Category: Business

Publicly traded Ethereum treasury firm BitMine Immersion Technologies made its largest weekly purchase since December, adding 101,627 ETH valued around $235 million, putting the firm on the brink of topping the 5 million ETH milestone.

The haul pushes the firm’s total holdings to 4,976,485 ETH worth more than $11.5 billion. It also holds 199 Bitcoin, or around $15 million worth, and $1.12 billion in cash as of its Monday update. 

“While many believe the crypto winter may last through the fall of 2026, our view remains that the crypto winter is much closer to ending,” said BitMine Chairman Tom Lee in a statement. (Disclosure: Lee is an investor in Dastan, the parent company of an editorially independent Decrypt.)

Ethereum is down around 1.1% in the last 24 hours, recently changing hands at $2,312. The second-largest crypto asset by market cap has jumped 5.4% in the last week. 

“As downside tail risks for the U.S.-Iran war diminish, ETH has risen 41% from its early February lows,” said Lee. “In our view, there is a lot of meaning to ETH being the best ‘war-time store of value,’ and to ETH being the asset leading since the war started,” he added. 

Last week, the firm reported a net loss of $3.8 billion for the three-month period ending on February 28, 99% of which was attributed to unrealized losses on its Ethereum holdings. BitMine now holds more than 4.1% of the entire ETH circulating supply. 

Over the six-month period ending on February 28, the firm had more than $9 billion in reported losses on account of ETH’s slide from its August all-time high mark of $4,946. As it stands, the asset is now trading about 53% off that mark. 

BMNR shares are down about 3.3% since the opening bell on Monday and have slightly underperformed ETH in the last month of trading, gaining nearly 3% while ETH has risen 5.5% during the same span.

The firm’s shares have fallen nearly 59% in the last six months of trading ,and are 86% off their 52-week high of $161, recently changing hands at $22.21. 

Strategy, the largest Bitcoin treasury firm, also made a major purchase last week, adding over $2.5 billion worth of Bitcoin in its largest addition since 2024.

Strategy reported its largest Bitcoin purchase in over 16 months on Monday, scooping up $2.54 billion worth of BTC last week as traders snapped up its flagship preferred share to receive an upcoming dividend.

The Tysons Corner, Virginia-based firm said that it purchased roughly 34,200 Bitcoin, lifting its stockpile to a total of around 815,000 Bitcoin. With Bitcoin trading close to $75,400, the sum was valued at around $61.4 billion, according to CoinGecko.

The Bitcoin-buying firm announced that it had issued nearly $2.2 billion worth of STRC, Strategy’s dividend-paying preferred share, which currently pays 11.5% in monthly dividends and is designed to trade around the $100 mark.

STRC’s ex-dividend date passed last Wednesday, representing the day on which investors buying the dividend-paying product no longer receive the next scheduled payment. Leading up to that threshold, STRC traded at or above the $100 mark for 10 straight trading days, indicating that the preferred share now valued at $8.5 billion saw consistent demand.

Andy Constan, a former Strategy bear and founder of research firm Damped Spring Advisors, wagered that STRC saw heightened demand from dividend-capture traders, who typically buy stocks immediately before the ex-dividend date and sell shortly after.

“Dudes I know were all in [STRC] leveraged long last night and have never done a div capture trade in their life,” he said in an X post last week.

Before Monday’s opening bell, the company’s stock had fallen 2% to $163, according to Yahoo Finance. On Friday, Strategy’s shares surged nearly 12% to $166, as the Bitcoin-buying firm’s industry-leading stockpile showed a profit on paper for the first time in months.

On Myriad, a prediction market owned by Decrypt parent company Dastan, traders foresaw a 13% chance Strategy would pare its holdings this year. On Feb. 1, when Strategy’s stockpile plunged underwater, traders foresaw a 31% chance of Strategy tapping its stash.

On Sunday, Strategy co-founder and Executive Chairman Michael Saylor told followers to “Think Even Bigger” in an X post, hinting at the size of the company’s recent purchase. A day before, he flicked at conflict in the Middle East, noting it’s “impossible to blockade Bitcoin.”

Following STRC’s ex-dividend date last week, the company proposed semi-monthly dividends for the preferred share. “These proposed changes are intended to stabilize price, dampen cyclicality, drive liquidity, and grow demand,” Saylor said in an X post.

Strategy’s latest buy represents its largest since November 2024. Days before, the company said that it had sold $3 billion worth of convertible bonds due in 2029, which grant holders the option of exchanging bonds for common shares should they reach $672.40 apiece.

The exploit that drained roughly $292 million from KelpDAO’s cross-chain bridge over the weekend was “likely” the work of North Korea’s Lazarus Group, specifically its TraderTraitor subunit, LayerZero said in a preliminary analysis on Monday.

Attackers drained 116,500 rsETH, a liquid restaking token backed by staked ether, from the KelpDAO bridge on Saturday, setting off withdrawals across the decentralized finance sector that pulled more than $10 billion out of lending protocol Aave.

The attack carried the markings of “a highly-sophisticated state actor, likely DPRK’s Lazarus Group,” LayerZero said, specifying the group’s TraderTraitor subunit.

North Korea’s cyber operations run under the Reconnaissance General Bureau, which houses several distinct units, including TraderTraitor, AppleJeus, APT38, and DangerousPassword, according to an analysis by Paradigm researcher Samczsun.

Among these subunits, TraderTraitor has been flagged as the most sophisticated DPRK actor targeting crypto, previously linked to the Axie Infinity Ronin Bridge and WazirX compromises.

LayerZero said that KelpDAO had used a single verifier to approve transfers in and out of the bridge, adding that it had repeatedly urged KelpDAO to use multiple verifiers instead.

Going forward, LayerZero said it will stop approving messages for any application still running that setup.

A single point of failure

Observers say the exploit exposed how the bridge was built to trust a single verifier.

It was “a single point of failure, regardless of what the marketing calls it,” Shalev Keren, co-founder at cryptographic security firm Sodot, told Decrypt.

A single compromised checkpoint was enough to allow the funds to leave the bridge, and no audit or security review could have fixed that flaw without “removing unilateral trust from the architecture itself,” Keren said.

That view was echoed by Haoze Qiu, Blockchain Lead at Grvt, who argued that, “Kelp DAO appears to have accepted a bridge security setup with too little redundancy for an asset of this scale,” adding that LayerZero “also has accountability” given that “the compromise involved infrastructure tied to its validator stack, even if this was not described as a core protocol bug.”

The attackers came within three minutes of draining another $100 million before a rapid blacklist cut them off, according to an analysis by blockchain security firm Cyvers. The operation was based on tricking a single channel of communication, Cyvers CTO Meir Dolev told Decrypt.

Attackers tapped two of the lines the verifier used to check whether a withdrawal had actually occurred on Unichain, fed it a fake “yes” on those lines, then knocked the remaining lines offline to force the verifier to rely on the compromised ones.

“The vault was fine. The guard was honest. The door mechanism worked correctly,” Dolev said. “The lie was whispered directly to the one party whose word opened the door.”

But while LayerZero, whose infrastructure powered the drained bridge, pointed to Lazarus as the likely culprit, Cyvers stopped short of the same attribution in its own analysis.

Some patterns match DPRK-linked operations in sophistication, scale, and coordinated execution, Dolev said, but no wallet clustering tied to the group has been confirmed.

The malicious node software was engineered to erase itself once the attack finished, wiping binaries and logs to obscure the attackers’ trail in real time and in the post-mortem, he added.

Earlier this month, attackers drained roughly $285 million from Solana-based perpetuals protocol Drift, in an exploit later attributed to North Korean operatives.

Dolev noted that the Drift hack was “very different in terms of the preparations and execution,” but both attacks required long lead times, deep expertise, and significant resources to pull off.

Cyvers suspects that the stolen funds have been transferred to this Ethereum address, aligning with a separate report from on-chain investigator ZachXBT which flagged it alongside four others. The attack addresses were funded through coin mixer Tornado Cash, per ZachXBT.

3,478.5543
Morning Minute is a daily newsletter written by Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt. And check out our new daily news show covering all of the top stories in 5 minutes or less, downloadable on Apple Pod or Spotify.

GM!

Today’s top news:

• Crypto majors fall then rebound as Iran tensions escalate; BTC at $75.4k
• ETFs see $1.4B in inflows on the week, 2nd biggest week of year
• DeFi TVL falls by $13B as KelpDAO exploit fallout worsens; AAVE -25%
• Vercel CEO says “highly sophisticated” actors used AI for its exploit
• Asteroid meme holds at $150M market cap after Elon says “ok” for SpaceX mascot

🔴 $292M Kelp DAO Exploit Triggers Aave Bank Run, $9B Leaves DeFi in a Day

Saturday at 17:35 UTC, an attacker sent a single crafted message to Kelp DAO’s LayerZero-powered cross-chain bridge.

The bridge accepted it as legitimate and released 116,500 rsETH – roughly $292 million and 18% of total circulating supply—to a wallet that had been pre-funded through Tornado Cash ten hours earlier. No ETH ever changed hands on the other side. The rsETH was effectively minted from nothing. The attacker deposited it into Aave V3 and V4 as collateral, borrowed real wrapped ETH against it, and walked.

Aave didn’t get hacked. Its contracts are fine. But it’s now carrying roughly $196M in bad debt it didn’t create, because rsETH had been whitelisted as ETH-correlated collateral—a faulty assumption.

In the aftermath, TVL on AAVE dropped 25% from $26.4B to ~$20B in a single day and continues to fall by the day. Broader DeFi TVL fell by $13B. The AAVE token fell 30%.

ETH depositors trying to withdraw found liquidity at zero, so they started borrowing stablecoins against their deposits to exit—a textbook bank run. SparkLend, Fluid, Upshift, and Lido all froze or paused rsETH exposure. rsETH holders on 20+ chains now have tokens of uncertain backing.

Aave’s own statement Sunday said rsETH on Ethereum mainnet is “fully backed” but remains frozen “out of an abundance of caution.” But the damage has been done.

DeFi users are re-evaluating the calculus. Does it make sense to risk exploits for average yield? And now every lending protocol has to reassess security. It will take time to rebuild from this, if it’s even possible.

There have been $600M lost from DeFi via exploits in just the past 3 weeks. And the pace is accelerating…

Key Details:

• Kelp DAO’s LayerZero bridge was exploited Saturday for 116,500 rsETH (~$292M, 18% of supply); attacker minted unbacked rsETH and used it as Aave collateral to borrow real WETH; ~$196M in bad debt left on Aave; AAVE -30%; largest DeFi exploit of 2026
• The contagion: Aave froze rsETH and WETH across Ethereum, Arbitrum, Base, Mantle, and Linea; TVL dropped $6.2B in one day; ETH depositors borrowing stablecoins to exit triggered a bank run dynamic; SparkLend, Fluid, Upshift, and Lido all froze rsETH exposure
• The structural issue: LRT tokens like rsETH were whitelisted as near-ETH collateral on Aave, Compound, and Euler; this exploit assumes backing was intact at all times; it wasn’t; every DeFi lending protocol now needs to reassess liquid restaking token collateral risk

🌊 BTC Hit $78K; Then Iran Closed Hormuz Again

Friday was the most violent 24 hours in crypto markets since the war started.

Iranian FM Araghchi posted that the Strait of Hormuz was “fully open to all commercial vessels.” Trump followed on Truth Social claiming Iran agreed to an “unlimited” suspension of its nuclear program and said a permanent deal was “mostly complete.”

Bitcoin ran from $74.5K to $78,400 – its first print above $78K since February 4. Oil crashed nearly 10% to ~$82/barrel. The S&P 500 closed at a record 7,121. There were $600M+ in crypto short liquidations. The ETFs posted ~$800M+ in inflows, the biggest in months.

The vibes were euphoric.

By Saturday morning, tanker owners were receiving Iranian radio transmissions closing the strait. State media said Hormuz had returned to “strict management and control.” BTC pulled back to ~$74K giving back its recent gains, Oil rebounded to $90 and stock futures are red.

And a return to war looks more likely than ever…

📅 Saylor Wants to Pay STRC Dividends Twice a Month

Strategy filed a preliminary proxy Thursday proposing to shift STRC dividend payments from monthly to semi-monthly.

The annual rate stays at 11.5%, and the $1.2B total obligation is unchanged. Holders would just receive smaller checks every two weeks instead of one larger check per month. If approved, the first semi-monthly payment lands July 15.

The reason this matters can be seen in the STRC price action over the past few months. Leading up to the dividend cut off date of the 15th, STRC trades at or above its $100 par with increasing volume until the 14th. Then it goes sub-par for a few weeks as traders no longer need to hold for the dividend. Around the 1st of the month, it hits $100 par again and the cycle repeats.

Well with semi-monthly dividend payments, Saylor could potentially erase that 2-week period where STRC trades sub-par. That would mean more potential capital for him to use to buy Bitcoin – and a safer hold for those holding STRC.

Assuming this goes through, expect Bitcoin to benefit (and maybe even bigly)…

🚀 A Dying Girl’s Wish Made a Meme Coin Worth $175M

Liv Perrotto was 15 years old when she died of cancer in January. Before she passed, she had designed a plush Shiba Inu named Asteroid that flew aboard SpaceX’s Polaris Dawn mission in 2024 as the zero-gravity indicator. Her dying wish was simple: she wanted Elon Musk to make Asteroid the official SpaceX mascot.

Radio host Glenn Beck posted her story on X Thursday night. Elon replied “Will answer shortly” at 11:50 PM ET. That response alone was enough to send the ASTEROID meme coin to a $30M+ market cap.

But traders anxiously awaited Elon’s response. On April 18 in the afternoon, they got it. Elon answered the girl’s questions for him and replied “OK” to the SpaceX final item, confirming Asteroid as the official SpaceX mascot.

The token immediately sent to $100M+ in market cap within hours, reaching $190M+ overnight. It’s now trading near $155M.

Now the question becomes—will Elon continue leaning in and actually make Asteroid Shiba the SpaceX mascot? Or was this a one off response?

🌎 Macro Crypto and Markets

• Crypto majors are red but rebounding after a big Sunday selloff; BTC -0.1% at $75.4k; ETH -1% at $2,316; SOL flat at $85; HYPE -4% at $41.30
• SKY (+5%), CC (+4%) and M (+7%) led top movers
• Oil +2% at $88; Gold even at $4,780
• Stock futures red after record-breaking green streak
• Vercel’s CEO confirmed a breach traced to a compromised third-party AI tool (Context.ai), which gave attackers access to internal Vercel environments via a hijacked Google Workspace account; CEO Guillermo Rauch called the actors “highly sophisticated” and said they may have used AI to accelerate the intrusion
• Coinbase is deploying AI agents modeled after legendary former executives directly into Slack and email; “Fred” is based on co-founder Fred Ehrsam and acts as a strategic planning agent; “Balaji” is modeled after former CTO Balaji Srinivasan and is designed to challenge assumptions and spark innovation
• Sam Altman’s World launched its biggest upgrade yet, bringing iris-scan proof-of-human verification to Zoom, Tinder, and concert ticket sales; Tinder will show a “verified human” badge, Zoom gets a deepfake-detection feature called Deep Face, and Concert Kit lets artists reserve tickets for real humans to block scalper bots

Corporate Treasuries & ETFs

Meme Coin Tracker

• Meme leaders were green on the day and week; DOGE +1%, SHIB +31%, PEPE +1%, TRUMP +1%, PENGU +2%, SPX -1%, FARTCOIN -2%
• Asteroid (+150x), Belief (+400%), Zerebro (+40%), and Griffain (+39%) led notable onchain movers

💰 Token, Airdrop & Protocol Tracker

• Creator Fun launched this wekend with a trading terminal, launchpad, AMM and more calling itself “The iPhone moment for Solana”; its CRX token at $13M
• The RAVE token fell 90% after a ZachXBT investigation

🚚 What is happening in NFTs?

• NFT leaders rallied over the weekend but fell overnight; Punks -1% at 26.6 ETH, Pudgy -5% at 4.36 ETH, BAYC -6% at 7.85 ETH; Hypurr’s -1% at 386 HYPE
• Normies (+20%) and Nakamigos (+15%) led notable movers
• A PUNK token was airdropped to all Punk holders, soaring 200,000% to $10M in its first night of trading