Menu
MCAP $2.79T ▼-1.91%
BTC $82,394 ▲+1.00%
ETH $2,454 ▲+1.53%
BNB $729.13 ▼-0.03%
XRP $1.340 ▲+0.50%
SOL $105.73 ▲+1.19%
DOGE $0.0814 ▼-0.62%
ADA $0.231 ▲+0.50%
TRX $0.3322 ▲+0.08%
LINK $12.51 ▲+0.86%
AVAX $10.05 ▲+0.47%
HYPE $82.18 ▲+1.80%
DOT $1.150 ▲+0.62%

DeFi Security

Every Crypto Coin Show story tagged DeFi Security, newest first, alongside the guides and interviews that give it context.

Guide: How do AI agents pay eachGuide: How do blockchains reach consensus? ProofNewsletter
From the interview archive
SecondFi Completes Refund Snapshot for Wallets Impacted by Recent Cardano Exploit
Blockchain

SecondFi Completes Refund Snapshot for Wallets Impacted by Recent Cardano Exploit

, , , , , , ,

BlockchainJune 27, 2026·5 min read

SecondFi has completed a final balance snapshot covering 374 wallets compromised in a June 21-23 Cardano exploit, marking the formal opening of its refund claims process. For institutional investors evaluating custody risks and platform security protocols across decentralized finance, the remediation timeline and affected wallet count signal both the scope of the breach and the speed at which a major platform can mobilize recovery operations.

  • SecondFi completed final balance snapshot on June 26, 2026 for 374 compromised wallets affected June 21-23
  • Snapshot represents refund preparation step, not confirmation that user payouts have already been processed
  • Development tests whether crypto market will treat security incidents as durable adoption challenges or short-term trading noise
  • 374 wallets compromised in the exploit compared to SecondFi’s broader user base
  • June 26, 2026 snapshot completion date, five days after exploit window closed June 23
  • 3 days duration of exploit window from June 21 through June 23, 2026

SecondFi announced on June 26, 2026, that it had completed a final balance snapshot for all wallets affected by a recent Cardano-based exploit that ran from June 21 through June 23. The snapshot covers 374 compromised wallets and represents a formal preparation step ahead of the platform’s refund distribution process.

The announcement carries significance beyond routine security disclosures: it establishes a documented baseline for claims verification and sets a concrete timeline against which investors can measure the pace of institutional-grade remediation in the decentralized finance sector.

SecondFi Isolates 374 Compromised Wallets Within Five Days of Exploit Detection

The three-day exploit window and the five-day turnaround to a completed snapshot underscore how quickly modern blockchain platforms must respond to security breaches. Institutional investors monitoring custody and platform risk typically watch two metrics: the total number of affected addresses and the speed of the entity’s technical response.

In this case, SecondFi isolated and verified 374 wallets with sufficient precision to generate a final balance snapshot within 120 hours of the breach ending.

The timing matters because crypto markets often conflate headline speed with actual competence. A snapshot announcement may signal infrastructure readiness, but it does not confirm that refund distributions have begun or that the platform has resolved the underlying security vulnerability. This distinction is critical for institutional risk assessments.

The Cardano ecosystem, in particular, has cultivated a reputation for technical rigor; a controlled, documented remediation process aligns with that positioning but also sets a high bar for follow-through.

For traders and portfolio managers, the scope of the incident, 374 wallets across a multi-day window, is neither trivial nor systemic by historical crypto standards. The 2022 FTX collapse affected millions of users; the 2016 DAO hack resulted in a network-level fork decision.

SecondFi’s incident appears operationally containable, though the actual recovery distribution timeline will determine whether this narrative sustains market attention or recedes into a series of weekly security patches that institutional investors have learned to treat as noise.

Snapshot Completion Does Not Confirm Refund Distribution Has Begun

A critical distinction embedded in SecondFi’s announcement is the difference between snapshot completion and actual refund processing. The platform explicitly stated that the snapshot represents a preparation step, not confirmation that users have already received compensation.

For institutional investors and compliance teams evaluating counterparty risk, this language choice matters: it prevents overstating the resolution timeline and establishes a legally defensible record of when the measurement period concluded.

The snapshot serves as a baseline for claims verification. Once the platform processes refunds, wallet holders will submit claims against the documented June 26 balance state. This two-stage process mirrors traditional securities settlement procedures and reflects how decentralized platforms must now operate under increasing regulatory scrutiny.

The delay between snapshot and payout also creates a window for additional technical investigation, legal review, or community governance input, common practice in high-profile DeFi incidents.

Institutional custodians and insurance providers will likely use the snapshot date as a reference point for coverage determinations and liability assessments.

Cardano Ecosystem Credibility Hinges on Refund Timeline and Completeness

SecondFi’s remediation approach will influence broader investor perception of Cardano-based platforms for the coming weeks. The Cardano network has positioned itself as a research-driven alternative to Ethereum, emphasizing formal verification and peer-reviewed development.

A security breach on a major Cardano application creates a narrative test: does the ecosystem’s underlying philosophy translate into faster, more transparent incident response than competitors face?

Market structure will play a decisive role in determining whether this story generates sustained follow-through. Bitcoin remains the anchor for broader sentiment, but altcoin narratives are increasingly evaluated on usage fundamentals, liquidity depth, compliance standing, treasury activity, and developer progress.

SecondFi’s handling of this incident touches all five variables: usage will be impacted by reduced user confidence; liquidity may tighten if market makers perceive counterparty risk; compliance standing depends on transparent communication with regulators; treasury activity will reflect refund funding; and developer progress must include security audits and protocol hardening.

If SecondFi distributes refunds completely and on a documented schedule, the incident may become an institutional case study in effective breach response. If payouts are delayed, incomplete, or disputed, the narrative will shift toward broader questions about custody risk in decentralized applications and whether platforms can credibly manage large-scale incidents.

Market Liquidity Response and Broader Crypto Sentiment Will Define Long-Term Impact

Even developments with genuine operational significance can fail to move prices if traders remain defensive, leverage is being unwound, or capital is rotating into other sectors. The SecondFi incident arrives at a moment when crypto assets are still establishing a clearer directional bias.

Institutional investors must watch whether on-chain data, exchange deposits, or derivatives positioning shows signs that the security incident is driving capital reallocation or is being treated as a contained, platform-specific issue.

Follow-up announcements from SecondFi, including governance votes on security upgrades, insurance payout confirmations, or audit reports from third-party security firms, will all serve as signals that the remediation process is advancing. Wallets that received compensation may exhibit deposit behavior, which can be tracked on-chain.

Stablecoin flows to and from Cardano-based platforms will indicate whether institutional users are maintaining positions or reducing exposure.

The next major data point will be whether SecondFi releases a specific refund distribution schedule and begins processing claims within a documented timeframe.

Institutional investors should monitor SecondFi’s official announcements for a refund processing schedule, third-party security audit findings on the underlying exploit, and on-chain transaction data showing the beginning of actual payouts. The June 26 snapshot completion marks the end of the measurement phase; the credibility of the entire remediation hinges on whether refunds flow as documented and whether the platform publicly commits to a payout timeline with specific dates and percentages of affected balances.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

The next DeFi drain could come from legacy contracts everyone forgot
DeFi

The next DeFi drain could come from legacy contracts everyone forgot

, , , , ,

DeFiJune 11, 2026·6 min read

A $1.34 million exploit of Raydium’s phased-out AMM V3 pools exposes a systemic risk across DeFi: deprecated contracts that remain callable on-chain but invisible to users and unsupported by protocol infrastructure. Institutional investors face blind-spot losses from legacy smart contracts that exploit tracking systems categorize as routine bugs, when the real vulnerability is that nobody decommissioned them.

  • Raydium’s legacy AMM V3 pools held $10.2 million in idle liquidity across five pools after Serum’s deprecation rendered them functionless.
  • At least eight documented exploits since March 2025 have targeted deprecated or obsolete DeFi contracts, totaling approximately $10.8 million in losses.
  • Exploit classification systems routinely misidentify legacy-contract attacks as standard smart contract bugs, masking a lifecycle-management failure across the DeFi ecosystem.
  • $22.5M Total losses from legacy and zombie-contract exploits including Raydium incident
  • 10 Documented incidents involving deprecated infrastructure since March 2025
  • $1.34M Amount drained from Raydium’s unsupported legacy AMM V3 pools

On a Solana blockchain still considered a frontier for institutional adoption, Raydium’s recent exploit reveals a category of loss that standard risk models do not track. The attack targeted liquidity pools that Raydium had formally deprecated, phased out of the protocol’s active product line, yet left callable and exploitable on-chain.

The attacker bypassed critical validation checks that the current AMM V3 implementation enforces: they created a fake LP mint token, presented it as legitimate collateral, and drained real assets from five pools that had fallen into a state of technical limbo between active deployment and full decommissioning.

The broader pattern suggests this is not an isolated operational failure but a scaling problem in how DeFi protocols manage contract lifecycles. Exploit tracking systems, the tools institutional investors and risk managers rely on to categorize losses, classify these incidents under existing taxonomies: smart contract bugs, access control failures, oracle flaws.

None of those categories captures the core issue: a contract that should have been shut down, but wasn’t.

Raydium’s V3 pools remained live after Serum dependency made them obsolete

Raydium’s original AMM V3 pools existed solely to place orders on the Serum decentralized order book. When Serum itself deprecated its core infrastructure, the V3 implementation lost its fundamental purpose. The protocol launched a new product line with upgraded validation logic, moving users and liquidity to current pools.

But the old pools never closed: they stayed on-chain, callable, and accumulated idle capital of approximately 150,177 RAY, 5,603 SOL, and 893,700 USDC.

The legacy program skipped two critical safety checks present in Raydium’s current implementation. Current pools verify the LP mint address and validate token proportions against a virtual supply mechanism to ensure collateral integrity. The V3 pools enforced neither check.

An attacker exploited this gap by creating a new mint, passing it off as the legitimate LP token, and withdrawing real assets without providing proportional backing, a classical proportion-control bypass that worked only because the old contract never implemented the guard in the first place.

The $1.34 million loss covered five distinct pools, all outside the active product path and marked as unsupported in Raydium’s user interface and SDK documentation. No current user could accidentally access these pools; the attack required direct blockchain interaction and familiarity with the deprecated program’s structure.

That specificity matters to institutional investors: it means this was not a zero-day affecting live trading infrastructure, but a predictable failure of contract retirement discipline.

Eight documented incidents in nine months trace a pattern of zombie contracts across protocols

The Raydium incident sits within a measurable trend. Public exploit reports identify at least eight clear cases since March 2025 where deprecated, obsolete, or legacy DeFi contracts became the primary attack surface. These incidents total approximately $10.8 million in direct losses.

Expanding the definition to include broader vault and product-level deprecation failures raises the count to roughly ten incidents totaling $22.5 million, a figure that includes Raydium and reflects losses from contracts that exploit tracking databases routinely misclassify.

The March 2025 1inch exploit drained roughly $5 million by targeting an obsolete Fusion v1 resolver contract. October 2025 saw Abracadabra lose $1.8 million when deprecated Cauldron V4 contracts remained exploitable due to a logic flaw that only affected the old implementation. December’s Yearn incident involved a legacy iEarn TUSD vault that had been phased out of the active product ecosystem.

None of these protocols deliberately kept these contracts online; all had moved users and capital to newer implementations. But the infrastructure persisted on-chain.

The commonality is not a technical flaw confined to one team or architecture. Rather, it reflects how DeFi protocols handle the transition from active product to dormant legacy status. Most deprecate by announcement and SDK update: they redirect users, stop routing traffic to old contracts, and document the transition in changelogs.

Few actually execute full decommissioning, the technical process of rendering a contract permanently non-callable or entirely removing its state. The gap between announced deprecation and technical decommissioning is where losses accumulate.

Exploit classification systems systematically miss the lifecycle-state risk layer

Standard exploit taxonomies break incidents into five categories: smart contract code bugs, access control failures, oracle and accounting issues, private key compromises, and bridge security flaws. Each describes a technical mechanism, the flaw that allowed funds to move. None captures the prerequisite: that a contract should not still have been callable in the first place.

A database entry for the Raydium incident would list “missing validation checks” as the root cause, correctly identifying the technical gap. But that classification obscures the fact that the V3 contract was deprecated infrastructure that should have been inaccessible. The 1inch loss gets tagged as a “resolver contract bug” without noting that the contract was obsolete.

Abracadabra’s incident appears as a logic flaw affecting Cauldron V4, not as a failure to decommission retired vault code.

This labeling problem has real consequences for institutional risk management. Portfolio managers and compliance teams use exploit databases to model DeFi exposure. If losses from deprecated contracts roll into the same “smart contract bug” bucket as zero-day flaws in active code, the risk profile becomes distorted.

A protocol with zero defects in its current implementation but poor lifecycle management looks identical to one with active code vulnerabilities. The institutional buyer cannot distinguish between these risks because the information system conflates them.

Exploits of zombie contracts are a governance and operations failure, not a cryptography or code-audit problem.

DeFi protocols face mounting pressure to decommission rather than simply deprecate

The recurring pattern has begun forcing protocol teams to address contract lifecycle more deliberately. Several have announced technical decommissioning procedures: not merely directing users away from old contracts, but rendering them non-callable through state migration, asset transfer-out, or self-destructing code mechanisms.

Some are retroactively adding kill-switches to legacy contracts, enabling admins to freeze calls and drain remaining balances.

However, this shift remains voluntary and inconsistent. There is no standard for how long a contract should remain callable after deprecation, no agreed timetable for full decommissioning, and no regulatory or community pressure comparable to what zero-day exploit prevention commands.

A protocol can announce a contract as deprecated and still leave it live for months or years without facing reputational consequence, until an attacker finds it.

For institutional investors, the operational question is whether DeFi can scale to support proper lifecycle management at the pace protocols currently ship new products. Raydium alone has gone through multiple AMM iterations; Yearn runs dozens of vault implementations across different assets and strategies. As the installed base of contracts grows and products cycle faster, the number of deprecated implementations waiting for decommissioning will only increase. The $22.5 million in documented losses represents the incidents that made it into public reports; the

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

The next big DeFi exploit will start before the code is deployed
DeFi

The next big DeFi exploit will start before the code is deployed

, , , , , , ,

BlockchainMay 26, 2026·6 min read

Software supply-chain attacks targeting cryptocurrency developers have evolved beyond code vulnerabilities to exploit the build infrastructure itself, with a single compromised package now capable of accessing deployment credentials, CI/CD systems, and cloud accounts that control protocol updates. For institutional investors, this shift means security audits of smart contract code alone no longer suffice, the attack surface now extends to the developer tools, package repositories, and automation systems that bring code to mainnet, creating a new category of systemic risk that traditional due diligence frameworks have not yet addressed.

  • Socket disclosed TrapDoor campaign May 24, containing 34 malicious packages and 384 related versions across npm, PyPI, and Crates.io targeting developer credentials
  • Attackers injected hidden Unicode instructions into AI coding assistant configuration files to steer workflows toward credential theft and data exfiltration
  • SafeDep documented 170 compromised npm packages in May 11 campaign, demonstrating escalating frequency and scale of coordinated supply-chain attacks
  • 34 Malicious packages identified in single TrapDoor campaign versus hundreds across related versions
  • 384 Related package versions spreading malicious payloads across three major developer repositories
  • 170 Npm packages compromised in SafeDep-documented campaign, exceeding TrapDoor’s direct package count

On May 24, cryptocurrency security firm Socket disclosed details of TrapDoor, a sophisticated supply-chain attack campaign that weaponized ordinary developer workflows to breach the infrastructure controlling how blockchain protocols reach production and remain updated.

The campaign deployed 34 malicious packages with 384 malicious versions distributed across npm, PyPI, and Crates.io, the three largest open-source package repositories used by protocol developers worldwide.

Rather than targeting the smart contracts themselves, TrapDoor exploited a gap between what security teams audit and what actually controls protocol deployment: the developer machines, build pipelines, credential systems, and cloud infrastructure that govern the path from code commit to mainnet execution.

The significance for institutional investors lies in a fundamental asymmetry. Smart contract audits, the standard risk control in institutional crypto due diligence, examine bytecode and logic flaws but cannot detect or prevent compromises that originate outside the blockchain.

A malicious package installed on a developer’s machine during a routine build can steal SSH keys, cloud credentials, or GitHub deployment tokens without ever appearing in the audited code. Once those credentials are stolen, an attacker can push unauthorized updates to a live protocol, drain reserves, or manipulate token mechanics, all without writing a line of vulnerable Solidity.

TrapDoor Delivered Payloads Through Standard Developer Commands

Socket’s technical analysis reveals the attack relied on execution paths that trigger during normal development work. npm packages embedded malicious code in postinstall hooks, PyPI packages executed payloads on import while fetching remote JavaScript, and Rust crates ran malicious build.rs scripts during compilation.

None of these required social engineering beyond a package name that appeared legitimate or a typo that resembled a known dependency. For developers managing dozens or hundreds of transitive dependencies, the barrier to adoption was negligible.

Once installed, the payloads executed in the developer’s local environment with the same permissions and access to credentials as the developer themselves. SSH keys, AWS credentials, GitHub personal access tokens, and cloud service accounts stored in environment variables or configuration files became available to the attacker.

Socket’s analysis explicitly documented that stolen SSH keys enabled lateral movement through internal infrastructure, while compromised cloud and GitHub credentials exposed entire repositories, CI/CD systems, private packages, and deployment environments.

The six-stage flowchart Socket provided traces the path: malicious package installation, developer machine compromise, credential theft, access to repositories and cloud systems, malicious code injection into the protocol, and deployment to mainnet.

Hidden Unicode Instructions Turned AI Assistants Into Exfiltration Tools

A particularly novel element of TrapDoor involved AI coding assistants. Socket found that attackers injected hidden instructions into configuration files such as .cursorrules and CLAUDE.md, which tools like Cursor and Claude Code read to understand project context and behavioral rules.

The injected instructions employed hidden Unicode techniques, invisible characters that humans cannot see in standard editors but which AI models process as genuine directives.

By silently manipulating these configuration files, attackers could steer AI-assisted workflows toward discovering credentials, extracting sensitive data, or modifying code in ways the developer would not immediately recognize.

Socket also documented pull requests submitted to AI tooling and developer platform projects attempting to introduce instruction files under benign labels, suggesting a coordinated effort to compromise the AI assistants themselves at their source.

The target was the AI assistant that reads the repo, generates code, and operates with whatever context the project files supply. If attackers silently manipulate that context through hidden Unicode instructions, the AI-assisted workflow becomes an exfiltration mechanism.

Socket security researchers

For institutional investors, this development compounds the risk. Developers increasingly rely on AI code generation and completion tools to accelerate work. If those tools are compromised at the configuration level, they become vectors for credential theft and protocol manipulation that occur transparently during the development process itself.

Security reviews of committed code cannot detect instructions that exist outside version control or that operate within the AI’s inference layer.

Coordinated Campaigns Across Multiple Repositories Signal Escalating Sophistication

TrapDoor is not an isolated incident.

On May 11, just two weeks prior, SafeDep documented a separate campaign that compromised more than 170 npm packages and two PyPI packages, affecting 404 malicious versions linked to high-profile targets including TanStack, Mistral SDK, UiPath, OpenSearch, and Guardrails AI. The targeting of AI and machine learning projects suggests attackers recognized these repositories as leverage points affecting downstream protocol development environments.

StepSecurity separately identified five major supply-chain attacks within a 48-hour window in the same period. The frequency and scale indicate a shift from opportunistic package hijacking to coordinated campaigns executed by sophisticated threat actors.

Each attack targeted not casual users but active developers in security-sensitive domains, cryptocurrency, AI infrastructure, and enterprise systems.

For institutional crypto investors, the pattern matters more than any single campaign: supply-chain attacks are becoming the preferred method for gaining control over protocol infrastructure.

Institutional Audits Miss the Attack Surface Entirely

Traditional due diligence workflows in crypto have not yet adapted to this threat model. Protocol teams commission audits of smart contracts, examining logic, reentrancy, economic incentives, and state management. These audits assume the code that runs on mainnet matches the code that was audited.

But in a supply-chain compromise, the code that reaches mainnet may differ from the audited version, or legitimate code may be deployed from credentials stolen from a developer’s compromised machine.

The TrapDoor incident demonstrates that an attacker needs neither a protocol team’s direct cooperation nor access to the audited repository. A single developer with the right credentials, perhaps a junior engineer whose machine is less hardened, or a contractor with temporary access, becomes a sufficient entry point.

Once credentials are stolen, the attacker can introduce changes, approve their own pull requests in compromised environments, and trigger deployments without detection by existing audit mechanisms.

Institutional investors performing due diligence on a protocol now face a blind spot. The smart contract audit provides no signal about whether the development team’s credentials have been compromised, whether their CI/CD pipeline has been tampered with, or whether their build environment contains malicious packages. A pristine audit report may precede a devastating exploit by hours or days.

What Institutional Investors Should Monitor Next

The immediate question is whether protocols will implement detection and response mechanisms for supply-chain compromise at the infrastructure level.

This would require practices such as signing all deployments with hardware security modules, implementing multi-signature approval for any update that touches critical infrastructure, maintaining offline backups of deployment credentials, and auditing the full dependency tree, not just direct dependencies but all transitive packages a protocol uses.

Some leading protocols have begun adopting these practices, but adoption is far from universal. Smaller projects with fewer resources often rely on standard CI/CD platforms without the hardened isolation and credential management that large enterprises employ. This creates a bifurcation where institutional

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

THORChain exploit turns emergency chain halt into a DeFi trust test
DeFi

THORChain exploit turns emergency chain halt into a DeFi trust test

, , , , ,

BlockchainMay 16, 2026·5 min read

THORChain’s May 15 emergency halt following a suspected multichain exploit that drained at least $10.7 million across nine blockchain networks has exposed the structural vulnerabilities in cross-chain DeFi infrastructure that institutional investors must now factor into their risk models. The incident reveals that seamless interoperability, the core value proposition of bridges and multichain protocols, simultaneously compresses response windows and amplifies contagion in ways that traditional finance segregates by design.

  • Attacker drained more than $11 million across at least nine chains including Bitcoin, Ethereum, Avalanche, Dogecoin, Litecoin, and XRP, according to TRM Labs assessment
  • THORChain executed emergency halt sequence including Halt All Trading, Halt Signing, and repeated global node-pause updates to contain the breach
  • Incident tests whether cross-chain infrastructure can patch single bugs and restore user confidence while maintaining operational credibility during active disruption
  • $11M Total losses across nine blockchains, up from initial $7.4 million estimate
  • 36.75 BTC Approximate Bitcoin stolen in the exploit across affected chains
  • 9 Number of distinct blockchains compromised in single multichain attack event

THORChain, a non-custodial cross-chain liquidity protocol designed to move native assets across isolated blockchain networks without wrapping them, initiated an emergency halt on May 15 after detecting unauthorized asset transfers affecting Bitcoin, Ethereum, Binance Smart Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP networks.

The breach exposed fundamental tensions in how cross-chain infrastructure operates: the same architectural design that enables frictionless asset movement between networks also collapses the time available for human operators and governance to respond when that design fails.

Initial loss estimates of $7.4 million were subsequently revised upward to at least $10.7 million, with TRM Labs reporting total losses exceeding $11 million.

The incident marks the largest multichain infrastructure failure since the February 2022 Ronin Bridge exploit, which cost users $625 million, and surfaces structural questions about how institutional capital should evaluate exposure to protocols that prioritize connectivity over isolation.

THORChain’s Emergency Framework Reveals the Cost of Cross-Chain Speed

THORChain’s response mechanism relied on a documented operational hierarchy: chain-specific halts, then Halt All Trading to prevent new transactions, followed by Halt Signing to block signature generation for withdrawals, Halt Chain Global to pause all chain activity, and Halt Churning to stop validator rotation.

The protocol then issued repeated global node-pause updates as the scope of the compromise became clearer.

This layered shutdown procedure exists precisely because the protocol’s core architecture, threshold-signature vaults managed by distributed validators across multiple observation systems, requires deliberate coordination to halt safely without creating secondary risks like stuck funds or validator desynchronization.

The operational reality, however, diverges sharply from traditional finance’s infrastructure expectations. When a bank’s trading desk discovers a breach, regulators and settlement systems remain isolated; a failure in one asset class or geography does not automatically trigger a halt across nine separate financial networks. THORChain’s architecture inverts that assumption.

By design, a single vulnerability in the observation layer, vault management, or signing logic can cascade across every blockchain the protocol connects to, because those chains share the same threshold-signature infrastructure and validator set.

The speed that makes cross-chain liquidity useful, near-instant settlement without wrapping or intermediaries, becomes a liability during a security incident, compressing the window between detection and full contagion from hours into minutes.

The halt itself, while necessary, also disrupted routing across the network during the response window, meaning legitimate users and liquidity providers experienced service degradation as emergency procedures took effect.

Nine-Chain Scope Shows Contagion Beyond Initial Estimates

Initial public alerts focused on four chains: Bitcoin, Ethereum, Binance Smart Chain, and Base, with losses estimated around $7.4 million. That framing suggested a localized incident in newer ecosystems.

TRM Labs’ subsequent assessment expanded the confirmed attack surface to at least nine chains, adding Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP, a material widening that included both legacy networks and modern Layer 1 systems.

The 36.75 Bitcoin stolen represents approximately $1.5 million at May 2025 market rates, but the denomination signals that the attacker systematically targeted native asset routes across the most liquid corridors, not opportunistic grabs of secondary tokens.

This scope expansion matters to institutional risk managers because it demonstrates that multichain exploits do not scale linearly with a protocol’s prominence or user base. THORChain’s primary volume flows through Bitcoin and Ethereum pairs, yet the attacker’s compromise touched nine distinct settlement layers, each with separate consensus mechanisms, node operators, and finality guarantees.

A single vulnerability in the observation or signing layer affected all of them simultaneously. For institutional traders evaluating cross-chain liquidity providers as alternatives to centralized exchanges or wrapped-asset bridges, the incident shows that operational risk concentrates in the shared infrastructure layer, not in individual blockchain security.

An Ethereum-specific exploit cannot drain Bitcoin; a THORChain vault compromise can.

The revised loss accounting may still shift as blockchain analysis firms reconcile transaction flows and identify recovered or redistributed funds.

Cross-Chain Trust Now Requires Proof of Mature Failure Response

Mature financial infrastructure is expected to fail safely: detect the breach, halt activity, communicate clearly, and publish a documented root cause within a known timeframe. The market can then price whether the bug was a one-time edge case or a systemic design flaw.

DeFi protocols have historically compressed this cycle, shipping new chain integrations and liquidity routes before the full operational risk landscape is visible to users and institutions.

THORChain’s response began to signal maturity, it published emergency halt procedures, executed them in sequence, and initiated damage assessment, but the test is whether that response translates into restoring institutional confidence.

For sophisticated investors, the core question is not whether THORChain had a bug; it is whether the protocol’s architecture can be patched without requiring a full redesign of its threshold-signature and observation layers.

If the vulnerability existed in the threshold-signature implementation itself, fixes may require coordinated upgrades across all nine chains, creating extended operational risk while nodes are in transit to new code. If the breach was in the vault management or observer coordination layer, patches could be isolated and deployed without waiting for Bitcoin or Dogecoin consensus changes.

That distinction determines whether THORChain remains viable for institutional liquidity provision or whether capital migrates to wrapped-asset bridges that accept centralized custody in exchange for reduced operational complexity.

The incident also tests whether cross-chain protocols can maintain liquidity during emergency response. When THORChain halted all trading and signing, users and market makers lost access to their locked capital and could not arbitrage price discrepancies across chains. That service disruption, while necessary for security, creates institutional hesitancy.

A protocol that must periodically shut down to remain secure may not satisfy the 24/7 liquidity guarantees that institutions require to allocate significant capital.

THORChain’s next milestone is publication of a detailed root-cause analysis, including whether the exploit targeted the threshold-signature logic, observation layer, vault management, or node coordination, and a timeline for patched code to reach production across all affected chains. Institutional capital deployment into multichain liquidity protocols will likely remain constrained until that analysis clarifies whether the May 15 incident was a remediable bug or a fundamental architectural limitation.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi
Bitcoin

Kraken moves Bitcoin to Chainlink as bridge fears spread across DeFi

, , , , , , , ,

BitcoinMay 15, 2026·5 min read

Kraken’s migration of its wrapped Bitcoin to Chainlink’s cross-chain messaging protocol signals institutional recognition that bridge infrastructure has become a primary custody and operational risk for tokenized assets. The move reflects a broader industry reckoning over wrapped-asset security that institutional investors and exchanges must now factor into their choice of Bitcoin distribution channels.

  • Kraken is deprecating its existing cross-chain provider and moving all kBTC exclusively to Chainlink CCIP infrastructure for wrapped Bitcoin distribution.
  • kBTC holds approximately 100 tokens in supply, with the majority deployed on Ethereum, backed 1:1 by Bitcoin held at Kraken Financial.
  • The migration follows heightened DeFi scrutiny over bridge security after the KelpDAO exploit, now forcing exchanges to reassess wrapped-asset cross-chain architecture.
  • $1.6T Bitcoin market value, representing 60% of total cryptocurrency market dominance
  • 100 kBTC tokens in supply across multiple blockchains and DeFi ecosystems
  • $45B Bitcoin 24-hour trading volume, demonstrating sustained liquidity demand

Kraken announced it will deprecate its current cross-chain infrastructure and transition all Kraken Wrapped Bitcoin (kBTC) exclusively to Chainlink’s Cross-Chain Interoperability Protocol (CCIP). CCIP will serve as the sole cross-chain backbone for kBTC and future Kraken Wrapped Assets, marking a significant shift in how the exchange manages Bitcoin distribution across multiple blockchains.

The decision places wrapped Bitcoin, already a strategic asset class for institutions seeking Bitcoin exposure in DeFi, squarely in the center of an ongoing industry debate about bridge security and custody risk architecture.

The move arrives as DeFi projects across the ecosystem have begun reassessing their cross-chain strategies following the KelpDAO exploit, which exposed vulnerabilities in bridge infrastructure.

Kraken’s decision to consolidate kBTC distribution through a single, institutional-grade messaging protocol rather than maintain a proprietary bridge reflects a calculated shift toward de-risking the asset itself.

Unlike other wrapped Bitcoin products, kBTC is issued and backed directly by a major regulated exchange, giving the infrastructure choice material weight for institutional investors evaluating both custody and operational security.

Kraken’s kBTC structure creates stacked custody and infrastructure risks requiring bridge reassessment

kBTC operates as a 1:1 Bitcoin-backed wrapper, allowing Bitcoin held in Kraken’s custody to become usable across multiple smart-contract environments including Ethereum, OP Mainnet, Unichain, and Ink.

Each kBTC token is fully collateralized by Bitcoin stored at Kraken Financial, a Wyoming-chartered Special Purpose Depository Institution (SPDI), with eligible Kraken users able to deposit or withdraw kBTC at a 1:1 rate against BTC, minus applicable fees.

The exchange provides public reserve and contract verification for the Bitcoin backing, creating a transparency layer that distinguishes it from less-auditable wrapped products.

That structure, however, creates a multi-layer trust stack that institutional investors must evaluate before deploying capital. Users accepting kBTC face sequential operational risks: Kraken’s custody practices, the wrapper’s smart-contract code, the cross-chain messaging protocol, each destination blockchain’s security model, and finally the DeFi venue where kBTC is deployed.

Previously, Kraken’s proprietary cross-chain infrastructure represented a single point of failure across that stack. By migrating to Chainlink CCIP, Kraken effectively outsources cross-chain messaging to a protocol that also serves as the backbone for other institutional-grade wrapped assets, centralizing both risk and scrutiny in a single, widely-monitored system.

Approximately 100 kBTC tokens currently exist in supply, with the majority held on Ethereum’s larger DeFi ecosystem. The relatively small supply reflects kBTC’s early-stage market position in the wrapped Bitcoin category, where alternatives from other exchanges and protocols are also seeking institutional adoption.

Kraken’s choice of Chainlink CCIP signals confidence that consolidating infrastructure around an established, audited cross-chain standard will accelerate adoption more effectively than maintaining proprietary connections.

Bridge security debate now defines wrapped Bitcoin as infrastructure choice, not just product feature

Bitcoin remains the dominant cryptocurrency by market value at approximately $1.6 trillion, representing roughly 60% of total crypto market capitalization. Yet the Bitcoin network’s isolation from smart-contract ecosystems creates persistent demand for wrapped Bitcoin products that allow BTC holders and traders to access DeFi applications without moving actual Bitcoin off-chain.

That structural mismatch explains why major exchanges and protocols continue building wrapped Bitcoin infrastructure, treating it as essential plumbing rather than a niche feature.

The KelpDAO exploit and subsequent bridge security scrutiny have reframed wrapped Bitcoin distribution from a simple product expansion into a market-structure decision with material implications for institutional risk management.

Institutions evaluating whether to hold kBTC, or any wrapped Bitcoin product, must now treat the cross-chain infrastructure as a primary custody consideration, not merely a technical implementation detail.

Chainlink CCIP’s selection as the exclusive infrastructure for kBTC reflects this institutional logic: by binding wrapped Bitcoin to an already-audited, widely-adopted cross-chain standard, Kraken reduces the surface area for novel attacks while increasing transparency for institutional due diligence.

The migration also signals that exchange-issued wrapped assets now occupy the same regulatory and operational scrutiny as DeFi-native projects. Kraken, as a licensed exchange, carries institutional legitimacy that pure-play DeFi protocols lack, yet the company still confronted the same infrastructure vulnerabilities that forced other projects to reassess their bridge choices.

That convergence suggests institutional investors should expect wrapped Bitcoin products to increasingly standardize around established cross-chain protocols rather than proprietary solutions.

CCIP adoption across wrapped Bitcoin products will create ecosystem-wide standards and operational transparency

Chainlink CCIP now serves as the cross-chain backbone for multiple institutional-grade wrapped assets, making Kraken’s migration part of a broader standardization trend.

As more exchanges and protocols consolidate around a single cross-chain messaging protocol, institutional investors gain the ability to compare wrapped products on asset quality and custody rather than spending resources evaluating disparate bridge architectures.

That standardization reduces operational complexity for treasury managers and fund managers operating across multiple blockchains simultaneously.

The broader implication is that wrapped Bitcoin will increasingly compete on custody quality, regulatory oversight, and asset transparency rather than on proprietary technical advantages. Kraken’s public reserve verification, Wyoming SPDI backing, and transparent reserve auditing now function as primary differentiators in a market where bridge infrastructure is no longer differentiated.

Institutional capital will likely gravitate toward exchanges that combine robust custody standards with widely-accepted cross-chain infrastructure, creating a moat for established players with both regulatory standing and technical credibility.

The next test of Kraken’s CCIP migration will emerge as other major exchanges and protocols decide whether to follow the same path, potentially creating an ecosystem-wide standard around Chainlink infrastructure. Institutional investors should monitor whether Kraken’s kBTC adoption accelerates post-migration, which would validate the thesis that standardized cross-chain infrastructure reduces friction for institutional Bitcoin deployment across DeFi, or whether alternative wrapped Bitcoin products maintain competitive positioning through differentiated custody or network access, signaling that bridge choice remains a secondary concern relative to asset backing and exchange reputation.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

Logic flaw drains $101K from Huma’s old Polygon contracts
Blockchain

Logic flaw drains $101K from Huma’s old Polygon contracts

, , , , , ,

BlockchainMay 12, 2026·5 min read

A logic flaw in Huma Finance’s legacy V1 smart contracts on Polygon enabled an attacker to drain $101,400 in stablecoins in a single transaction, highlighting how abandoned infrastructure remains a persistent attack surface even after teams shift focus to newer systems. The incident underscores a structural risk for institutional investors: legacy DeFi contracts often linger in production long after development resources move elsewhere, creating maintenance blind spots that malicious actors systematically exploit.

  • Attacker drained $101,400 USDC across three BaseCreditPool contracts in one transaction on Polygon.
  • Bug in refreshAccount() function bypassed approval requirements by falsely marking unauthorized accounts as good standing.
  • Huma had already begun sunsetting V1 when exploited; V2 on Solana completely unaffected and operating normally.
  • $101,400 total USDC lost across V1 contracts on Polygon network.
  • 1 transaction needed to drain funds from three separate contract deployments.
  • May 11, 2026 date Huma exploit occurred, same day as Ink Finance $140K incident on Polygon.

A vulnerability buried deep in Huma Finance’s legacy V1 smart contracts allowed an attacker to siphon $101,400 in stablecoins from the protocol’s treasury pools on Polygon in a single transaction on May 11, 2026. Security firm Blockaid identified the flaw within the refreshAccount() function in BaseCreditPool contracts, a function responsible for updating account status within the lending system.

Rather than verify eligibility through proper channels, the function unconditionally promoted credit lines to “good standing” status, bypassing the approval step required to unlock fund withdrawals. The attacker exploited this state-machine logic error to impersonate an authorized account and execute drawdown operations against unprotected pools.

The breach affected three separate contract instances, with individual losses of approximately $82,300 USDC, $17,300 USDC.e, and $1,800 USDC.e respectively. Huma confirmed the incident on X, stating that no user deposits held in its newer V2 system on Solana were at risk and that the production platform continues normal operations.

The company emphasized that V2 was built from scratch with entirely different code architecture, isolating the vulnerability to obsolete infrastructure.

refreshAccount() Function Lacked Conditional Checks Required for Credit Line Promotion

The core vulnerability stemmed from poor access control design in a single contract function. Blockaid’s technical analysis revealed that refreshAccount() performed a critical state transition, promoting a credit line from “Requested” status to “GoodStanding” status, without requiring approval from any external authority or executing conditional validation logic.

In properly architected lending systems, such transitions require sign-off from designated roles (often labeled “Eligibility Agents” or similar) and verification that the account meets predefined criteria.

By removing those gatekeeping steps, Huma’s V1 code treated the refreshAccount() function as a direct pathway from request to approval. An attacker with the ability to call this function could manufacture legitimate-appearing account states and immediately begin withdrawing collateralized assets.

The exploit executed in a single on-chain transaction, suggesting no additional complexity, no flash loan mechanics, no price manipulation, no cryptographic compromise. The attacker simply invoked state changes that the contract was never supposed to permit unilaterally.

This type of logic error, where developers omit necessary access controls or conditional checks, has become one of the most common vectors for DeFi contract exploits over the past three years.

The flaw indicates that V1 underwent insufficient peer review or formal verification before deployment, a limitation that likely reflected the earlier, faster-moving development cycle of 2023-2024 DeFi infrastructure.

Huma’s Planned Sunset of V1 Already Underway Before Exploit Surfaced

The timing of the exploit is significant: Huma’s team had already initiated the deprecation of V1 when the attack occurred. According to the company’s public statement, the team was actively winding down V1 pool operations and had begun transitioning users to V2 infrastructure on Solana.

The exploit accelerated this timeline by forcing an immediate full pause of all remaining V1 contracts to prevent further drainage.

This context matters for institutional risk assessment. A protocol abandoning legacy code typically signals either that new architecture has proven superior or that maintenance costs no longer justify continued operation. However, the lag between development team shift and complete contract retirement creates a window of vulnerability.

During that window, fewer developers monitor transactions, fewer security audits occur, and fewer infrastructure upgrades happen, precisely when legacy contracts become most attractive to attackers aware they will eventually disappear.

Huma’s move to Solana with V2 represents a full rewrite rather than an incremental update, meaning no code was carried forward and no shared vulnerabilities exist between the compromised contracts and the current product. User deposits on V2 remained unaffected and the newer platform continued processing transactions normally throughout the incident.

Polygon Network Faces Repeated Logic Vulnerabilities on the Same Day

The Huma exploit arrived on a particularly vulnerable day for Polygon-based protocols. On May 11, 2026, Ink Finance separately suffered a loss of nearly $140,000 from its Workspace Treasury Proxy contract when attackers deployed a contract matching a whitelisted claimer address to bypass eligibility verification.

Both incidents involved attackers finding and exploiting logic flaws rather than cryptographic weaknesses, revealing a pattern of insufficient access control and state validation across multiple protocols on the network.

For institutional investors allocating to Polygon-based DeFi, these twin exploits surface a broader operational risk: many protocols running on Polygon maintain legacy contracts longer than intended, and some lack sufficient incentive structures to fund ongoing security monitoring once development teams shift focus.

Polygon’s architecture itself was not compromised, both attacks succeeded through application-layer logic errors rather than network-level vulnerabilities, but the concentration of similar flaws in the same timeframe suggests inadequate security maturity across parts of the ecosystem.

The incidents also highlight the value of post-mortem transparency. Blockaid’s detailed public analysis of the refreshAccount() flaw and the three affected contract addresses enables other protocols to audit their own code for similar patterns, potentially preventing copycat exploits elsewhere.

The key institutional takeaway centers on the operational and security risks of legacy contract retirement: Huma’s team must now monitor whether attackers make further attempts against remaining V1 pools despite the pause, and whether other Polygon protocols will accelerate security audits of deprecated infrastructure before sunsetting it completely. Investors should track whether Huma publishes a formal post-mortem documenting the code review process that allowed refreshAccount() to reach production without proper access controls, and whether the company implements additional safeguards during V2’s ongoing operation on Solana, such as formal verification or multi-signature requirements for critical state transitions, to prevent similar lapses in the next generation.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

artbitrum-dao-freeze-eth-thumbnail
Ethereum

Arbitrum’s Security Council Seizes $71M in Stolen ETH After KelpDAO Bridge Hack

, , , , , , , , , , , , ,

Arbitrum’s Security Council Seizes $71M in Stolen ETH After KelpDAO Bridge Hack
BREAKING · APRIL 21, 2026 · ARBITRUM · DEFI ANALYSIS

Arbitrum’s Security Council Seizes $71M in Stolen ETH After KelpDAO Bridge Hack

Arbitrum’s Security Council just immobilized $71 million in stolen ETH. One emergency vote. Nine signatures. And a question that won’t go away: can a “decentralized” network really freeze your funds?

ETH Frozen 30,766 ETH ≈ $71M
Original Exploit $292M rsETH
Council Vote 9 of 12 in favor
Suspected Actor Lazarus Group (DPRK)
$292M Total Exploit Value
$71M ETH Frozen by Arbitrum
18% rsETH Supply Drained
$230M Potential Aave Bad Debt
§ 01 — The Attack

How 116,500 rsETH Materialized Out of Thin Air

On Saturday, April 18, 2026, at precisely 17:35 UTC, someone did something extraordinary: they minted 116,500 rsETH tokens on Ethereum mainnet with zero legitimate backing behind them. Worth roughly $292 million at the time, this wasn’t a flash loan attack or a smart contract reentrancy bug. The contracts ran exactly as written. The verification layer was the weapon.

KelpDAO is a liquid restaking protocol built on EigenLayer. Users deposit ETH, which earns compounding yield across EigenLayer’s Actively Validated Services, and receive rsETH — a tradeable liquid restaking token representing their position. To enable rsETH to move across the multi-chain ecosystem, KelpDAO deployed a LayerZero-based bridge architecture using the OFT (Omnichain Fungible Token) standard. As of the exploit, that bridge held the backing reserve for rsETH deployed across more than 20 networks — Arbitrum, Base, Linea, Blast, Mantle, Scroll, and more. The protocol had roughly $1.07 billion in total value locked, making it the second-largest participant in EigenLayer’s ecosystem. This was the reserve that was drained.

// Attack flow — on-chain forensics (Blockaid / DeFiPrime)

LayerZero EndpointV2: 0x1a44076050125825900e736c501f859c50fE728c
KelpDAO rsETH OFT Adapter: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3
Attacker address: 0x8B1b6c9A6DB1304000412dd21Ae6A70a82d60D3b

// Forged origin packet → EID 30320 (Unichain)
→ 116,500 rsETH released from escrow
→ Single Transfer · One OFTReceived · One PacketDelivered
→ ~$292,000,000 exited the protocol

The Technical Root Cause: A 1-of-1 DVN

LayerZero’s security model is built on Decentralized Verifier Networks (DVNs) — independent entities that verify and attest to the authenticity of cross-chain messages. When a message travels from Chain A to Chain B, one or more DVNs must observe the packet on the source chain and deliver a signed attestation to the destination. The critical configuration choice is how many DVNs must agree.

KelpDAO’s rsETH bridge was configured with a 1-of-1 DVN setup — LayerZero Labs itself as the sole verifier. A single signature was all that stood between the bridge’s escrow and the open internet. The attackers, preliminarily attributed to North Korea’s Lazarus Group (TraderTraitor unit), exploited this exactly.

April 18 · 10:20 AM PT

RPC Node Compromise Begins

Attackers compromise two of LayerZero’s downstream RPC nodes, swapping out op-geth binaries with malicious versions engineered to selectively lie to the DVN while reporting accurate data to all other querying IP addresses.

April 18 · ~11:30 AM PT

DDoS Triggers Failover

Attackers DDoS the uncompromised RPC nodes, forcing LayerZero’s DVN to failover to the poisoned endpoints. The malicious nodes confirm fraudulent cross-chain transactions that never occurred on the source chain.

April 18 · 17:35 UTC

The Drain — 116,500 rsETH Released

A forged LayerZero packet claiming origin from KelpDAO’s Unichain deployment passes the single compromised DVN. The OFT Adapter releases 116,500 rsETH from escrow to the attacker’s address. ~$292M exits in a single transaction.

April 18 · 18:21 UTC

KelpDAO Emergency Pause (46 Minutes Later)

Kelp’s emergency multisig freezes core contracts. Two subsequent follow-up attacks at 18:26 and 18:28 UTC — each attempting another 40,000 rsETH (~$100M) — both revert. The pause held.

April 18–19

DeFi Contagion Spreads

Attackers weaponize stolen rsETH as Aave v3 collateral, borrowing $196M in WETH. Aave WETH markets hit 100% utilization. Aave, SparkLend, and Fluid freeze rsETH markets. $6.6B in TVL collapses within 48 hours across affected protocols.

§
§ 02 — The Intervention

Arbitrum’s Security Council Acts: A Race Against the Bridge

As stolen funds began moving through the ecosystem, blockchain security firm PeckShield flagged a critical development: the exploiter had already initiated a native bridge withdrawal from Arbitrum back to Ethereum mainnet. The clock was ticking. If the 30,766 ETH that had been consolidated on Arbitrum One completed the withdrawal, it would enter Ethereum’s base layer — far harder to intercept.

The Arbitrum Security Council — a 12-member body elected by the Arbitrum DAO through semi-annual elections — convened an emergency session. According to council member Griff Green, the deliberation involved “countless hours of debates, technical, practical, ethical and political.” Nine of the twelve members voted to act. The council coordinated with law enforcement, who provided input on the exploiter’s identity. Security researchers later linked the operation to North Korea’s Lazarus Group.

“The Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users.”

— Arbitrum Security Council · April 21, 2026

Using the 0x0000000000000000000000000000000000000DA0 precompile — a standard native ETH transfer mechanism — the council moved 30,766 ETH to a protocol-controlled intermediary address. The freeze was confirmed by Lookonchain approximately 20 minutes after execution. The funds were intercepted before the bridge withdrawal completed.

What Exactly Was Frozen

  • 30,766 ETH moved to intermediary wallet FROZEN
  • Destination: Protocol-controlled address 0x000…0DA0 ARBITRUM GOVERNANCE
  • Access requires further governance vote PENDING
  • Represents ~24% of the total $292M stolen PARTIAL RECOVERY
  • Remaining ~$220M moved via other chains UNRECOVERED
  • Lazarus Group suspected to be routing remainder LAUNDERING

For observers watching the situation unfold in real time, the move carried a weight that went beyond the mechanics of a single freeze. Dylan Dewdney, Founder of Kuvi AI, was among those who felt the historical echo immediately.

“It’s a fascinating moment for crypto governance — reminds me actually of the same gravitas as TheDAO, in a way. On one hand, decentralization purists will hate it. On the other, a DAO effectively looked at a state-sponsored hacking group and said: not this time. Arbitrum just demonstrated that onchain systems can defend themselves in real time. In a strange way, they out-coordinated one of the most sophisticated adversaries in the world. Legitimately onchain gangster moves.”

— Dylan Dewdney, Founder, Kuvi AI
§
§ 03 — The Blame Game

LayerZero vs. KelpDAO: Who Owns a $292M Default?

Even as funds were being frozen, a parallel battle erupted between the two parties at the center of the exploit. LayerZero moved first with a post-mortem attributing responsibility squarely to KelpDAO’s configuration choices. Kelp fired back with documentation. The dispute cuts to the heart of modular DeFi architecture.

LayerZero’s Position

LayerZero stated that KelpDAO “chose to utilize a 1/1 DVN configuration” despite the protocol’s consistent recommendation of multi-DVN redundancy. The firm argued that a properly hardened setup would have required consensus across multiple independent verifiers, making the attack ineffective even with a single node compromised. LayerZero announced it would stop signing messages for any application using a single-validator setup going forward, forcing a broad migration across its ecosystem.

KelpDAO’s Counter

Kelp pushed back hard. The team argued the 1-of-1 DVN was not a rogue customization but LayerZero’s own documented default. The protocol’s V2 OApp Quickstart — including the sample layerzero.config.ts — wires every pathway with one required DVN and no optional DVNs. Kelp added that approximately 40% of protocols currently on LayerZero use the same configuration, and that in the direct communications channel with LayerZero open since July 2024, there was no specific recommendation to change the rsETH DVN setup.

@cryptogoblin · April 19, 2026

“The KelpDAO exploit (~$290M) is NOT a LayerZero protocol bug. It’s a configuration issue and a case study every project with a cross-chain token needs to look at today. The smart contracts weren’t broken. The verification layer was.”

@FishyCatfish · April 19, 2026

“There is no security floor. A configuration can be a 1/1 DVN and the DVN you chose can be a single node ran by a single entity. This is a design flaw.”

Independent analysis from Blockaid confirmed: “The KelpDAO exploit will be studied as the definitive case study in bridge DVN configuration risk. It did not require a zero-day. It exploited a weak governance policy and limited controls.” Chainalysis put it more bluntly: the attack proves that detecting malicious code isn’t enough — protocols must detect when a system enters an impossible state.

§
§ 04 — DeFi Implications

The Contagion Map: From rsETH to Aave to the Whole Ecosystem

The KelpDAO exploit did not stay contained. Within 46 minutes of the drain, the attackers began weaponizing the stolen rsETH across DeFi’s interconnected lending infrastructure. The mechanics were straightforward and devastating.

Attackers deposited the minted rsETH on Aave v3 as collateral and borrowed $196 million in WETH against it. Aave’s WETH market hit 100% utilization, rendering deposits inaccessible and triggering a $5.4 billion liquidity withdrawal cascade. Total DeFi TVL collapsed by $6.6 billion within 48 hours. Aave, SparkLend, and Fluid all froze their rsETH markets. Lido disclosed approximately $21.6 million in rsETH exposure through its EarnETH product and signaled it may deploy a $3 million loss buffer.

Aave Risk Scenarios (Per Ecosystem Risk Assessment)

  • Scenario A: Losses socialized across all rsETH holders across chains $123.7M bad debt · ~15% depeg
  • Scenario B: Losses isolated to L2 markets (Arbitrum, Mantle) Up to $230.1M impact
  • Aave treasury backstop available $181M treasury
  • Umbrella model available in certain cases Active

April 2026 has become the worst month for crypto hacks since February 2025, with over $606 million lost in just 18 days. The KelpDAO incident came on the heels of the Drift Protocol breach ($285M, April 1) — also linked to Lazarus Group — suggesting a sustained, coordinated campaign targeting DeFi infrastructure rather than isolated opportunistic attacks.

The structural lesson is uncomfortable: liquid restaking tokens (LRTs) as collateral on money markets create systemic amplification. When an LRT loses peg or backing, lending protocols don’t just feel the impact of the token — they absorb the entire downstream leverage built atop it. This is the second time in 2026 that an LRT collateral accepted on Aave has produced a nine-figure incident downstream of a non-Aave failure.

§
§ 05 — The Core Tension

The Decentralization Paradox: Safety Valve or Fatal Contradiction?

Arbitrum’s intervention was precise, effective, and — for many in the crypto community — deeply troubling. In a single emergency session, a 12-person council immobilized 30,766 ETH that an external party held in their address. The funds were moved without a DAO vote, without the standard governance delay, and without consulting the broader community before execution. The legality, the ethics, and the precedent are all contested.

“A 12-person committee — elected by ARB token holders, sure — just demonstrated it can immobilize any funds on the network given sufficient justification. For a technology built on the promise of permissionless transactions, that’s either a necessary safety valve or a fundamental contradiction.”

— Blockchain.news analysis · April 21, 2026

The Arbitrum Security Council is defined in the Constitution of the Arbitrum DAO as a 12-member body divided into two cohorts, with members elected in semi-annual elections by ARB token holders. The council is bound by the Constitution to use its emergency powers only when necessary for declared security emergencies, and must issue a transparency report when those powers are invoked. The frozen ETH can only move through further governance action — ARB holders will ultimately vote on its fate.

The Community Splits

For the Freeze

  • $71M recovered, likely from state-sponsored thieves
  • Zero impact on legitimate users or applications
  • Law enforcement coordination adds legitimacy
  • Funds remain under governance — not taken
  • DPRK laundering would have made recovery impossible
  • Security Council acted within its constitutional mandate

Against the Freeze

  • Permissionless transactions is the core value proposition
  • Council can theoretically freeze any funds on the network
  • Sets precedent for future, potentially non-consensual freezes
  • “Decentralized” becomes a marketing term, not a guarantee
  • Who decides what justification is “sufficient”?
  • Ethereum community has concerns about L2 centralization
@Leonidas (DOG creator) · April 21, 2026

“Decentralized has become a marketing term. Only Bitcoin is actually decentralized.”

@baeyeee · April 21, 2026

“WLFI is accused of wrongfully freezing user assets, while ARB froze stolen funds linked to DPRK hackers. One is ethically accepted, the other is criticized — but both prove the same point. When it matters most, governance overrides decentralization.”

@JoelKatz (Ripple CTO David Schwartz) · April 21, 2026

“They can make the chain claim that they did whatever they want to all of the funds on the chain. But they cannot compel anyone to listen to those claims. Everyone else can make different claims and choose which set of claims to honor.”

The Stage 2 Problem

The Arbitrum DAO’s own governance documentation asks the question directly: “Can the governance process be further decentralized? How and when can the Security Council’s power be further minimized, or eliminated entirely?” These don’t have easy answers. Arbitrum achieved Stage 1 decentralization with permissionless fraud proofs via the BoLD upgrade. But Stage 2 — which would limit the Security Council to adjudicating only demonstrable bugs — remains a future aspiration, not a current reality.

The irony is sharp: the same emergency power that just recovered $71M in stolen funds is precisely the mechanism that prevents Arbitrum from claiming Stage 2 decentralization. Security and trustlessness are in direct tension, and today’s events demonstrated that tension is not theoretical.

§
§ 06 — What Comes Next

Open Questions & The Road Forward

As of April 21, 2026, the 30,766 ETH remain locked in the protocol-controlled address at 0x000...0DA0. No timeline has been set for final disposition. The ARB community will vote on what happens to the funds — options range from returning them to affected KelpDAO users to holding them pending law enforcement proceedings. KelpDAO’s rsETH contracts remain paused. Founders Amitej G and Dheeraj B have not announced a recovery timeline.

Open Questions as of Publication

  • How will ARB governance vote to allocate the frozen $71M? PENDING VOTE
  • Will other chains with similar emergency powers freeze their portions? UNCERTAIN
  • Who bears legal liability — KelpDAO, LayerZero, or both? DISPUTED
  • Will Aave deploy its Umbrella backstop for rsETH bad debt? MONITORING
  • Will LayerZero’s forced DVN migration affect other protocols? IN PROGRESS
  • Can the remaining $220M be traced before laundering completes? UNLIKELY

The KelpDAO exploit has accelerated three structural conversations that DeFi has been deferring: bridge configuration standards (who sets them, who enforces them, and who is liable when defaults cause catastrophic losses); LRT collateral risk in money markets (the second $100M+ incident in 2026 with restaked ETH tokens as the vector); and Layer 2 emergency powers (the legitimate tension between user protection and permissionless guarantees).

Chainalysis’s recommendation cuts through the noise: protocols must build systems capable of detecting when they have entered an “impossible state” — where issued tokens exceed locked collateral. For a cross-chain bridge, that means real-time consistency monitoring across every deployed chain. For DeFi as a whole, it means acknowledging that the “code is law” principle has never been fully true — and deciding what replaces it.

“The Lazarus Group, if indeed responsible, has already moved the remaining $220 million through various chains. Arbitrum caught what it could. The rest is likely gone.”

— Blockchain.news · April 21, 2026

EXCLUSIVE ANALYSIS · APRIL 21, 2026

Research compiled from Arbitrum DAO governance documentation, LayerZero official incident statement, KelpDAO response, Blockaid forensics, Chainalysis, CoinDesk, Decrypt, CoinCentral, and real-time X/Twitter discourse.


This article is for informational purposes only and does not constitute financial advice.

Expert Says North Korean IT Workers Helped Build Top Protocols During DeFi Summer
DeFi

Expert Says North Korean IT Workers Helped Build Top Protocols During DeFi Summer

, , , , , ,

BlockchainApril 6, 2026·5 min read

North Korean-linked IT workers have been embedded within major DeFi protocols since 2020, contributing genuine technical work to projects including SushiSwap, THORChain, Yearn, and Harmony while positioning themselves for later exploitation, according to cybersecurity researcher Taylor Monahan. The discovery carries acute risk for institutional investors whose custody, exchange, and protocol exposures may harbour state-backed operatives with multi-year access to critical systems.

  • North Korean IT workers contributed real technical expertise to six major DeFi protocols during 2020’s DeFi summer boom, per Monahan’s analysis of developer resumes.
  • State-backed actors extracted an estimated $6.7 billion from crypto during the infiltration period, with 2025 alone seeing $2.02 billion stolen, a 51% year-on-year increase.
  • Tactics have evolved to use non-North Korean proxies for in-person interactions and social engineering, making attribution and vetting substantially harder for institutional onboarders.
  • $2.02B stolen by DPRK hackers in 2025, up 51% versus 2024
  • 76% of all service-related breaches in 2025 attributed to state-backed actors
  • $6.7B estimated total extraction across entire DeFi infiltration period

Cybersecurity researcher Taylor Monahan has revealed that North Korean-linked information technology workers have operated inside the decentralized finance sector for years, contributing legitimate technical work to well-known protocols before positioning themselves for coordinated asset theft.

The infiltration strategy, detailed in recent public analysis, represents a departure from conventional hacking and points to a sustained, patient campaign of institutional capture spanning the 2020 DeFi boom and continuing into 2025.

When pressed for specifics, Monahan identified SushiSwap, THORChain, Yearn, Harmony, Ankr, and Shiba Inu as projects touched by these actors, a roster that underscores how deeply the operation penetrated the ecosystem’s infrastructure layer.

Monahan Confirms Genuine Code Contributions Across Six Major Protocols

The most significant finding is that North Korean operatives did not pose as developers with fabricated credentials. Instead, their resume histories of blockchain development experience were authentic, reflecting real and sometimes substantial technical contributions to protocol codebases.

This approach gave the actors legitimacy within teams and access to sensitive systems, repositories, deployment keys, operational infrastructure, that would normally require earned trust.

Monahan’s research identified a spectrum of security postures among affected projects. Yearn Finance emerged as an outlier, maintaining strict peer-review processes, high skepticism toward new contributors, and security-first operational discipline that limited exposure compared to peers.

Other projects, by implication, operated with looser vetting and faster contributor onboarding, creating surface area for insertion. The distinction matters for institutional investors assessing counterparty risk: protocols that resisted rapid scaling and maintained bottlenecks at code review phase faced lower infiltration depth.

The scale of extraction during the infiltration window, estimated at $6.7 billion collectively, suggests these were not isolated incidents of individual developer malfeasance but a coordinated campaign. State-backed actors positioned themselves within projects, earned trust, gained access to keys or deployment authority, and then executed timed exploits.

The patient accumulation of credentials and relationships mirrors tradecraft used in nation-state cyber operations against financial institutions.

2025 Breaches Show 51% Acceleration in Stolen Assets and Proxy Tactics

The infiltration has accelerated sharply in 2025. According to Chainalysis data, North Korean-linked hackers stole at least $2.02 billion in digital assets in 2025 alone, representing a 51% increase from 2024 and accounting for 76% of all service-related breaches in the sector.

Notably, the number of attacks declined even as the scale grew, indicating fewer but larger, more targeted operations, the hallmark of an operation that has refined targeting and maximized per-breach payoff.

Chainalysis attributed this scale to the state-backed groups’ systematic use of infiltrated IT workers embedded within crypto exchanges, custodians, and infrastructure providers. Once inside, operatives gain access before major exploits occur, positioning them to unlock wallets, drain accounts, or disable monitoring.

After theft, the actors typically move assets in tranches under $500,000 to avoid triggering automated threshold alerts, with more than 60% of transfers staying below that amount. This disciplined money movement contrasts with opportunistic hacking and again signals institutional planning.

Monahan’s latest intelligence indicates that tactics have evolved beyond the initial embedded-worker model. Operatives are now using non-North Korean individuals to carry out portions of operations, including in-person interactions with targets.

This layering obscures attribution and makes conventional due diligence, which often relies on detecting geographic inconsistencies or communication patterns, far less reliable. An employee meeting a new contractor in a coffee shop may have no way to verify whether that contractor is a legitimate hire or an infiltrator working on behalf of a state actor.

Fake Video Calls and Telegram Compromise Chains Enable Malware Deployment

The mechanics of initial compromise have been documented by the Security Alliance (SEAL) and point to social engineering that preys on institutional trust structures. Attackers compromise Telegram accounts of known contacts, often current or former employees, and use those hijacked accounts to invite targets to video calls.

The attacker then plays a pre-recorded video designed to appear legitimate before instructing the victim to install a supposed security update.

The “update” is malware that grants the attacker remote access to the target’s device. Once installed, the malware harvests credentials, session tokens, and sensitive files. The attacker then reuses the compromised device to propagate further into the organization, moving laterally through network trust relationships.

This attack chain bypasses perimeter defenses because it originates from inside trusted communication channels and relies on social proof rather than technical exploits.

In March 2025, North Korean-linked hackers were suspected of executing a similar chain against Bitrefill, a major cryptocurrency payment processor. Attackers gained entry through a compromised employee device and extracted credentials that would permit deeper system access. The incident is not isolated; it reflects an operational pattern now understood to be systematic across the sector.

Post-Theft Movement Uses Cross-Chain Bridges and Chinese Financial Networks

Once assets are stolen, the operatives employ a layered laundering strategy designed to obscure the fund trail. Stolen crypto is moved across blockchains using cross-chain bridges, mixed through centralized and decentralized mixing services, and ultimately converted to fiat through Chinese-language financial networks that operate with fewer regulatory compliance barriers than Western exchanges.

This multi-hop approach is time-consuming but effective at breaking on-chain traceability.

The use of Chinese financial networks is notable because it suggests logistical support from within China or from diaspora networks with ties to Chinese financial infrastructure. It also indicates that the operation has solved the “last mile” problem of converting seized crypto to spendable fiat, a known chokepoint for cybercriminals operating from isolated jurisdictions.

The integration with Chinese financial channels suggests either tacit tolerance from Beijing or active operational collaboration.

For institutional investors, this money movement pattern has a direct implication: even if a hack is detected and the stolen address is identified, the probability of asset recovery declines sharply once the funds enter cross-chain bridge protocols and Chinese financial networks. Traditional law enforcement tools have limited reach into those jurisdictions.

Preventive security, vetting, monitoring, access controls, becomes the only reliable line of defense.

Institutional Crypto Investors Face Cascading Exposure Across Custodians and Protocols

The scope of infiltration creates a cascading risk for institutions that hold digital assets. If North Korean operatives maintain persistent access within custodians, exchanges, or protocol infrastructure, then the timing and targeting of exploits may be adversarial, designed to strike when an institution holds large balances or when market conditions maximize the value of stolen assets.

An institution cannot reliably know whether its custodian, exchange counterparty, or protocol dependencies harbor embedded operatives.

This risk is heightened for institutions that were early adopters of DeFi, including those that deployed

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Subscribe

Cetus mounts full-scale recovery after $162M attack
AI News

Cetus mounts full-scale recovery after $162M attack

, , , , , , , , , ,

The Cetus protocol, a Sui-based decentralized exchange (DEX), suffered an exploit of its Concentrated Liquidity Market Maker (CLMM) pools on 22nd May 2025. That left it scrambling to prevent the loss of $223 million of its investors’ funds.

Unfortunately, the team’s best efforts couldn’t stop the attacker from making away with $60M of those funds. Consequently, the DEX paused its operations momentarily to audit the incident, 

Fast forward to 6th June, and the firm teased about relaunching its activities two days later, boldly proclaiming, “This isn’t just about recovery or bouncing back — it’s about resilience, rebuilding, and an unwavering long-term commitment to the entire Sui ecosystem. “

This announcement tore the Cetus community right through the middle, indicating that it would take plenty of effort and goodwill from all the parties to stitch it together. While the decision to relaunch its CLMM pools service is commendable, the DEX has a long way to go in regaining its users’ trust 

Cetus mounts full-scale recovery after $162M attack

Throughout the May 22nd debacle, the Cetus team pulled all stops to contain the situation. Together with its Sui blockchain counterparts, it managed to pause the transfer of $162M of the stolen funds. It then initiated moves to protect itself from further attacks, including identifying and patching the vulnerability that exposed it to hackers. 

It also rallied its community to work with Sui validators to free the assets they had quarantined after the attack. At the same time, it secured a $30M line of credit from the latter’s foundation to boost its recovery. Next, it resets all the affected pool data to its original settings while aligning it with prevailing market conditions. 

Additionally, it rebalanced its assets in preparation for pool refills and drew up a compensation contract for the affected. These efforts and many pledges of future enhancements did little to erase the mistrust some held on the DEX’s restart.

Investors continue to express misgivings about Cetus’s relaunch

Even as Cetus embarks on the audacious relaunch, it can’t play deaf to the concerns part of its community holds regarding the exercise. One such fear is that the token may turn inflationary, as some of its members suggested. 

Lady Cardano, for instance, was skeptical about the relaunch, suggesting that the DEX would inject 76 million new $CETUS tokens (a 5% supply increase) into circulation. The member concluded that the recipients could sell their allocations, potentially reducing the token’s value. 

Many members also complained that they’d lost significant portions of their investments. For example, Nikolai (@Nikolai7035) decried losing 30% of his position and swore never to return to that dump (Cetus again). His counterpart Stas (@staasbtc) reiterated this point, asking the protocol if it was using them to cover for the 30% of the liquidity lost in the hacking. 

It didn’t help that others could not access liquidity pools or remove their funds. If true, this latest failure indicates that technical or organizational hurdles continue to plague trust in the weapon system’s performance.

As resentment over Cetus’s slow recovery of full service mounted, some investors like Wesley_ (Redwhite2626) began to call the project a scam. Reservations of such a kind reveal a lack of trust and resentment toward the team and their project.

How can Cetus regain its users’s trust? 

If Cetus had imagined having a smooth restart after the hack, then it had another thing coming. That’s because winning over a community plagued with discontentment and mistrust is exacting. It will require more than PR stunts to pacify people who strongly feel the exchange let them down by failing to provide their investments with the protections they trusted it with. 

So, with time, tact, and sustained effort the protocol may still cultivate its community’s trust to the pre-hack day levels. However, it must be forthright with its users to achieve that feat. That entails coming clean on the claims that its issuance of 70M+ $CETUS tokens will erode the crypto asset’s value. It should enlighten its users on why making such a huge allocation was necessary and commit to buybacks and token burns to prop up the asset’s value. 

Secondly, the team should move fast to quell its users’ other concerns: they might have lost some of their funds forever. That calls for a full and timely restoration of the protocol to its pre-hack state, including a full restitution of investor positions and liquidity pools. This move will bolster users’ confidence in the project’s recovery efforts/sustainability. 

Again, the DEX should double down on allaying its investors’ qualms about its long-term security. Some quarters have questioned the robustness of its systems’ overhaul, given the pace of its relaunch. In this instance, a public and detailed update of the process will go a long way in easing those uncertainties. Add to the platform’s improved operability post-restart, and it’ll inspire more confidence in its offerings. 

Cetus’s resurgence is about more than just recovering lost funds or lost market share; it is about demonstrating that DeFi can move past its pain points. If it can use the disaster of recent weeks as a spark for reform, it may actually end up stronger, providing, over time, a more secure and stable foundation for the future.

Yet, for that to occur, it will need to move beyond this moment of crisis and make security, transparency, and user trust paramount above all else. The DeFi community is watching and waiting for now but knows the next chapter is up to them to write.

Cryptopolitan Academy: Tired of market swings? Learn how DeFi can help you build steady passive income. Register Now

Sui Network releases post-mortem on $260M Cetus hack
AI News

Sui Network releases post-mortem on $260M Cetus hack

, , , , , , , , , ,

The Sui network has released a post-mortem report regarding the cause of the $260 million Cetus hack that shook up its ecosystem last week. 

According to the post-mortem report, the main reason for the Cetus incident was a problem in a math library used by Cetus, not a weakness in Sui or Move. 

Move is a programming language for creating smart contracts on various blockchain platforms, and Sui is a Layer-1 blockchain project.

However, based on the report, the effect on users is still the same. As a result, Sui Network revealed that they needed to adopt a more effective approach and improve their efforts to support the ecosystem’s security. 

Apart from this, the report also highlighted that the network was designed to allow for safer smart contract development, making the first significant incident for a dApp a “deeply sad” moment for the team. 

Sui team takes effective measures to strengthen the network’s security

Last week, the $223 million crypto hack hit the network’s largest decentralized exchange and liquidity provider, Cetus Protocol. Luckily, the network managed to freeze $162 million while Cetus put out a $6 million bounty to reclaim the other $60 million of stolen funds.

The Cetus team earlier stated that they were collaborating with the Sui Foundation and other groups in the ecosystem to recover the remaining funds. The Sui Foundation confirmed that many validators had identified the addresses linked to the stolen funds and were blocking transactions on those addresses until further notice. The Cetus team was looking for ways to recover those funds and return them to the community.

In addition, to enhance the network’s security, Sui has decided to invest an extra $10 million in security efforts. The network will use this money for audits, bug bounty programs, and formal verification. The team also aims to work with the developer community to finalize these security strategies. 

Concerning the incident, the team mentioned that it marks a coming-of-age experience, which, according to them, is something every major blockchain has unfortunately faced. They further supported their claim with the argument that no design or programming language can prevent humans from creating bugs. 

Therefore, the Sui team has urged community members to use this incident as a lesson to learn from it to strengthen vital code on the network and assist builders in taking the necessary steps to come back stronger. 

Following the CoinMarketCap report, SUI’s price currently trades at $3.49, reflecting a 3.07% decrease in the past 24 hours.

Growing cases of cybersecurity raise serious concerns in the crypto world

On May 22, the Cetus DEX experienced a hack that was thought to have happened due to a smart contract code issue, resulting in the loss of around $223 million in user funds. 

Based on the information from the Extractor Web3 security notification tool team, $63 million of the stolen money was moved to the Ethereum network. They also reported a wallet address ending in “AF16” that the hackers used to launder 20,000 Ether worth about $53 million. 

The recovery efforts and the freezing of assets, organized by various projects, platforms, and validators in the Sui ecosystem, received mixed reactions from the crypto community. 

Following this, one user commented that the action was good news for the victims. However, according to the user’s argument, if the 114 validators could freeze wallets whenever they wanted, it raised serious concerns about the network’s ability to resist censorship. The user then concluded that Sui was far from decentralized.

Notably, the Cetus hack is the latest incident affecting crypto and Web3 in the first half 2025. On top of that, cybersecurity still remains a big concern in the crypto world, with many leaders in the industry urging the sector to self-regulate and strengthen defenses to avoid more regulatory attention. 

Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot