’s Security Council Acts: A Race Against the Bridge

As stolen funds began moving through the ecosystem, blockchain security firm PeckShield flagged a critical development: the exploiter had already initiated a native bridge withdrawal from Arbitrum back to Ethereum mainnet. The clock was ticking. If the 30,766 ETH that had been consolidated on Arbitrum One completed the withdrawal, it would enter Ethereum’s base layer — far harder to intercept.

The Arbitrum Security Council — a 12-member body elected by the Arbitrum DAO through semi-annual elections — convened an emergency session. According to council member Griff Green, the deliberation involved “countless hours of debates, technical, practical, ethical and political.” Nine of the twelve members voted to act. The council coordinated with law enforcement, who provided input on the exploiter’s identity. Security researchers later linked the operation to North Korea’s Lazarus Group.

“The Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users.”

— Arbitrum Security Council · April 21, 2026

Using the 0x0000000000000000000000000000000000000DA0 precompile — a standard native ETH transfer mechanism — the council moved 30,766 ETH to a protocol-controlled intermediary address. The freeze was confirmed by Lookonchain approximately 20 minutes after execution. The funds were intercepted before the bridge withdrawal completed.

What Exactly Was Frozen

30,766 ETH moved to intermediary wallet FROZEN
Destination: Protocol-controlled address 0x000…0DA0 ARBITRUM GOVERNANCE
Access requires further governance vote PENDING
Represents ~24% of the total $292M stolen PARTIAL RECOVERY
Remaining ~$220M moved via other chains UNRECOVERED
Lazarus Group suspected to be routing remainder LAUNDERING

For observers watching the situation unfold in real time, the move carried a weight that went beyond the mechanics of a single freeze. Dylan Dewdney, Founder of Kuvi AI, was among those who felt the historical echo immediately.

“It’s a fascinating moment for crypto governance — reminds me actually of the same gravitas as TheDAO, in a way. On one hand, decentralization purists will hate it. On the other, a DAO effectively looked at a state-sponsored hacking group and said: not this time. Arbitrum just demonstrated that onchain systems can defend themselves in real time. In a strange way, they out-coordinated one of the most sophisticated adversaries in the world. Legitimately onchain gangster moves.”

— Dylan Dewdney, Founder, Kuvi AI

§ 03 — The Blame Game

LayerZero vs. KelpDAO: Who Owns a $292M Default?

Even as funds were being frozen, a parallel battle erupted between the two parties at the center of the exploit. LayerZero moved first with a post-mortem attributing responsibility squarely to KelpDAO’s configuration choices. Kelp fired back with documentation. The dispute cuts to the heart of modular DeFi architecture.

LayerZero’s Position

LayerZero stated that KelpDAO “chose to utilize a 1/1 DVN configuration” despite the protocol’s consistent recommendation of multi-DVN redundancy. The firm argued that a properly hardened setup would have required consensus across multiple independent verifiers, making the attack ineffective even with a single node compromised. LayerZero announced it would stop signing messages for any application using a single-validator setup going forward, forcing a broad migration across its ecosystem.

KelpDAO’s Counter

Kelp pushed back hard. The team argued the 1-of-1 DVN was not a rogue customization but LayerZero’s own documented default. The protocol’s V2 OApp Quickstart — including the sample layerzero.config.ts — wires every pathway with one required DVN and no optional DVNs. Kelp added that approximately 40% of protocols currently on LayerZero use the same configuration, and that in the direct communications channel with LayerZero open since July 2024, there was no specific recommendation to change the rsETH DVN setup.

@cryptogoblin · April 19, 2026

“The KelpDAO exploit (~$290M) is NOT a LayerZero protocol bug. It’s a configuration issue and a case study every project with a cross-chain token needs to look at today. The smart contracts weren’t broken. The verification layer was.”

@FishyCatfish · April 19, 2026

“There is no security floor. A configuration can be a 1/1 DVN and the DVN you chose can be a single node ran by a single entity. This is a design flaw.”

Independent analysis from Blockaid confirmed: “The KelpDAO exploit will be studied as the definitive case study in bridge DVN configuration risk. It did not require a zero-day. It exploited a weak governance policy and limited controls.” Chainalysis put it more bluntly: the attack proves that detecting malicious code isn’t enough — protocols must detect when a system enters an impossible state.

§ 04 — DeFi Implications

The Contagion Map: From rsETH to Aave to the Whole Ecosystem

The KelpDAO exploit did not stay contained. Within 46 minutes of the drain, the attackers began weaponizing the stolen rsETH across DeFi’s interconnected lending infrastructure. The mechanics were straightforward and devastating.

Attackers deposited the minted rsETH on Aave v3 as collateral and borrowed $196 million in WETH against it. Aave’s WETH market hit 100% utilization, rendering deposits inaccessible and triggering a $5.4 billion liquidity withdrawal cascade. Total DeFi TVL collapsed by $6.6 billion within 48 hours. Aave, SparkLend, and Fluid all froze their rsETH markets. Lido disclosed approximately $21.6 million in rsETH exposure through its EarnETH product and signaled it may deploy a $3 million loss buffer.

Aave Risk Scenarios (Per Ecosystem Risk Assessment)

Scenario A: Losses socialized across all rsETH holders across chains $123.7M bad debt · ~15% depeg
Scenario B: Losses isolated to L2 markets (Arbitrum, Mantle) Up to $230.1M impact
Aave treasury backstop available $181M treasury
Umbrella model available in certain cases Active

April 2026 has become the worst month for crypto hacks since February 2025, with over $606 million lost in just 18 days. The KelpDAO incident came on the heels of the Drift Protocol breach ($285M, April 1) — also linked to Lazarus Group — suggesting a sustained, coordinated campaign targeting DeFi infrastructure rather than isolated opportunistic attacks.

The structural lesson is uncomfortable: liquid restaking tokens (LRTs) as collateral on money markets create systemic amplification. When an LRT loses peg or backing, lending protocols don’t just feel the impact of the token — they absorb the entire downstream leverage built atop it. This is the second time in 2026 that an LRT collateral accepted on Aave has produced a nine-figure incident downstream of a non-Aave failure.

§ 05 — The Core Tension

The Decentralization Paradox: Safety Valve or Fatal Contradiction?

Arbitrum’s intervention was precise, effective, and — for many in the crypto community — deeply troubling. In a single emergency session, a 12-person council immobilized 30,766 ETH that an external party held in their address. The funds were moved without a DAO vote, without the standard governance delay, and without consulting the broader community before execution. The legality, the ethics, and the precedent are all contested.

“A 12-person committee — elected by ARB token holders, sure — just demonstrated it can immobilize any funds on the network given sufficient justification. For a technology built on the promise of permissionless transactions, that’s either a necessary safety valve or a fundamental contradiction.”

— Blockchain.news analysis · April 21, 2026

The Arbitrum Security Council is defined in the Constitution of the Arbitrum DAO as a 12-member body divided into two cohorts, with members elected in semi-annual elections by ARB token holders. The council is bound by the Constitution to use its emergency powers only when necessary for declared security emergencies, and must issue a transparency report when those powers are invoked. The frozen ETH can only move through further governance action — ARB holders will ultimately vote on its fate.

The Community Splits

For the Freeze

$71M recovered, likely from state-sponsored thieves
Zero impact on legitimate users or applications
Law enforcement coordination adds legitimacy
Funds remain under governance — not taken
DPRK laundering would have made recovery impossible
Security Council acted within its constitutional mandate

Against the Freeze

Permissionless transactions is the core value proposition
Council can theoretically freeze any funds on the network
Sets precedent for future, potentially non-consensual freezes
“Decentralized” becomes a marketing term, not a guarantee
Who decides what justification is “sufficient”?
Ethereum community has concerns about L2 centralization

@Leonidas (DOG creator) · April 21, 2026

“Decentralized has become a marketing term. Only Bitcoin is actually decentralized.”

@baeyeee · April 21, 2026

“WLFI is accused of wrongfully freezing user assets, while ARB froze stolen funds linked to DPRK hackers. One is ethically accepted, the other is criticized — but both prove the same point. When it matters most, governance overrides decentralization.”

@JoelKatz (Ripple CTO David Schwartz) · April 21, 2026

“They can make the chain claim that they did whatever they want to all of the funds on the chain. But they cannot compel anyone to listen to those claims. Everyone else can make different claims and choose which set of claims to honor.”

The Stage 2 Problem

The Arbitrum DAO’s own governance documentation asks the question directly: “Can the governance process be further decentralized? How and when can the Security Council’s power be further minimized, or eliminated entirely?” These don’t have easy answers. Arbitrum achieved Stage 1 decentralization with permissionless fraud proofs via the BoLD upgrade. But Stage 2 — which would limit the Security Council to adjudicating only demonstrable bugs — remains a future aspiration, not a current reality.

The irony is sharp: the same emergency power that just recovered $71M in stolen funds is precisely the mechanism that prevents Arbitrum from claiming Stage 2 decentralization. Security and trustlessness are in direct tension, and today’s events demonstrated that tension is not theoretical.

§ 06 — What Comes Next

Open Questions & The Road Forward

As of April 21, 2026, the 30,766 ETH remain locked in the protocol-controlled address at 0x000...0DA0. No timeline has been set for final disposition. The ARB community will vote on what happens to the funds — options range from returning them to affected KelpDAO users to holding them pending law enforcement proceedings. KelpDAO’s rsETH contracts remain paused. Founders Amitej G and Dheeraj B have not announced a recovery timeline.

Open Questions as of Publication

How will ARB governance vote to allocate the frozen $71M? PENDING VOTE
Will other chains with similar emergency powers freeze their portions? UNCERTAIN
Who bears legal liability — KelpDAO, LayerZero, or both? DISPUTED
Will Aave deploy its Umbrella backstop for rsETH bad debt? MONITORING
Will LayerZero’s forced DVN migration affect other protocols? IN PROGRESS
Can the remaining $220M be traced before laundering completes? UNLIKELY

The KelpDAO exploit has accelerated three structural conversations that DeFi has been deferring: bridge configuration standards (who sets them, who enforces them, and who is liable when defaults cause catastrophic losses); LRT collateral risk in money markets (the second $100M+ incident in 2026 with restaked ETH tokens as the vector); and Layer 2 emergency powers (the legitimate tension between user protection and permissionless guarantees).

Chainalysis’s recommendation cuts through the noise: protocols must build systems capable of detecting when they have entered an “impossible state” — where issued tokens exceed locked collateral. For a cross-chain bridge, that means real-time consistency monitoring across every deployed chain. For DeFi as a whole, it means acknowledging that the “code is law” principle has never been fully true — and deciding what replaces it.

“The Lazarus Group, if indeed responsible, has already moved the remaining $220 million through various chains. Arbitrum caught what it could. The rest is likely gone.”

— Blockchain.news · April 21, 2026

Apr 18, 2026

Ethereum

Ethereum Hits All-Time High in Quarterly Network Activity

Crypto Coin Show News Team Ethereum Arbitrum, Base, Dencun Upgrade, Ethereum, layer 2., On-Chain Activity, Stablecoins

EthereumApril 18, 2026·5 min read

Ethereum processed over 200 million transactions in Q1 2026, its highest quarterly total on record, marking a 43% surge from the prior quarter, yet the network’s price strength has not kept pace with its usage metrics. For institutional investors, this divergence between on-chain fundamentals and market valuation signals either a delayed repricing opportunity or a caution that transaction volume may not reflect genuine economic demand.

Ethereum base layer processed 200 million transactions in Q1 2026, up 43% from 145 million in Q4 2025
Stablecoin supply on Ethereum reached approximately $180 billion during the quarter, supporting DeFi and payment activity
Layer 2 rollups and the Dencun upgrade drove growth while constraining gas fee pressure on mainnet

200M Q1 2026 base-layer transactions, highest quarterly total since network launch
43% Quarter-over-quarter transaction growth versus Q4 2025 baseline
$180B Ethereum stablecoin supply in Q1, underpinning ecosystem activity layers

Ethereum achieved a significant on-chain milestone in the first quarter of 2026, processing over 200 million transactions on its base layer, the highest quarterly volume in the network’s history. This represents a 43% increase from the 145 million transactions recorded in the final quarter of 2025, according to data from on-chain analytics provider Artemis.

The growth follows a period of relative stabilization after transaction volumes bottomed near 90 million quarterly transactions in 2023, marking a notable recovery trajectory across a three-year cycle.

For institutional investors tracking Ethereum’s utility and adoption, the metric reflects expanding network engagement, though its relationship to price discovery and genuine user adoption remains contested among market participants.

Layer 2 Rollups and Dencun Upgrade Drive Transaction Surge While Containing Fees

The majority of Ethereum’s transaction growth stems not from direct mainnet usage but from Layer 2 scaling solutions, particularly rollups such as Base and Arbitrum.

These networks process transactions off-chain and settle the bundled results on Ethereum’s base layer, effectively multiplying the on-chain transaction count recorded by the network without proportionally increasing mainnet congestion.

This architectural pattern has become the primary driver of headline transaction figures since the 2024-2025 period, as developers and users migrated activity to cheaper, faster execution environments.

Complementing this scaling effect, the Dencun upgrade deployed earlier in the cycle significantly reduced data costs for Layer 2 networks by introducing proto-danksharding and blob transaction storage. By limiting the cost burden on rollups for anchoring their activity to Ethereum, the upgrade removed direct fee pressure on mainnet usage.

Higher transaction volumes therefore did not translate into elevated gas fees or proportional increases in ETH token burns, a dynamic that historically pressured both user adoption and network revenue during peak congestion periods.

This efficiency gain has allowed transaction growth and cost management to decouple, a structural shift that reshapes how institutional investors should interpret throughput metrics.

The practical result is a network handling record activity without corresponding friction costs or scarcity premiums.

Stablecoin Supply Expansion Signals Ecosystem Breadth Beyond Speculative Trading

Alongside transaction growth, stablecoin issuance on Ethereum expanded materially during Q1 2026, with total dollar-pegged token supply reaching approximately $180 billion.

This expansion indicates that Ethereum’s activity growth extends beyond automated scaling mechanics into genuine economic use cases, stablecoins underpin decentralized finance protocols, cross-border payment flows, and remittance activity where price stability is a prerequisite.

For institutional investors evaluating whether network growth reflects speculative positioning or legitimate demand, stablecoin adoption signals the latter, particularly as regulatory clarity around USD-backed tokens has improved in major jurisdictions.

The relationship between stablecoin supply growth and transaction volume is not incidental. Larger stablecoin pools support higher throughput in DeFi applications, payment settlement, and arbitrage activity across Ethereum and its Layer 2 ecosystem.

When stablecoin balances expand, the velocity and composition of transactions typically shift toward utility-driven use cases rather than pure token speculation. This pattern has historically preceded stronger long-term price performance, though timing and magnitude remain difficult to predict in advance.

Ethereum Price Lags Activity Metrics by Over 50%, Creating Valuation Debate

Despite these fundamental gains, Ether has not participated symmetrically in the network’s expansion. The token trades near $2,400 in the current period, more than 50% below its 2025 peak levels, creating a notable divergence between on-chain usage and market valuation.

This gap has sparked debate among institutional observers about whether price represents a lagging indicator that will eventually catch up to network fundamentals, or whether it reflects justified skepticism about the durability and economic authenticity of the activity surge.

Some analysts point to historical market cycles in which sustained on-chain usage expansion preceded broader price recovery phases by several quarters, particularly following periods of retail capitulation and institutional reaccumulation.

Under this view, Ethereum’s current network strength could foreshadow a repricing window as mainstream adoption of Layer 2 applications and stablecoin infrastructure broadens.

However, competing analysis cautions that a significant portion of recorded transactions may represent automated stablecoin movements, bridge transactions, and other low-economic-value activity that inflates throughput without signaling new user demand or revenue growth for the protocol itself.

Analysts caution that transaction growth may include automated stablecoin movements rather than new user adoption. This raises questions about how much of the activity reflects genuine economic demand on the network.

Market observers tracking Ethereum fundamentals

The distinction matters critically for valuation models that tie protocol cash flows to native token appreciation.

Q2 2026 Sustainability Test Will Clarify Whether Activity Boom Is Structural or Cyclical

The institutional investment case for Ethereum now hinges on a forward-looking question: whether the network sustains above 200 million quarterly transactions into Q2 2026 alongside continued stablecoin issuance and Layer 2 expansion.

A sustained plateau would suggest the activity surge reflects a structural shift in ecosystem usage patterns, supporting arguments that price divergence represents an opportunity. A sharp decline would validate skepticism that the spike was driven by temporary dynamics such as rollup competition mechanics or automated settlement traffic rather than durable user demand.

The broader uncertainty extends to whether on-chain strength will eventually translate into renewed long-term market performance, a question amplified by the persistence of divergence between usage, scaling metrics, and price trends.

Institutional investors must simultaneously track three potentially independent variables: continued transaction growth, stablecoin supply stability, and Layer 2 deployment activity. If all three remain elevated through the next quarter, the case for deferred pricing response strengthens. If stablecoin supply plateaus or rollup activity consolidates, the case weakens.

Market participants will focus on Q2 2026 transaction reports, stablecoin supply trends, and Layer 2 transaction volumes to determine whether Ethereum’s activity milestone represents a new equilibrium or a cyclical peak that fades into mid-2026.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Apr 18, 2026

DeFi

KelpDAO Loses $280 Million in DeFi Wallet Drain Across Ethereum, Arbitrum

Crypto Coin Show News Team DeFi, Ethereum, Web3 Arbitrum, DeFi Attack, Ethereum, KelpDAO, KyberSwap, Tornado Cash, ZachXBT

BlockchainApril 18, 2026·5 min read

A $280 million theft from KelpDAO represents one of the largest wallet compromises on record and signals intensifying attacks against institutional and whale-sized DeFi positions across multiple blockchains. For asset managers and custodians, the incident underscores the operational risk of managing large protocol exposures across fragmented chains and the persistent vulnerability of private-key infrastructure to social engineering and phishing campaigns.

KelpDAO lost $280 million across Ethereum and Arbitrum after attackers drained DeFi positions and consolidated 75,700 ETH into a single wallet.
On-chain investigator ZachXBT identified six attacker-controlled wallets funded via Tornado Cash mixer hours before the theft began on April 18.
The incident follows a January 2026 phishing attack that cost a single victim $284 million, signaling a sustained rise in targeted whale attacks.

$280M Total value drained from KelpDAO across Ethereum and Arbitrum protocols
75,700 ETH Amount consolidated by attackers into single wallet, worth approximately $178 million
70% Percentage of January 2026 crypto theft losses attributed to single phishing victim’s compromise

KelpDAO suffered a catastrophic breach on April 18, losing more than $280 million after attackers systematically drained positions across multiple DeFi protocols on both Ethereum and Arbitrum. On-chain investigator ZachXBT flagged the incident and identified six attacker-controlled wallets actively moving stolen funds in real time.

Within approximately one hour of the theft’s initiation, the attackers had consolidated roughly 75,700 ETH, valued at around $178 million at current market rates, into a single address. The remaining stolen value consisted of additional tokens and positions held on Arbitrum.

As of the incident’s public disclosure, no outflows from the primary consolidation wallet had been detected, suggesting the attacker may be holding or laundering the assets through privacy channels.

Tornado Cash Funding Precedes Systematic Liquidation Across Two Blockchains

Blockchain analysis reveals that the six attacker wallets received their initial funding through Tornado Cash, the privacy mixer service, hours before the theft commenced. This timing and methodology point to a coordinated, pre-planned operation rather than an opportunistic exploit.

The attacker then executed a systematic series of token approvals and swaps, first through KyberSwap and then targeting KelpDAO positions directly, before converting all holdings into raw ETH.

The operational pattern strongly suggests a private-key compromise rather than a vulnerability in any single smart contract. ZachXBT noted on Telegram: “KelpDAO appears to have had $280M+ stolen one hour ago on Ethereum and Arbitrum.

The attack addresses were funded via Tornado Cash.” The victim, likely an institutional or whale-sized holder, had accumulated significant DeFi exposure spanning both chains, and the attacker systematically liquidated those positions with precision. The rapid consolidation into a single wallet demonstrates both technical sophistication and prior reconnaissance of the victim’s on-chain holdings.

Security analysts have flagged the incident as consistent with advanced persistent targeting of high-value accounts rather than an indiscriminate protocol-wide vulnerability.

Private-Key Compromise Reflects Escalating Phishing and Social Engineering Threats

The KelpDAO incident arrives amid a documented surge in phishing and social engineering attacks specifically targeting whale-tier crypto holders. In January 2026 alone, a single phishing victim lost $284 million, which accounted for over 70 percent of the entire month’s total crypto theft losses across all attack vectors.

If confirmed at the reported figure, the KelpDAO breach would rank among the largest individual wallet compromises ever recorded on public blockchains.

The concentration of January’s losses in a single phishing incident underscores the vulnerability profile facing institutional players: one successful social engineering campaign against a trader, engineer, or key holder can dwarf the losses from technical exploits or market volatility.

For custodians and portfolio managers, the data suggests that private-key security architecture remains the critical failure point, despite advances in smart contract auditing and protocol hardening. The use of Tornado Cash to stage the attack wallets also demonstrates attacker familiarity with privacy infrastructure, indicating a degree of operational maturity beyond script-kiddie-level theft.

Industry security analysts are expected to publish deeper on-chain forensics in coming hours, potentially revealing additional details about the attacker’s identity or end-stage fund movement.

Aave Multisig Moves to Freeze Staked ETH Positions as Contagion Risk Emerges

In response to the KelpDAO drain, the Aave multisig guardian function executed a freeze on rsETH (KelpDAO’s restaked ETH token) across Aave’s lending markets.

This defensive action prevents the attacker from using stolen rsETH as collateral to borrow additional assets, but it also highlights the interconnectedness of major DeFi protocols and the speed at which risk spreads across the ecosystem once a major position is compromised.

The rsETH freeze raises a broader institutional concern: when a single large holder is drained, downstream lending and collateral markets face immediate counterparty risk. Aave’s rapid response prevented potential secondary losses, but it also required the protocol to exercise governance authority under crisis conditions.

For institutions holding liquid staking tokens or protocol-specific assets, the incident demonstrates that portfolio insurance is incomplete without accounting for operational security at the token issuer level. A stolen position is not simply a market loss; it becomes a systemic contagion point.

The freeze is temporary and contingent on further investigation and coordination with KelpDAO’s recovery efforts.

Pump.fun Instagram Compromise Compounds Ecosystem-Wide Confidence Crisis

Separately, reports emerged on April 18 that the Instagram account of Solana meme coin launchpad Pump.fun had been compromised. The platform’s team issued a public warning: “Any posts made from the official pump fun Instagram account should not be trusted.

Ignore any and all posts made by the account until we have secured the account.” Despite the breach, Pump.fun’s core infrastructure remained operational and user funds held on the platform were not affected.

While less severe than the KelpDAO private-key compromise, the Pump.fun breach reflects a secondary attack vector that targets user confidence and market sentiment. Compromised social media accounts can drive phishing campaigns, pump-and-dump schemes, or reputational damage that weakens user trust during periods of ecosystem stress.

Institutional investors monitoring emerging market infrastructure have noted the clustering of these incidents within a narrow timeframe, which some analysts attribute to coordinated campaigns or heightened attacker opportunism during market transitions.

Pump.fun did not report direct fund loss, but the incident reinforces the importance of multi-layer authentication and compromise detection at the organizational level.

Institutional investors and custody providers should expect detailed on-chain forensics from leading security firms within 48 hours, which may clarify whether the attacker is a professional theft ring, a nation-state actor, or an insider with advance knowledge of KelpDAO’s infrastructure and holdings. The key question for market participants remains whether the stolen ETH will be moved to exchange wallets for liquidation, routed through privacy protocols, or held as leverage for ransom negotiation. Additionally, the Aave multisig’s freeze sets a precedent for governance intervention during security crises; further coordination between major protocols and Ethereum validators may follow if additional large positions are threatened.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Mar 19, 2026

DeFi

Fhenix Is Making Private DeFi a Reality — Without Asking You to Switch Chains

Crypto Coin Show News Team DeFi, Editor's Choice, Ethereum, Layer 2 Arbitrum, Base, Ethereum, Fhenix, Fully Homomorphic Encryption, Guy Itzhaki, Private DeFi

Fhenix Brings Fully Homomorphic Encryption to DeFi — Private Smart Contracts on Ethereum, Arbitrum & Base

Privacy Infrastructure Mar 19, 2026

Fhenix Is Making Private DeFi a Reality — Without Asking You to Switch Chains

Using Fully Homomorphic Encryption, Fhenix lets developers add on-chain confidentiality to Ethereum, Arbitrum, and Base smart contracts — a few lines of Solidity away from private lending, dark pools, and compliant institutional finance.

Ashton Addison

Crypto Coin Show · Blockchain Interviews

Founder

Guy Itzhaki — ex-Intel TEE lead, co-founder Secret Network

Core Technology

Fully Homomorphic Encryption (FHE)

Supported Chains

Ethereum · Arbitrum · Base

Current Stage

● Testnet Live · Mainnet 2026

The Privacy Problem Hiding in Plain Sight

Every transaction on a public blockchain is visible to anyone with a browser. Open Etherscan, and you can trace wallets, balances, and strategies back to the genesis block. For retail users, that might feel abstract — but for institutional players, DeFi protocols, and enterprise payments, transparent ledgers are a non-starter.

That is the gap Fhenix is building to close. Founded by Guy Itzhaki, a former Intel executive who led the company’s Trusted Execution Environment (TEE) division, and the co-founder of Secret Network, Fhenix is developing what it calls the fastest privacy infrastructure for blockchain — powered by Fully Homomorphic Encryption (FHE).

If you want to bring real money, bring the large players in, see mass adoption — there needs to be a level of maturity that includes privacy. But not just privacy: it also includes compliance.

— Guy Itzhaki, Co-Founder & CEO, Fhenix

What Is Fully Homomorphic Encryption?

Most people understand encryption as a lock: you can encrypt data to hide it, but you have to decrypt it before you can do anything useful with it. FHE breaks that assumption entirely.

The term “homomorphic” comes from mathematics — it refers to preserving structure during transformation. In practice, FHE encrypts data in a way that retains enough mathematical structure for computation to happen on the ciphertext itself. The result is decrypted only at the end, meaning no one — including the nodes processing the transaction — ever sees the raw data.

FHE has existed as a theoretical concept for decades, long regarded as too slow for real-world use. Itzhaki, who worked on hardware acceleration for FHE at Intel before leaving to co-found Fhenix, says the performance trajectory has changed dramatically — and that gap is exactly what Fhenix is engineered to close.

Privacy Approaches Compared

Technology	What It Does	Compute on Encrypted Data?	Trust Requirement
Zero-Knowledge Proofs	Hides identity / proves a statement without revealing it	No	Math-based
Trusted Execution Environments (TEE)	Computes in a secure hardware enclave	Partial	Hardware trust required
Fully Homomorphic Encryption (FHE)	Computes directly on encrypted data — no decryption needed	Yes	Pure math — trustless

From L2 to Co-Processor: Meeting Developers Where They Are

Fhenix did not start where it is today. The original architecture was an independent Layer 2 — another chain for developers to migrate to. Within months, the team recognized the strategic error: the market doesn’t need another L2. It needs privacy on the chains where developers already live.

The pivot led to what Fhenix now calls a co-processor architecture — or, more simply, Privacy as a Service. The Fhenix co-processor plugs into existing EVM chains (currently Ethereum, Arbitrum, and Base) and exposes a library developers can import directly into their Solidity smart contracts.

No new toolchain. No new language. No chain migration. Developers import a library, call encrypt and decrypt functions, and their contracts gain data confidentiality. Itzhaki puts the integration at roughly four lines of code for a basic private stablecoin implementation.

Use Cases Already in Development

With eight projects actively building on the testnet, early implementations span a range of confidential finance applications: private lending protocols, confidential payment rails, dark pools, and OTC settlement. Each addresses a category where on-chain transparency has historically been a dealbreaker for serious capital.

Official Links

🌐 fhenix.io 𝕏 @fhenix on X 𝕏 @GuyItz — CEO ▶ Watch Interview

Privacy Without Sacrificing Compliance

One of the most persistent objections to blockchain privacy tools is regulatory: if transactions are opaque, how do you enforce KYC and AML? Fhenix’s architecture directly addresses this tension.

Rather than giving users a binary choice between private and auditable, Fhenix’s smart contract framework lets developers define programmable disclosure conditions. A regulator or auditor can be granted access to specific transaction data only when predefined criteria are met — without the protocol itself ever holding or exposing a master key.

This is what Itzhaki calls KYT — Know Your Transaction — a compliance primitive built natively into the privacy layer.

Institutional players still want KYC. They still want AML. You need a solution flexible enough to give them the privacy levels they need — but that doesn’t open the door for regulators to walk in and say this isn’t what we need.

— Guy Itzhaki, Fhenix

Private Stablecoins: A Dual-Mode Future

One concrete product demonstration Fhenix has already shipped is a dual-mode stablecoin framework. Rather than issuing a purely private stablecoin — which would be incompatible with most existing DeFi yield applications — Fhenix’s model allows issuers to deploy a token that users can toggle between private mode (for transfers and balance privacy) and public mode (for composability with yield-bearing protocols like lending markets).

Asked whether this could be applied to USDC or USDT, Itzhaki confirmed that Fhenix is actively in conversations with major stablecoin issuers. The technical lift, he says, is surprisingly minimal.

Why Privacy Is Having a Moment in 2026

After spending years defending privacy as a legitimate need rather than a criminal one, Itzhaki sees three structural forces finally converging:

1. Stablecoins found product-market fit. Payments with stablecoins are a real use case. Real payments demand real privacy — the question becomes obvious once money starts moving seriously.

2. Institutions are arriving with a different set of requirements. JP Morgan, Robinhood, and others entering the space are not coming with a cypherpunk ethos — they’re coming with compliance departments. Privacy infrastructure that satisfies both camps is now a prerequisite, not a nice-to-have.

3. AI agent payments are early but accelerating. The emerging narrative around agent-to-agent micropayments on stablecoin rails points toward a future where machine-speed transactions carrying confidential business logic will require privacy at the infrastructure level. Fhenix already shipped a private implementation of the x402 AI payment standard roughly three months ago.

Roadmap: Testnet Now, Mainnet by Year-End

Fhenix is currently live on testnet across Ethereum, Arbitrum, and Base. A new SDK version was shipping at the time of this writing, described by Itzhaki as a major improvement in developer experience and performance. Mainnet is targeted for later in 2026, with significant engineering work focused on security hardening and production-grade performance.

Parallel to the engineering path, Fhenix is running a builder program, a planned buildathon, and active outreach to established DeFi protocols. The team also recently co-hosted an open house with Arbitrum in New York, where projects building on Arbitrum explored FHE integrations in real time.

Developers can access documentation, SDK downloads, and testnet resources at fhenix.io. The DevRel team is available for direct support.

Stay in the loop

Follow Fhenix on X for the latest on private DeFi

SDK updates, mainnet progress, buildathon announcements & more — straight from the team.

Follow @fhenix

Full Interview · Blockchain Interviews with Crypto Coin Show

Topics