To the latest edition of DeFi Roundup, where we save you time by filtering the market and separating the signal from the noise. You don’t have to spend all week scrolling Crypto Twitter to stay current.

Market Context

U.S. spot bitcoin ETFs saw $1.26B of net outflows for the week ending May 23 which was the the worst week since late January…

Read more

What a difference a week makes: Hyperliquid is up over 30% since capturing nearly all yield from USDC deposited on the platform (see our recent coverage). Bitwise and 21Shares also launched spot HYPE ETFs this month.

The fully diluted value of the top decentralized exchange’s HYPE token has now flipped the equity value of Coinbase stock COIN 2.38%↑ (~$60B vs $51B).

It’s time for a victory lap. A DeFi product built from the wreckage of the FTX collapse - when DeFi was declared dead - has now exceeded the value of its largest US-listed competitor. And for many of our readers Hyperliquid has special significance due to our early participation in the points farming program and the record breaking airdrop.

Read more

The Clarity Act cleared the Senate Banking Committee on a bipartisan 15-9 vote. It is advancing toward a full Senate floor vote while lawmakers negotiate merging it with a separate Senate Agriculture Committee version.

A lot of focus has gone into the yield component of Clarity, but what about our beloved altcoins?

Global crypto market capitalization is about $2.65 trillion today, Bitcoin dominance is ~58%, and the implied crypto market excluding Bitcoin is ~$1.1 trillion. Stablecoins are about $323 billion of that. Ethereum still dominates DeFi and stablecoin liquidity, Solana and Base are major app and onchain trading venues, Tron is essentially a stablecoin settlement chain, and Hyperliquid is the major onchain perps liquidity venue.

In other words, altcoins are no longer just one market.

Today’s altcoin market includes:

• Stablecoins like USDT and USDC

• Layer 1 tokens like ETH, SOL, BNB

• DeFi governance tokens

• Oracle network tokens like LINK

• Multi-faceted tokens like HYPE

• Memecoins

• Privacy coins

• Low float tokens with large paper valuations

• Airdropped tokens from points campaigns

• Tokens attached to apps, games, NFTs, real world assets, etc

These token types have very different regulatory and economic risks. The House and Senate versions of the Clarity Act differ significantly on agency jurisdiction, decentralization rules and banking sector involvement.

A crypto project can sell a token to raise money. That original sale may look like an investment contract because buyers are putting in money and expecting the team to build something valuable.

Years later, that same token may trade on exchanges. It might be used to pay gas fees, stake, vote, access services, secure the chain, etc.

So what is it at that point? Is every secondary trade still a securities transaction because the original sale looked like a securities offering?

Or can the token separate from the original fundraising transaction once the network is live?

The House version of the Clarity Act leans toward the second answer.

If you only care about the single biggest implication it’s this:

If a House-style version were to be enacted, the fundraising method does not permanently dictate the asset’s legal status.

The SEC has historically relied on the Howey test to argue that if a crypto project sells a token to institutional investors or the public to raise money, that transaction constitutes an investment contract (and is therefore a security). Any subsequent trade of that token between independent users on a retail platform is treated as a securities transaction. This would leave exchanges at risk of lawsuits for operating unregistered securities platforms.

The House-passed version of the CLARITY Act introduces a statutory “firewall” between the investment contract (the capital raising transaction) and the underlying token(the digital asset itself).

The traditional securities law analogy is that selling an orange grove via an investment scheme can be a securities transaction, but the oranges themselves do not remainsecurities when sold down the line at a grocery store.

Secondary market intermediaries (exchanges, brokers, and Alternative Trading Systems) would be protected from being forced to register under traditional equity exchange rules just to list altcoin pairs.

This would provide legal certainty required for U.S. institutional market makers, custody providers and asset managers to deeply integrate altcoins into their offerings.

A token could start its life through a regulated fundraising process then eventually trade more freely if it qualifies as a network asset.

Issuer treasury sales, underwriter activity and capital raises would remain more regulated. The Senate version also adds explicit resale limits designed to prevent insiders from dumping large quantities into the public market over a 12-month period.

Today, token issuers with U.S. exposure avoid broad public sales and instead use private rounds, offshore structures, SAFT-like instruments, points systems and airdrops. A House-style Clarity Act would create a more defined exempt sale path for digital commodity offerings, with a four year window to mature into a decentralized or “mature blockchain system” and a $75 million rolling annual fundraising cap. The Senate version uses Regulation Crypto and allows the greater of $50M per calendar year for four years or 10% of outstanding asset value, with a $200M gross proceeds cap. A Senate-style final bill would still help but it would more likely produce a disclosure first launch process under Regulation Crypto, with semiannual obligations and explicit controls around insider sales.

The tokens most likely to benefit are the ones with a clear connection to actual protocol usage (like we’ve been writing about for years). Gas tokens, staking tokens, oracle tokens, and some governance tokens. Governance tokens are trickier, but the House version of the bill appears to treat governance rights as acceptable if they are tied to the blockchain system itself. In other words, voting on protocol upgrades is not the same as owning shares in a company (we would be surprised if this stance covered voting on issuer revenues).

Other winners are teams willing to document decentralization targets, token functionality, risks, insider holdings, issuance plans, and governance transition (this will likely come with significant costs - $$$ for crypto lawyers paid for by VCs!). Teams hoping to raise capital with aggressive price promotions and minimal disclosure would lose comparative advantage.

Secondary market clarity should reduce friction for circulating altcoins being listed on exchanges.

Airdrops could become more important

Airdrops remain a core part of the token launch playbook.

For readers who are new here: instead of selling tokens directly to the public projects reward users who used the protocol, provided liquidity, tested the network, or accumulated points.

Points are not automatically safer. A pure airdrop is different from a points program where users spend money, provide liquidity or perform “labor” (click buttons) because they expect a future token.

We have highlighted problems with this model before. Points campaigns can become fake engagement farms. Users often do things only because they expect a token. Teams do still create investment-like expectations even without selling anything.

But from a regulatory perspective airdrops may be easier to defend than public token sales if structured properly.

The SEC and CFTC have indicated that some airdrops, protocol mining, staking, and wrapping activity may fall outside securities offering treatment when there is no investment of money.

Clarity could make airdrops even more attractive. Projects would use private funding to build the network, then distribute tokens to users, contributors, and liquidity providers instead of selling everything to retail upfront.

That does not eliminate all risk though. If the team openly markets the airdrop as a way to get rich from their future efforts, regulators can still raise an eyebrow.

Economic value capture would shift

Clarity would likely push token design toward usage linked value capture and away from cash flow promises by the issuer. Under the House version, the safest large scale altcoin designs are those where demand comes from gas usage, staking, governance participation, service access, fee payment, validation incentives, or network effects. Designs that promise revenue sharing, interest, principal return, or quasi-equity upside from an issuer are more likely to remain securities-like. In economic terms, that means more emphasis on protocol utility and staking security and less emphasis on explicit dividends.

This would not kill value capture for tokens since they would still be able to direct value to tokenholders indirectly through fee burns, staking rewards, buyback/burn executed at the protocol level, governance over treasury expenditure, or rights to use scarce protocol resources. The old model of selling a token while overtly telling buyers it is a claim on the issuer’s future efforts and financial performance would go away. The Senate version points the same way but with more required disclosure about managerial efforts while they are ongoing.

Larger and more established tokens would get more listings, deeper markets, more institutional access, and better financing options. Weak tokens would be on offshore venues, low quality exchanges and speculative platforms.

Practical effects for launching new altcoins

The practical effect on new token launches is that the U.S. would become more viable, but not simpler. Founders would still need to choose entity structure, token rights, governance transition, disclosure practices, and exchange strategy carefully. Their lawyers would just have a more clear playbook and strategy to follow.

Below is our thoughts on the types of launches, in order of lowest to highest compliance burden:

• Fair launch with no treasury sale by the issuer (lowest)

• Airdrop or points-driven launch with active core team (medium)

• Public token sale to retail in the U.S. (high)

• Token with revenue share, debt-like, or yield rights (very high - likely treated as security)

Recommendations

For projects

Projects should assume that the easiest tokens to defend under a final Clarity regime will be tokens whose value is tightly tied to network use. Anyone who has been reading this publication knows we’ve been recommending projects take this approach since 2021. Policymakers seem to agree!

That means stripping out explicit revenue-share language, avoiding debt-like or fixed-return claims, documenting why governance rights are protocol-native rather than issuer-equity-like, and separating the financing of the development company from the economic role of the token itself. Teams should also build a formal evidence file for decentralization, insider allocations, lockups, token-release schedules, and the practical limits on admin-key control.

Projects that want U.S. access should also build for the likely compliance stack now: sanctions screening, wallet analytics where they run controlled infrastructure, clear offering-risk language, beneficial-ownership and insider-sale tracking, and a credible path to the maturity or decentralization milestone contemplated in the House bill or the end-of-managerial-efforts concept reflected in the Senate substitute and SEC interpretation. Airdrop-heavy launches may still be attractive, but only if the surrounding facts do not recreate the same investment-contract story that the airdrop is meant to avoid.

For investors

Don’t treat Clarity as a blanket bullish event for “altcoins.” We’ve been preaching asset selection for years. This will be asset-specific repricing of legal risk. Tokens with strong onchain usage, large secondary liquidity, clear network function, and fewer cash flow features are the most obvious beneficiaries.

Tokens with low float, heavy insider concentration and narratives built around price/treasury promotion instead of network adoption may struggle (good!). Our readers already know that market caps overstate actual usable liquidity in crypto, especially on low volume exchanges or meme coins.

As an important note: Clarity mainly helps inform whether a token is likely a digital commodity, its distribution, and where it trades. You will still have token unlocks, exchange insolvencies, and protocol failure risks to manage. Also, the existence of regulations does not mean bad actors will go away. Just look at the stock market!

Concluding Thoughts

Clarity isn’t going to create a universal altcoin boom. We’ll see a sorting mechanism take place with altcoins that resemble real network commodities gaining the most (since institutions will be able to participate more easily).

Tokens subject to legal ambiguity, equity-like tokenomics or offshore-only distribution models could lose relative ground. However, it is crypto after all. Whether or not the “shadowy super coder” segment of the crypto market remains significant will depend on the level of enforcement pursued against offshore exchanges and issuers.

If you want to avoid repeating the expensive mistakes that inexperienced crypto investors make every cycle, become a paid subscriber.

Subscribe now

Paid subscribers also get access to:

• All of our past posts

• Weekly Deep Dive Report

• A comprehensive bi-weekly DeFi Roundup

• Bi-weekly Q&A sessions with our team

Until next time..

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• We now have a full course on crypto that will get you up to speed (Click Here)

  • We offer the Prediction Markets module on a standalone basis (Click Here)

• Security: Our official views on how to store Crypto correctly (Click Here)

Read more

Today we’re going to dive into Coinbase’s Q1 2026 earnings.

Coinbase reported a $394 million net loss, which sounds bad until you realize they “lost” $482 million simply because the Bitcoin they own was worth less on March 31 than it was on January 1. What we really care about for Coinbase is the money they make or lose based on their core operations. Hence companies use “Adjusted EBITDA.”

Key Financial Highlights

• Total revenue fell to $1.41 billion from $1.78 billion in Q4 2025 and $2.03 billion in Q1 2025

  • Transaction revenue remained the largest revenue line at $756 million, but fell 40% year YoY, showing Coinbase is still exposed to trading activity despite the Everything Exchange narrative

  • Subscription and services revenue of $584 million was 16% declined QoQ and 13% YoY; more resilient than transaction revs but still down significantly

• GAAP net loss was $394 million

• Adjusted EBITDA of $303 million down 46% from Q4 2025, and down 67% compared to Q1 2025 (peak market activity)

• Spot trading volume fell to $202 billion, assets on platform fell to $294 billion, and MTUs declined to 8.2 million. However, the company states they are at an all time high in crypto trading market share (essentially gained market share in a down market)

• Record average USDC in Coinbase products of $19 billion

• ATH in institutional loan balances

As we highlighted in our Deep Dive last year, Coinbase is looking to grow beyond retail trading cyclicality to a business with more reliable/predictable/stable revenue. They are making bets on adjacent businesses (USDC, Base, institutional products) that keep users transacting inside of their ecosystem.

The old crypto exchange model worked like this:

• Retail users showed up when prices went up

• These users traded spot crypto at very high fees

• Then after losing money to the eventual market crash they disappeared

• Exchanges were left with a bloated cost structure built to service users that are no longer active

Coinbase is trying to rework this model and keep the user inside the Coinbase ecosystem and own more of their financial activity. Stablecoins are their mass adoption play, Coinbase One is their subscription service play and Base is their onchain play.

Autist note: Every financial app eventually adds more products. That’s not the main takeaway here. Coinbase wants to move away from being *transaction* driven to driving value from *balances*. Coinbase believes they hold 12% of the world’s crypto, which means there’s a lot of value that can be unlocked beyond transactions.

Revenues dropped alongside a weaker crypto market but it is also an explicit transition year where the company is working toward a different set of economics. In Q1 2026, retail derivatives annualized revenue exceeded $200 million, prediction markets reached a $100 million annualized revenue run rate in March, and non-crypto contracts such as silver, gold, and oil grew more than 4x quarter over quarter.

One major consideration is Coinbase’s role as the default institutional custodian for U.S. spot crypto ETFs. Coinbase said it continued to custody over 80% of U.S. BTC and ETH ETF assets in 2025, while its 2024 annual report noted that 9 of the 11 approved spot Bitcoin ETF applications and 8 of the 9 Ethereum ETF applications partnered with Coinbase. This likely gives Coinbase high visibility into institutional flows/activity and supports stronger relationships for attaching new institutional products.

On May 5, 2026 Coinbase announced a restructuring plan where it shed 700 employees (~14% headcount reduction to 4,300) due to market conditions and “AI”. The company is guiding towards a lower fixed cost base on a go-forward basis.

Coinbase is experimenting with “single-person pods” in which a single human acts as an engineer, designer, and product manager combined using a fleet of AI agents. One person becomes responsible for the entire development cycle end-to-end. Roughly 40% of Coinbase’s daily code is written by AI. Coinbase is essentially trying to solve for a much higher revenue per employee and increase shipping velocity. In an industry like crypto where nearly everything gets copied and pasted as soon as it finds product market fit, being able to ship and iterate fastest can be a competitive advantage.

There has been a lot of chatter in recent weeks around Coinbase’s headcount reductions and fee compression from TradFi competition. We had already expected all of this 6 months ago as per our “Future Outlook” section in our Coinbase Deep Dive:

Coinbase’s advantage could narrow as more competitors (including from TradFi) start popping up to take a piece of Coinbase’s business.

The resulting effect would likely be fee erosion. Transaction fees are likely to come down (good for users!) as more exchanges compete.

…

Coinbase is planning to slow down on opex / headcount growth next year, which could mean they’re expecting a slower year in crypto or one that is more representative of a mature market.

If you’re tired of feeling like you’re behind the ball in crypto, become a paid subscriber.

Subscribe now

Fee compression will be a more dominant factor 1-2 years out. Providing crypto spot trading will become a commoditized service. Coinbase has to continue to enter and corner new crypto market segments, ideally where tradfi competitors will be slow to play in longer term. Coinbase does have some customer stickiness because the crypto market still operates on hype cycles. When crypto is popular again people will quickly hop to the platforms they already have familiarity with and are not going to be that fee sensitive. Past marketing spend and user acquisition pays off across cycles at least until TradFi crypto trading has both widespread usage and access to a wide range of tokens.

Base

Base processed 62% of total global onchain stablecoin transaction volume in Q1 2026, exceeding all other chains combined. Coinbase’s earnings deck shows total stablecoin transaction volume by chain of $22.4 trillion, implying roughly $13.9 trillion of adjusted stablecoin transaction volume on Base. Base stablecoin transaction volume grew 10x year over year which demonstrates Coinbase’s commitment to an onchain-enabled model. Coinbase also saw a QoQ increase in DEX trading volume driven by native DEX integration inside the Coinbase app.

We are glad Coinbase is finally treating Base as a serious asset and a centerpiece of its business rather than trying to convince users to “coin everything” in pursuit of higher transactions onchain.

Key Risks

While the company is shifting towards less cyclical uses (primarily stablecoins) it’s still reliant on crypto retail activity for its core business. A meaningful portion of revenue is tied to crypto prices and volumes. Its initiatives have changed the mix of the company’s financials somewhat but the crypto market will still drive performance. Many of the company’s strategic initiatives today will have delayed or indirect payoffs. AI agentic activity is (in our view) a longer dated payoff and the company’s claim that “Coinbase is the settlement, distribution, and commerce layer for agents” is premature.

Shifting to an AI-heavy workforce and codebase suggests more risk for a company that has previously been unable to secure its user data. Having 40% of your code generated by AI and managed by “single-person pods” creates an enormous surface area for security vulnerabilities. In the past attackers have used bribed contractors to access names, emails, phone numbers, and even government ID images. This data was then used to craft highly convincing spear-phishing attacks. Frankly, learning this about a company that holds 12% of global crypto assets is not inspiring confidence.

Thankfully crypto is the solution. Custody your own coins!

Also, while we are bullish on the stablecoin sector, Coinbase’s performance will become increasingly exposed to interest rate risk. If the Fed cuts rates a large chunk of revenue disappears. That said, the stablecoin market still has room to grow so this may not end up being a problem relative to current scale.

DeFi Ed’s Q1 2026 verdict: Coinbase’s reported numbers were weak, as we would expect for a cyclically weak quarter in crypto. Their pursuit of the “Everything Exchange” business model is in full force. The inevitable fee compression will take time, and we’ll be monitoring closely to see how well its strategic initiatives scale to offset compression in its “old” business model. In practice some level of fee compression is already occurring as customers shift to using Advanced Trading and Coinbase One, which have lower fees than the simple retail trading interface.

That’s all for today!

If you’ve enjoyed this coverage and want to more posts every week, subscribe today.

Paid subscribers also get access to:

• All of our past posts

• Weekly Deep Dive Report

• A comprehensive bi-weekly DeFi Roundup

• Bi-weekly Q&A sessions with our team

Until next time..

Subscribe now

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• We now have a full course on crypto that will get you up to speed (Click Here)

  • We offer the Prediction Markets module on a standalone basis (Click Here)

• Security: Our official views on how to store Crypto correctly (Click Here)

Time flies - today is the latest DeFi Roundup.

The last month has been good news for everyone who still owns computer coins (you!)

Crypto had been lagging other risk assets but has put in a strong catch up these last few weeks as the final piece of regulatory uncertainty - banks stonewalling the critical Clarity Act - gives way to a clear c…

Read more

Plate spinning relies on continuous movement - the plate must spin fast enough to prevent gravity from overcoming its stability. Each plate stays stable only while it has enough rotational momentum, so the plate spinner has to keep revisiting each one otherwise it slows down and falls.

Yes we are talking about (Micro)Strategy.

Today we deep…

Read more

The question on every crypto executive’s mind is how AI based cybersecurity tools - offensive and defensive - will change the security posture of the crypto world.

April was a near record breaking month for number of successful crypto attacks and the total value stolen.

Today we’ll cover Anthropic’s Mythos and Glasswing projects, infrastructure, and smart contract security so you can understand which aspects of crypto have become more secure and which are more vulnerable.

Can The AI Companies Do Security?

For amusement we’ll first briefly cover the security posture of the self-appointed AI “safety” company.

On March 31, 2026, Anthropic’s Claude had its complete proprietary source code accidentally published to the public Internet via a source map file included in the production npm package. The map file referenced a publicly accessible Cloudflare bucket containing the full source archive.

This is 101 level cybersecurity.

Then we discovered that Anthropic “moves fast and breaks things” rather than engineers highly secure code - 3 shell injection vulnerabilities in the leaked source code. In laymans terms: people running Claude could have had their computer exploited. For more on this see Phoenix Security article:

Then the Mythos project itself was supposed to be secret, until someone (or some AI agent?) at Anthropic misconfigured security on a server and the project notes were made public, forcing the Company to announce sooner than planned.

Ironically Anthropic believes its tool “presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders.” Citing this reason, the model is withheld from the general public and is being shared with tech companies of systemic importance in an effort to help them discover and patch flaws in their software ahead of the blackhats. At least this is the story we are being told…

Finally Anthropic’s own models present a cybersecurity risk. From the Mythos system card:

Across a number of instances, earlier versions of Claude Mythos Preview have used low-level /proc/ access to search for credentials, attempt to circumvent sandboxing, and attempt to escalate its permissions. In several cases, it successfully accessed resources that we had intentionally chosen not to make available, including credentials for messaging services, for source control, or for the Anthropic API through inspecting process memory...

In [one] case, after finding an exploit to edit files for which it lacked permissions, the model made further interventions to make sure that any changes it made this way would not appear in the change history on git...

Last year we had already reported that AI tools were prone to these security issues.

Engaging in unauthorized activities AND covering its tracks to avoid detection.

So in short we probably can’t trust the AI company, the governments it answers to, the security of the software it writes, or that the “agents” it creates will run in an “aligned” way and not present their own cybersecurity risk. And the AI companies are training the models to get better at offensive capabilities, with the most capable hostile modules available for use by tech giants who arguably have too much power.

Red Team Was Here

We made two predictions on DeFi Education about AI x security which now seem too obvious (in hindsight) to be cited as predictions:

1. AI would lead to the proliferation of insecure code; and

2. AI would be a force multiplier to scan codebases and systems for exploits at scale

We think the first prediction is more interesting and elaborate as follows:

• inexperienced developers can now leverage AI to ship products while minimizing the gaps in their knowledge and experience

• the management layer and commercial pressure prioritizes “efficiency” and speed of shipping features over security for almost every industry for which software is written (with the obvious exceptions - regulated, safety critical, etc)

• misconception that software security can be replaced with “ask the AI to run all the security checks” - this will catch trivial bugs, while elite hacking teams supported by leading edge or even custom AI models find decades old flaws in widely deployed core libraries (e.g. Linux servers which run half the corporate ‘net)

The second prediction is the focus of today’s post - and Anthropic agrees with us!

AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.

Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser. Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely. The fallout—for economies, public safety, and national security—could be severe. Project Glasswingis an urgent attempt to put these capabilities to work for defensive purposes.

This needs to be read for what it is - marketing hype around a grain of truth. Yet the grain of truth is very real. For now, defenders appear to have a marginal advantage because detecting an exploit is easy, fixing it can be easy*, but exploiting it can be harder and carries costs (risk of detection etc). So assuming a level playing field where attackers and defenders can access cutting edge AI, defenders should be able to patch before blackhats can exploit. In the general case. Keeping the state of the art models accessible only by defenders of systemic importance is logical.

* - this assumes software under active development by a well resourced team where AI can be part of the development process - defenders are at a disadvantage in legacy code, embedded systems, etc. Most of crypto is actively maintained. Your IoT dishwasher chip: not so much.

Marketing hype aside, Anthropic’s assessment of the sophistication of the new model in finding exploits and being able to engage in multi-step attacks is directionally correct. Government departments which study AI safety also agree:

we built “The Last Ones” (TLO): a 32-step corporate network attack simulation spanning initial reconnaissance through to full network takeover, which we estimate to require humans 20 hours to complete. Claude Mythos Preview is the first model to solve TLO from start to finish

This multi-step cyberattack capability is directly relevant to crypto. An attacker might use a combination of social engineering attacks and technical vulnerabilities to compromise a DeFi frontend. Then malicious code needs to be inserted to inject permit/sign requests, either to all users or to switch out a specific high value transaction (as with the hack of Gnosis Safe’s frontend to drain ByBit’s cold wallet).

Or a specific DeFi vulnerability may need a multi step approach, for example performing MEV, flash borrowing assets, manipulating an oracle, or deploying a custom smart contract as part of a live exploit.

To understand the real threat to crypto we need to move beyond thinking of smart contracts and frontends as isolated targets and recognize that all the infrastructure - from servers which hold keys, provide bridging or validating services, through to the computers the end users use to sign transactions are all legitimate targets, and often vulnerable ones.

Where Crypto Security Gains With AI

The biggest gain is smart contract auditing. Subtle bugs have taken down large projects. Newer/smaller projects cannot afford good audits. For code which is written and deployed once after thorough AI-assisted / human in the loop auditing we have a far higher chance of the code itself being secure.

An analog to the Lindy effect could hold that high value smart contracts which have not yet been drained in the post-AI script kiddy world are likely to be resistant to future exploits.

A secondary gain is user education. An AI tool can be used to assess “is this proposed transaction safe”, reducing complexity from users not understanding how to verify transactions before signing. This doesn’t substitute for real knowledge but it makes the knowledge faster and cheaper to acquire. Lower quality projects can be “outed” as insecure by casual users running ChatGPT queries. There aren’t enough hours in the day for ZachXBT level experts to flag every fraud, slow rug pull, and just poorly written code.

Intelligence Agencies Will Likely Lean Towards Patching Over Exploiting

There’s a technical gap in cybersecurity skill between the US (and some allies) and, broadly speaking, the rest of the world. This led to a policy which resolves what happens when the government discovers a vulnerability. If they leave it unpatched, it could be exploited against American interests. If they work with the vendor to patch it, they lose the ability to exploit it (abroad). The decision turns on assessment of enemy credibility - if “nobody but us” can exploit, then the exploit is allowed to remain. If foreign threat actors - including AI assisted ones - can or may be able to exploit then the NSA will disclose the exploit responsibly so the vendor will fix.

Where Crypto Security Loses With AI

Crypto depends on endpoint security: web servers (DeFi frontends), application servers (bridges, cross chain messaging, nodes), private key security and development credential security. Anything which makes it easier to hack computers and phones generally can be leveraged against crypto specifically. Any zero day exploit affecting a browser or operating system is a foothold in a campaign to steal crypto assets.

High value smart contracts are likely written correctly and not exploitable. AI is a force multiplier for defenders enabling far more sophisticated audits at lower cost. However there are many lower value smart contracts which are worthwhile to attack as the economic cost of the attack is driven down by AI.

The lower hanging fruit will be attacks on infrastructure (frontends and server), and social engineering. Going forward we will see more sophisticated campaigns including planting mole employees.

And AI assisted deepfakes make social engineering attacks significantly easier.

What’s Next?

Although April was a record breaking hack month there’s little evidence this is due to AI tooling being used to exploit bugs at scale. That’s for the future. It’s also possible that the leak of Claude Code source code in March has allowed black hats to build a Claude-level AI which could be asked to search for exploits without the ability to refuse based on guardrails or inform to Anthropic. Expect increasingly sophisticated attacks across the board. This is why defense in depth remains important:

• learn how to inspect and understand transaction data before signing

• ensure you always use a hardware wallet

• continue to educate yourself about the latest crypto exploit patterns

If you’ve enjoyed this coverage and want to access in depth cybersecurity advice, including Q&As with our team, subscribe today.

Subscribe now

Paid subscribers also get access to:

• All of our past posts

• Weekly Deep Dive Report

• A comprehensive bi-weekly DeFi Roundup

• Bi-weekly Q&A sessions with our team

Until next time..

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• We now have a full course on crypto that will get you up to speed (Click Here)

  • We offer the Prediction Markets module on a standalone basis (Click Here)

• Security: Our official views on how to store Crypto correctly (Click Here)

MegaETH recently launched its platform “Terminal” which serves as the points farm for the ecosystem. When you go to the site (terminal.megaeth.com) you are presented with a city map. Each location is an ecosystem app that you can interact with.

Unlike past chains where you could spray and pray across every dApp, MegaETH uses a weekly selec…

Read more

Most participants intuitively understand price. You’ve all seen vomit inducing red candles in crypto.

However, the post-top phase of crypto cycles has a a much more effective (albeit slower) weapon for freeing you from your coins. Time capitulation. The 6 month period where seemingly nothing happens. The volatility that brought you to crypto disappears and your Twitter feed gets quiet.

The “experts” who were posting 100x gains pivot to AI. People forget about crypto bull markets. They also forget the euphoria they felt, and the painful lessons they learned from buying the top (this is a good thing for the astute readers staying plugged in).

Big players love this phase because they can accumulate leisurely without competing with frontrunners. When you find yourself checking the price only once a week instead of once an hour, you are in the middle of time capitulation.

A lot of noise is made in crypto about tops, bottoms, and the cycle. However, we don’t spend that much time in the tops and bottoms. Most of your time is the “in between” period where most people aren’t able to make sense of what’s happening. Today we’ll explain the “post-top” phase of the crypto cycle.

The Cycle Continues

First off, the cycle pattern continues if you consider November 2021 as the end of the 2021 cycle instead of May 2021 (we do).

Bitcoin made its final cycle high on November 10, 2021 near $69,000. In 2025, Bitcoin again peaked in early October, this time above $126,000, before the market suffered the largest liquidation event in crypto history a few days later. Bull markets end quickly and viciously. The post-top repricing takes longer.

The December 2017 top to the November 2021 top was 1,424 days. The November 2021 top to the October 2025 top was 1,426 days. We’re not saying the four year cycle is law, just that it continues to matter to enough market participants to drive outcomes. The data is strong enough to continue to take the cycle framework seriously.

The Mechanics

A very specific phenomenon occurs at tops. Long-term holders and smart money have finished distributing their coins to short-term holders and FOMOers. By the time the top is reached the percent of supply held by short-term holders is at multi-year highs. These weak hands have a high cost basis, little loyalty and ungrounded belief in the asset. This cohort may also deploy leverage, which means they can be sitting in a asset that is “flat” in price but is being taxed by funding fees. When they begin to panic sell they create the first leg of the repricing. Smart money isn’t interested in stepping in without a major discount.

With leverage at peak levels and major buyers sitting out, a small 5-10% dip in spot prices (easily caused by long-term holders taking profits) turns a selloff into a liquidation cascade.

The immediate post-top environment is a liquidity vacuum. In a parabolic rally the order book becomes top heavy. There are lots of market buy orders at the peak but few bid orders underneath because buyers are waiting for a dip that never comes (until it does). When it breaks the bid side of the order book is thin. A single large sell order can skip through multiple price levels because there isn’t enough capital waiting to absorb the selloff. We broke down the October 2025 crash in-depth here.

In this phase there is still opportunity. The market feels fast and exciting, just in the opposite direction. It’s like you left a big party. You know you drank too much. But you’re still in the uber home. The hangover is yet to come.

The Boring Hangover

Think of the market as a series of cause and effect actions. There are people, institutions, and other entities with capital, together termed “market participants.” Their collective participation and perceptions of other participants shape the market. Markets are driven by both rational analysis and emotion. That means you have to be able to understand both logic and emotion to truly understand what makes markets tick.

After the initial crash, the market doesn’t just immediately bottom and go back to highs. This much is obvious to anyone watching BTC prices in recent months. When the initial selling peaks shorts cover positions and knife catchers will often cause a big bounce. Eventually though prices fall back to feel where sellers still exist. When prices start holding it can mean supply is starting to dry up. This is basically what occurred through Q1 as prices bouncing between big walls.

Remember how we mentioned that big players “distributed” their coins in the bull market (that big party)? That takes them some time! They went to the same party and didn’t drink much at all. They’re not hungover, they got up to prepare for a marathon. As bored retail players and non-believers exit their “dead” bags these institutions slowly absorb them while trying to make as little noise as possible. To crush the will of even true believers big players try to shake them out.

To resume the bull market all speculators need to be emptied of their coins. This takes time and pain. For those of you who have been through multiple cycles you will surely have experienced at least one cycle with brutal pain and losses. It’s by design.

What about altcoins?

When Bitcoin and Ethereum experience a post-top repricing, the altcoin market experiences a mass extinction event. During the party, money flows from BTC into increasingly speculative assets. This used to be “alt season” though we have held for years now that the alt season of the old days has now made way for a period of outperformance only for alts that have a) strong fundamentals or b) unique narrative that people are unable to value. As the cycle turns there’s no bid for alt coins. We do expect this to change with greater institutional access to crypto assets and there being more crypto assets worth holding. HYPE is a notable standout as an altcoin that maintained a bull market valuation in a bear market.

How to Survive

If you’ve already survived the crash the “hardest” part is over. Now you’re just in the most annoying part.

First things first, no hero plays or hail marys. If you’ve been running a 2024-style playbook you’ve probably already been separated from your capital well before the first letter was typed on this post. If not, here is your last warning. If you can’t see yourself holding your current positions for another 12 months you are overleveraged or in the wrong coins.

Then work backwards. For the coins you do hold work backwards from where you expect them to be in 6 months, 1 year, 3 years, and beyond. No this is not about price. List out the following beside each asset:

• Narrative (why will people care about this theme in the future?)

• Qualitative fundamentals (team, market leadership)

• Quantitative fundamentals if applicable (revenue, profit, TVL)

Let’s take Bitcoin since it’s an example everyone can understand.

• Narrative: People will always care about having an asset that exists outside the control of the state. Bitcoin is the best asset for this purpose. Therefore it looks good from a narrative standpoint for the foreseeable future (there are other strong narratives around Bitcoin but you get the point)

• Qualitative fundamentals: Largest, oldest crypto asset with institutional acceptance and cult following.

And so on.

Now you can think like an institution and focus on accumulating the few coins you’ve been watching that pass the standard.

In the mean time you can focus on getting your cash flow up so you have more investable assets for the next bull market.

No matter how hungover you are the sun will rise again and you will be fine. Just remember not to drink so much at the next party.

Until next time..

This is a free post. Sign up to the paid sub for market takes and deep dives on specific tokens.

Paid subscribers also get access to:

• All of our past posts

• Weekly Deep Dive Report

• A comprehensive bi-weekly DeFi Roundup

• Bi-weekly Q&A sessions with our team

Subscribe now

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• We now have a full course on crypto that will get you up to speed (Click Here)

  • We offer the Prediction Markets module on a standalone basis (Click Here)

• Security: Our official views on how to store Crypto correctly (Click Here)

To the latest edition of the DeFi Roundup.

Reminder: there is no bull market or bear market, there is just the market. A $2.4 trillion market in the case of crypto. Sun or shine, there are tectonic shifts happening in crypto that will influence the rest of the world.

Market Context

Risk markets continue to climb the “wall of worry” following…

Read more

If you’d stumbled into the financial industry 15 or 20 years ago you’d have been shown the way with lessons from legacy investors like Warren Buffett or Stanley Druckenmiller. Today new investors likely turn to their Tik Tok feed. As access to financial markets became cheaper, easier, and more popular as a result of online education, trad…

Read more

Paid subscribers to DeFi Education have been following our close coverage of major changes at the Aave DAO over the last six months.

In a nutshell the founder elected to leverage control over key Aave brand assets like the domain and frontend to essentially take the protocol private. The first decision in the new regime was to redirect a key revenue source away from the DAO towards privately held Aave Companies. This led to a substantial drop in the value of the governance token AAVE.

Entities linked to the founder and Aave Companies control a large share of the governance tokens, and so were able to vote for (despite the obvious conflict of interest) a proposal to grant themselves a significant budget from the DAO in return for redirecting revenue back to the AAVE token. The long term key contributors to the Aave ecosystem then saw no clear path forward for Aave as a DeFi DAO and opted not to renew their service agreements.

As the demand for leverage reduced substantially after the recent crypto bull market we formed the view that the risk/reward of depositing on Aave was no longer favorable for us. Stablecoin yields were substantially below the USD risk-free rate (treasuries). Investors with idle stablecoins and access to low friction fiat on/off ramps could deploy their capital for greater returns elsewhere, even in TradFi (tbills).

Core contributors exiting means the protocol loses much of the institutional knowledge which was necessary to keep the protocol secure- another point we flagged.

Last weekend another 9 figure DeFi hack associated with North Korean hacker groups targeted a liquid staking protocol via a bridge exploit. This LST token had been onboarded as collateral on Aave, and had e-mode enabled allowing the stolen tokens to be used as collateral for 90%+ LTV loans of native ETH.

The first order consequence was bad debt, the second order consequence was a bank run which exhausted available liquidity on Aave. Under conditions of 100% utilization no lender may withdraw from a pool and liquidations would not be processed.

This is a major setback for DeFi’s reputation and we’d argue the root cause is governance failures in allowing a wide range of collateral quality to benefit from high LTVs. The original DeFi bank, MakerDAO, issued loans backed only by pristine collateral: ETH. Accepting a wider range of collateral brings more utility (and revenue!) but also increases risk to lenders. While there is a place for higher risk higher reward opportunities (e.g. in 2021 Spell was MakerDAO for risky alts), Aave was a respected, battle tested protocol and the average user probably had more confidence in the DAO’s collateral due diligence process than was warranted.

It’s clear in hindsight that the addition of each new collateral introduces systemic risk.

And it’s especially clear that many collateral types have a very complex chain of dependencies. Some technical, some legal (e.g. RWA tokens). It’s very hard for users and even DAOs with risk management specialists to truly understand all the risks.

So what can you do about this? And where are the opportunities?

Today’s post is going to cover:

• details of the original hack and why Aave was impacted

• second order effects when there’s a run on deposits and no liquidity

• what readers can do to better assess their risk and protect their investments

• business opportunities arising from the technical threats in DeFi

1) What

On April 18 a hacker group exploited a vulnerability in an Ethereum restaking protocol’s cross chain bridge (Kelp which uses Layer Zero messaging protocol). Kelp had configured their Layer Zero integration with a 1/1 DVN with LayerZero Labs as the sole verifier, a configuration which Layer Zero formally recommends against but had continued to support, including as a default configuration in documentation. All support for 1/1 is being withdrawn after the Kelp exploit.

In the future there needs to be better due diligence on “supported” configurations which are not recommended and a protocol’s choice to use such configuration should carry economic consequences - whether this is exclusion from certain lending pools or a higher rate of interest

There was no second verifier in the configuration to reject a forged message. This is a rejection of the software security principle “defense in depth” and it’s something the Aave DAO’s risk analysis overlooked completely when onboarding rsETH collateral.

A Lazarus-linked threat group were able to poison the RPC infrastructure used by the LayerZero Labs DVN. This was done by a combination of gaining unauthorized access to nodes, replacing their clients with compromised binaries; and then using a denial of service attack to take the majority of honest nodes offline, allowing the compromised DVN to confirm the forged transactions.

The forged message released 116,500 rsETH (Kelp’s ETH staking token) which the attackers were able to use as collateral to borrow WETH on Aave. This should result in rsETH being ~18% unbacked.

Layer Zero “omnichain fungible tokens” OFTs have a shared unified supply. rsETH holders (of whichever token on whichever chain) have equal redemption rights(ranking pari passu) according to issuer documentation. This suggests that losses will need to be socialized across all holders including Aave pools - there is no legal carve out to treat only the L2 bridge assets as unbacked.

Aave’s LST looping and e-mode

In January Aave governance added rsETH to e-mode:

The Aave Core market has recently experienced significant ETH inflows, increasing the available supply and lowering utilization. Maintaining a healthy utilization rate on WETH is crucial for protocol revenue and lender incentives.

rsETH is a liquid staking token issued by Kelp, already proven across Aave deployments as a robust collateral asset. Currently, rsETH suppliers on the Core instance can only borrow stablecoins and access the LST E-Mode, which limits their leverage strategies.

By adding WETH to the rsETH/LST E-Mode, the protocol unlocks classical rsETH/WETH yield maximising loops, historically one of the largest sources of borrowing demand on Aave.

Previous governance discussions had surfaced absence of a critical timelock and more general centralization risk at Kelp:

LRTManager permissioned function: The Kelp External Admin (6/8) is whitelisted as the LRTManager, which can updatePriceOracleFor without a timelock. This centralization could lead to mistakes or malicious actions that could brick the protocol or cause a loss of funds….

KelpDAO remains very centralized, with the development team having significant power over contract upgrades, protocol parameters, and total control over the off-chain services needed for minting and withdrawals to work correctly. There is no DAO nor governance tokens. Communication mediums for users exist, including Twitter, Telegram, and Discord, but they mostly serve marketing and support purposes….there is no clear path to decentralization

Nowhere in the risk analysis was a consideration of the actual exploit vector: the LayerZero bridge module. This tends to show the limits of the template based risk analysis that the Aave DAO were using when considering new collateral. In this case the risk template covered issuer centralization but not bridge/messaging layer configuration. The 1/1 DVN issue wasn’t in anyone’s collateral risk template.

In reality Aave purports to be a decentralized protocol but it inherits technical and centralization risks from supported collateral. E-mode amplifies these risks. The risks weren’t understood by the risk assessors or disclosed to lenders. This has to change.

E-Mode

“High Efficiency Mode” allows loan markets for correlated collateral e.g. stablecoins and Liquid Staking Tokens to have very high Loan to Value ratios, often above 92% compared to e.g. 70% for other markets.

This is a business decision to drive revenue by allowing highly leveraged trading strategies which are particularly vulnerable to depegs, including in the scenario where unbacked tokens exist (either unbacked tokens are generated by an attacker using a minting bug, or backed tokens become unbacked e.g. collateral is stolen from a lock-and-mint type bridge, as in this example).

Consider ETH. The max loan-to-value on Aave for Lido’s liquid staking product is 79%. However, if the wsETH is deposited as collateral for an ETH loan under e-mode the depositor can borrow up to 93% of face value in real ETH.

Aave Liquidity

Loans on Aave are for an indeterminate term. It is the borrower’s choice when to repay. “If” to repay is controlled by the interest rate. If a borrower makes no loan repayments the accrued interest will eventually push the position into liquidation, returning the borrowed asset to the pool as the collateral asset is sold to repay the debt.

Aave’s smart contract algorithms monitor the utilization of pools - total amount borrowed / total amount made available by lenders - and the price of the loan is configured to increase with demand. In theory, borrowers have some maximum carry rate they are willing to pay, above which they will redeem the loan, which will reduce pool utilization. Another factor is that raising the price of money attracts new marginal lenders willing to put capital to work to earn a higher return - this is especially helpful when the lending activity is judged especially risky.

These assumptions are based on economic theory, which tends to hold over the long term but can be distorted in the short term when other incentives - e.g. concern about solvency - prevail. There are some failure scenarios where the market does not clear. Imagine all USDC stablecoins in the Aave pool have been borrowed. A USDC depositor cannot withdraw their capital until either a borrower repays some USDC or a new lender deposits USDC into the pool. If this doesn’t happen the loan is not liquid.

This scenario triggered a “bank run” on Aave. If you had USDC which you couldn’t withdraw, the only other option is to pledge your USDC on Aave as collateral to borrow an asset which did have liquidity. Investors could use USDC in e-mode to borrow ~95% of the value of their deposit in USDT and withdraw from Aave. Everyone had the same idea, resulting in frozen funds being pledged to withdraw other assets, which increased utilization in those pools as well until nobody could withdraw/borrow any of the major assets on Aave, essentially freezing the protocol.

Liquidations are also impossible in a pool facing 100% utilization. This is a known protocol risk.

What Happens Next?

Aave - “nothing useful to say”

Coindesk reports it reached out to Aave’s founder Stani Kulechov who is said to have responded that he had “nothing useful to say” during a time when Aave’s main markets were locked at 100% utilization

Of the 116,500 rsETH received by the attacker, 89,567 were deposited on Aave.

Aave’s risk service providers are unable to definitively state the consequences for depositors:

Because loss allocation, recovery, and redemption mechanics remain subject to decisions external to Aave, and each materially affects the protocol’s exposure, a single definitive outcome cannot yet be established.

The open variables include the socialization boundary (whether the haircut applies to all rsETH holders or only those on the affected chains, which alone changes the per-token impact by roughly 5×), the size and timing of any recovery or recapitalization, redemption pricing (whether redemptions reopen at the pre-exploit rate, a post-haircut rate, or remain gated), and the treatment of rsETH minted via the compromised cross-chain bridge path.

The extent of bad debt on Aave is somewhere between $123.7 and $230 million.

This isn’t the first incident with Aave this year - the platform saw a spike in liquidations caused by a misconfigured price oracle for Lido wstETH.

It’s now clear that the Aave brand is damaged, perhaps irreparably. Just how damaged depends on how long the system takes to reach resolution and who bears the losses - e.g. how well did the umbrella module work and who suffered actual loss.

Aave’s TVL has fallen by a quarter since the incident began.

The perception now is that you can lend money in DeFi and be unable to recover your capital during times of stress due to liquidity constraints. DeFi has no central bank or lender of last resort as in TradFi. The biggest whales and the fastest acting participants rushed to withdraw leaving no liquidity behind for others.

There is no “withdrawal queue” as such, once utilization hits 100% withdrawals are on a real time basis where technically sophisticated participants who can withdraw within the same block as a new deposit or loan repayment. This means anyone navigating manually with a wallet is permanently at the back of the liquidity queue compared to automation. This isn’t an ideal user experience as the majority of deposited capital comes from manual participants who do not run automation.

User Behavior

The rational response for DeFi lenders is to switch to (or build - there’s an opportunity here) Aave competitors who are more judicious about risk. Improvements could include ring fenced lending markets backed by only the most pristine collateral for risk averse depositors and degen-style high risk offerings for everyone else. This incident has moved Aave’s design into the “degen” risk category. The front runner here is Liquity, but network effects are real in bootstrapping lending markets.

Some users will not understand the nuances and will consider all of DeFi unacceptably risky, withdrawing from lending markets entirely. This presents opportunities for the remaining sophisticated participants who can assess risk.

Related Business Opportunities

Anyone with a software development background will immediately notice that there is no standard for generating a “dependency graph” for DeFi interactions. Without a “point and click” ability to access the current dependencies and risks of DeFi in real time it’s impossible to know your full risk. This isn’t something that corporate and institutional (or even sophisticated retail) investors will tolerate forever.

The next phase of DeFi is likely going to be supported by professional risk assessment firms building tooling to provide such real time visibility. Protocols and DAOs will be expected to integrate this data in their pipelines in real time. Governance controls like Loan to Value parameters and acceptable collateral types will need to evolve to assess risk on a near real time basis supported by this intelligence. DeFi currently relies on point in time snapshots like single audits of software smart contracts or a single risk assessment exercise on collateral which doesn’t automatically update based on future technical and operational decisions taken by the issuer.

Blockchains provide real time visibility into transactions and AI based platforms can integrate other sources of data like oracle feeds, software code updates, and infrastructure choices and changes (e.g. the 1/1 DVN configuration). In the future an AI platform (or Layer Zero) can make an assessment that particular configurations are vulnerable and this information should disseminate into the market and update the price of loans and governance parameters on lending platforms.

We’d expect regulators to move towards a model which requires real time rather than point in time risk assessments and disclosures. And it’s possible that given the specialization required to do this correctly the function is better handled by specialist providers rather than built in house by each DeFi protocol.

There’s many possible approaches to solving this problem and we’d predict that there will be billion-dollar companies, protocols, or DAOs based on leveraging automation and cutting edge technology to provide fully automated real time risk analysis in DeFi.

How To Respond In Real Time

Always panic early.

If there’s rumor about technical or solvency risks to a protocol exit all of your positions immediately.

The cost of doing so in a lending market is your gas costs, and any trading fees required to square off your position (and replicate it elsewhere).

Those are fixed known costs. They should be considered the cost of doing business in DeFi where security risks are simply a cost of doing business.

Delaying withdrawals means risking the reality that liquidity to meet short term demands is consumed by other participants leaving your positions stuck.

Know Your Exposure

You should err on the side of caution, as you might not think your use of the protocol is affected. DeFi is complex and interdependent. If your only positions on Aave were stablecoins you might be forgiven for initially thinking that an exploit on another chain affecting an Ethereum LST would not affect you. A bridge hack of an ETH LST absolutely can affect your stablecoin deposit on Aave.

Aave deposits aren’t into an asset specific vault - there’s a general pool where all collateral is combined and all loans are drawn from. You’re a general creditor. The pool lends to all comers against all supported collateral and your share in the pool as a lender may take a haircut in a bad debt situation where Aave’s risk management (umbrella) has not been able to make depositors whole.

This is why it is so important to do thorough due diligence on every protocol. This means understanding all the factors: from the economic model, to the safety of the smart contract code, and most importantly all the dependencies. Unless you can trace through the whole system to understand that depositing USDC on Aave to earn interest actually exposes you to the Layer Zero bridge and the market price of Kelp’s liquid staking tokens you are running risks you are not aware of. This inherent complexity is why we started DeFi Education. The rewards in DeFi investing can be huge, but there’s no reward without taking risk. The best you can do is to educate yourself to only invest the best risk/reward opportunities - on average that works well.

Key Takeaway: Put Risk On In A Bull Market

Nobody should be taking high risk for marginal returns. DeFi is still risky. During crypto bull markets the risk of being aggressively invested in DeFi is justified by the high potential rewards. During bear markets when rewards are smaller, yields lower, and incentives to hack and exploit protocols (including inside jobs) are at a record high it is not smart to take on too much risk.

This doesn’t mean you disengage from the industry - it’s important to get a head start on what is going to be the next hot sector. Here’s DeFi’s “FTX moment” and it will create an equivalent opportunity.

DeFi’s FTX Moment?

Readers should pause to acknowledge the prevailing sentiments. Less than 6 months into a cyclical crypto bear market DeFi is being sworn off as dead / not fit for purpose.

In November 2022 all of crypto was being sworn off as dead / a scam. The issue was actually centralization risk which was highlighted by the FTX blowup.

While others departed, a small team were building a solution to the FTX problem. It was called “Hyperliquid” and made its early adopters rich in a few short years. Solving the centralized exchange custody risk problem was a decabillion dollar opportunity.

Solving the cyber threat problem, even partially, is at least a billion dollar opportunity. Huge rewards will go to the builders who tackle this problem and the investors who back them. DeFi does have a security problem which has so far proved intractable if the benchmark is “nine figure thefts should not occur / have systemic consequences for users of protocols which were not exploited”.

Looking at the data the attackers are becoming more sophisticated (supported by AI and state-level cyberoffensive capabilities) and it’s harder for an ordinary user to assess what is safe. But this doesn’t mean DeFi is unfit for purpose.

It means we need technical and behavior based solutions which counter the threat. Crypto is a multi-trillion dollar market which is maturing and attracting institutional investors. There is now a huge pool of capital willing to back solutions and a larger talent pool to draw from now that crypto has been “legalized”.

There’s probably never been a more opportune time to build something in the DeFi security space. Meanwhile DeFi investors should be less aggressive during bear market conditions, pass on low reward investments where assessing the risk is difficult/expensive, and continue to research the next opportunities.

Until next time..

P.S. this is a free post, sign up to become a paid sub for more posts every week.

Paid subscribers also get access to:

• All of our past posts

• Weekly Deep Dive Report

• A comprehensive bi-weekly DeFi Roundup

• Bi-weekly Q&A sessions with our team

Subscribe now

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• We now have a full course on crypto that will get you up to speed (Click Here)

  • We offer the Prediction Markets module on a standalone basis (Click Here)

• Security: Our official views on how to store Crypto correctly (Click Here)

This is a must read high level post on mobile device security given the increasing aggressiveness and sophistication of hacker groups. 90%+ chance how you are currently using mobile devices is putting you at risk.

Everyone has a different threat model and circumstances so we’re going to be opening this post up to an ongoing Q&A for anythin…

Read more

We would define the public’s sentiment today as financial exhaustion. Markets have been weak, the world is at war and climbing the ladder in a traditional career feels hopeless to most. Those hoping for a quick rebound in crypto markets have been let down and they have wrongfully checked out - which means more opportunity for us. Your dumbest friends aren’t asking you how to buy Bitcoin anymore (the smart ones should be).

If you’re feeling the urge to capitulate and walk away stop and take a deep breath. You’ve already made it past the worst. Join us on today’s post with fresh eyes as we look back into history for lessons on tech adoption and why this seemingly quieter period is setting crypto up for even more success over the coming decades.

The Nerd Phase

The early internet was weird, slow, hard to use, and mostly interesting to technical people. TCP/IP existed. Browsers like Mosaic existed. You could see the development of something important relatively early on. But normal people were not looking at a big beige box on their desk and saying this thing will reorganize every aspect of commerce, media, advertising, communications, software, and daily life. They were mostly saying how annoying this thing is to use.

If you pick the start of the internet to the ARPANET’s first message (Oct 29, 1969), the modern internet began as a technical research network not a consumer product. By the time many people first encountered the web in the 1990s the underlying networking work was decades old.

Internet usage was at ~399 million users in 2000, scaling to ~1.5 billion by 2008 and ~2.9 billion by 2014. More recently, the International Telecommunication Union 6.0 billion users in 2025.

Crypto experienced a similar pattern of early experimentation with the release of Bitcoin in ‘09 to the launch of Ethereum in 2015. It was clunky and arguably terrifying to use due to its associating with the dark web and largely populated by ‘shadowy super coders’ who cared about the tech.

Autist Note: This is why we always suggest dropping everything to figure out whatever the “weirdos and nerds” are most excited about. You can’t be early to new ideas when you’re viewing things from a mainstream perspective. Yes you’ll be wrong some times, but you only need to be right once or twice in your entire life when it comes to investing in early technology. If it’s “cool” and “prestigious” you’re too late.

Up Only

Every transformational technology in history has experienced a period of time where markets and the population collectively decide the rules of gravity and economics no longer apply. People can be directionally right about the tech and hilariously wrong about the timeline. In the late 90s this was “dot com.” In 2021 it was crypto. During these periods, institutions have thrown billions at pitch decks solely because they use the right buzzwords. Retail investors tend to pile in later on the hype.

In 1999, adding “.com” to your company name instantly doubled your valuation, regardless of whether you had a working product or a path to revenue. In 2021, throwing “Web3” “DeFi” or “Metaverse” into your marketing had the exact same effect. You could get funded for millions of dollars with no credibility or track record to speak of.

In 2022 the media said Sam Bankman-Fried was the “Next Warren Buffett” just like they made Jeff Bezos Time’s “Person of the Year” right before the Nasdaq collapsed.

Pets.com sold dog food online for a loss and was valued at over $300 million before going bankrupt within 9 months of its IPO. In crypto we had algorithmic stablecoins printing 20% yields out of thin air and jpegs selling for the price of a house.

In 2000, the Nasdaq crashed 78% and wiped out trillions in paper wealth, not unlike 2022’s crypto deleveraging that caused BTC and ETH to fall over 70% from their highs.

You’re surely familiar with this story by now. But what is often overlooked in this comparison is the importance of the years that followed.

Mourning the Death of the Internet

After the dot-com bust, some concluded that the internet itself was completely overhyped as a category. That should sound familiar. Every major crypto drawdown produced an obituary. Dead asset class, no real use case, bad reputation related to crime, etc.

These periods come with two primary benefits:

1. It discredits weak business models and forces their liquidation (many of the largest crypto companies in 2021 are no longer around for this exact reason)

2. It creates an environment where only improvements that survive in severe difficulty can compound (DeFi protocols that survived are far more stable today)

Quiet Progress

Between 2001 to 2005 users began to switch from dial up internet to broadband. By the end of 2005 the internet had crossed one billion users. The surviving companies were becoming operationally sophisticated and profitable.

The internet took 36 years (1969–2005) to reach 1 billion users. Crypto has reached an estimated 600 million owners in just 16 years (*active* crypto users are estimated at closer to 40 - 70 million).

The right combo of infrastructure improvements, user growth and companies that delivered what customers wanted at scale accelerated the distribution of the internet as a technology.

We consider the 2024 bull run somewhere between a hype cycle and genuine development. January 2024 brought SEC approval for spot bitcoin ETPs, March 2025 brought the Strategic Bitcoin Reserve executive order, and July 2025 brought the GENIUS Act for payment stablecoins. However, 2024 was also dominated by memecoin mania which was entirely speculative.

A lot of the progress since the 2022 washout has been easy to miss simply because it is less entertaining. Blockspace has gotten cheaper through Ethereum rollups and alt L1s. Stablecoin market cap is over $300 billion. Select crypto companies have become some of the most profitable in the world, proving out crypto native business models and scalability. Legacy financial institutions are tokenizing assets on public ledgers. Global payment processors are running their own nodes. This can be analogized to engineers laying thousands of miles of fiber optic cables under the ocean for faster internet.

The post-2005 internet era not only captured more users, it made the internet accessible to the average person. Payments felt more secure and simple. Search improved. Eventually there was a breakthrough (the iPhone) which turned the experience into something highly sought after - the internet went from a nice to have to a must have.

Looking Ahead

What does the post-2005 phase look like for crypto? The market has already experienced a drawdown magnitude comparable to historical tech washouts. Adoption as measured by ownership is large but habitual usage is small, suggesting there is still a major gap in usability and integration.

Furthermore, the post-2005 era for internet companies was not a broad win for every surviving website. Just like the internet, it does not mean that every chain or app token suddenly becomes the next Amazon. The “rising tide lifts all boats” era is largely behind us. You have to be in the right boat.

A maturing market does not reward every chain, every token, or every narrative. We’ve been saying this on this very newsletter since 2024 and this has proven out over this past cycle.

The main questions to ask are a) who owns the user and b) who owns the liquidity. There have been many attempts over the year to use crypto towards solutions for social media and the like, but time again crypto has proven to be most disruptive and useful for financial use cases. The “Googles” and “Amazons” in crypto are those that concentrate liquidity (exchanges, bridges, L1 networks, etc) to provide the best quality transactions for users.

For those of you that have been in crypto for multiple cycles, it’s important to make the shift and understand adoption does not happen when technology is most ‘ideologically pure.’ Products have to be good enough that normal people can use them without caring how it works under the hood.

People adopted the internet because eventually the things you could use it for became too useful to ignore. If you weren’t using the internet you were wasting lots of time and money!

Until next time..

P.S. this is a free post, sign up to become a paid sub for more posts every week.

Paid subscribers also get access to:

• All of our past posts

• Weekly Deep Dive Report

• A comprehensive bi-weekly DeFi Roundup

• Bi-weekly Q&A sessions with our team

Subscribe now

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• We now have a full course on crypto that will get you up to speed (Click Here)

  • We offer the Prediction Markets module on a standalone basis (Click Here)

• Security: Our official views on how to store Crypto correctly (Click Here)

Welcome to the DeFi Roundup. Important security reminder:

Drift (perps protocol on Solana) was recently hacked and depositors lost over a quarter billion dollars. If you’re new to DeFi be sure to read our coverage on this so you can avoid losing money in future hacks. Our long term readers were marked safe because Drift was centralized (te…

Read more

The year is 2035.

The cell phone which tracks you everywhere and is the only way to access your bank accounts, pay bills, and apply for jobs has required a government ID to activate since 2030. As part of the new law, every taxable transaction requires scanning a QR code which automatically copies the tax authorities.

Ethereum remains decentralized despite ETFs controlling 29% of supply. Metamask now tracks your IP address, mobile ID, and shares all your transaction data with the government (and 257 selected corporate partners).

Rabby wallet still exists, but is banned from the official Google, Apple, and Microsoft app stores. It can only be installed on unlocked devices, but possession of the debugging tools required to unlock a device is a federal crime.

Unlocked Pixel 37s from before the prohibition date are legal to purchase, but they cost upwards of $50,000 on the grey market. Even if you can buy a device, the information on how to set up your own Ethereum RPC server is hard to find - AI will inform on you for asking about it. There are 3 “legitimate” public RPCs run by Consensus, Blackrock, and the US Government. The only solution to access the uncensored chain is to be introduced to one of the elite hackers from the 2020s, willing to teach people the forbidden knowledge in person - for a price.

How might we arrive at this dystopian scenario?

Back in 2026, when there was time to do something about it, the signs were obvious.

Governments around the world were building an identity layer into hardware devices and digital services. Citizens already needed to show ID to even register a cell phone number in many countries. Within 2 years compulsory ID verification to use the Internet and social media went from a fringe position (we need to protect children) to actual policy in Southeast Asia, and then the rest of the world followed along.

In reality many of the benefits of DeFi simply evaporate if one is compelled to transact via hardware and software completely controlled by centralized corporation and over-regulated by governments. Crypto was born from a philosophy of resistance to state control over ideas, communication, knowledge, and money itself.

Just using crypto as a product isn’t enough to secure the freedom we’ve built. The community needs to apply decentralized principles to the digital devices, software, operating systems, networks, and AI tools which we rely on.

Today we’ll address how this is possible at a high level, followed by a deep dive on the specifics we’re taking to establish “decentralized tech” for our own DeFi and general purpose use. Our conclusion is simple: if you don’t control your hardware and software you are living on “borrowed privacy”, merely rending your free access to the DeFi ecosystem. The price of admission in terms of knowledge and effort will continue to increase until it is unaffordable for those who didn’t put in an effort early.

But there’s also good news. We’ll define “decentralized tech” as hardware, software, and infrastructure which can operate without dependence on a central authority. No single entity can monitor or restrict your access to all of it. This is incredibly valuable and will unlock efficiencies in a similar way to DeFi’s disintermediation benefits.

Some concrete examples of what we’d include in DeTech:

• Decentralized finance: Peer-to-peer financial protocols that operate on public blockchains without intermediaries or KYC requirements.

• Freedom operating systems: Linux for computers and GrapheneOS for phones replace corporate software systems controlled by Microsoft, Apple, and Google. Centralized OS collect telemetry (snooping), require account sign-in (soon with KYC/age verification), and answer to a corporate agenda and the political regimes of the countries they do business in. Decentralized alternatives let you customize the code to do what you and your customers or community want, an advantage which goes beyond the assumed table stakes of stripping out surveillance control.

• Self-hosted services: Running AI models on your own computer or community hardware instead of querying a corporate API. Decentralized mesh networks instead of monopoly telecoms. Email, file storage and backup, password management, and other services controlled by you, not a service provider.

Interestingly, various aspects of DeTech serve as force multipliers for each other.

The bedrock is DeFi - anonymous capital formation and payments. Without the freedom to transact, freedom of speech is meaningless. Builders can spin up privacy solutions without exposing their identities (with potential real world consequences) or risking being demonetized by centralized, regulated payment processors. Serious privacy efforts will likely be targeted for deplatforming/debanking just like crypto.

Then self-hosed AI acts as a force multiplier for individual and group capability. It can help non-developers contribute to a software project by building the features and customization they want, then submitting them as software patches using decentralized software like Git (GitHub is just a centralized service which runs the open source Git software). The administrative and security burden of self-hosting servers and auditing code is also reduced by AI. Using uncensored local models enables interactive learning about privacy techniques, something which isn’t assured with corporate models with various layers of “guardrails” aka censorship.

Decentralized hardware and software are essential - otherwise you will not be permitted to use AI without state-mandated “trust and safety” subversion, possess tools like debuggers or decompilers, or even write, speak, or get paid privately.

2026: It’s Later Than You Think

Here’s a birds eye view of government overreach on your technical freedom.

Age Verification / KYC for Tech

Age verification for digital services has shifted from fringe policy to global norm in under two years. More than 30 countries have enforceable age-gating requirements.

If you live in North America you’re probably not aware of this. Although half of US states now enforce age verification laws for adult content, triggered by the Supreme Court’s 2025 Paxton ruling, there is no federal age verification mandate and social media age-gating remains largely blocked by litigation. Canada has no enforceable age verification law yet, but the bill (S-209) is working through Parliament.

The rest of the world is in worse shape:

• India: Legislation coming into force 2027: verifiable parental consent for all under 18s across every digital service - largest age gating regime by user count

• China: Most stringent regime globally. Real-name + facial recognition verification for gaming (3 hrs/week limit for minors), mandatory identity checks on all social media and messaging.

• Southeast Asia: Singapore (app store age-gating, April 2026), Indonesia (under-16 social media ban, March 2026), Malaysia (under-16 ban, January 2026), Vietnam (mandatory ID verification for all social media, December 2024), Thailand (drafting under-14 ban). The region is moving from zero to near-universal within ~18 months.

• Middle East: UAE from January 2026, Turkey April 2026.

• Europe: UK (Online Safety Act 2025), France, Germany, Italy, Ireland, Spain: domestic legislation. EU-wide Digital Services Act applies to 27 European states.

• South America: Brazil (Digital ECA, March 2026) has the most comprehensive online child safety law in the Americas.

• Oceania: Australia (under-16 ban, December 2025). New Zealand has a bill in progress.

• Russia: mandatory age classification since 2012, with digital age verification mandated from late 2025.

The global picture is roughly where SIM registration was around 2010–2012: a handful of aggressive early movers (China, South Korea, UK, Australia), a large middle tier legislating rapidly (EU, Southeast Asia, Brazil, UAE), and significant holdouts (most of Africa, much of Latin America, Canada, and the US at federal level).

SIM Registration

On January 9, 2026, Mexico enacted a new law requiring all cell phone numbers to be verifiably associated with an individual. Any number not linked to a government-issued ID by June 30, 2026, will be suspended. Poland is using its EU Presidency seat to advocate for mandatory ID collection to register SIMs in all of Europe.

The tracking device which you carry around in your pocket all day now needs to be linked to an official government ID in the following regions:

• Africa: has the highest SIM registration adoption rate globally 51/54 states.

• India: Mandatory Aadhaar biometric verification covering > 1 billion SIMs

• China: “real name” system requiring mandatory facial recognition scans

• Middle East and Central Asia: Almost universal except Israel

• Europe: 19 of 27 EU member states currently enforcing

• North America: Mexico capitulated 2026, US and Canada still free

• South America: Almost universal except Chile

• Oceania: Almost universal except New Zealand and some microstates

OS-Level Identity Infrastructure

Age verification is migrating from the app/service layer to the OS layer. Once embedded in every computer it’s trivial for any app to query it. Apps would then refuse service to “non compliant” devices. Then simple age verification can easily be replaced with full KYC.

Colorado’s SB26-051 passed the Colorado Senate in March, requiring operating systems to collect a user’s age at device setup and expose that data to apps via a real-time API. California’s equivalent AB 1043 takes effect January 2027. So far the corporate monopolies are included: Apple, Google, Microsoft, and Canonical (Ubuntu).

Google Developer ID Requirement & Killing Open Source

Starting September 2026 all Android app developers must register centrally with Google - including providing government ID, a $25 fee, and agreeing to Google’s terms - or their apps will be blocked from installing on certified* devices. This applies to sideloaded apps, not just Play Store downloads.

The apps that matter most for daily life (banking, payments, government services, corporate email) increasingly demand certified-device attestation, which pushes users toward certified devices, which are now the very devices locked down to the new verification mandate.

Just 20 years ago it would have been unthinkable (and probably an antitrust issue) for Microsoft or Apple to dictate which software you were and were not permitted to install on the computer you just purchased. Please pause to reflect how quickly the Overton window has moved here.

Google is also perceived as trying to “kill” AOSP, the Free Software underlying its Android operating system. They have been moving more critical components into closed-source Google Play Services for years, and recently cut AOSP source code releases from quarterly to Q2 and Q4 only. Custom ROMs face longer waits for security patches and feature updates on this schedule.

For more information see the very important Keep Android Open project.

VPN Bans

Wisconsin and Michigan both attempted to ban VPN use as part of age verification legislation in early 2026. Wisconsin removed the VPN provision in late February after backlash. Michigan’s bill would force ISPs to monitor and block all VPN-style traffic with no carve-out for business use. The UK is also openly discussing restricting VPN access for minors. More authoritarian countries have banned VPNs for years.

DeTech: Towards Sovereign Computing

Our strategy can be summed up as defense in depth plus diversification across multiple sovereigns (governments). The goal is that no single government, corporation, or policy can significantly disrupt your operations.

Here are some guiding principals (we’ll get into specifics for paid subs):

1. Use multiple jurisdictions. Governments regulate what they can reach. For example a roaming eSIM registered to a foreign LLC, used with a device purchased abroad is far harder for local authorities to automatically track. This can effectively bypass local SIM ID requirements.

2. Use VoIP. legacy voice calls are insecure, legacy SMS can contain exploit payloads. Your telephone number is associated with your location. A data SIM has none of these issues. You can rent telephone numbers, including SMS capable ones, directly from carriers or through resellers. Make calls through a VPN and your local cell phone provider can’t see who you are calling, just encrypted data packets.

3. Use Free Software. We are writing precisely. Free Software is more than Open Source. Free software is defined by the Four Freedoms: the freedom to run the program for any purpose, the freedom to study how it works and modify it, the freedom to redistribute copies, and the freedom to distribute your modified versions. Free as in freedom. Importantly this includes the freedom to help others, whether altruistically or commercially. We all have limited time and competing priorities beyond wrestling with computer software. Our community needs to streamline access to Free Software versions of the computer code we depend on to access DeFi.

4. Use DeFi for what it was built for. Every few years there’s a chance to get rich(er) in some speculative mania - NFTs, memecoins, perps, etc. That’s a side quest. DeFi is for secure payments, managing your savings, and making investments without intermediaries who can freeze your account, report your transactions, or enforce “compliance” measures (cutting you off) because of a “profiling” glitch.

5. Use Self Hosting. Selectively. This is time consuming so pick your battles. At minimum you should be able to take back your email from corporations as that’s a single point of failure with complete information about your life and “recovery” access to most of your digital accounts for anyone who cracks it. Then the next big block is having a functional, uncensored, local AI even if it isn’t cutting edge.

6. Use Reactance. Coined by Jack Brehm in 1966, this behavioral psychology concept describes a motivational state arising when a perceived freedom is threatened or removed. The desire to exercise the freedom increases. This drive state generates sustained focus, creative problem-solving, and an almost irrational willingness to spend time and resources achieving the restricted outcome. Yes this probably explains the extreme lengths the DeFi team have gone to: researching every corner of technology and finance to avoid being hacked, ripped off, scammed, stolen from, tracked, surveilled, pushed, filed, stamped, indexed, briefed, debriefed, or numbered. All of us in DeFi have some level of high trait reactance. We don’t trust the state with custody of our monetary sovereignty and we don’t want them tracking our transactions, imposing capital controls, or requiring us to justify to a compliance clerk at a bank when we try to move our own assets. Beyond the defensive, some of us will be able to use this powerful drive as a fuel in a career or business focused on removing restrictions for ourselves and others.

DeTech Education

This newsletter has spent 5 years helping you navigate DeFi.

By popular request we’re expanding our coverage to include decentralized technologies like locally hosted AI, self hosted services, free operating systems, and multi-jurisdictional structures because DeFi without these is incomplete.

Your continued safe and private access to DeFi without decentralized technology is at risk, so it’s time to level up.

For paid subscribers we’ll be covering what we’ve learned about improving security on mobile devices. We’ve discouraged using crypto on cell phones in the past (except for an amount you’d carry as physical cash and would not be too upset if it were stolen), but we’ll cover both crypto and non-crypto uses and configurations.

Subscribe now

Paid subscribers also get access to:

• All of our past posts

• Weekly Deep Dive Report

• A comprehensive bi-weekly DeFi Roundup

• Bi-weekly Q&A sessions with our team

Until next time..

Disclaimer: None of this is to be deemed legal or financial advice of any kind. These are opinions from an anonymous group of cartoon animals with Wall Street and Software backgrounds.

• We now have a full course on crypto that will get you up to speed (Click Here)

  • We offer the Prediction Markets module on a standalone basis (Click Here)

• Security: Our official views on how to store Crypto correctly (Click Here)