protocol

After KelpDAO was attacked, resulting in a loss of $292 million, the industry's scrutiny of the security of cross-chain infrastructure has intensified. Approximately $4 billion in assets have completed or are in the process of migrating from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP). The DeFi protocol Lombard is the latest project to join this migration trend. The protocol announced it would discontinue the use of LayerZero and migrate over $1 billion in Bitcoin-backed assets to Chainlink CCIP, stating that this decision stemmed from a comprehensive internal security review following the April attack incident.Lombard issues two types of Bitcoin-backed tokens—LBTC and BTC.b—and will prioritize the migration of assets on chains such as Solana, Etherlink, Berachain, Corn, and TAC, while terminating the use of LayerZero on Morph and Swell. Lombard stated that the reason for choosing CCIP is its independent node operators, built-in rate limiting mechanisms, and audited infrastructure. Additionally, the protocol will adopt Chainlink's cross-chain token standard to facilitate asset cross-chain circulation through a burn-and-mint model.Previously, Kelp DAO, Solv Protocol, Re, and the cryptocurrency exchange Kraken have all completed similar migrations, with these projects collectively transferring approximately $4 billion in assets. Chainlink Labs Chief Business Officer Johann Eid stated, "We are witnessing a continued wave of risk-averse migration within the industry."

Kelp announced on platform X that the rsETH protocol has fully resumed normal operation, and the related functions have been re-launched on the mainnet and all Layer 2 networks, with the overall system status restored to normal levels. The rsETH exchange rate has been updated, accounting for all staking reward earnings accumulated during the suspension period. Meanwhile, EIGEN rewards are now open for distribution to rsETH holders, covering the entire suspension period.In addition, the deposit and withdrawal functions have been restored on the mainnet and Layer 2 networks, and the rsETH asset support status has been fully restored to 100% backing. The official emphasized that the current rsETH has achieved complete and sufficient support on the mainnet and L2 networks, and all operational processes have returned to normal.

Arbitrum official announcement, the x402 protocol under Coinbase is now live on the Arbitrum network, allowing developers to enable AI agents to directly use stablecoins to pay for APIs, services, and software fees. The x402 protocol is named after the unused HTTP 402 "Payment Required" status code, which allows websites, APIs, and AI bots to request and receive instant micropayments through blockchain and traditional payment channels.The protocol is managed as an open standard by the x402 Foundation under the Linux Foundation and has the support of over 20 institutions and crypto companies, including Cloudflare, Stripe, AWS, Google, Visa, Base, Circle, and the Solana Foundation.

Base co-founder Jesse stated that the x402 protocol now supports batch settlement, enabling a large number of small payments, with individual transactions as low as below 0.0001 USD, making it very suitable for on-demand payment calculations and instant resources such as inference.

ZKsync's official announcement stated that following several ZK token governance proposals, the governance service provider ScopeLift has now launched the "ZK Fee Flow System" proposal on the forum. This system is a set of smart contract mechanisms that allow ZKsync Governance to route and allocate protocol revenue and fees through its controllable on-chain mechanisms. ZKsync indicated that the relevant forum post has detailed the contract architecture, operational mechanisms, security measures, and deployment addresses of the system.

The Ethereum Foundation has appointed three new co-leads, Will Corcoran, Kev Wedderburn, and Fredrik, to lead the main protocol cluster. The team handover work is now fully underway. The focus for the future is to release Glamsterdam, continue preparations for Hegotà, and advance Strawmap.

The BSC ecosystem's Fortune Protocol has announced the completion of its Seed round financing. This round of financing was participated in by TBV, Cogitent Ventures, X21 Digital, CGV FoF, K24 Ventures, LandScape Capital, and others.Fortune is a new generation Web3 financial protocol focused on building and innovating liquidity infrastructure for prediction markets. The funds raised in this round will be used to accelerate the development of Fortune's AI prediction tools and large-scale prediction models, promoting further development of the protocol in terms of technology, products, and ecosystem.

According to analyst Tom Wan's monitoring, despite LayerZero issuing an apology statement, several protocols with a total TVL of approximately $2 billion have announced their migration to Chainlink CCIP, including KelpDAO ($1.5 billion), SolvProtocol ($600 million), and re ($200 million).Meanwhile, the top assets still using the LayerZero OFT standard include: USDe/sUSDe (Ethena), weETH (Etherfi), USDT0 (Tether), thBILL (Theo), and WBTC (Bitgo), with specific migration progress to be determined by project announcements.Previously, LayerZero formally apologized for poor communication regarding security incidents over the past three weeks. The official acknowledged that its internal RPC was attacked by the Lazarus Group and admitted to mistakenly allowing LayerZero Labs DVN to act as a 1/1 verification node for high-value transactions, leading to a single point of risk.

Wasabi Protocol released a security incident update, stating that attackers exploited a configuration vulnerability in the Spring Boot Actuator within its AWS infrastructure to steal the private keys controlling EVM smart contracts, resulting in the theft of approximately $4.8 million in user funds and $900,000 in protocol treasury funds, with total losses amounting to about $5.7 million.The attack chain began with a public server used for analysis, whose Actuator heap dump was not properly password protected, allowing attackers to obtain credentials for another server and ultimately gain control of the smart contract private keys. This incident only affected EVM deployments, including certain treasuries on Ethereum, Base, Blast, and Berachain, while Solana deployments and Prop AMM were not affected.There has not yet been a final update on the user compensation plan, but "ensuring all affected users are compensated" remains the team's top priority, and updates on the investigation progress will be released in the Discord community in the future.

According to early investor Trix Ventures of Humanity Protocol ($H), their team chose the "3:10" plan offered by the Humanity Foundation on April 26, planning to immediately unlock 30% of their shares on June 25. Trix Ventures believes this is essentially a structural hedge that allows for early profit-taking.Investors stated that they invested in Humanity Protocol at a valuation of $60 million, and have currently achieved a 10x return, which is considered an ideal profit-taking in the current market environment. The institution believes that in the current macro market environment, liquidity premiums are far more defensive than forward expectations, and early exit is a standardized operation for professional institutions to realize capital recovery and risk clearance in complex market cycles. By locking in immediate liquidity, they can effectively avoid long-cycle uncertainties and ensure the safety of initial investment returns.On-chain data shows that investors have monitored that on-chain associated addresses of Humanity Protocol have locked 440 million $H tokens awaiting release, leading to the judgment that their decision is not an isolated case. Considering that Humanity has only gone through one round of financing, these investors all entered at a valuation of $60 million, and their profits have now reached 1000%. Investors believe this indicates that the choice of "3:10" is not limited to just one entity; many early investors across the network have formed a highly consistent strategy, and the market may see a concentrated chip reorganization led by early participants.Regarding potential impacts, investors stated that this portion of tokens is valued at approximately $80 million, and if they enter circulation in a short period, it will pose a severe liquidity pressure test on the secondary market. They also mentioned that under the background of large liquidity concentration release, holders of long positions in $H need to remain highly vigilant, timely assess risk exposure, and consider closing positions at the right time, which is a rational choice to avoid intensified volatility caused by short-term supply and demand imbalances.However, investors also stated that their current defensive actions are entirely based on investment discipline and risk control requirements, rather than doubts about the project's fundamentals. The institution still holds a long-term optimistic view on this core track and maintains a high recognition of the long-term vision of Humanity Protocol. They will continue to monitor liquidity fluctuations, chip reshuffling progress, and marginal changes in on-chain data, and will consider re-entering for strategic layout at the appropriate time.

According to market news, Solv Protocol announced the migration of over $700 million of SolvBTC and xSolvBTC from the LayerZero cross-chain bridge to Chainlink's CCIP, and the deprecation of LayerZero support on networks such as Corn, Berachain, Rootstock, and TAC.Solv stated that this move is based on the latest security review and recent cross-chain attacks, positioning CCIP as the standard cross-chain infrastructure. This migration follows Kelp DAO's shift to Chainlink after its LayerZero-based bridge suffered an attack of approximately $292 million in rsETH.

Lido released the latest updates on the Kelp security incident, stating that the Snapshot vote regarding the EarnETH first loss protection mechanism being below the 1% threshold has reached the quorum and been approved. The losses for EarnETH users will be fully covered by the Lido Earn first loss mechanism.The rsETH held by the attacker has been liquidated, and the related stETH has been transferred to the DeFi United rescue plan. In addition, the EarnETH treasury is expected to reopen shortly after the Kelp protocol resumes operations, at which point users will be able to conduct normal deposit and withdrawal operations. Lido emphasized that during the freeze period, the EarnETH and EarnUSD treasuries continue to generate returns. Currently, EarnETH users only need to wait for the brief unfreezing process to complete, and once the funds are restored, they will be compensated according to the first loss protection mechanism.

1inch posted on platform X, stating that it has noted reports involving TrustedVolumes and confirmed that 1inch and all its protocols are not involved in the incident. The 1inch system, infrastructure, and user funds have not been affected.TrustedVolumes operates independently as a liquidity provider and is used by multiple protocols in the industry, not exclusive to 1inch. 1inch will continue to monitor the situation and actively assist relevant security parties when appropriate.

The Bitcoin TAP protocol ecological project BIT (@dmt_bit_) has released a new roadmap, announcing a focus on the narrative of "Bitcoin Security Budget Layer," with tokens being directly issued to Bitcoin miners every block as a new source of miner subsidies.The BIT team disclosed that currently only the $NAT token enjoys the miner subsidy mechanism under the TAP protocol, and this mechanism is hardcoded in the protocol's source code (effective only for the dmt-nat token), making it unavailable for other DMT projects. The TAP protocol has also not publicly disclosed any third-party security audits to date.BIT has submitted a code upgrade proposal to TAP, hoping to open this mechanism for use by all DMT tokens, but it was rejected by the TAP officials.According to the roadmap, BIT will next develop a new protocol based on a TAP fork—any DMT token deployment party can customize the token issuance rules and miner distribution methods (including distribution by mining pool weight, independent miner prize accumulation, mixed distribution, etc.) through a single inscription, eliminating any hardcoded privileges for projects. A third-party security audit will be completed before the mainnet launch of the new protocol. $BIT will serve as the native token of the new protocol, and the ecological development of the protocol will continue to empower $BIT.

NEAR Protocol stated on platform X that the team is adding post-quantum cryptography support for the network. NEAR's account model is different from Bitcoin and Ethereum; accounts are decoupled from cryptography and controlled through rotatable access keys.The NEAR One team is adding the NIST-approved lattice-based signature FIPS-204 scheme as the first post-quantum signature option. Once launched, any NEAR account holder can rotate keys through a single transaction, achieving quantum safety. NEAR is also collaborating with software and hardware wallets to advance post-quantum support.Through the chain signature feature, NEAR can provide threshold signatures for over 35 chains. The NEAR Intents team is developing a quantum-safe cross-chain signature solution. If other chains progress slowly in adopting post-quantum cryptography, NEAR can offer a quantum-safe environment. Aspects such as consensus mechanisms, validators, block synchronization, and transaction signatures also need to evolve for the post-quantum era, with the goal of achieving a one-time future-compatible migration.

According to the security agency Blockaid (@blockaid_), the Ekubo Protocol is currently experiencing ongoing attacks on a v2 custom extension contract on Ethereum, resulting in a loss of approximately $1.4 million.The root cause of the attack lies in the fact that the IPayer.pay callback of this extension does not effectively restrict the source of the parameters, allowing attackers to control the payer, token, and amount parameters, thereby arbitrarily transferring authorized tokens. Users of the core Ekubo protocol are not affected, but users who have authorized this v2 contract as a token spender face direct risks. Blockaid recommends that relevant users immediately revoke their authorization.

The RWA tokenization protocol KAIO announced on platform X that it will conduct its TGE today.Previously, KAIO revealed its token economic model, with a total supply of 10 billion tokens. The community and liquidity incentives account for 37.5%, which is the largest allocation portion; the team and early investors' tokens are subject to lock-up and phased release mechanisms, with no initial release at TGE. The foundation's allocation accounts for 17%, intended for long-term ecological development.

According to Forbes, the Bitcoin mining company GoMining plans to launch its Bitcoin native payment protocol GoBTC, based on its own block production, at the Consensus conference.The protocol offers users instant authorization and settlement on the Bitcoin mainnet within a few hours, charging merchants a fee rate of 0.2%, which is an order of magnitude lower than the 1.5% to 3.5% rates of Visa and Mastercard.

According to on-chain analyst Specter, the attacker of the Wasabi protocol has transferred all stolen funds into Tornado Cash, completing a centralized mixing operation of approximately $5.9 million in assets.On-chain analysis shows that this attacker and a suspected North Korean-related hacker organization (DPRK) have recently continued to use Tornado Cash to launder stolen funds, including those from KelpDAO and LayerZero, exhibiting a multi-stage complex flow of funds.A typical money laundering path includes: funds first entering the Wasabi Mixer for initial mixing and withdrawal, then cross-chain flowing back to Ethereum, re-entering Tornado Cash for deep mixing, withdrawing to a new wallet, and dispersing to multiple addresses. New tokens are deployed in the new wallets, liquidity is guided to buy and extract liquidity assets, and then cross-chain to the Tron (USDT) system, where funds briefly stay before flowing to OTC-related wallets. On-chain security analysis indicates that this model has become a high-frequency attack money laundering template recently, presenting a combination structure of "mixing + cross-chain + tokenization + OTC exit."Industry security personnel remind that such attacks have shifted from simple theft to systematic engineered money laundering paths, significantly increasing the difficulty of tracking.

According to official news, a recent agreement was attacked due to a lack of verification mechanisms, resulting in approximately 11 BTC being stolen, mainly involving altcoin trading. The attackers exploited a negative miner fee vulnerability to transfer funds to their own accounts through multi-signature transactions.Currently, Bisq is discussing compensation plans, and victims can choose compensation in Bitcoin or BSQ tokens, but it must be implemented after a DAO vote, which is expected to be determined after the DAO cycle ends on May 25.Bisq stated that the vulnerability has been fixed and plans to release a patch update while strengthening the security review of the codebase, focusing on preventing vulnerabilities that may affect wallets. In addition, Bisq reminds users to temporarily reduce the amount of BTC stored in their wallets. The officials believe that although this incident is serious, it is controllable, and they hope to provide a security warning for other projects.