usp

According to CoinDesk, on-chain analysis firm Arkham Data shows that over the past year, wallets associated with Bhutan have seen outflows of approximately $1 billion in Bitcoin, with funds flowing to multiple trading platforms and trading institutions, reducing their holdings from about 13,000 BTC to around 3,100 BTC.Arkham speculates that there may be ongoing selling behavior, and if the trend continues, the relevant addresses may be cleared of holdings before October 2026. However, Bhutan's sovereign fund Druk Holding and Investments (DHI) stated that "they do not recall any recent Bitcoin sales," did not respond to specific changes in on-chain addresses, and did not confirm the current holding size, only emphasizing that there are no additional comments.The report points out that some of the fund inflow paths are related to institutions such as Galaxy Digital and OKX, leading the market to interpret this as selling or over-the-counter trading behavior, but there are also possibilities of transfers into custody, collateralization, or structured trading that do not involve selling. Additionally, some trading institution personnel stated that there has been no clear selling recently.Furthermore, Bhutan's previous commitment to a reserve of 10,000 BTC for the "Gelephu Mindfulness City" project has also been questioned due to potential sell-offs. Currently, there is still significant disagreement regarding its actual holdings and mining operations.

THORChain has announced that one Asgard vault has been attacked, and trading has been suspended. Initial signs indicate that user funds are safe, and only the protocol's own funds are affected. THORChain stated that the network automatically detected abnormal behavior and suspended signing activities to prevent further fund transfers. The estimated loss is currently around $10.7 million.The announcement mentioned that one of the six Asgard vaults is suspected to have been breached, and related nodes have triggered the RUNE staking penalty mechanism due to unauthorized transfers. The current network has suspended Churn activities, and new connections and related operations will also be postponed until the investigation and repairs are completed.THORChain stated that preliminary investigations show that users' personal exchange transactions have not been affected, and all node operators have been asked to immediately check their infrastructure, key management systems, and operating environments for any anomalies.

According to the Binance wallet page, it appears that the "Luo Yonghao" named Meme coin has been blocked and can no longer be searched for.ChainCatcher previously reported that Luo Yonghao called out Zhao Changpeng on social media, stating, "Recently, a virtual currency named 'Luo Yonghao' (which used my avatar as its logo) is being traded on the Binance trading platform. Although it has not officially entered the 'trading platform' tab yet, it is still on the 'wallet' tab, but it is still part of the Binance trading platform. To prevent people from being deceived, please delist it or provide a formal complaint delisting channel."

"On-chain detective" ZachXBT stated that the hacker "Dritan Kapplani Jr" transferred approximately $2.59 million in assets, including 1.99 million DAI and 259 ETH. The related funds were transferred from address 0x4487...bba6 to address 0x67ec...125d, and the stolen funds are currently in a stagnant state.ZachXBT indicated that it released an investigation report on May 12, detailing the connections between Dritan Kapplani Jr and Trenton (Trent) Johnson in a social engineering theft case involving 185 bitcoins (approximately $13 million).

According to on-chain detective ZachXBT, THORChain has suffered attacks on multiple chains, resulting in losses exceeding $7.4 million.

The South Korean cryptocurrency exchange Upbit announced that due to the hard fork upgrade of the Polygon network, it will suspend the deposit and withdrawal services for related assets starting from May 21, 2026, at 20:00 (KST), until the network stability is restored.The affected assets include Polygon Ecosystem Token (POL), STEPN (GMT), and NFT assets based on the Polygon network.The announcement stated that this suspension only involves on-chain deposit and withdrawal functions, and spot trading will not be affected.Upbit reminds users that transfers made before and after the suspension may experience delays or may not be credited, and related processing will be carried out in order after the network is restored.

Binance announced that due to third-party system maintenance, Binance Alpha tokenized securities trading services are currently in temporary maintenance status, and users are temporarily unable to place orders or conduct transactions.Binance stated that user asset security is not affected, and the platform is actively communicating with the third party to promote service recovery. Users will be notified as soon as the relevant functions are restored.

According to on-chain analyst Yu Jin (@EmberCN), the suspected investment fund address gammafund.eth redeemed 5,555 ETH from ether.fi about 6 hours ago, worth approximately $12.53 million, and transferred it to Binance.This address previously purchased 11,215 ETH in March of this year at a price of about $1,999, totaling approximately $22.42 million; based on the cost corresponding to this transfer, it has an unrealized profit of about $2.87 million. In addition, this address currently has about 5,500 ETH still in the redemption application, which may be completed next week.

According to on-chain analyst Yu Jin (@EmberCN), the suspected investment fund address gammafund.eth redeemed 5,555 ETH from ether.fi about 6 hours ago, worth approximately $12.53 million, and transferred it to Binance.This address previously purchased 11,215 ETH at a price of about $1,999 each in March this year, totaling approximately $22.42 million; based on the cost corresponding to this transfer, it has an unrealized profit of about $2.87 million. Additionally, this address currently has about 5,500 ETH still in the redemption application, which may be completed next week.

According to on-chain analyst @ai_9684xtpa, a certain address is suspected of reducing its holdings by 40 WBTC.This address had previously withdrawn a total of 50.91 WBTC from exchanges between February 2024 and February 2026, and it has been over two years since its initial position was established. This is its first operation to recharge to the exchange. If the relevant WBTC has been sold, its return rate is approximately 35.7%, corresponding to a profit of about $847,000. Currently, this address still holds 10.965 WBTC on-chain.

On-chain detective ZachXBT exposed American threat actor Dritan Kapllani Jr, claiming he is suspected of participating in a social engineering theft targeting crypto users, totaling approximately $19 million. ZachXBT stated that Dritan has long flaunted luxury cars, high-end watches, private jets, and nightlife on social media. On April 23, 2026, during a "Band 4 Band (B4B)" voice chat on Discord, he publicly displayed an Exodus wallet containing $3.68 million in assets to prove he was wealthier than another hacker.The relevant ETH address is: 0x4487db847db2fc99372a985743a26f46e0b2bba6. ZachXBT tracked and found that this address is linked to a social engineering theft case involving 185 BTC (approximately $13 million) on March 14, 2026. The next day, Dritan's Exodus wallet received about $5.3 million of those funds. By the time of the B4B call six weeks later, about $1.6 million had been spent or laundered.On May 11, the U.S. Justice Department unsealed a criminal indictment against Trenton Johnson, who is accused of participating in the aforementioned 185 BTC theft case and could face up to 40 years in prison. "Coconspirator 1" in the indictment is alleged to be Dritan, who has not yet been formally charged. ZachXBT also pointed out that Dritan is connected to hacker John Daghita (Lick), who was previously arrested for stealing $46 million from the U.S. government, and John had exposed Dritan's old wallet address on Telegram.On-chain analysis shows that this address is related to multiple high-confidence social engineering theft cases in 2025, with a total amount involved exceeding $5.85 million. ZachXBT stated that Dritan has been active in "The Com" hacker circle for a long time and had previously not faced formal charges due to his minor status. He is now over 18 years old, and "the borrowed time may finally be over."

Korean trader Definalist posted on social media that there are suspected wash trading activities during the listing process of WIF and VVV on Upbit. Several addresses funded by Upbit's hot wallet bought before WIF was listed on Upbit and quickly sold after the listing; similar operations also appeared with VVV.In addition, Definalist hinted that Upbit has been intensively testing STABLE tokens recently, and the suspected wash trading wallets also showed related buying activities.

According to the official announcement, OKX will suspend the deposit and withdrawal services for all tokens on the Ronin network on May 12 at 22:00. The services will resume after the network upgrade is completed. Please note that trading of the relevant tokens will continue as normal, and users do not need to take any action.

According to CoinDesk, some Revolut users saw the price of Bitcoin (BTC) briefly drop significantly below global market levels in the app on Friday. The candlestick chart showed that the price plummeted suddenly before quickly returning to normal ranges, with the lowest quote even being captured in a screenshot at around $0.02.Currently, mainstream exchanges tracked by CoinGecko and CoinMarketCap have not shown similar anomalies, with BTC trading around $79,000 during the same period. Revolut has not yet responded to whether there were actual trades executed at the abnormal price. If there were indeed trades, the platform may need to determine whether it was due to real liquidity matching, quote routing issues, or errors in front-end price display. Industry insiders say that insufficient liquidity depth, temporary withdrawal of market makers, or disruptions in quote sources could all lead to extreme "flash crash" scenarios on a single platform.

According to monitoring by Hyperinsight, in the past half hour, three major long BTC addresses on Hyperliquid simultaneously executed liquidations, creating a total of 776 BTC sell orders, worth approximately 62 million USD, with an average liquidation price around 79,880 USD, indicating that the positions were close to breakeven.It is reported that the funding sources of the three addresses can all be traced back to on-chain transfers from the HitBTC trading platform, and the on-chain transfer records are highly synchronized with trading activities, suspected to belong to the same whale.

According to EmberCN monitoring, a suspected Arrington Capital associated address transferred 100,000 COMP ($2.26 million) to Binance in the last 4 hours, while COMP dropped 4% during that time, currently reported at $22.

According to on-chain analyst Yu Jin (@EmberCN), an address suspected to belong to Arrington Capital recently transferred 100,000 COMP to Binance, worth approximately $2.26 million at the time.This transfer may have caused COMP to drop about 4% in the past 4 hours, with the price falling from $22.9 to $22.

According to Cointelegraph, crypto risk management and infrastructure provider Chaos Labs stated that its oracle network experienced a suspected "nation-state" hacker attack last weekend but was not breached.Chaos Labs founder Omer Goldberg stated on the X platform that the attack was strictly limited to the operational wallets used for daily on-chain operations, and the oracle network was never compromised. The oracles operate in a fully isolated environment, with nodes distributed globally, protected by multi-layer security and encryption controls. Chaos Labs has rotated all keys since the attempted attack and has not detected any suspicious activity.

The largest lending protocol Tydro under Kraken's Ink Layer 2 announced yesterday that it will remain in a market pause state until the completion of the Chainlink price oracle migration. On May 4, the risk management agency Chaos Labs notified Tydro that its oracle provider had been attacked, with an attack pattern similar to that of a nation-state actor, and recommended an immediate pause of all markets.Tydro stated that there were no abnormal price feeds to its market before or after the pause, and user positions were unaffected. About 48 hours later, Chaos Labs confirmed that the compromised keys had been rotated, and technically, operations could resume, but Tydro chose to continue the pause until the second push oracle was in place. The completion of the Chainlink migration will trigger a 48-hour time lock, during which a four-hour grace period will also be set, allowing borrowers with health factors below 1 to repay or add collateral without being liquidated. Tydro is a white-label deployment of Aave v3, and the total market size has recently exceeded $700 million.

According to monitoring by Lookonchain, a suspected BIT-related address deposited 403,289.5 HYPE (17.4 million USD) into Hyperliquid and began to sell. So far, it has sold 100,000 HYPE for 4.24 million USDC.