Code, stablecoin, central bank, AI lab. Every system contains an intervention point. The question is whether it exists, who controls it, and what happens when it is used.
An attacker has drained $4.67 million from an Axelar-linked bridge on the Secret Network. The incident, which occurred on 10 June but was not detected until 17 June, exploited a critical vulnerability in a third-party smart contract responsible for managing wrapped assets.
The word DeFi is getting heavier. The CLARITY Act may force crypto to prove what it has only claimed for years: who controls the system, who can change the rules, and who was actually built for the moment the mask came off.
BREAKING: US agencies have proposed forcing stablecoin issuers to follow bank-style customer ID rules. The regulated digital dollar is being pulled deeper into the surveillance stack, with issuers positioned as the new compliance gatekeepers.
Aztec Connect was already deprecated. The contracts were immutable. The funds were still there. That combination turned an old privacy bridge into a sitting target, and when the proof logic failed to bind what was verified to what was executed, $2.1M walked straight through the gap.
The fastest way into a protocol this week was not through its code. It was through whatever the code was forced to trust: a signing key on the wrong laptop, a governance vote for sale, or a bank acting on the state's behalf.
Q2 2026 exposed a darker shift in DeFi security. The biggest losses were not just contract bugs, but failures in bridges, key management, messaging layers and hidden control points. The attack surface has moved beyond the code, into everything the code is forced to trust.
A coordinated pattern of attacks targeting unverified smart contracts has led to the theft of at least $36 million across four separate DeFi protocols since January. The largest single loss was sustained by Truebit, an Ethereum-based project, which lost $26.2 million from an exploit of a contract.
The architecture designed to protect became the attack surface. A safety module, a proof circuit, a secure element. Software, mathematics, silicon. Three layers. One week. One pattern. Meanwhile, PulseChain shipped.
Three protocols, Virtuals Protocol, Pleasing Market, and Zest Protocol, have announced the migration of their cross-chain infrastructure from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP). The announced value of the assets and infrastructure covered by these moves exceeds $1.
Apyx Finance’s stablecoin, apxUSD, has broken its intended one dollar peg, falling into the low 90 cent range before partially recovering.
An attacker has drained approximately $7.3 million from legacy liquidity provider locker contracts belonging to the DxSale launchpad platform on BNB Chain.