From Moonwell and Term Finance to Cosmos EVM and a federal court ruling for Anthropic, this week's failures share one shape: the control was real. It just didn't cover the path that mattered.
Goliath promised DeFi yield but put nothing into liquidity pools. It spent millions manufacturing credibility instead, including a reported $1 million Vault sponsorship. What does Patrick Bet-David owe the victims now?
A wallet tied to the $285 million Drift exploit pushed 23,095 ETH into Tornado Cash through 245 precisely structured deposits. We trace the two-hour operation, the machinery behind it and the battle to follow what emerges.
Uniswap’s Permissioned Pools do more than bring regulated assets onchain. They put the gatekeeper inside the code, giving issuers the power to decide who can trade, provide liquidity and remain in the market.
An oracle that lied with a valid signature. A one-way conversion at OKX. A federal deadline missed by six agencies. A blockchain that markets itself as permissionless while reserving the right to seize issued tokens. The asset looked free. It was tethered the whole time.
Nothing had to break this week. The contracts executed. Governance counted the votes. A hardware wallet enforced its own immutability. Three governments applied their own laws. Millions moved. Funds became inaccessible. One asset meant three different things depending on the border.
The attacker didn't break Hedera. They didn't need to exploit Bonzo's core contracts. They reportedly found a verifier willing to certify fiction as fact, then let the rest of the system behave exactly as designed. The result was a $9 million lesson in misplaced trust.
A trader trusted the route and got fed to the machine. One swap, thin liquidity, a brutal backrun, and a block builder paid more than most people will ever see. Ethereum didn’t blink. MEV just did what MEV does.
Summer Finance didn’t lose $6M because the chain broke. It lost it because the protocol trusted an assumption the attacker could bend. That’s the quiet horror of DeFi: the code can execute perfectly and still pay out the wrong reality.
Every system rests on something it has decided to trust. A signing key. A frontend vendor. A sequencer. A stablecoin issuer's word. This week the question was whether anyone could see the assumption before it broke.
Base didn’t fail because Ethereum broke. It halted because the sequencer did. Two outages in two days exposed the quiet dependency inside today’s Layer 2 stack: billions can sit on Ethereum security, while day-to-day liveness still runs through one centralised machine.
THORChain has resumed trading after more than a month offline, marking the end of one of the more serious operational pauses in recent cross chain DeFi.