On September 3, 2026, roughly $1.73M in DAI and USDC left Notional Finance’s V1 Escrow contract in a single transaction. There was no flash loan, no price oracle manipulation, and no compromised key. The attacker minted a fabricated fCash claim equal to Escrow’s entire live balance and withdrew it as real tokens, using a raw type-narrowing cast in Notional’s collateral valuation code that let a maximally insolvent account report zero debt.
Protocol Background
Notional Finance V1 represents fixed-rate lending positions as ERC1155 tokens called fCash. Every position is one half of a payer and receiver pair, the payer owes cash at maturity, the receiver is entitled to collect it. Transferring one of these ERC1155 tokens does not move an existing balance. It calls Portfolios.mintfCashPair(), which mints a brand new offsetting pair on the spot, a design built for OTC block trades. That function's only safeguard is a free collateral check on the payer, computed in Portfolios._freeCollateral() and converted into an ETH value by Escrow.convertBalancesToETH(). The entire system's solvency rests on that one conversion being correct.
Hack Analysis
An attacker-controlled helper contract deployed four disposable contracts.
The helper contract then called safeTransferFrom on Notional's ERC1155 fCash token, which routed into Portfolios.mintfCashPair(). That function creates a new payer and receiver position in a single call and checks free collateral on the payer only, an assumption written directly into the code that the receiver's position always increases and therefore needs no check of its own.
The same account acted as payer twice in a row, first for a notional of 1, then for a notional of 340282366920938463463374607431768211455, the maximum value a uint128 can hold. Combined, the two debts summed to exactly 2¹²⁸, a boundary value chosen with precision rather than brute force.
That combined debt reached Escrow.convertBalancesToETH(), which calls ExchangeRate._convertToETH() to price the payer's balance in ETH for the solvency check. Inside that function, uint128 absBalance = uint128(balance.abs()) casts the debt with a raw, unchecked cast rather than SafeCast.toUint128(). A value of exactly 2^128 truncates cleanly to 0 in that cast, so the largest debt mathematically possible was read as owing nothing.
The second disposable contract, 0x84A060Ed81316E6741Af216A099cFea8bCDd3489, the one holding that fabricated 2¹²⁸-1 claim, passed its own free collateral check on the strength of it, even after Notional’s standard haircut, a claim that size dwarfs any real-world debt. It called safeTransferFrom twice more, once with a notional of 69,257,372,677,950,923,155,658 sent to a third contract, 0x265ccfF3673bCAb03867988081cd51bFd919C03C, once with a notional of 1,658,524,864,122 sent to a fourth contract, 0x4a3508C5aC0677325932f3bC786Ae7A1C3e9CAfF.
Both calls routed through mintfCashPair() again, so the third contract came away holding a receiver claim exactly equal to Escrow's real DAI balance, and the contract came away holding a receiver claim exactly equal to Escrow's real USDC balance.
In a second transaction, Portfolios.settleMaturedAssets() converted the third contract fabricated claim into a real, internally tracked Escrow cash balance, and Escrow.withdraw() checked that balance, found no offsetting debt, and paid out 69,257.372677950923155658 DAI from Escrow to 0x265ccfF3673bCAb03867988081cd51bFd919C03C, which forwarded the full amount to the attacker's main address, 0xDaCC235a494750193695A111D715c2ca12b5Ce38, in the same transaction.
The same transaction repeated the process for the fourth contract, settling its fabricated claim into an Escrow cash balance and paying out 1,658,524.864122 USDC from Escrow to 0x4a3508C5aC0677325932f3bC786Ae7A1C3e9CAfF, which likewise forwarded the full amount to 0xDaCC235a494750193695A111D715c2ca12b5Ce38.
Root Cause
The root cause is an unchecked, raw uint128() cast on a debt balance inside ExchangeRate._convertToETH(), in place of the reverting SafeCast.toUint128() used elsewhere in the same file.
Two things made that cast reachable in the first place. Portfolios.mintfCashPair() checks solvency on the payer only, so a fabricated debt on one account is never caught by a check on the account that actually benefits from it.
RiskFramework.sol itself computes the debt correctly, using safe, reverting arithmetic throughout, which meant the attacker had to engineer one exact value rather than exploit sloppy math earlier in the chain. Each factor on its own would have limited the damage, together they turned a single missing bounds check into a full drain.
How QuillAudits Smart Contract Audit Could Have Prevented This
Type-boundary fuzzing on every narrowing cast. Fuzzing _convertToETH() and every other raw uint128() or uint256() cast with boundary values, 0, 2^128 minus 1, and 2^128 itself, would have surfaced the exact wrap that zeroed out the payer's debt.
Two-sided solvency checks on any function that mints offsetting positions. A review of mintfCashPair() against the principle that both sides of a newly created payer and receiver pair need verification, not just the side assumed to be taking on risk, would have flagged the one-sided freeCollateral(payer) check as a design gap on its own, independent of the cast bug.
A project-wide ban on raw narrowing casts in solvency-critical paths. A lint rule or manual pass flagging every uint128(x) or uint256(x) cast on a value that can carry adversarial input, requiring SafeCast or an explicit bounds check instead, would have caught this specific line even without the fuzzing pass above.
Funds Flow After Attack
The DAI and USDC withdrawn from Escrow were moved through intermediary wallets and consolidated into a single address.
That address swapped the combined DAI and USDC for approximately 689.2 ETH.
The ETH was then deposited into Tornado Cash.
Post-Attack Mitigation
At the time of writing, Notional Finance has not published a tweet, statement, or post-mortem addressing this incident, and has not disclosed an official loss figure or confirmed root cause. This section will be updated once the protocol responds.
This was not a flash loan attack and not a price manipulation. It was a single unchecked cast, uint128(balance.abs()), sitting inside a function that turns a debt balance into an ETH-denominated solvency check. Because Notional's fCash minting function trusted that check completely and only applied it to one side of every new position, an attacker who could engineer one specific number, 2^128, could make the largest possible debt look exactly like zero. Roughly $1.73M in DAI and USDC left Notional's V1 Escrow contract as a result, swapped to ETH and moved into Tornado Cash. In a system built entirely on solvency checks, the check itself has to be the most carefully verified line in the codebase, because everything downstream believes whatever number it returns.
You can borrow against Bitcoin, stake it, trade it on-chain, post it as margin for perpetuals, supply it to a liquidity pool, convert it into stablecoins to pay someone, and use it to buy tokenised stocks. Two of those are worth doing for most holders, two are worth doing for a specific kind of trader, and three are worth skipping unless you have a reason. None of them happen on Bitcoin’s own chain, so every one of them starts with moving value somewhere else.
Why would anyone want Bitcoin in DeFi?
Bitcoin holds more value than anything else in crypto and does less with it than almost anything else in crypto. At roughly $78,482 per coin on 8 September 2026, its market capitalisation sits near $1.57 trillion — 57% to 59% of the entire asset class, depending on the tracker. It is the deepest and most widely held pool of capital in the industry.
Almost none of it is doing anything. Spark’s BTCFi research, published 29 May 2026, put Bitcoin’s DeFi footprint at 91,332 BTC — 0.46% of circulating supply, or about 0.8% counting every wrapped variant and all of Babylon’s staking. Threshold’s July 2026 follow-up measured roughly 91,000 BTC. The same research puts Ethereum’s DeFi penetration near 15% of ETH supply.
So the gap is roughly thirty-fold, and it is not a demand problem. Holders want liquidity without selling; the tax event and the lost position are both real costs. The gap exists because of where Bitcoin lives.
Why can’t you do any of this on Bitcoin itself?
Bitcoin’s base chain has no lending markets, no perpetuals, no automated market makers and no stablecoins, and that is a design decision rather than a missing feature. Bitcoin Script can verify a signature, enforce a timelock and check a hash preimage. It cannot run the persistent, composable contract state a money market or an order book needs. Ten-minute blocks make anything price-sensitive slow, and there is no native dollar to price a loan in.
So every use case below has the same first step: value has to move to a chain that can execute it. That step is the part most guides skip, and it is where the real cost and the real risk live. Once value is there, you no longer hold Bitcoin. You hold a token that tracks its price, whose risk is the issuer’s or the bridge’s.
What can you actually do with Bitcoin in DeFi?
1. Borrow stablecoins against it
Borrowing against Bitcoin is the most used thing you can do with it, and the only one here that leaves your position intact. You deposit a Bitcoin-denominated token as collateral, borrow USDC or USDT against it, and repay later. No sale, so in most jurisdictions no disposal at the point of borrowing.
Aave is the biggest venue: over $14.6 billion in total value locked as of mid-2026, more than $3 billion of it in Bitcoin markets. It accepts WBTC and cbBTC, with WBTC carrying a 73% maximum loan-to-value and a 78% liquidation threshold. Morpho is second at over $1.5 billion in BTC vaults.
The honest part: this is a margin loan, and margin loans liquidate. Borrow at 50% LTV against a 78% threshold and your collateral only has to fall about 36% before the protocol sells it for you, at a price you did not pick. Bitcoin has produced that drawdown repeatedly.
2. Stake it
Bitcoin staking pays a yield for locking BTC in a timelock script on the Bitcoin chain itself, without wrapping or bridging it anywhere. The coins stay under your keys; the stake secures other proof-of-stake networks, and those networks pay for it.
Babylon is the category, not just the leader: over $4 billion in TVL and roughly 57,000 BTC as of May 2026, close to 80% of everything counted as Bitcoin DeFi. Lombard, at about $1.5 billion, issues the liquid staking token most people use to keep the position tradeable.
The honest part: yields are low single digits, lockups are real, and the liquid staking wrapper reintroduces exactly the token risk native staking was meant to avoid. Solv Protocol, another large player in the category, was exploited in March 2026.
3. Trade with it
Once Bitcoin is on an EVM chain or Solana you can trade it against anything else on-chain, at any hour, without an account. Uniswap is the largest decentralised exchange by volume and the deepest venue for WBTC and cbBTC pairs against ETH and stablecoins.
The honest part: for the plain trade of Bitcoin into dollars, a centralised exchange is almost always cheaper. On-chain trading earns its keep when the thing you want is not listed anywhere else — a token on a rollup, a new asset, something that never reaches an exchange.
4. Post it as margin for perpetuals
Perpetual futures venues let you take leveraged directional positions, and the largest on-chain one is Hyperliquid, which processed $633 billion in volume in Q1 2026, holds roughly 70% of decentralised perp volume and about 6.2% of the global perps market including centralised exchanges.
The honest part, and it is the whole story: Hyperliquid margins in USDC, not in Bitcoin. Putting BTC to work there means converting it first, which is a disposal, after which you hold dollar collateral and a synthetic position that can be closed against your will. A legitimate trade, but not the trade of holding Bitcoin.
5. Supply it to a liquidity pool
Supplying Bitcoin to an automated market maker earns a share of trading fees on the pair. Uniswap v3 and Curve are the two venues that matter.
The honest part: for most holders, this is the worst option on the list. Bitcoin pools are thin — the WBTC/cbBTC pool on Base showed roughly $270,000 of liquidity against $135,000 of daily volume in 2026. And a volatile pair carries impermanent loss, so a large BTC move can leave you with less than holding would have. Fee income on a thin pair rarely covers it.
6. Convert it and pay someone — Lightning, or stablecoin rails
If the goal is to send value rather than hold a position, Bitcoin has two working answers and neither is a DeFi protocol. Lightning settles small BTC payments in seconds for cents, and is the right tool when both sides want bitcoin. For paying someone who wants dollars, converting to USDC or USDT and sending on a cheap chain is the standard route.
The honest part: spending Bitcoin is selling Bitcoin. A card, a payment processor and a stablecoin conversion are all disposals, taxable in most jurisdictions, and a year of small ones is worse to account for than a single sale.
7. Buy tokenised stocks and real-world assets with it
Tokenised equities are the newest destination, and Bitcoin is a legitimate funding source for them. On Solana, Kamino Lend handles 82.6% of tokenised stock lending — $31 million of the $53 million of tokenised stock collateral on the network as of late July 2026. Robinhood’s own chain is building in the same direction.
The honest part: $53 million across an entire chain is a small market. The rails work, the depth does not exist yet. Early rather than established.
Which of these are actually worth it?
How do you get Bitcoin onto an EVM chain, Solana or a rollup?
Four routes exist, and they differ mainly in who holds your Bitcoin while you are using the token. Ask that first; the fee difference is usually smaller than the custody difference.
A centralised exchange: Deposit BTC, sell or convert, withdraw the destination asset. For common pairs — BTC to USDC, BTC to ETH — this is frequently the cheapest route available and worth checking before anything else. It costs you an account, KYC and the exchange holding your coins in between, and it fails outright for most rollups, which exchanges do not support as withdrawal networks.
Mint directly from the issuer:Coinbase issues cbBTC, BitGo WBTC, Kraken kBTC, Binance BTCB, and Circle launched cirBTC on Ethereum on 8 June 2026. You are trading Bitcoin for a claim on that institution’s reserves, which buys the deepest liquidity and the widest acceptance in lending markets. Threshold’s tBTC is the decentralised alternative: 51-of-100 threshold signers, about $5 billion of cumulative bridge volume, no losses in six years.
Cross-chain swap protocol:Garden Finance, THORChain, and Chainflip all move native BTC to other chains without an exchange account, and they differ more in coverage than in what they enable. THORChain reaches the most standalone L1s; Chainflip runs a short, deliberate asset list across six chains. Garden’s catalogue on 8 September 2026 listed 26 assets across 15 chains, including Lightning, Solana, Starknet, Spark, Ink and Hyperliquid, 13 of those entries a form of Bitcoin across seven tickers. In a nine-swap cost snapshot on 20 August 2026, Garden quoted lowest on all nine and Chainflip highest, the gap widest on $100 swaps.
Bitcoin-native layer 2: Spark and Stacks run BTC as the network’s own asset rather than a company’s token — less counterparty concentration, thinner liquidity, fewer applications waiting. Botanix, often named in this category, announced a full wind-down on 9 June 2026.
What to check before you move anything
Check the token, not the ticker. WBTC on Starknet is a different token from WBTC on Ethereum, and cbBTC is three separate contracts across Ethereum, Base, and Solana.
Have gas on the destination. Arriving with a Bitcoin token and no ETH, SOL or STRK is the most common way a first attempt stalls.
Size to the destination’s liquidity, not to your balance. Caps exist on every route, and inside them the far side’s depth sets your slippage.
Assume the conversion is taxable. In most jurisdictions giving up BTC for a token is a disposal, and coming back is a second one.
FAQ
Can I use Bitcoin in DeFi without wrapping it? Yes, in one case. Babylon’s staking locks native BTC in a timelock script on the Bitcoin chain, so the coins never leave and are never wrapped. Every other use case here needs a representation of Bitcoin on another chain.
Is wrapped Bitcoin the same as Bitcoin? No. It is a token on another chain representing BTC held elsewhere, and its risk is the issuer’s rather than Bitcoin’s. cbBTC is a claim on Coinbase, WBTC on BitGo, kBTC on Kraken.
What is the safest way to earn yield on Bitcoin? Native staking through Babylon has the fewest moving parts, because the BTC stays on Bitcoin under your own keys. Lending on Aave is more liquid and adds smart-contract and wrapped-token risk on top.
How much Bitcoin is actually in DeFi? About 91,000 BTC, or 0.46% of circulating supply, per Spark’s May 2026 research and Threshold’s July 2026 update — roughly 0.8% counting every wrapped variant and all Babylon staking.
Can I use Bitcoin in DeFi on Solana? Yes. cbBTC is the main Bitcoin representation on Solana, and Kamino is the largest money market there at around $3.2 billion in TVL, with Jupiter Lend second.
Is a bridge cheaper than an exchange? Often not, for common pairs. Exchanges usually win on BTC to USDC or BTC to ETH. Bridges win when the destination is a rollup the exchange does not support, which is most of them.
Why did Bitcoin DeFi shrink in 2026? Layer-two and sidechain TVL fell 74% in Q1 2026, and the broader ecosystem about 10%, from 101,721 BTC to 91,332. Threshold’s read is that capital rotated toward verifiable custody and a dependable route back to native BTC.
Do I have to sell my Bitcoin to trade perps? Effectively yes. The major perp venues, Hyperliquid included, margin in USDC rather than Bitcoin, so the conversion is unavoidable.
How StonkFun’s integration with Raydium’s LaunchLab sent STONK up 250%, RAY up 40%, and JUP up 21% — and what it means for Solana DeFi.
STONK Surges 250% — Inside the Raydium x StonkFun Integration
A token most traders had never heard of a week ago just ripped 250% in 24 hours and briefly touched an all-time high. No celebrity endorsement. No exchange listing. No viral tweet from a billionaire. Just a plumbing upgrade.
That’s the story of STONK, the native token of Solana launchpad StonkFun, and it’s one of the more interesting case studies in crypto market structure this year — because the rally wasn’t really about STONK at all. It was about what happens when a fast-growing app plugs directly into the dominant liquidity layer of an entire blockchain.
If you trade Solana tokens, watch DeFi, or just want to understand how integrations move markets in 2026, this one is worth unpacking in detail.
What Actually Happened
On Saturday, September 6, 2026, StonkFun announced it was integrating with Raydium’s LaunchLab, the token-launch infrastructure built by Solana’s largest decentralized exchange. The next day, the numbers told the story:
STONK surged more than 250% in 24 hours, reaching an all-time high near $0.212 before pulling back to trade around $0.16.
Its market capitalization jumped to roughly $140 million, with about $135 million in daily trading volume.
RAY, Raydium’s own token, gained more than 40%, trading around $1.27.
JUP, the token behind Solana DEX aggregator Jupiter, climbed about 21% to roughly $0.27.
Raydium itself pulled in close to $440,000 in protocol revenue in a single day — its best day since July 2025.
Three tokens across three different projects all moved together, in the same direction, on the same news. That’s not a coincidence. It’s how integrations work when they touch the core of a network’s liquidity.
What Is StonkFun, and Why Does It Matter?
StonkFun is a Solana-based token launchpad, but with a twist that separates it from the thousands of meme-coin factories that have come and gone: it lets users create tokens paired against real-world financial assets — tokenized stocks, ETFs, commodities, and currencies — rather than just pairing new tokens against SOL or stablecoins.
The flagship example is STONK itself, which trades against SPYx, a tokenized product from Backed Finance designed to track the S&P 500 through the SPDR S&P 500 ETF. Other pairs on the platform link tokens to assets like ZCash, Hyperliquid, and Bittensor.
It’s important to be precise about what this actually means for holders: pairing a token against a tokenized stock or ETF does not grant ownership of the underlying shares, dividends, or shareholder rights. The token’s dollar price simply reflects the value of the paired asset and the exchange rate between the two — more like a synthetic trading pair than an equity investment. That distinction matters for anyone evaluating the token, and it’s a detail worth remembering before assuming “stock-paired” means “backed by stock.”
StonkFun also runs a buyback-and-burn program, funneling a share of trading fees from its newer liquidity pools into purchasing and burning its ten largest tokens by market cap, weighted by size and executed every few minutes. As of the integration announcement, tokens paired with ZEC, HYPE, and TAO occupied the top three buyback slots, and the platform reports 78 different tokens have gone through the burn mechanism to date.
What Is Raydium’s LaunchLab, and Why Did the Integration Matter So Much?
Raydium is the largest decentralized exchange (DEX) on Solana by volume, and LaunchLab is its permissionless token-launch infrastructure — a system that lets any project deploy tokens with a bonding-curve trading model that “graduates” into a full Raydium liquidity pool once it hits a volume threshold.
Before the integration, StonkFun ran its own launch mechanism. That created two problems the team had publicly acknowledged just days earlier, in a September 2 announcement:
Sniping — bots and insiders buying up new token launches within seconds, before retail traders get a fair shot.
High deployment costs — StonkFun’s team confirmed the switch to LaunchLab cut deployment costs from roughly 0.29 SOL down to 0.03 SOL, close to a 90% reduction.
Single-wallet launch risk — concentrated ownership at launch that skews price discovery.
By routing new token deployments through Raydium’s LaunchLab instead of a proprietary system, StonkFun effectively outsourced its liquidity and trust problem to the most established DEX infrastructure on Solana. New tokens launched on StonkFun now settle directly into Raydium’s order flow and, eventually, Jupiter’s aggregated routing — which explains why all three tokens moved in tandem.
Solana’s own official account publicly signaled support for the move, responding to a StonkFun post with a simple statement of backing for “Stonk Tokens” — a small detail, but one that added a layer of ecosystem-level credibility to a project that, just days earlier, was fielding user complaints.
Why This Kind of Integration Moves Three Tokens at Once
This is the part that’s genuinely useful to understand, beyond the STONK headline number.
When a launchpad integrates directly with a major DEX’s infrastructure, it creates a flywheel effect across the stack:
The launchpad token (STONK) benefits from increased attention, new deployments, and the buyback mechanism scooping up fees generated by fresh activity.
The DEX token (RAY) benefits because every new token graduating through LaunchLab generates trading fees and protocol revenue — Raydium’s $440K single-day haul is the clearest evidence of that.
The aggregator token (JUP) benefits because increased trading volume across Solana DEXs means more routing activity through Jupiter, which captures a share of that flow.
In other words, a single infrastructure decision created three separate, simultaneous demand shocks — one for narrative attention, one for protocol revenue, and one for trading volume. That’s a pattern worth recognizing any time you see a launchpad-to-DEX integration announcement: check not just the launchpad’s token, but the underlying DEX and aggregator tokens too.
Is the Rally Sustainable, or Just a News Spike?
This is the question every trader should be asking, and it’s fair to say the honest answer is: nobody knows yet, and the early data is already showing the limits of the move.
A few signals worth watching:
Volatility has already shown up. STONK gave back a meaningful chunk of its intraday gains after hitting its all-time high, and later data showed the token cooling to around $0.129 with volume pulling back to roughly $105 million — a reminder that a 250% single-day move rarely holds its full magnitude.
The catalyst was structural, not fundamental. Lower deployment costs and reduced sniping risk are real improvements to StonkFun’s product, but they don’t guarantee sustained user growth or trading demand once the initial announcement fades from the timeline.
The buyback program is fee-dependent. StonkFun’s burn mechanism only works if trading volume stays elevated. If activity reverts to pre-integration levels, the buyback flywheel slows down with it.
RAY’s 40%+ move reflects genuine revenue, which is a stronger signal than a narrative pump. Protocol revenue tied to actual fee generation tends to be a more durable indicator than social attention alone — though even that can normalize once the initial wave of new launches slows.
For traders and researchers, the metrics worth tracking going forward are straightforward: daily trading volume on StonkFun, the pace of new token launches through LaunchLab, Raydium’s daily protocol revenue, and whether STONK’s price finds a stable range above pre-announcement levels or fully retraces.
The Bigger Picture: Stock-Paired Tokens on Solana
Beyond the immediate price action, this integration is a useful data point in a broader trend: the merging of tokenized real-world assets (RWAs) with Solana’s meme-coin and launchpad culture.
StonkFun’s core pitch — pairing speculative tokens against tokenized stocks, ETFs, and commodities instead of just SOL — sits at the intersection of two of crypto’s biggest 2025–2026 narratives: real-world asset tokenization and permissionless token launches. Whether that combination produces durable products or just a faster way to speculate on volatility remains an open question, and it’s one worth watching regardless of which side of that debate you land on.
What’s clear is that infrastructure integrations are becoming one of the most reliable short-term catalysts in Solana DeFi. When a launchpad plugs into a major DEX’s liquidity engine, the resulting demand doesn’t stay contained to one token — it ripples across the stack. Anyone tracking Solana DeFi should be watching for the next version of this pattern, not just this one.
Ready to trade without watching the charts all day?
Subscribe to Hyperlyx AI and put your trading strategies on automation — built for traders who want to stay in the game through every twist of a rally like this one, without letting emotion drive the decision.
Frequently Asked Questions
What is STONK?
STONK is the native token associated with StonkFun, a Solana-based launchpad that lets users create tokens paired against tokenized stocks, ETFs, commodities, and other assets, most notably SPYx, a token tracking the S&P 500.
Why did STONK price go up 250%?
STONK surged after StonkFun announced an integration with Raydium’s LaunchLab on September 6, 2026, which lowered deployment costs, reduced sniping risk, and routed new token launches directly into Raydium’s liquidity infrastructure.
Does owning STONK mean owning S&P 500 exposure?
No. Pairing a token against a tokenized asset like SPYx means its price reflects that asset’s value and exchange rate — it does not grant ownership, dividends, or shareholder rights tied to the underlying stocks.
Why did RAY and JUP also rally?
Because new StonkFun token launches now settle through Raydium’s LaunchLab and route through Jupiter’s aggregation layer, increased activity on StonkFun directly generates trading fees and volume for both platforms.
Is the STONK rally likely to continue?
That depends on whether trading volume and new launches on StonkFun stay elevated after the initial news cycle. Early data already shows some pullback from the token’s all-time high, so sustained interest — not just the announcement itself — will determine whether gains hold.
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are highly volatile, and tokens like STONK, RAY, and JUP can experience rapid, significant price swings. Always do your own research before making investment decisions.
Katana CEO Matt Fisher has said a dollar stablecoin planned by 21 financial institutions for the first half of 2027 could generate yield through independent DeFi protocols, although holders would assume risks not covered by its issuing banks. Katana CEO…
MoonPay issues the token. It is backed by PYUSD. PYUSD is issued by Paxos and backed by actual dollars and Treasuries. Count the layers: there are two, and the law Congress passed last year describes one.
A new draft of the long-awaited crypto Clarity Act has dropped with amendments.
As first reported by Eleanor Terrett from Crypto in America and Punchbowl’s Brendan Pedersen, the updated bill contains changes including requiring non-decentralized DeFi protocols to register with the CFTC, and changes around how credit unions deal in crypto, according to reporters.
The specifics include that a decentralized finance app fails the test of being such a protocol test if someone can control or materially alter its functionality, if it doesn’t run solely on pre-established transparent encoded rules, or if someone can restrict or censor its use.
It also adds that a federal credit union may use a digital asset or distributed ledger system to perform, provide, or deliver any activity, function, product, or service it is otherwise authorized by law to perform.
JUST IN: An updated version of the Clarity Act has released ahead of next week's floor vote
"Latest changes include new DeFi requirements and credit union fix" — Punchbowl News
Lawmakers were hoping a crucial vote on the crypto market structure bill would go ahead in August before their five-week recess. It was delayed and the Senate will now vote on it on September 15.
The bill is not bipartisan yet, according to the reporters. Senate Republicans started circulating the updated legislation on Thursday.
The Clarity Act drafts a framework to formally divide oversight between regulators, distinguishing which digital assets are securities, commodities or stablecoins. Crypto industry executives have long called for such rules to be in place.
Though passed by the House of Representatives last July, it has been stalled this year, mostly because the banking lobby clashed with crypto companies over paying customers stablecoin yield.
A new draft tackling the issue of ethics started circulating in July, banning government officials from promoting or making money from crypto — something Democrats have criticized the Trump family for doing.
Despite the changes, a group of Democrats said the bill fell short and demanded amendments to the bill.
Pro-crypto lawmakers have blasted Democratic politicians who they think are deliberately holding back the bill.
President Donald Trump has urged lawmakers to get the legislation over the line. In August, he said that in order for the U.S. to remain the “undisputed leader in Bitcoin and crypto,” they had to pass the “very, very powerful legislation.”
The September 15 upgrade brings smart contracts, an AMM DEX, and RPC infrastructure to a chain that has never processed a single swap. Seven years of mobile mining come down to whether anyone builds on the other side. The most…
Arbitrum’s Watchdog Committee has proposed permanently excluding three DeFi projects from future DAO programs after flagging cases involving 457,553 ARB, valued at roughly $76,000. Arbitrum grant cases involve three different findings The Sep. 3 governance proposal said Good Entry, Limitless,…
A range-proof cache bug in the Elements codebase let an unknown actor mint unbacked L-BTC, drain 95% of the federation reserve through SideSwap, then negotiate its return on-chain via OP_RETURN messages. The network remains frozen, 598.5 BTC sits in the…
Nansen has integrated Outcome.xyz’s HIP-4 markets into its trading platform, becoming the first front end to support the venue as Hyperliquid opens its outcome-market infrastructure to outside builders. According to a press release shared with crypto.news, the integration is live…
Solana has captured $348 million in net real-world asset inflows over a 30-day period, pushing its tokenized RWA value to $720 million, according to RWA.xyz data.
That is a strong number for a network usually associated with memecoins, retail trading, fast DeFi, and consumer crypto apps. RWAs give Solana a slightly different story: institutional-style capital moving into tokenized Treasuries, credit products, and other real-world asset structures.
It is important not to blur these categories.
RWA inflows are not the same thing as meme-token liquidity. They are not the same as speculative trading volume. They represent capital moving into tokenized asset products, which is a very different kind of activity.
For more details, visit the official App platform.
TL;DR
Solana recorded $348 million in 30-day net RWA inflows.
Solana RWA TVL reached $720 million.
The data points to tokenized asset growth, not meme-market speculation.
Why RWA Growth On Solana Matters
Solana’s image has changed a few times.
At different moments, it has been seen as an Ethereum challenger, an NFT chain, a memecoin chain, a DeFi chain, and a consumer crypto network. RWA growth adds another layer.
Tokenized real-world assets are often treated as a more institutional category.
They can include U.S. Treasury products, private credit, tokenized funds, real estate exposure, and other assets that connect traditional finance with blockchain settlement.
For Solana to attract meaningful RWA inflows, it suggests the network’s speed and low fees are starting to matter beyond retail speculation.
The $720M TVL Level Gives It Weight
A $720 million RWA base is not small.
It does not put Solana at the top of every tokenization leaderboard, but it gives the chain real presence in the sector. The 30-day inflow number is even more interesting because it shows recent momentum rather than only accumulated value.
Momentum matters in RWA because institutional capital tends to move carefully.
If tokenized Treasury products and credit pools are expanding on Solana, the ecosystem may be gaining trust from issuers, allocators, or infrastructure providers who need more than fast trading.
Solana’s Speed Could Help RWA Products
RWAs do not always need high-frequency settlement, but speed and cost still matter.
Lower transaction fees can make token transfers, collateral movement, and settlement operations easier. Fast confirmation times can also make user experience smoother, especially if tokenized assets are integrated into DeFi or trading platforms.
That gives Solana a practical pitch.
It can offer RWA issuers a network with liquidity, users, low costs, and growing financial infrastructure.
Do Not Overstate Institutional Adoption
The careful part is language.
RWA inflows do not mean every major institution has adopted Solana. They do not prove that all tokenized products on the network are institutionally used. They also do not guarantee that the capital will remain if yields, incentives, or market conditions change.
The data shows inflows and TVL.
That is strong enough without exaggerating it.
The Solana Market View
Solana’s RWA growth gives the network a more rounded story.
It is still a retail-heavy, fast-moving ecosystem. But the $348 million 30-day inflow figure shows tokenized asset activity is building alongside the louder trading narratives.
That matters because sustainable networks usually need more than one use case.
If Solana can keep attracting both consumer activity and institutional-style asset flows, its ecosystem becomes harder to pigeonhole.
This article draws on RWA.xyz Solana network data and public DeFiLlama Solana metrics.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by App. at App
Aave governance is considering an emergency Guardian powers proposal that would allow vulnerable lending pools to be frozen quickly during active security threats, without requiring immediate public write-ups.
It is a slightly uncomfortable proposal, and that is exactly why it matters.
On one hand, DeFi users want transparency. On the other hand, publishing too much detail during an active exploit can hand attackers a roadmap. Aave contributors are trying to solve that tension: how do you act fast enough to protect users without making governance feel opaque?
The proposal does not allow guardians to seize user funds or liquidate deposits. It is about emergency freeze powers.
For more details, visit the official Governance platform.
TL;DR
Aave governance is discussing emergency Guardian freeze tools.
The proposal would allow faster response during active exploit situations.
It does not give guardians power to seize deposits.
Why Emergency Tools Matter In DeFi
DeFi moves fast when things go wrong.
A bug, oracle issue, bad debt event, or market manipulation attack can escalate in minutes. Waiting for a full public governance process is not always realistic when funds are at risk.
That is why many large protocols use emergency roles.
These roles are supposed to pause, freeze, or limit certain functions while the team or DAO investigates. The difficult part is designing those powers so they are strong enough to protect users, but narrow enough that they cannot be abused.
Aave’s proposal sits right in that design problem.
Transparency Versus Security
The public-notice question is the most interesting part.
In normal conditions, users should expect clear explanations. If a market is frozen, people want to know why. They want to understand whether their funds are safe and when normal operations may resume.
During an active exploit, though, immediate disclosure can be dangerous.
If the issue is not fully contained, a public write-up may expose technical details that help attackers move faster. That is the argument behind delaying some disclosures until the threat is under control.
It is not an easy trade-off.
Aave Has To Protect A Large System
Aave is one of DeFi’s core lending protocols.
That means its risk controls matter beyond one market. Aave deployments sit across multiple chains and assets, with users relying on the protocol for borrowing, lending, collateral management, and liquidity.
Emergency response is not a side issue.
It is part of the protocol’s safety design. If governance cannot respond quickly enough, users can suffer. If emergency powers are too broad, users may worry about centralization.
Finding the middle ground is the hard part.
What The Proposal Does Not Do
The proposal should not be exaggerated.
It does not mean Aave guardians can take user funds. It does not mean deposits can be seized. It does not mean liquidations can be manually forced outside protocol rules.
The proposal is about freezing vulnerable markets during emergencies.
That distinction is important because “emergency powers” can sound scarier than the actual mechanism.
The DeFi Governance Lesson
Aave’s discussion shows how mature DeFi protocols are thinking about crisis management.
Early DeFi loved pure automation. Over time, protocols learned that some emergency controls may be necessary, especially when billions of dollars are at stake. The question is how to make those controls accountable.
The best version of this proposal would protect users during live threats while preserving post-incident transparency.
That is the balance Aave governance now has to debate.
This article draws on Aave governance materials relating to the emergency Guardian powers proposal.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by Governance. at Governance
Router Protocol has announced a deprecation plan that will shut down the cross-chain messaging network and permanently burn 303 million ROUTE tokens.
The team said users will have a grace period to move assets back to origin chains before relayer nodes are disconnected. That makes this a user-action story as much as a tokenomics story. Anyone still relying on Router needs to pay attention to the timeline.
The most important thing is not to invent a cause.
The shutdown has not been framed as a hack or exploit. The team cited unsustainable relayer maintenance costs, so the story is about protocol economics and wind-down planning rather than a security breach.
Relayers, validators, message verification, audits, monitoring, liquidity support, and developer maintenance all cost money. If usage or revenue does not justify that cost, even useful infrastructure can become hard to sustain.
Router Protocol’s deprecation notice points to that problem.
A protocol can have real technology and still struggle as a business or network. In cross-chain crypto, that is especially true because competition is intense and users often move toward the fastest, cheapest, or most liquid route.
That leaves smaller networks under pressure.
The Token Burn Is A Big Part Of The Story
Burning 303 million ROUTE tokens is a major tokenomics action.
A burn permanently removes tokens from circulation, but in this case the context is not a bullish supply-reduction campaign. It is part of the network’s wind-down process.
That distinction matters.
Some token burns are designed to support long-term scarcity narratives. This one is tied to shutting down operations and completing deprecation. Traders should not treat the burn as a normal growth catalyst.
It is part of closing the book.
Users Need To Watch The Grace Period
The practical issue is asset movement.
If Router relayers are being disconnected, users need clear instructions on how and when to bridge assets back to origin chains. Missing a grace period can create headaches, especially if liquidity routes or interfaces disappear.
That is why the timeline matters more than the headline.
The token burn may get attention, but the user priority is simple: check exposure, follow official instructions, and avoid waiting until the last minute.
Coinbase Backing Does Not Mean Coinbase Liability
Router has been described as Coinbase-backed, but that should not be twisted into blame.
Early venture backing or ecosystem investment does not mean Coinbase controls daily operations or is responsible for the shutdown. Unless official sources say otherwise, the decision belongs to Router Protocol’s team and governance structure.
That nuance is important.
Crypto headlines often use investor names to make a story sound bigger. But backing is not the same as operational control.
Cross-Chain Infrastructure Remains Difficult
Router’s shutdown says something broader about interoperability.
Crypto needs cross-chain systems, but building them safely and sustainably is hard. Bridges and messaging protocols must deal with security risk, liquidity fragmentation, operational cost, user trust, and fierce competition.
Not every protocol survives that pressure.
Router’s wind-down is a reminder that infrastructure projects need durable economics, not just clever architecture.
The Market View
The Router Protocol shutdown is a serious event for ROUTE holders and users of the network.
It is not a confirmed exploit story. It is not a reason to blame every early backer. It is a protocol deprecation with a large token burn and a user withdrawal window attached.
For anyone still interacting with Router, the next step is boring but important: read the official notice, move assets if needed, and do not rely on relayer availability past the stated deadlines.
This article draws on Router Protocol’s official deprecation notice and related public materials.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by X. at X
Solana app Fomo has overtaken Pump.fun in 24-hour protocol revenue, generating $1.4 million in fees during the latest tracking window.
That is a pretty sharp move, because Pump.fun has been one of the defining apps in Solana’s retail trading cycle. For another app to flip it, even for a single day, tells us something about how quickly attention can move inside the Solana ecosystem.
But there is an obvious caveat.
One strong 24-hour window does not mean Fomo has permanently taken Pump.fun’s place. Crypto app revenue can swing fast, especially when traders pile into a new mechanic, launch format, or incentive loop. Still, this is exactly the kind of on-chain shift Solana traders watch closely.
For more details, visit the official Defillama platform.
TL;DR
Solana app Fomo generated $1.4 million in 24-hour protocol revenue.
That put it ahead of Pump.fun during the tracked window.
The flip is notable, but it does not prove permanent market dominance.
Why The Fomo Flip Matters
Solana has become one of the most active environments for fast-moving consumer crypto apps.
A big part of that comes down to cheap transactions, fast settlement, and a retail user base that is willing to try new trading experiences quickly. When an app catches attention on Solana, volume can appear almost immediately.
That is what makes the Fomo data interesting.
This is not just another token chart. Protocol revenue shows users are paying to interact with the app. That means actual fee generation, not only speculative market cap movement.
For Solana, fee-generating apps are important because they show there is economic activity happening on the network.
Pump.fun Is Still The Benchmark
Pump.fun has become a kind of reference point for Solana app culture.
It turned token creation into something simple, chaotic, and wildly popular. That made it one of the clearest examples of Solana’s retail flywheel: users create assets, traders chase them, liquidity moves fast, and fees stack up.
So when Fomo moves ahead of Pump.fun on daily revenue, people notice.
It does not mean Pump.fun is finished. It means traders are willing to rotate into another venue when the incentives, mechanics, or social energy line up.
That is how Solana works at its most intense.
Revenue Spikes Need Context
The danger is overreading the number.
A 24-hour spike can come from a launch event, a temporary incentive, a viral trading cycle, or concentrated activity around a small group of assets. That can make one day look bigger than the longer-term trend.
The better question is whether Fomo can repeat it.
If the app keeps generating strong fees over several days or weeks, the story becomes much more meaningful. If revenue drops back quickly, this may be remembered as a short burst of attention.
Either way, the $1.4 million day deserves coverage because it shows how quickly Solana’s app leaderboard can change.
Solana’s App Layer Is The Main Story
SOL price is not really the center here.
The better story is that Solana’s application layer remains lively. Apps are competing for users, creators, fee flows, and attention. That is exactly what a healthy consumer crypto ecosystem needs, even if some of the activity is speculative.
For builders, this kind of rotation proves there is still room to challenge incumbents.
For traders, it shows where capital is moving right now.
What To Watch Now
The next thing to watch is whether Fomo’s revenue holds up after the first surge.
If it keeps pulling traders away from Pump.fun, Solana may have a new app battle on its hands. If Pump.fun quickly retakes the lead, then Fomo’s flip still matters, but more as a sign of short-term rotation.
Either way, Solana’s revenue map is moving again.
And in this ecosystem, that usually means traders are awake.
This article draws on DeFiLlama Solana fee analytics and public Solana network data.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by Defillama. at Defillama
On August 23, 2026, an attacker used roughly half an ETH to acquire majority governance control over Term Labs Meta Vaults, then passed a routine-looking proposal that disabled the vault’s transaction delay and drained six vaults. No key was stolen and no core vault code was broken: with almost no one else voting, the attacker simply became the governance, extracting 2,841.74 WETH and 1,679,639 USDC, about $8.5 million, later swapped to DAI.
Protocol Background
Term’s Strategy Vaults are ERC-4626 vaults built on Yearn V3 infrastructure, governed through Aragon TokenVoting. Voting power isn’t tied to vault deposits directly: to get it, a depositor has to wrap their vault shares into a separate governance token, an extra opt-in step almost nobody took. A Zodiac Delay module was meant to sit between an approved governance proposal and its execution, giving roughly a week’s cooldown before anything it authorized could actually run.
Hack Analysis
Term’s voting power came from wrapping vault shares into a separate governance token, and almost no one bothered. On the ETH Meta Vault the total wrapped supply was just 0.5352 tokens, across the USDC vaults it was similarly thin. A depositor putting in about 0.5 ETH and wrapping the resulting shares ended up holding 0.4852 of that ETH Meta Vault supply, about 90.7%, while a separate wallet held all of the active voting power across all seven USDC vault proposals it opened.
Because the minimum proposer voting power was set to zero, opening a proposal cost nothing beyond gas. The attacker filed a proposal titled Veto strategy vault parameter change, using the exact wording the curator used for routine parameter updates, so it read on the surface like an ordinary item up for a veto vote rather than an attack.
Underneath that title sat 17 actions. The first three reset the Zodiac Delay module’s roughly seven-day cooldown and expiration to zero and handed control of it to an attacker-controlled executor. The rest recalled capital from all four of the ETH Meta Vault’s real strategies, deployed a new strategy called Fixed Recipient WETH Exit Strategy, gave it a debt ceiling of uint256 max, and routed the vault's balance into it.
Six days later, with the voting window closed and almost nobody having voted against a majority the attacker already held, the proposal became executable. At about 06:25 UTC on August 23, the attacker called executeProposal(), recalling WETH from four strategies and pulling roughly 2,841.74 WETH out through the planted strategy contract.
Twenty-two minutes later, a second attacker wallet ran the identical playbook against five USDC vaults in a single transaction, where it held all of the voting power across every proposal it had opened on those vaults. That transaction drained approximately 1,679,639 USDC, which was later swapped into DAI.
Root Cause
This wasn’t a bug in Term’s core vault code. The root failure is that voting power depended on an opt-in wrapping step almost nobody took, so a deposit worth a few hundred dollars was enough to become the effective government of vaults holding millions, and that governance had the authority to disable its own safety delay.
The formal governance settings, a 50% support threshold, 5% minimum participation, and a roughly six-day voting window, weren’t reckless on their own, but they meant nothing once one wallet held almost all the active voting power. A zero minimum proposer-power requirement meant opening the proposal cost nothing, and the proposal’s own opening actions could reset the Zodiac Delay module’s cooldown and expiration to zero, removing the one control meant to slow exactly this kind of action before it executed.
Whether the delay module’s exposure to governance was an intentional design choice or a distinct authorization failure hasn’t been publicly explained.
How QuillAudits Governance Review Could Have Prevented This
Governance participation and concentration monitoring. A review should flag when a governance token’s actively-wrapped supply is thin enough that a small deposit can cross a majority threshold, and require a minimum active-participation floor before proposals gain force, not just a percentage-of-supply threshold.
Scope-limit what governance can touch. The Zodiac Delay module existed specifically to slow dangerous actions, but the same governance process could reset its own cooldown and expiration. A review would flag any proposal-executable action that can modify the safeguard meant to gate proposal-executable actions, and wall that off behind a separate, higher-friction control.
Title and content review for proposals, not just code review. A malicious proposal disguised as a routine curator veto item passed unnoticed for six days. Requiring a structured, machine-checkable diff of what a proposal actually changes, surfaced independently of its title, would have caught the delay-module reset regardless of what the proposal was called.
Funds Flow After Attack
2,841.74 WETH and 1,679,639 USDC(swapped to DAI) drained from the vaults converged at a single address, 0xD5183d8BfC65a50863C62aF2538198A8288FFc13.
Stolen USDC was swapped into DAI and then transfer to another address 0x9210130f81c84d028DB83701fF379A79c9365135, and then swapped to ETH and deposited into tornado cash.
Since then, major ETH didn’t moved from attacher wallet, 300 of it moved out of the consolidation address to 0xC14007663A5bb9F13d4d2AEE8c6FE9075eF1d83e, and deposited to tornado cash.
Post-Attack Mitigation
Term Labs posts its first public acknowledgment, confirming a governance exploit hit its vaults, without giving a loss figure or technical explanation.
Term Labs follows up, confirming all Term Meta Vaults have been shut down and their DAO governance roles revoked, an irreversible step that blocks new deposits while leaving withdrawals open.
No key was stolen and no line of core vault code was broken. Almost nobody wrapped their shares into Term’s governance token, so a deposit worth a few hundred dollars was enough to become the majority, and that majority had the authority to disable the one mechanism built to slow it down. The vault executed exactly what its governance authorized, the governance itself was the vulnerability. A safeguard that governance can switch off isn’t a safeguard, it’s a formality waiting for someone to notice nobody’s watching.
The cloture vote, the CPI print, the FOMC decision, and the SEC’s 24-hour trading roundtable all fall in the same 10-day window. The outcome will shape crypto regulation for the rest of the decade. The United States Senate has 14…
Login
