Markets

SPCX-USDC launched on Hyperliquid at 5:16 AM UTC with a $150 reference price and a $1.78 trillion implied valuation. By the close it was trading at $202.89, implying a valuation well above any private-market mark SpaceX has cleared.

THORChain confirmed on May 15 that one of its six Asgard vaults was compromised for roughly $10.7 million via a GG20 threshold-signature key-leak; on May 18, Blockaid flagged an $11.58 million drain on the Verus-Ethereum bridge caused by the same class of source-destination value-binding gap that broke Wormhole and Nomad in 2022.

WETH borrowing parameters on Aave V3 returned to pre-incident values across Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle and Linea on Monday, after more than 95 per cent of the unbacked rsETH from April's exploit was clawed back through liquidations.

A compromised admin key let an attacker mint 1,000 unbacked eBTC on Monad before Echo Protocol regained control and burnt the remaining 955 tokens. The nominal exposure was $76.7 million; the realised loss, laundered through Tornado Cash, came to about $821,700.

NUVA, co-developed by Animoca Brands and Nuva Labs, has linked $19 billion of Figure Technologies' tokenised assets — including a $18.4 billion HELOC portfolio — to Ethereum DeFi through two new products: nvYLDS and nvPRIME.

An attacker minted roughly 1,000 unbacked eBTC worth $76.7 million on Echo Protocol's Monad deployment by compromising a single admin key, though the realised loss was around $816,000 after the team regained control and burned the remaining tokens.

TrustedVolumes, a market maker resolving orders for 1inch Fusion, was drained across 85 transactions on May 7 after an attacker added themselves to the contract's signer allowlist — a function any wallet could call.

A class action filed in April alleges Circle had both the technical capability and a recent track record of freezing wallets, then declined to act for eight hours while $230 million in stolen USDC moved out of Solana through its own bridge.

Aave's 29-page filing argues that briefly-stolen ETH cannot be treated as North Korean property, even when Lazarus Group was the thief — and warns the SDNY restraining order could chill every future DeFi hack recovery.

Coinbase Asset Management opened a stablecoin-linked institutional credit fund on Thursday, with investors able to hold their shares either through traditional channels or as tokens minted on Ethereum, Solana or Base via Superstate's FundOS platform.

Wasabi Protocol's deployer EOA held the only ADMIN_ROLE for the entire permission system, and an attacker drained roughly $4.55 million from perp vaults across four chains. The vulnerability was governance, not code.

MegaETH's native token launches on Thursday, with 53.3 per cent of supply locked behind on-chain performance milestones rather than calendar dates. Pre-market perpetuals on Hyperliquid have been trading at an implied $1.5 to $2 billion fully diluted valuation.

The Colombia-born lending protocol on Rootstock told users on April 27 they have three months to withdraw before the web interface goes dark, blaming a 2021 architecture that cannot be fixed without redeploying.

Aave on Tuesday published the technical proposal that will determine whether DeFi can claw back the $292 million Kelp DAO lost to North Korean hackers ten days ago. The two-part plan re-collateralises rsETH with fresh ETH and uses a temporary oracle adjustment to liquidate seven attacker positions stranded across Aave and Compound.

A coordinated industry rescue has raised $160 million to cover Aave's bad debt from the KelpDAO exploit, with total pledges exceeding $300 million after Consensys committed 30,000 ETH on Sunday.

A compromised operator key — not a smart-contract flaw — let the attacker drain three vaults on the Sui-based DeFi protocol, but Volo and ecosystem partners froze $500,000 within minutes and intercepted a $2.1 million WBTC bridge attempt.

LayerZero's post-mortem pins the largest DeFi exploit of 2026 on KelpDAO's single-verifier bridge configuration, but Kelp says it was using LayerZero's own defaults. North Korea's Lazarus Group has been attributed as the attacker.

Lido DAO transferred the first $1.81 million tranche of its $20 million LDO buyback programme on Wednesday, routing tokens through centralised exchanges in a bid to retire up to 8 per cent of the circulating supply at historically depressed prices.

Drift Protocol will relaunch with USDT as its settlement layer after securing $147.5 million from Tether and partners, replacing Circle's USDC following an April 1 exploit that drained $270 million from the Solana-based perpetuals exchange.