Menu

DeFi Security

Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol

Unresolved $11 million liquidity crash leaves pools exposed as attacker still holds 20.83 BTC on Maya Protocol

, , , , , ,

BitcoinAugust 21, 2026·5 min read

Maya Protocol’s August 18 exploit has metastasized into an $11 million liquidity crisis that extends far beyond the initial $1.36 million theft, with the attacker still holding 20.83 BTC and no transparent recovery plan addressing cascading pool damage. Institutional investors face opacity on which losses will be restored and by whom, raising questions about cross-chain protocol resilience and reserve adequacy in decentralized finance.

  • Attacker retains 20.8273 BTC worth approximately $1.59 million with no outgoing transactions since August 18 exploit
  • Initial accounting flaw spiraled into $11 million total pool damage through CACAO repricing and arbitrage cascades
  • Maya Protocol has not disclosed which losses it will restore or how remaining $9.6 million gap will be absorbed
  • $11 million Total estimated damage across Maya Protocol pools versus initial theft
  • 88.7% CACAO token price decline from $0.115 to $0.013 post-exploit
  • 20.83 BTC Bitcoin still held by attacker address with zero spend activity

Maya Protocol faces a compounding crisis three days after an August 18 exploit that began as a targeted theft but evolved into systemic pool damage affecting the cross-chain liquidity network’s reserve structure.

The attacker’s Bitcoin address remains frozen with 20.8273 BTC accumulated across ten deposits totaling 20.82730682 BTC at 17:32:18 UTC on August 18, plus a 546-satoshi transaction that slightly raised the total.

At current valuations, that holdings represents approximately $1.59 million, but the real damage extends across Maya’s broader liquidity pools, where an estimated $10.9 million in secondary losses have emerged independent of the direct theft.

The technical failure that enabled the attack has been dissected by security researcher SigIntZero, who identified a chain of six accounting and state-handling flaws compressed into a single 23-message transaction.

The exploit manipulated outbound state handling to trigger a false missing-transfer signal, which activated an internal compensation mechanism that credited roughly 49.45 million CACAO tokens to an ARB.LINK pool despite Maya’s reserve holding only about 168,000 CACAO. Though the reserve transfer ultimately failed, the inflated balance persisted in the pool accounting system, allowing the attacker to claim approximately 99.93% of the pool’s ownership units without proportional capital contribution.

Attacker Withdraws $1.36 Million Through Cross-Chain Arbitrage

Once the attacker secured control of the CACAO pool, the path to extraction became straightforward. After depositing negligible liquidity relative to pool ownership, the attacker withdrew roughly 48.87 million CACAO tokens and immediately swapped them into assets held by other MAYAChain pools, moving approximately $1.36 million in value to external blockchains.

SigIntZero’s analysis traced about $1.36 million to external chains while an additional $291,000 remained on MAYAChain, suggesting total attacker-controlled value near $1.65 million to $1.7 million across both on-chain and bridged positions.

The scale of this direct theft pales against the secondary damage inflicted across Maya’s broader ecosystem.

CryptoSlate analysis attributes approximately $6.4 million in losses to CACAO repricing as the market processed the exploit, with an additional $2.9 million lost to arbitrage activity that capitalized on the token’s collapse from roughly $0.115 to $0.013, an 88.7% decline in a matter of hours.

This pricing dislocation cascaded across interconnected pools, creating a liquidity spiral that damaged liquidity providers and reserve holders who had no direct role in the exploit itself.

Maya Protocol’s Recovery Plan Leaves $9.6 Million Gap Unaddressed

Maya Protocol founder Aaluxx initially characterized the incident as a potential loss of about 20 BTC worth roughly $1.4 million at the time, plus approximately $300,000 in other assets, and committed to working toward full recovery.

The protocol has since outlined a potential recovery path involving a bug-bounty request to the attacker and, if unsuccessful, replacement of roughly 20 BTC through liquidation of Aztec Chain investments and other assets held in reserve.

Critically, even full recovery of the 20 BTC component would address only the direct theft portion of the damage, leaving the $10.9 million in secondary pool losses entirely unresolved.

As of press time, Maya had not published a comprehensive recovery framework explaining which categories of losses would be restored, whether CACAO repricing damage would be reimbursed, how arbitrage losses would be allocated across liquidity providers, or which party, protocol, token holders, or external parties, would absorb the remaining gap.

The absence of a transparent recovery timeline creates acute uncertainty for institutional liquidity providers and holders of CACAO tokens.

Cross-Chain Protocol Complexity Amplifies Recovery and Audit Risk

Maya Protocol’s architecture as a cross-chain liquidity network magnifies both the technical complexity of the exploit and the operational difficulty of executing a clean recovery.

The attacker’s ability to bridge stolen CACAO across multiple chains and instantly swap into assets held in separate pools demonstrates how interconnected liquidity reservoirs can turn a localized accounting error into a network-wide solvency event.

Each cross-chain bridge interaction introduces additional verification and custody points where protocol state must remain consistent, and the August 18 exploit revealed that Maya’s state-handling logic failed to maintain that consistency under adversarial conditions.

The six-layer flaw chain identified by SigIntZero, outbound state overwrite leading to false missing-transfer signal triggering compensation mechanism triggering inflated balance persistence, suggests the exploit required not a single vulnerability but coordinated exploitation of multiple safety checks that should have been independent.

This pattern raises questions for institutional counterparties about whether Maya’s engineering processes adequately stress-tested state transitions under edge-case scenarios, and whether similar vulnerabilities might exist in other cross-chain protocols using comparable accounting architectures.

Institutional investors now face the challenge of assessing whether Maya’s remediation efforts will address only symptom treatment or underlying architectural risk.

Attacker’s Inactive Bitcoin Holdings Suggest Regulatory Pressure or Uncertainty

The attacker’s decision to leave 20.83 BTC untouched for at least three days following the exploit, with no mempool activity and zero outgoing transactions, may signal either regulatory caution or uncertainty about how to move the funds without detection.

Public blockchain analysis has already linked the Bitcoin to the Maya Protocol exploit, meaning any attempt to deposit the funds to a centralized exchange for fiat conversion would likely trigger automated compliance screening and asset freezes.

This dynamic creates a potential negotiation opportunity for Maya Protocol. If the attacker faces genuine barriers to realizing the stolen Bitcoin value without regulatory capture, bug-bounty recovery becomes more credible as a path to return at least the 20 BTC component, the largest, most traceable, and hardest-to-liquidate portion of the theft.

However, the $1.36 million in CACAO and cross-chain assets already moved to external blockchains represents a substantially different recovery problem, as those tokens may have been rapidly sold through decentralized exchanges with no central authority capable of freezing or reversing the transactions.

Maya Protocol’s next critical milestone is either confirmation of bug-bounty payment or public announcement of which reserve assets will be liquidated to replace the 20 BTC, alongside a detailed framework explaining whether CACAO repricing losses and arbitrage damage will be covered or absorbed by existing token holders. Until that announcement, institutional liquidity providers and CACAO holders have no basis for modeling recovery probability or timeline.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

MAYAChain’s $1.36 million exploit spiraled into nearly $11 million of pool damage

MAYAChain’s $1.36 million exploit spiraled into nearly $11 million of pool damage

, , , , ,

BlockchainAugust 20, 2026·5 min read

MAYAChain suffered an $11 million liquidity pool collapse triggered by a single transaction that corrupted its core accounting logic, allowing an attacker to withdraw nearly 49 million CACAO tokens that should never have existed. The incident exposes a critical vulnerability in cross-chain liquidity protocols where a failure in one pool’s state management can cascade across an entire network’s interconnected markets.

  • Attacker extracted $1.36 million in hard assets, including roughly 20.83 BTC, to external blockchains.
  • False accounting created 49.45 million CACAO tokens despite reserve holding only 168,000 CACAO available.
  • CACAO token price collapsed 88.7% from $0.115 to $0.013, triggering systemic repricing across all pools.
  • $11 million estimated total impact across MAYAChain’s liquidity pools versus initial exploit value
  • 88.7% CACAO price decline during incident versus pre-exploit trading levels
  • 49.45 million CACAO tokens created by exploit versus 168,000 CACAO in actual reserve

MAYAChain, a cross-chain liquidity protocol, experienced a sophisticated exploit on August 18 that cascaded from a single corrupted transaction into network-wide damage approaching $11 million.

The attacker moved approximately $1.36 million in hard assets, led by 20.83 BTC, to external blockchains, while the broader impact across MAYAChain’s interconnected pools reached roughly eight times that figure.

The exploit’s severity reflected the protocol’s architecture: CACAO, MAYAChain’s native token, underpins all paired liquidity pools, meaning a failure in one pool’s accounting logic triggered repricing across the entire system as the token’s value collapsed.

As of August 20, MAYAChain’s official channels had published no confirmed recovery timeline, no patch deployment details, no final loss tally, and no compensation framework for affected liquidity providers.

One transaction’s 23 messages corrupted the reserve’s core accounting system

Independent researcher Vini Barbosa traced the exploit to a single MsgDeposit transaction containing 23 separate messages that systematically corrupted MAYAChain’s state tracking. The critical failure occurred when a final DONATE message overwrote earlier ObservedTxVoter state data, erasing the outbound height parameter used to match legitimate transactions between chains.

This overwrite caused MAYAChain to misclassify real, completed outbound transfers as missing, a condition that should trigger only when legitimate withdrawals fail to appear on external blockchains.

The protocol’s theft-detection safeguard, designed to compensate pools after genuinely missing transfers, automatically activated in response to the false signal. The compensation calculation then executed on the ARB pool without enforcing a cap on subsidy amounts relative to the pool’s actual depth or reserves.

Barbosa’s reconstruction showed the handler calculated 49.45 million CACAO in subsidy value, roughly 294 times the 168,000 CACAO tokens the reserve actually held. The system committed this inflated pool state to the ledger even though the module transfer itself failed due to insufficient reserve balance.

The attacker then exploited the committed but unfunded balance by depositing negligible liquidity into the distorted ARB pool and claiming approximately 99.93% of its ownership units. This dominant position in the pool enabled a withdrawal of roughly 48.87 million CACAO tokens that existed only as false accounting entries.

The exploit succeeded because the handler continued execution after the failed transfer, preserving the inflated balance rather than rolling back the transaction. No safeguard prevented the recorded balance from supporting a liquidity claim despite having no underlying reserve to fund it.

Pool failure triggered token collapse that repriced the entire network

CACAO’s role as the connector token across all of MAYAChain’s paired liquidity pools meant the attacker’s massive withdrawal forced immediate repricing across every market on the network. The token fell from approximately $0.115 to $0.013 during the incident, an 88.7% decline, as the inflated CACAO supply hit open markets and liquidity providers rushed to exit positions.

This price collapse wasn’t isolated to a single pool; it affected the measured value of CACAO held in every other pool on the platform, amplifying the initial exploit’s damage far beyond the $1.36 million in hard assets actually moved.

MAYAChain Protocol founder Aaluxx stated on August 18 that the team would resolve the incident and “recover in full,” but provided no timeline or mechanism details.

The cascade reflected a structural weakness in cross-chain liquidity designs: when one asset pair’s accounting fails catastrophically, the repricing it triggers becomes a second-order loss event for every other pool using that asset. Liquidity providers who had deposited assets into other MAYAChain pools faced sudden, involuntary revaluation as CACAO’s price collapsed.

The $1.36 million in direct theft understates the total damage because it excludes the value destruction experienced by unaffected pools through forced repricing of their CACAO-denominated positions.

Protocol lacked safeguards to prevent unfunded pool states from becoming withdrawable

The exploit exposed three consecutive defense failures in MAYAChain’s architecture. First, the protocol allowed a single transaction containing multiple messages to overwrite critical state parameters (the outbound height) that should have been protected from mid-transaction modification.

Second, the compensation handler calculated subsidy amounts without enforcing bounds relative to actual reserve depth, creating a pathway for the system to recognize value it could never fund. Third, and most critically, the system committed an inflated pool state to the ledger even after detecting the subsidy transfer itself had failed due to insufficient reserves.

Standard cross-chain bridge and liquidity protocols include atomic execution logic: if a module transfer fails, the entire transaction should fail and roll back, preventing committed state from diverging from actual asset balances. MAYAChain’s handler continued after the failed transfer, leaving the inflated CACAO balance in place as a recorded pool asset.

This decoupling of state from reality became withdrawable because the attacker could then add real liquidity to the distorted pool and claim ownership stakes based on false accounting. The combined failures, state corruption, unbounded subsidy calculation, and post-failure commitment, created a chain of events that no single safeguard could have prevented.

Compensation framework and recovery timeline remain undefined as of August 20

MAYAChain faced an immediate operational decision: whether to restart swaps on pools that may have been repriced unfairly, and how to allocate losses between liquidity providers who exited positions before the collapse and those who remained.

Aaluxx’s public commitment to “recover in full” suggested the team would attempt to compensate affected users, but the specific mechanism, whether through a treasury recovery fund, CACAO reissuance, emergency liquidity injection, or forced rebalancing of pools, remained unstated.

The absence of a published patch, confirmed restart date, asset-recovery total, loss-allocation framework, or compensation terms as of August 20 left institutional liquidity providers without clarity on their exposure or timeline for fund recovery.

For institutional investors considering exposure to MAYAChain or similar cross-chain liquidity protocols, the incident highlighted the risks inherent in protocols where a single pool’s accounting failure can trigger systemic repricing. The fact that a $1.36 million direct theft expanded into an $11 million network impact demonstrated how interconnected pool designs amplify tail risks.

Any recovery plan would likely require network governance decisions to determine whether liquidity providers should absorb losses proportionally, or whether the protocol would use treasury assets or token reissuance to restore the lost value.

Watch for MAYAChain’s formal announcement of the deployed patch, the confirmed mainnet restart date for swaps, and the published loss-allocation framework. The team’s choice between proportional loss-sharing versus full compensation through treasury deployment will signal whether MAYAChain can restore institutional confidence or faces sustained capital flight.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

How tokenized stocks fail as collateral even when the stock price does not move

How tokenized stocks fail as collateral even when the stock price does not move

, , , , , ,

DeFiJuly 2, 2026·5 min read

A $403,000 exploit of the DeFi lending protocol Edel has exposed a structural vulnerability in tokenized stocks as collateral: the exchange rate between a wrapped token and its underlying asset can be manipulated independently of the stock price itself, inflating collateral value by 78 times. For institutional investors treating real-world assets as a new collateral class, this breach signals that token architecture and oracle design matter as much as the underlying asset’s creditworthiness.

  • Edel’s wGOOGLx token’s exchange rate against GOOGLx was manipulated to 78 times its correct value using a flash loan attack, enabling $403,000 in losses.
  • Tokenized stocks hold $1.7 billion in total onchain value with $8.92 billion in monthly transfer volume across over 396,000 holders and 100-plus stocks.
  • The attack succeeded because Edel’s price oracle read the wrapped token’s conversion rate as a stable peg, missing that this rate depends on vault flows attackers can control.
  • $403,000 Size of Edel exploit loss versus $1.7 billion total tokenized stock market value
  • 78x Inflation of wGOOGLx collateral value relative to true level before real assets borrowed
  • $8.92B Monthly transfer volume in tokenized stocks versus $1.7 billion total onchain value

On-chain real-world asset tokenization has emerged as one of crypto’s most promising institutional use cases, with major lending protocols now accepting stocks as collateral. But the Edel exploit reveals a risk that survives even when the underlying stock price moves nowhere: the token wrapper itself can become a source of systemic fragility if its exchange rate is not properly guarded.

The attack did not require Google’s share price to fluctuate. Instead, an attacker used flash loans to manipulate the conversion rate between Edel’s wrapped token (wGOOGLx) and the underlying GOOGLx, inflating the collateral value that the lending market recognized. The attacker then borrowed real assets, 384,215 USDC and positions in five other tokenized stocks, against that false collateral.

Edel’s response was immediate: the team announced it would absorb all bad debt, restore affected balances one-to-one, and rebuild the protocol’s oracle architecture for a version two launch.

Flash Loan Attack Exploits Edel’s Direct Reading of Vault Conversion Rate

The root cause sits in how Edel priced collateral. The protocol’s oracle used latestAnswer() to read the conversion rate from an ERC-4626-style vault, treating that rate as a reliable input for collateral valuation.

Security firm SlowMist identified the flaw: when an attacker controls sufficient underlying flow, the convertToAssets() rate, which reflects the balance of assets held by the vault, becomes malleable. Edel’s price feed read this conversion rate directly without checks for sudden shifts or dependencies on vault composition.

The attack unfolded in five steps. The attacker took a flash loan to acquire large quantities of GOOGLx, supplied it to Edel’s lending market to mint wGOOGLx, then borrowed against the inflated collateral value. By repeating this cycle and distorting the wGOOGLx/GOOGLx conversion rate, the attacker inflated the collateral recognized by Edel’s lending system to roughly 78 times its true value.

Security analysts disagreed slightly on the total loss: Cyvers estimated $353,000, GoPlus cited $403,000 in losses with $305,000 in attacker profit, and CertiK reported roughly $204,000 drained. The variance reflects different measurement methodologies, some firms counted bad debt, others gross loss or net profit, but all confirmed the same structural failure.

The critical insight is that Edel priced wGOOGLx’s collateral value as if the wrapped-to-underlying exchange rate were stable, when in fact that rate depends entirely on vault flows an attacker can control.

Tokenized Stocks’ Rapid Growth Outpaces Risk Frameworks for Wrapper Architecture

The Edel breach arrives as tokenized stocks have become a genuine market segment. According to RWA.xyz, onchain tokenized stock value stands at $1.7 billion, up 2.17% over the past 30 days, with monthly transfer volume reaching $8.92 billion across over 396,000 holders.

Backed, the primary issuer behind xStocks, now markets over 100 stocks and ETFs across more than 50 integrated platforms, with combined transaction volume exceeding $25 billion. Kamino Finance reported being the first major lending protocol to accept tokenized equities as collateral, enabling users to deposit tokens like SPYx, QQQx, GOOGLx, and AAPLx to borrow stablecoins or earn yield.

Robinhood has also begun issuing tokenized positions.

This growth reflects genuine institutional appetite for tokenized stocks in DeFi, but Edel’s vulnerability highlights a gap: most risk frameworks focus on the underlying asset’s price stability and creditworthiness, not on the token’s internal architecture.

A tokenized stock is not simply a stock price on-chain; it is a wrapper around an underlying token or asset, and that wrapper has its own mechanics. If the conversion rate between wrapper and wrapped asset is not properly secured against manipulation, collateral valuation breaks down, even if the stock itself trades normally.

Backed describes xStocks as fully backed and permissionless, meaning any DeFi protocol can integrate them without approval. That flexibility is a selling point for the ecosystem, but it also means protocols like Edel must independently solve the problem of safely valuing wrapped tokens. The Edel exploit suggests many protocols have not yet done so.

Oracle Redesign and Permission Models Will Determine Institutional Adoption

Edel’s commitment to rebuild its oracle architecture for version two signals the beginning of industry-wide reckoning with this risk class. The protocol is absorbing all losses and restoring affected balances, actions that preserve user confidence but also highlight that a single protocol failure can drain real value from a market that holds $1.7 billion and moves $8.92 billion monthly.

Institutions considering tokenized stocks as collateral will now demand clearer answers: how does a protocol safely read and update an exchange rate that sits between wrapper and wrapped token, and what happens if that rate becomes untethered from the underlying asset’s price?

Two competing approaches are emerging. One path favors tighter integration with token issuers, Backed or other RWA platforms might guarantee oracle feeds, shifting the burden of verification upstream.

The other path asks protocols to implement stricter internal checks: rather than reading a conversion rate at face value, a lending market could require multiple independent sources, apply rate-of-change limits, or require time delays between price updates. Each approach has tradeoffs.

Tighter coupling with issuers improves security but reduces permissionless innovation; stricter internal checks maintain decentralization but require sophisticated engineering.

The institutional question is not whether tokenized stocks belong in DeFi, the market’s $1.7 billion and growing adoption suggest they do, but whether protocols can build collateral frameworks that survive manipulation of the token layer without relying on constant emergency bailouts.

Edel’s version two launch will be the first major test of whether oracle redesign can solve this class of risk. In parallel, Kamino Finance and other protocols now holding tokenized stocks as collateral face immediate decisions: whether to implement new valuation checks on existing wrapped tokens, whether to restrict which token wrappers they accept, or whether to wait for industry standards to emerge. The pending question is whether institutional crypto investors will treat the Edel incident as a one-time protocol failure (and thus move forward with tokenized stocks) or as a structural warning that wrapper-layer risk requires new regulatory and technical frameworks before real-world asset tokenization can scale to the dollar volumes institutions require.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks

Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks

, , , , , ,

BlockchainJune 28, 2026·5 min read

Q2 2026 saw the worst quarter on record for cryptocurrency hacks, with 85 separate exploits costing the sector $775 million in stolen assets, nearly 50 times more incidents than any prior three-month period. For institutional investors evaluating custody, bridge infrastructure, and DeFi protocol exposure, this data signals both elevated operational risk in the space and the real fragility of verification systems that large-scale crypto finance depends on.

  • 85 hacks in Q2 2026 represent 49 more incidents than Q1 2026, the second-worst quarter on record for exploit frequency
  • Drift Protocol and KelpDAO breaches alone accounted for $590 million, more than half of all 2026 DeFi losses year-to-date
  • Total value locked in DeFi fell from $115 billion in January to $70 billion by late June, a 39% decline amid broader market retreat
  • 85 Hacks in Q2 2026 versus 36 in Q1 2026, the prior record quarter
  • $775M Stolen in Q2 2026 versus $942 million total across all of 2026 through June
  • 39% Decline in DeFi TVL from January to June 2026, from $115.3 billion to $70 billion

The cryptocurrency sector experienced its most severe quarter for security breaches in recorded history during the second quarter of 2026, according to data released this week by CryptoRank. Eighty-five separate hacking incidents struck decentralized finance platforms between April and June, resulting in approximately $775 million in direct losses to users and protocols.

This exploit frequency shattered the prior record of 36 incidents in Q1 2026, underscoring a structural vulnerability in the infrastructure supporting institutional-grade crypto finance. The breach wave arrived during a period of acute market stress, with total value locked in DeFi protocols falling 39 percent across the first half of the year as investor confidence eroded.

North Korea-Linked Attackers Stole $590 Million Across Drift and KelpDAO in April

Two major exploits in April accounted for the disproportionate share of Q2 losses and exposed critical weaknesses in protocol security architecture. Drift Protocol, a derivatives trading platform, suffered a $285 million breach on April 18 after attackers compromised multiple security council members through social engineering.

Blockchain intelligence firm TRM Labs traced the operation to actors connected with North Korea’s Lazarus Group, noting that preliminary on-chain reconnaissance began as early as March 11 with a 10 ETH withdrawal from Tornado Cash, a cryptocurrency tumbler.

The attacker used social engineering to induce Drift Security Council multisig signers into pre-signing transactions that appeared routine but carried hidden authorizations for critical admin actions.

TRM Labs, blockchain intelligence firm

Just over two weeks later, the same threat actors targeted KelpDAO, a liquid restaking protocol, and extracted approximately $290 million worth of rsETH tokens.

According to Chainalysis, the attackers achieved this by forging a fraudulent cross-chain message through LayerZero’s bridge infrastructure on April 18 after compromising two remote procedure call nodes used by the Decentralized Verifier Network.

Simultaneously, the adversaries launched a distributed denial-of-service attack against a third node, forcing the system to rely on corrupted verifiers to validate transactions.

The combined $590 million loss from these two breaches represented 63 percent of all DeFi losses recorded during the first six months of 2026.

LayerZero Bridge Compromise Enabled Creation of Unsecured Tokens Across Chains

The KelpDAO attack illustrates a critical vulnerability in cross-chain bridge architecture that institutional investors have flagged as a persistent systemic risk.

By controlling the verification layer, attackers forced the network to mint rsETH tokens on Ethereum without burning the corresponding backing assets on Unichain, creating a token supply imbalance that broke the protocol’s fundamental collateralization mechanism.

This type of attack, targeting the consensus and verification layer rather than smart contract logic alone, represents an elevated threat vector for protocols relying on decentralized bridge infrastructure to manage multi-chain liquidity.

The cascade effect rippled across the broader DeFi ecosystem within days of the KelpDAO breach. Aave, the largest lending protocol by total value locked, experienced a TVL decline of $12.1 billion, a 46 percent drop from $26.4 billion to $14.3 billion, as market participants withdrew capital in response to heightened perception of systemic risk.

The speed and scale of the withdrawal demonstrated how quickly contagion spreads through DeFi when major protocols are breached, particularly when those breaches involve infrastructure used across multiple platforms.

Aave’s drawdown was not isolated to a single protocol but reflected a sector-wide contraction in confidence.

Market Contraction Accelerated as Monthly DeFi TVL Declined Every Month in 2026

The series of April hacks occurred within an already deteriorating market environment. Total value locked across all DeFi protocols fell consistently month-to-month throughout the first half of 2026, declining from $115.3 billion in January to just over $70 billion by late June.

This 39 percent contraction was not driven primarily by the hacking losses themselves, which accounted for roughly $942 million of the roughly $45 billion reduction, but rather by a broader retreat of institutional and retail capital from the sector amid weakening confidence in protocol security and macroeconomic headwinds.

The monthly pattern of TVL erosion suggests sustained investor caution rather than a sharp panic response to any single event. Each month registered declines independent of major security incidents in most cases, indicating that market participants were systematically reducing exposure to DeFi protocols as a category.

The hacks, rather than causing the broader contraction, accelerated an existing trend of capital flight from the sector.

For institutional investors, the data presents a dual risk profile: elevated frequency of exploits coupled with structural market retreat. The 85 Q2 incidents did not occur in a robust market where losses could be quickly absorbed; they occurred in a contracting ecosystem where already-thin margins for operational error were tested at scale.

85 Incidents in One Quarter Signals Deteriorating Attack Surface or Enhanced Adversary Capability

The sharp increase in exploit frequency raises questions about whether the DeFi sector faces a structural increase in attack surface or whether threat actors have developed more effective exploitation methods. The 49-incident jump from Q1 to Q2 cannot be explained by market size alone, as TVL actually contracted during this period.

Instead, the acceleration may reflect a combination of factors: increased targeting by well-resourced adversaries like North Korea’s Lazarus Group, proliferation of younger or less-mature protocols with untested security infrastructure, and possible copycat attacks following proof-of-concept breaches in high-profile targets.

The data also highlights a concentration of losses among a small number of large-scale breaches rather than widespread but individually smaller exploits. Two attacks accounted for 63 percent of Q2 losses, while 83 other incidents distributed the remaining $185 million across the sector.

This distribution suggests that the headline figure masks significant variance in breach severity, with most incidents causing localized damage while a handful of sophisticated attacks targeting infrastructure vulnerabilities produced outsized losses.

Institutional Risk Frameworks Will Face Pressure to Formalize DeFi Counterparty Vetting

The convergence of record hack frequency and sustained market contraction will likely force institutional investors and custodians to implement more rigorous protocol security assessments before allocating capital. The Drift Protocol breach demonstrated that multisig governance structures, long considered a standard security practice, remain vulnerable to determined social engineering campaigns.

The KelpDAO exploit showed that bridge infrastructure, essential for multi-chain liquidity provision, can be compromised at the consensus layer, a vulnerability that cannot be mitigated through code audit alone.

Institutional investors and prime brokers should monitor whether CryptoRank releases Q3 2026 hack

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

SecondFi Completes Refund Snapshot for Wallets Impacted by Recent Cardano Exploit

SecondFi Completes Refund Snapshot for Wallets Impacted by Recent Cardano Exploit

, , , , , , ,

BlockchainJune 27, 2026·5 min read

SecondFi has completed a final balance snapshot covering 374 wallets compromised in a June 21-23 Cardano exploit, marking the formal opening of its refund claims process. For institutional investors evaluating custody risks and platform security protocols across decentralized finance, the remediation timeline and affected wallet count signal both the scope of the breach and the speed at which a major platform can mobilize recovery operations.

  • SecondFi completed final balance snapshot on June 26, 2026 for 374 compromised wallets affected June 21-23
  • Snapshot represents refund preparation step, not confirmation that user payouts have already been processed
  • Development tests whether crypto market will treat security incidents as durable adoption challenges or short-term trading noise
  • 374 wallets compromised in the exploit compared to SecondFi’s broader user base
  • June 26, 2026 snapshot completion date, five days after exploit window closed June 23
  • 3 days duration of exploit window from June 21 through June 23, 2026

SecondFi announced on June 26, 2026, that it had completed a final balance snapshot for all wallets affected by a recent Cardano-based exploit that ran from June 21 through June 23. The snapshot covers 374 compromised wallets and represents a formal preparation step ahead of the platform’s refund distribution process.

The announcement carries significance beyond routine security disclosures: it establishes a documented baseline for claims verification and sets a concrete timeline against which investors can measure the pace of institutional-grade remediation in the decentralized finance sector.

SecondFi Isolates 374 Compromised Wallets Within Five Days of Exploit Detection

The three-day exploit window and the five-day turnaround to a completed snapshot underscore how quickly modern blockchain platforms must respond to security breaches. Institutional investors monitoring custody and platform risk typically watch two metrics: the total number of affected addresses and the speed of the entity’s technical response.

In this case, SecondFi isolated and verified 374 wallets with sufficient precision to generate a final balance snapshot within 120 hours of the breach ending.

The timing matters because crypto markets often conflate headline speed with actual competence. A snapshot announcement may signal infrastructure readiness, but it does not confirm that refund distributions have begun or that the platform has resolved the underlying security vulnerability. This distinction is critical for institutional risk assessments.

The Cardano ecosystem, in particular, has cultivated a reputation for technical rigor; a controlled, documented remediation process aligns with that positioning but also sets a high bar for follow-through.

For traders and portfolio managers, the scope of the incident, 374 wallets across a multi-day window, is neither trivial nor systemic by historical crypto standards. The 2022 FTX collapse affected millions of users; the 2016 DAO hack resulted in a network-level fork decision.

SecondFi’s incident appears operationally containable, though the actual recovery distribution timeline will determine whether this narrative sustains market attention or recedes into a series of weekly security patches that institutional investors have learned to treat as noise.

Snapshot Completion Does Not Confirm Refund Distribution Has Begun

A critical distinction embedded in SecondFi’s announcement is the difference between snapshot completion and actual refund processing. The platform explicitly stated that the snapshot represents a preparation step, not confirmation that users have already received compensation.

For institutional investors and compliance teams evaluating counterparty risk, this language choice matters: it prevents overstating the resolution timeline and establishes a legally defensible record of when the measurement period concluded.

The snapshot serves as a baseline for claims verification. Once the platform processes refunds, wallet holders will submit claims against the documented June 26 balance state. This two-stage process mirrors traditional securities settlement procedures and reflects how decentralized platforms must now operate under increasing regulatory scrutiny.

The delay between snapshot and payout also creates a window for additional technical investigation, legal review, or community governance input, common practice in high-profile DeFi incidents.

Institutional custodians and insurance providers will likely use the snapshot date as a reference point for coverage determinations and liability assessments.

Cardano Ecosystem Credibility Hinges on Refund Timeline and Completeness

SecondFi’s remediation approach will influence broader investor perception of Cardano-based platforms for the coming weeks. The Cardano network has positioned itself as a research-driven alternative to Ethereum, emphasizing formal verification and peer-reviewed development.

A security breach on a major Cardano application creates a narrative test: does the ecosystem’s underlying philosophy translate into faster, more transparent incident response than competitors face?

Market structure will play a decisive role in determining whether this story generates sustained follow-through. Bitcoin remains the anchor for broader sentiment, but altcoin narratives are increasingly evaluated on usage fundamentals, liquidity depth, compliance standing, treasury activity, and developer progress.

SecondFi’s handling of this incident touches all five variables: usage will be impacted by reduced user confidence; liquidity may tighten if market makers perceive counterparty risk; compliance standing depends on transparent communication with regulators; treasury activity will reflect refund funding; and developer progress must include security audits and protocol hardening.

If SecondFi distributes refunds completely and on a documented schedule, the incident may become an institutional case study in effective breach response. If payouts are delayed, incomplete, or disputed, the narrative will shift toward broader questions about custody risk in decentralized applications and whether platforms can credibly manage large-scale incidents.

Market Liquidity Response and Broader Crypto Sentiment Will Define Long-Term Impact

Even developments with genuine operational significance can fail to move prices if traders remain defensive, leverage is being unwound, or capital is rotating into other sectors. The SecondFi incident arrives at a moment when crypto assets are still establishing a clearer directional bias.

Institutional investors must watch whether on-chain data, exchange deposits, or derivatives positioning shows signs that the security incident is driving capital reallocation or is being treated as a contained, platform-specific issue.

Follow-up announcements from SecondFi, including governance votes on security upgrades, insurance payout confirmations, or audit reports from third-party security firms, will all serve as signals that the remediation process is advancing. Wallets that received compensation may exhibit deposit behavior, which can be tracked on-chain.

Stablecoin flows to and from Cardano-based platforms will indicate whether institutional users are maintaining positions or reducing exposure.

The next major data point will be whether SecondFi releases a specific refund distribution schedule and begins processing claims within a documented timeframe.

Institutional investors should monitor SecondFi’s official announcements for a refund processing schedule, third-party security audit findings on the underlying exploit, and on-chain transaction data showing the beginning of actual payouts. The June 26 snapshot completion marks the end of the measurement phase; the credibility of the entire remediation hinges on whether refunds flow as documented and whether the platform publicly commits to a payout timeline with specific dates and percentages of affected balances.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

The next DeFi drain could come from legacy contracts everyone forgot

The next DeFi drain could come from legacy contracts everyone forgot

, , , , ,

DeFiJune 11, 2026·6 min read

A $1.34 million exploit of Raydium’s phased-out AMM V3 pools exposes a systemic risk across DeFi: deprecated contracts that remain callable on-chain but invisible to users and unsupported by protocol infrastructure. Institutional investors face blind-spot losses from legacy smart contracts that exploit tracking systems categorize as routine bugs, when the real vulnerability is that nobody decommissioned them.

  • Raydium’s legacy AMM V3 pools held $10.2 million in idle liquidity across five pools after Serum’s deprecation rendered them functionless.
  • At least eight documented exploits since March 2025 have targeted deprecated or obsolete DeFi contracts, totaling approximately $10.8 million in losses.
  • Exploit classification systems routinely misidentify legacy-contract attacks as standard smart contract bugs, masking a lifecycle-management failure across the DeFi ecosystem.
  • $22.5M Total losses from legacy and zombie-contract exploits including Raydium incident
  • 10 Documented incidents involving deprecated infrastructure since March 2025
  • $1.34M Amount drained from Raydium’s unsupported legacy AMM V3 pools

On a Solana blockchain still considered a frontier for institutional adoption, Raydium’s recent exploit reveals a category of loss that standard risk models do not track. The attack targeted liquidity pools that Raydium had formally deprecated, phased out of the protocol’s active product line, yet left callable and exploitable on-chain.

The attacker bypassed critical validation checks that the current AMM V3 implementation enforces: they created a fake LP mint token, presented it as legitimate collateral, and drained real assets from five pools that had fallen into a state of technical limbo between active deployment and full decommissioning.

The broader pattern suggests this is not an isolated operational failure but a scaling problem in how DeFi protocols manage contract lifecycles. Exploit tracking systems, the tools institutional investors and risk managers rely on to categorize losses, classify these incidents under existing taxonomies: smart contract bugs, access control failures, oracle flaws.

None of those categories captures the core issue: a contract that should have been shut down, but wasn’t.

Raydium’s V3 pools remained live after Serum dependency made them obsolete

Raydium’s original AMM V3 pools existed solely to place orders on the Serum decentralized order book. When Serum itself deprecated its core infrastructure, the V3 implementation lost its fundamental purpose. The protocol launched a new product line with upgraded validation logic, moving users and liquidity to current pools.

But the old pools never closed: they stayed on-chain, callable, and accumulated idle capital of approximately 150,177 RAY, 5,603 SOL, and 893,700 USDC.

The legacy program skipped two critical safety checks present in Raydium’s current implementation. Current pools verify the LP mint address and validate token proportions against a virtual supply mechanism to ensure collateral integrity. The V3 pools enforced neither check.

An attacker exploited this gap by creating a new mint, passing it off as the legitimate LP token, and withdrawing real assets without providing proportional backing, a classical proportion-control bypass that worked only because the old contract never implemented the guard in the first place.

The $1.34 million loss covered five distinct pools, all outside the active product path and marked as unsupported in Raydium’s user interface and SDK documentation. No current user could accidentally access these pools; the attack required direct blockchain interaction and familiarity with the deprecated program’s structure.

That specificity matters to institutional investors: it means this was not a zero-day affecting live trading infrastructure, but a predictable failure of contract retirement discipline.

Eight documented incidents in nine months trace a pattern of zombie contracts across protocols

The Raydium incident sits within a measurable trend. Public exploit reports identify at least eight clear cases since March 2025 where deprecated, obsolete, or legacy DeFi contracts became the primary attack surface. These incidents total approximately $10.8 million in direct losses.

Expanding the definition to include broader vault and product-level deprecation failures raises the count to roughly ten incidents totaling $22.5 million, a figure that includes Raydium and reflects losses from contracts that exploit tracking databases routinely misclassify.

The March 2025 1inch exploit drained roughly $5 million by targeting an obsolete Fusion v1 resolver contract. October 2025 saw Abracadabra lose $1.8 million when deprecated Cauldron V4 contracts remained exploitable due to a logic flaw that only affected the old implementation. December’s Yearn incident involved a legacy iEarn TUSD vault that had been phased out of the active product ecosystem.

None of these protocols deliberately kept these contracts online; all had moved users and capital to newer implementations. But the infrastructure persisted on-chain.

The commonality is not a technical flaw confined to one team or architecture. Rather, it reflects how DeFi protocols handle the transition from active product to dormant legacy status. Most deprecate by announcement and SDK update: they redirect users, stop routing traffic to old contracts, and document the transition in changelogs.

Few actually execute full decommissioning, the technical process of rendering a contract permanently non-callable or entirely removing its state. The gap between announced deprecation and technical decommissioning is where losses accumulate.

Exploit classification systems systematically miss the lifecycle-state risk layer

Standard exploit taxonomies break incidents into five categories: smart contract code bugs, access control failures, oracle and accounting issues, private key compromises, and bridge security flaws. Each describes a technical mechanism, the flaw that allowed funds to move. None captures the prerequisite: that a contract should not still have been callable in the first place.

A database entry for the Raydium incident would list “missing validation checks” as the root cause, correctly identifying the technical gap. But that classification obscures the fact that the V3 contract was deprecated infrastructure that should have been inaccessible. The 1inch loss gets tagged as a “resolver contract bug” without noting that the contract was obsolete.

Abracadabra’s incident appears as a logic flaw affecting Cauldron V4, not as a failure to decommission retired vault code.

This labeling problem has real consequences for institutional risk management. Portfolio managers and compliance teams use exploit databases to model DeFi exposure. If losses from deprecated contracts roll into the same “smart contract bug” bucket as zero-day flaws in active code, the risk profile becomes distorted.

A protocol with zero defects in its current implementation but poor lifecycle management looks identical to one with active code vulnerabilities. The institutional buyer cannot distinguish between these risks because the information system conflates them.

Exploits of zombie contracts are a governance and operations failure, not a cryptography or code-audit problem.

DeFi protocols face mounting pressure to decommission rather than simply deprecate

The recurring pattern has begun forcing protocol teams to address contract lifecycle more deliberately. Several have announced technical decommissioning procedures: not merely directing users away from old contracts, but rendering them non-callable through state migration, asset transfer-out, or self-destructing code mechanisms.

Some are retroactively adding kill-switches to legacy contracts, enabling admins to freeze calls and drain remaining balances.

However, this shift remains voluntary and inconsistent. There is no standard for how long a contract should remain callable after deprecation, no agreed timetable for full decommissioning, and no regulatory or community pressure comparable to what zero-day exploit prevention commands.

A protocol can announce a contract as deprecated and still leave it live for months or years without facing reputational consequence, until an attacker finds it.

For institutional investors, the operational question is whether DeFi can scale to support proper lifecycle management at the pace protocols currently ship new products. Raydium alone has gone through multiple AMM iterations; Yearn runs dozens of vault implementations across different assets and strategies. As the installed base of contracts grows and products cycle faster, the number of deprecated implementations waiting for decommissioning will only increase. The $22.5 million in documented losses represents the incidents that made it into public reports; the

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

The next big DeFi exploit will start before the code is deployed

The next big DeFi exploit will start before the code is deployed

, , , , , , , , ,

Socket’s May 24 disclosure of TrapDoor found more than 34 malicious packages and over 384 related versions spread across npm, PyPI, and Crates.io, each targeting the developers who build and maintain protocols, and the credentials that govern access to the systems around them.

What TrapDoor built is a route from a single developer’s compromised machine into the repositories, CI/CD pipelines, cloud accounts, and deployment keys that govern how protocols reach mainnet and stay updated once deployed.

Socket’s report confirms credential theft and infrastructure exposure as the campaign’s documented scope, leaving on-chain exploits as the inferred downstream consequence.

How a malicious package can become DeFi exploit risk
A six-stage flowchart shows how a malicious package moves from developer machine compromise through credential theft to put user funds at risk.

The attack surface developers don’t audit

The campaign delivered payloads through ordinary developer workflows, such as npm packages executing malicious code through postinstall hooks, PyPI packages triggering payloads on import while fetching remote JavaScript, and Rust crates running build.rs scripts during compilation.

Normal developer behavior is the attack surface, as none of these execution paths requires anything beyond a package install, an import, or a build command.

In the environment around a live protocol, any one of those credential classes can represent a path to user funds that no smart contract audit ever examines.

Socket explicitly framed stolen SSH keys as enabling lateral movement, and cloud and GitHub credentials as exposing repositories, CI/CD systems, private packages, and deployment environments.

That chain, comprising malicious package, developer compromise, credential theft, repo and cloud access, and malicious update, describes how a DeFi exploit can arise without a single line of vulnerable Solidity.

The AI instruction injection

Socket found the TrapDoor campaign attempted to plant hidden instructions inside files such as .cursorrules and CLAUDE.md, which are configuration files that AI coding assistants like Cursor and Claude Code read to understand how to behave within a project.

The injected instructions employed hidden Unicode techniques to steer AI-assisted workflows toward secret discovery and exfiltration.

Socket also found pull requests submitted to AI and developer tooling projects that tried to introduce instruction files under benign-sounding labels.

The target was the AI assistant that reads the repo, generates code, and operates with whatever context the project files supply.

If attackers silently manipulate that context through hidden Unicode instructions, the AI-assisted workflow becomes an exfiltration mechanism.

A broader pattern

SafeDep documented a May 11 campaign that compromised more than 170 npm packages and two PyPI packages, hitting 404 malicious versions tied to TanStack, Mistral SDK, UiPath, OpenSearch, and Guardrails AI.

StepSecurity described five major supply-chain attacks in 48 hours across VS Code extensions, GitHub Actions, npm, and PyPI, including a poisoned VS Code extension with 2.2 million installs and trojanized Microsoft PyPI packages.

Sonatype reported more than 454,600 new malicious packages in 2025, bringing the cumulative count to above 1.233 million, with malicious packages now serving as entry points for broader intrusions.

Campaign / source Timing Ecosystem affected Scale cited Why it matters for this story
TrapDoor / Socket May 2026 npm, PyPI, Crates.io 34+ malicious packages; 384+ versions/artifacts Shows crypto developers being targeted before code reaches mainnet
SafeDep campaign May 11, 2026 npm, PyPI 170+ npm packages; 2 PyPI packages; 404 malicious versions Shows malicious packages spreading through mainstream developer dependencies
StepSecurity 48-hour wave May 2026 VS Code, GitHub Actions, npm, PyPI 5 major attacks; one VS Code extension had 2.2M installs Shows attackers moving across multiple layers of developer tooling
Sonatype 2025 data 2025 Major open-source ecosystems 454,600+ new malicious packages; 1.233M+ cumulative Shows malicious packages becoming an industrialized intrusion channel

The control-plane attack pattern has already resulted in measurable DeFi losses using structurally identical methods.

Resolv’s March incident was a $23 million exploit where the deployed code worked exactly as designed, but off-chain infrastructure and trusted keys failed.

In April 2026, Drift lost $285 million when attackers combined long-running social engineering with valid admin signatures.

KelpDAO lost approximately $292 million the same month when attackers compromised off-chain RPC and DVN infrastructure.

In each case, the failure point was operational: trusted infrastructure, off-chain systems, and admin access layers surrounding the contract.

Where the risk resolves

If TrapDoor-style packages draw quick detection, since Socket’s system logged average detection at 5 minutes and 56 seconds, and teams rotate exposed credentials before downstream access occurs, the campaign ends at the detection layer, with its damage limited to credentials that teams can still rotate.

DeFi losses track near the 2025 Immunefi baseline of $680 million, with TrapDoor’s primary effect being accelerated security reviews of package dependencies, CI/CD secrets, and developer environment hygiene across crypto teams.

The bear case draws on data from Chainalysis, TRM Labs, and Immunefi, measured in 2025 and early 2026.

TRM Labs estimated that North Korean hackers stole approximately $577 million through April 2026, accounting for 76% of all crypto losses during that period. Chainalysis put total crypto service theft at more than $3.4 billion in 2025, with the top three incidents accounting for 69% of that figure.

A TrapDoor-type upstream compromise reaching deployer keys, bridge validator infrastructure, or admin credentials at a mid-to-large protocol could add $100 million to $300 million to 2026’s running total, pushing annual DeFi losses toward $1 billion or above.

One infected developer machine with a GitHub token controlling a deployment pipeline, a cloud credential managing bridge infrastructure, or a wallet key holding protocol admin authority can reach far more than the developer’s own funds.

In the Drift incident, attackers drained assets including cbBTC and WBTC, showing that Bitcoin-linked liquidity wrapped or bridged into DeFi sits inside the same operational infrastructure that TrapDoor targets.

Scenario What happens Loss implication Article takeaway
Contained / bull case TrapDoor-style packages are detected quickly, exposed credentials are rotated, and no downstream protocol access occurs DeFi losses remain near the 2025 Immunefi baseline of $680M Fast detection limits the campaign to credential hygiene and dependency reviews
Base case Copycat campaigns compromise smaller teams, CI/CD secrets, or cloud credentials, causing limited protocol incidents Annual DeFi losses move above the 2025 baseline but remain below $1B The exploit surface shifts upstream, but losses stay fragmented
Bear case One compromised developer machine exposes deployer keys, bridge infrastructure, admin credentials, or repo access at a mid-to-large protocol One incident adds $100M–$300M, pushing annual DeFi losses toward or above $1B The next major exploit may begin before vulnerable code is deployed
Black swan A self-propagating or AI-assisted supply-chain campaign compromises multiple developer environments, packages, or CI/CD systems Clustered losses approach the scale of major 2025 crypto service theft DeFi’s control plane becomes the attack surface

What audits don’t reach

The DeFi industry has built a meaningful smart contract security layer over the past four years. Immunefi’s data shows that the median incident size dropped from $6 million in 2022 to $1.5 million in 2025, a sign that core contract-level defenses have matured.

But Resolv, Drift, and KelpDAO show that attackers have absorbed that improvement and moved to systems audits cannot reach, such as deployer permissions, bridge validators, cloud infrastructure, admin keys, off-chain RPC endpoints, and now the developer machines, package dependencies, and AI coding environments that produce and configure all of the above.

A smart contract can pass every audit a protocol commissions and still sit atop a deployment pipeline where a post-install hook has already exfiltrated the deployer’s GitHub token.

TrapDoor is a specific campaign with a specific package count and a detection timestamp. The attack surface it targeted, consisting of developer machines, package registries, CI/CD credentials, AI coding files, and cloud accounts, persists beyond TrapDoor’s own package list.

Other campaigns are already using the same pathways, and the next DeFi exploit may begin on a developer’s laptop, inside a build script, or within an AI coding environment.

The post The next big DeFi exploit will start before the code is deployed appeared first on CryptoSlate.

THORChain exploit turns emergency chain halt into a DeFi trust test

THORChain exploit turns emergency chain halt into a DeFi trust test

, , , , , , ,

THORChain’s suspected multichain exploit and emergency halt on May 15 has turned into another DeFi security incident, and another test of cross-chain trust.

Emergency controls moved through chain-specific halts, Halt All Trading, Halt Signing, Halt Chain Global, Halt Churning, and repeated global node-pause updates.

One public alert described the likely exploit affecting Bitcoin, Ethereum, BSC, and Base, resulting in more than $10.7 million in losses, revised from an earlier $7.4 million estimate.

Another security estimate put the loss near $10 million, including 36.75 BTC and about $7 million across BNB Chain, Ethereum, and Base.

The chain scope was later expanded in a TRM Labs assessment, which reported that the attacker drained more than $11 million across at least nine chains. Those chains included Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP, in addition to the initial four-chain framing. The figures may still move as the accounting is reconciled, but the available record points to a multichain infrastructure event touching several native-asset routes.

The halt, therefore, carried consequences beyond THORChain. Cross-chain liquidity is supposed to make crypto feel more useful, liquid, and connected. Yet the same design that lets assets move between isolated networks can also compress the response window when something breaks.

Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi
Related Reading

Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi

Kraken is rebuilding how Bitcoin moves through DeFi after the KelpDAO shock.
May 15, 2026
·
Liam ‘Akiba’ Wright

In this case, DeFi’s promise of seamless routing ran straight into the need for an emergency stop.

Detective investigating a DeFi exploit map with THORChain, Bitcoin, BNB, DOGE, and liquidity clues.

The Halt Became The Signal

The operational response is documented in the chain’s emergency framework. THORChain’s procedures describe network and chain halts as tools node operators can use when funds are at risk.

Its architecture relies on Bifrost observation, vaults, and threshold-signature signing to move native assets across chains without wrapping them.

Those controls can protect funds by stopping further activity. They also show that cross-chain infrastructure is a stack of observers, validators, vaults, signing logic, node operations, and emergency procedures.

When that stack is tested, the market asks whether a single bug can be patched and whether the system can remain credible while the response itself disrupts routing.

I think that distinction brings the THORChain incident into the broader DeFi story. Mature financial infrastructure is expected to fail safely, explain quickly, and restore confidence with a documented root cause.

DeFi often moves faster than that standard. It ships integrations, new chains, and liquidity routes before users and institutions have a clear way to price the full operational risk.

After the $16.5 billion in exploits, DeFi is now being forced toward the controls it once resisted
Related Reading

After the $16.5 billion in exploits, DeFi is now being forced toward the controls it once resisted

Aave’s rsETH bad debt shows DeFi’s next security crisis rests in broken assumptions across bridges, governance, collateral listings, and risk controls.
May 10, 2026
·
Gino Matos

A compact confidence ladder captures the current state of record:

Signal What is supported What remains unresolved
Initial security alert Likely exploit across Bitcoin, Ethereum, BSC, and Base for more than $10.7 million. Final loss accounting and complete chain scope.
Independent estimate About $10 million, including 36.75 BTC and roughly $7 million on EVM-linked chains. Whether all affected assets and addresses have been fully reconciled.
Analytics scope More than $11 million across at least nine chains. How the wider scope maps to THORChain’s final postmortem.
Emergency controls Trading, signing, global chain activity, and churning controls were activated. How quickly the halt contained the damage and what activity resumed afterward.
Protocol confirmation One of six Asgard vaults was reportedly compromised for roughly $10.7 million; initial indications said individual swaps were unaffected. Final root cause, final user-impact accounting, and postmortem detail.
Infographic mapping THORChain's May 15 exploit scope against emergency halt controls and unresolved postmortem questions.
THORChain’s May 15 halt showed how suspected multichain losses, emergency controls, and unresolved postmortem questions converged into a broader DeFi infrastructure test.

The Trust Discount Is Now Measurable

The damage from exploits rarely ends with the drained wallet. Immunefi’s 2026 security findings put the average direct theft at $25 million, while the median loss fell to $2.2 million.

That gap shows a market where routine defenses may improve while the largest incidents still define confidence.

The same report found that the top five hacks in 2024 and 2025 accounted for 62% of stolen funds, and hacked tokens saw a median six-month decline of 61%.

Those token moves cannot be cleanly separated from market conditions or project-specific weakness in every case. Still, the pattern supports the core market reaction: exploits become long-tail business events.

They drain capital, consume team time, slow integrations, and make partners question whether the next failure will hit them indirectly.

The trust discount reflects an extra layer of skepticism toward a sector that wants to be treated as financial infrastructure, yet still produces failures that look like crisis drills.

Users, exchanges, market makers, custodians, and institutions require more evidence to trust a protocol’s uptime, monitoring, key management, and emergency processes.

Recent cross-chain incidents reinforce that point. In the KelpDAO bridge exploit, attackers targeted off-chain verification and source-chain watching infrastructure rather than a conventional smart-contract bug.

The result was a false view of reality that led to valid-looking transactions releasing funds. Bridge-security fears have already influenced infrastructure decisions, including Kraken’s move to use Chainlink CCIP for kBTC and future wrapped assets following the KelpDAO shock.

Chainlink emerges as the unlikely $3B winner of KelpDAO exploit as DeFi projects dump LayerZero
Related Reading

Chainlink emerges as the unlikely $3B winner of KelpDAO exploit as DeFi projects dump LayerZero

More than $3 billion in DeFi value is moving toward Chainlink’s CCIP after the KelpDAO exploit exposed weaknesses in bridge verification.
May 11, 2026
·
Oluwapelumi Adejumo

That makes the THORChain halt feel less isolated. The sector is being forced to prove that the trust path across chains is observable, redundant, and controllable before billions of dollars of liquidity are routed through it.

For institutional users, the issue becomes operational due diligence. Cross-chain exposure touches custody policy, liquidity commitments, incident response, and counterparty reviews.

A protocol that routes native assets across chains has to prove that the monitoring and emergency process around that routing is as strong as the connectivity itself.

For builders, that changes what counts as progress. New routes and integrations can deepen liquidity, but they also create more surfaces for monitoring, key management, and incident response.

The next credibility gains will come from showing that controls scale with liquidity before a failure forces counterparties to revisit assumptions.

THORChain Carries A Compliance Layer Too

THORChain’s position is especially sensitive because the protocol combines an attack surface with a routing role in major illicit-flow episodes.

As of TRM’s report, the May 15 exploit had no public actor attribution. That caveat keeps the current incident separate from earlier laundering cases unless new evidence changes the record.

The same analysis described THORChain as a recurring rail for moving stolen funds, including flows tied to the Bybit and KelpDAO incidents.

That pressure was evident after Lazarus-linked Bybit funds moved through the protocol, when THORChain faced tensions between developers and validators.

Thorchain faces developer exodus amid North Korean money laundering scandal
Related Reading

Thorchain faces developer exodus amid North Korean money laundering scandal

A core contributor known as TCB warned that Thorchain could face a crisis if the network is framed as a money laundering facilitator.
Feb 28, 2025
·
Gino Matos

Federal investigators attributed the February 2025 Bybit theft of about $1.5 billion in virtual assets to North Korea’s TraderTraitor activity.

The FBI also urged private-sector crypto entities, including DeFi services and bridges, to block transactions to or from addresses linked to laundering.

That history sharpens the current episode. A protocol can be useful because it makes native cross-chain swaps efficient. The same utility can make it attractive to attackers and difficult for compliance teams to ignore.

Once a protocol is seen as both exploitable infrastructure and a route for illicit funds, counterparties have to price in more than just smart-contract risk.

They have to price operational interruption, screening exposure, and the chance that integrations become reputational liabilities.

RUNE price reaction stays secondary. Market data on May 16 put RUNE at around $0.44, down 21.90% over 24 hours.

The broader crypto market stood near $2.61 trillion with Bitcoin dominance at 60.2%. The market noticed the incident, but the more important question is whether liquidity providers, routing interfaces, wallet integrations, and compliance desks change behavior after the halt.

The important market signal will come from the next set of operational choices rather than from a one-day chart. Liquidity interfaces can route around protocols that introduce uncertainty; custodians and market makers can raise internal risk scores.

Compliance teams can demand better screening and incident records before supporting integrations. Those reactions are slower than a token selloff, but they are the way a security event becomes a durable trust discount.

That is the slower repricing institutions notice. It shows up in due diligence questions, integration queues, and risk limits long after the emergency halt leaves the alert feed.

The Next Test Is The Postmortem

The next test starts with more than a recovery message: THORChain needs to produce a clear postmortem, reconcile the final loss figure and chain count, explain the root cause without speculation, and show what changed in its vault, key-management, node, monitoring, and halt processes.

Recovery details may help contain user harm while leaving the infrastructure question intact.

If THORChain completes compensation, resumes safely, and documents a credible fix, the incident can remain a severe but contained confidence hit.

If the root cause remains unsettled, final accounting keeps changing, or integrations pull back, the event becomes another data point in a broader repricing of cross-chain DeFi.

That is the sector-level consequence. DeFi wants to present itself as a durable, always-on financial infrastructure.

Every major cross-chain exploit makes that claim harder to defend until the industry can show that the bridges, vaults, signing systems, and emergency controls connecting its markets are as mature as the capital they aim to attract.

The post THORChain exploit turns emergency chain halt into a DeFi trust test appeared first on CryptoSlate.

Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi

Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi

, , , , , , , ,

Kraken is moving its wrapped Bitcoin (kBTC) to Chainlink CCIP as bridge-security fears continue spreading across DeFi, turning the bridge-security debate into a decision about wrapped-Bitcoin infrastructure.

In a recent announcement, the exchange said it is deprecating its existing cross-chain provider and moving all Kraken Wrapped Bitcoin to Chainlink’s Cross-Chain Interoperability Protocol. CCIP will become the exclusive cross-chain infrastructure for kBTC and future Kraken Wrapped Assets.

The move adds a centralized exchange‘s Bitcoin wrapper to the migration wave that followed the KelpDAO exploit. It places exchange-issued BTC distribution inside the same risk debate that has already pushed DeFi-native projects to reassess how tokens move between chains.

The asset itself is the difference. kBTC is Kraken’s 1:1 Bitcoin-backed wrapper, designed to make BTC usable across networks outside Bitcoin’s native environment.

Kraken says kBTC can be used on Ink, Unichain, Ethereum, OP Mainnet, and other DeFi ecosystems, with Bitcoin backing held through Kraken Financial and public reserve and contract links available for verification.

Kraken launches kBTC as competition heats up in wrapped Bitcoin market
Related Reading

Kraken launches kBTC as competition heats up in wrapped Bitcoin market

Kraken’s kBTC has around 100 tokens in supply, with the majority held on the Ethereum blockchain.
Oct 17, 2024
·
Oluwapelumi Adejumo

That structure creates a trust stack with several layers. Users face a stacked decision involving Kraken custody, the wrapper’s smart contracts, cross-chain messaging, destination networks, and DeFi venues where kBTC is used.

Kraken’s CCIP decision addresses one part of that stack, while also showing why wrapped Bitcoin distribution is now a market-structure question rather than a simple product expansion.

Kraken wrapped Bitcoin kBTC moves from bridge risk toward Chainlink CCIP infrastructure

Why kBTC makes the migration different

Wrapped Bitcoin exists because BTC remains the dominant crypto asset, while the Bitcoin network connects poorly with most DeFi applications.

CryptoSlate data shows Bitcoin trading below $80,000 on May 15, with a market value of nearly $1.6 trillion, about 60% market dominance, and $45 billion in 24-hour volume. Even amid the dip, that scale explains why exchanges and protocols keep trying to move Bitcoin liquidity into smart-contract environments.

Kraken’s answer is kBTC. The exchange’s product page describes the token as fully backed and exchangeable for BTC, with each kBTC collateralized by Bitcoin held in Kraken’s custody.

Its whitepaper says that eligible Kraken users can deposit or withdraw kBTC at a 1:1 rate with BTC, with applicable fees deducted, and that BTC backing is held at Kraken Financial, a Wyoming-chartered Special Purpose Depository Institution.

The same materials point users to reserve and contract data, including the SPDI custody wallet and kBTC smart contracts on Ink, Unichain, OP Mainnet, and Ethereum. That transparency is important because wrapped assets depend on the market believing that the issued token remains redeemable for the asset it represents.

The remaining risk remains even with transparency. Kraken’s whitepaper lists smart contract vulnerabilities, possible peg divergence on third-party platforms, regulatory changes, and problems on third-party blockchains or protocols as risks tied to kBTC.

It also says that Kraken effectively controls token management functions through a Kraken-controlled wallet.

That is the tension Kraken’s CCIP decision brings into focus. Wrapped Bitcoin needs distribution to matter in DeFi.

Every added chain and venue can increase utility, but it also makes cross-chain infrastructure choices more visible to users, integrators, and risk teams.

Risk layer Known facts What remains to watch
Custody and reserves kBTC is backed 1:1 by BTC held at Kraken Financial, with reserve links published by Kraken. Whether future Kraken Wrapped Assets use the same level of public reserve transparency.
Smart contracts and token control Kraken cites internal reviews, a Trail of Bits audit, and Kraken-controlled token management functions. How users and protocols assess issuer control alongside contract security.
Cross-chain messaging Kraken is moving kBTC and future wrapped assets to Chainlink CCIP as exclusive cross-chain infrastructure. The exact CCIP configuration, migration timing, and rate-limit or attestation design.
Market peg and liquidity Kraken says kBTC is redeemable 1:1 through eligible Kraken accounts, while third-party markets can diverge. Whether kBTC liquidity grows across DeFi while peg stress stays limited.
Destination-chain and protocol risk Kraken discloses technical risks on third-party chains and protocols where kBTC may be used. Whether broader distribution increases exposure to weak DeFi venues or chain incidents.

Infographic showing five risk layers in kBTC's trust stack, from Kraken custody and reserves through smart contracts, CCIP messaging, market peg, and destination-chain exposure.

How CCIP changes kBTC routing

Chainlink markets CCIP as a cross-chain standard for DeFi and institutional use cases. Its materials say CCIP supports Cross-Chain Tokens, uses decentralized oracle networks and risk-management features, and is covered by ISO 27001 and SOC 2 Type 2 security statements.

Those claims help explain why asset issuers would evaluate it after a major bridge incident.

The safer interpretation is that Kraken is changing the infrastructure layer it wants kBTC and future wrapped assets to depend on. That may reduce some configuration or vendor-risk concerns, while custody risk, smart contract risk, peg risk, and exposure to destination chains remain outside the bridge-provider decision.

The move lands in a specific post-KelpDAO context. CryptoSlate previously reported that more than $3 billion in DeFi value had moved toward Chainlink CCIP after the $292 million KelpDAO exploit intensified scrutiny of bridge security and LayerZero-linked configurations.

Chainlink emerges as the unlikely $3B winner of KelpDAO exploit as DeFi projects dump LayerZero
Related Reading

Chainlink emerges as the unlikely $3B winner of KelpDAO exploit as DeFi projects dump LayerZero

More than $3 billion in DeFi value is moving toward Chainlink’s CCIP after the KelpDAO exploit exposed weaknesses in bridge verification.
May 11, 2026
·
Oluwapelumi Adejumo

LayerZero later said its protocol remained unaffected, but acknowledged that allowing its decentralized verifier network to act as a 1/1 DVN for high-value transactions was a mistake. It recommended stronger multi-DVN configurations and said the affected incident involved a single application.

That admission frames the issue less as a simple bridge-brand fight and more as a debate over defaults, issuer responsibility, and how much security configuration should sit with the application.

Kraken’s move now brings that debate to exchange-issued wrappers. The exchange is deciding how kBTC moves and signaling which interoperability stack it wants future wrapped assets to inherit.

Infographic timeline showing the post-KelpDAO bridge-risk reset, including the exploit, LayerZero apology, DeFi migration wave, Solv, Re, and Kraken kBTC move to CCIP.

Other migrations show why context matters. Solv Protocol said it moved more than $700 million in SolvBTC and xSolvBTC cross-chain infrastructure from LayerZero bridges to CCIP after a security review.

Re said it moved from LayerZero to CCIP for reUSD after evaluating cross-chain infrastructure, citing $475 million-plus in TVL, $160 million-plus reUSD market cap, 16 independent node operators, native rate limits, and institutional controls.

Those moves make Kraken part of a broader risk reset. But kBTC adds the Bitcoin and exchange-custody dimension.

The test now moves to execution

For users, the practical question is whether Kraken’s migration gives kBTC holders and DeFi integrators a clearer, more resilient operating model.

The first signal will be an operational detail. Kraken has said kBTC and future Kraken Wrapped Assets will use CCIP, but the exchange has yet to disclose the migration timeline, chain-by-chain cutover process, and the exact configuration that will apply to kBTC.

For an asset marketed around reserve transparency and exchange custody, those details matter because infrastructure changes can affect how users evaluate deposits, withdrawals, bridging, and downstream protocol integration.

The second signal will be liquidity. kBTC’s value proposition depends on Bitcoin becoming useful in places outside its native network.

If the CCIP migration helps Kraken expand kBTC usage across Ink, Unichain, Ethereum, OP Mainnet, and future networks while keeping redemption and reserve visibility clear, the move could strengthen the case for exchange-issued wrapped assets in DeFi.

Kraken eyes DeFi expansion with launch of Ink, its new Ethereum layer-2 network
Related Reading

Kraken eyes DeFi expansion with launch of Ink, its new Ethereum layer-2 network

Kraken’s Ink to boost DeFi on Ethereum with Optimism tech.
Oct 24, 2024
·
Oluwapelumi Adejumo

Lagging usage would make the announcement look more like a vendor rotation than a change in wrapped-Bitcoin market structure.

Strong usage would sharpen the tradeoff: kBTC may gain more reach, but users will still be relying on Kraken as issuer and custodian, CCIP as cross-chain infrastructure, and third-party chains and protocols as execution venues.

That is why the migration matters. Kraken is moving more than a token route.

It is putting a Bitcoin-backed exchange wrapper into the same security debate that has already reshaped DeFi bridge decisions after KelpDAO. The next test is whether that decision turns into safer, clearer BTC distribution across DeFi, or simply shifts wrapped-asset trust to a new set of dependencies.

The post Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi appeared first on CryptoSlate.

Logic flaw drains $101K from Huma's old Polygon contracts

Logic flaw drains $101K from Huma’s old Polygon contracts

, , , , , , , ,

An attack on the V1 smart contracts of Huma Finance on Polygon resulted in a loss of $101,400 USDC. The exploit added to what’s already been a difficult time for DeFi protocols on the network.

The exploit was reported by web3 security firm Blockaid. The attacker targeted BaseCreditPool deployments related to Huma’s older V1 infrastructure. The total loss was ~$101,400 in USDC and USDC.e coins across various contracts.

Huma Finance confirmed the incident on X, saying “No user funds at risk and PST is not impacted.” The team said its V2 system, which runs on Solana, was built from scratch. It shares no code with the compromised contracts.

Huma’s V1 flaw was in one function

The smart contract flaw was found inside a function named refreshAccount(). Its a function located within the V1 BaseCreditPool contracts. Blockaid security researchers identified the bug. They shared more information on X, saying:

“Bug: refreshAccount() unconditionally promotes a Requested credit line to GoodStanding, bypassing the EA approval step and enabling drawdown().”

refreshAccount() labelled accounts with ‘good standing’ without actual verification or conditions. The attacker took advantage of this flaw and drained funds from the protocol’s treasury pools

The losses were found in three contracts according to Blockaid’s on-chain analysis. One account lost ~82,300 USDC. A second lost ~17,300 USDC.e. And a third account lost ~1,800 USDC.e. According to on-chain data, the entire exploit was completed in one transaction.

There was no cryptographic issue. The attacker just changed the contract’s state machine to trick it into treating an unauthorized account as legit.

Huma’s team wrote on X, “Earlier today a vulnerability in Huma’s legacy v1 contracts on Polygon was exploited for 101,400 USDC.” They continued, “Huma’s v2 system on Solana is a complete rewrite and this issue does not apply to v2 systems.”

Huma said it had already been winding down V1 operations before the exploit occurred. The team said on X, “The teams were already in the process of sunsetting all the legacy v1 pools, and have paused v1 completely now.”

After the incident, the team fully paused all remaining V1 contracts. The company said that user deposits on V2 were untouched and that the newer platform continues to operate normally.

Polygon had a bad day

According to a recent report from Cryptopolitan, the exploit took place on the same day that Ink Finance lost almost $140,000 from its Workspace Treasury Proxy contract on Polygon. The attacker deployed a contract matching a whitelisted claimer address to bypass eligibility checks.

In both incidents, the attackers found logic mistakes in smart contract design. The back-to-back exploits on Polygon come after April 2026, setting the record for the worst month of smart contract losses.

The smartest crypto minds already read our newsletter. Want in? Join them.

Load More