Crypto and DeFi projects continue to be hacked at a dizzying pace, and few days in recent weeks have been incident-free.

That said, Thursday was a particularly busy day, with three projects hit for a total of more than $11 million worth of crypto.

By the end of play, Payy Network had lost $1.8 million, Duelbits $7 million, and Meter $2.3 million.

Payy Network

The bridge connecting Payy Network, a rollup which offers on-chain payroll/treasury services, and Ethereum was first to be hit.

Pseudonymous on-chain investigator Specter first flagged suspicious withdrawals in a message to its Telegram group. Funded via privacy protocol Railgun, the attacker swapped $1.8 million of USDC for ETH.

The firm later confirmed the exploit, which drained the entire balance of its bridge, and paused all operations. It then clarified that the funds were “users’ non-custodial deposits to Payy Network/Payy Wallet,” but is yet to disclose the cause of the loss.

Read more: Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week

Duelbits

Crypto casino and sports betting platform Duelbits was next up in a suspected private key compromise.

The estimated losses stacked up from blockchain security auditor PeckShield’s first tally of $4.3 million. Specter upped the ante to $4.9 million and then $5.9 million after identifying affected addresses on Bitcoin and Solana.

Duelbits’ own co-founder put the final number at approximately $7 million.

Read more: $2M stolen in triple attack on Fetch.ai, NuNet, and SingularityNET

The project was previously hacked for $4.6 million in 2024. At the time, auditor CertiK also suspected the loss to be due to a private key compromise.

Meter.io

EVM blockchain Meter.io also fell victim to a bridge attack, but this time, unbacked tokens were minted instead of existing deposits being drained.

Addressing the incident via X, the team pointed to a “block validation flaw” and informed users that “we’ve preserved the chain state. The recovery method is still to be decided.”

Tokens worth a reported $2.3 million were minted out of thin air before being dumped on the PancakeSwap decentralized exchange.

The sales crashed the price of both MTR and MTRG tokens, which are down almost 80% and 75%, respectively. 

Meter has also been hacked before, for $4.4 million back in 2022, in what was also a bridge hack.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Sudan’s bloody war has raged for more than three years, and the need for an armistice is urgent. In September 2025, the United States, the United Arab Emirates, Saudi Arabia and Egypt, who are leading mediation efforts, proposed a humanitarian truce. The effort failed. Other diplomatic initiatives have tried to bring civilians into the conversation. An April conference in Berlin included women’s groups and other organizations, but it failed to persuade the warring parties to engage with anyone, much less with civil society. For now, even progress toward a basic ceasefire seems unattainable, making a broader approach to ending the violence ever more distant.

Diplomats with involvement and knowledge of the Sudan talks describe gender as a “non-starter” with the Sudanese Armed Forces and Rapid Support Forces. Both factions have an interest in avoiding accountability for sexual violence and other atrocities while remaining focused on retaining their power. As Sudanese communities endure the war, diplomats are pursuing a narrow but pragmatic goal: finding a path to ceasefire while preserving space for later talks on who will have a voice in Sudan’s political future.

KelpDAO has escalated its dispute with cross-chain protocol LayerZero by filing a lawsuit tied to the roughly $292 million exploit that hit its rsETH bridge earlier this year. In the complaint, the restaking and tokenization platform alleges that shortcomings in LayerZero’s security infrastructure helped enable the attack.

According to KelpDAO, LayerZero failed to properly disclose risks in its technology and did not stop attackers from compromising components of its infrastructure. The filing also names LayerZero co-founder and CEO Bryan Pellegrino as a defendant, setting up a legal fight over who—if anyone—bears primary responsibility for the loss.

Key takeaways

• KelpDAO’s lawsuit targets LayerZero and names CEO Bryan Pellegrino over the April 18 rsETH bridge exploit.
• The complaint alleges LayerZero did not disclose key risks and that attackers were able to compromise LayerZero’s infrastructure.
• KelpDAO also claims LayerZero reviewed and endorsed Kelp’s bridge deployment and configuration in writing.
• LayerZero’s prior incident report attributed the theft to compromise of its internal nodes and the subsequent approval of a forged cross-chain message.
• The case reflects a broader pattern in DeFi cross-chain disputes: responsibility is contested between protocol infrastructure failures and application-level design choices.

The lawsuit: allegations of undisclosed risks and infrastructure compromise

KelpDAO said in its filing that LayerZero did not adequately disclose risks associated with its technology and did not prevent attackers from compromising the systems underlying its cross-chain verification process.

The lawsuit further alleges that LayerZero reviewed and supported KelpDAO’s deployment and configuration before the exploit, according to a document made available by KelpDAO. This is a central part of the dispute because it challenges LayerZero’s narrative that the loss was primarily driven by how KelpDAO configured its bridge.

KelpDAO framed the legal action as both a security-focused effort and an attempt to correct what it views as an inaccurate account of the incident. It said holding LayerZero and Pellegrino accountable is necessary to address the harm caused to KelpDAO and to parts of the broader DeFi ecosystem.

LayerZero’s leadership has denied the core allegations. Pellegrino characterized the claim as “meritless” and indicated he would defend the case in Vancouver, signaling that the protocol intends to contest the complaint rather than pursue a settlement immediately.

What happened in April—and why the blame is contested

On April 18, an attack on KelpDAO’s LayerZero-powered bridge led to the theft of 116,500 rsETH, which was valued at about $292 million at the time, according to earlier reporting by Cointelegraph. The loss centered on the way cross-chain messages were verified and approved before funds moved.

LayerZero’s final incident report, as described by Cointelegraph, stated that attackers compromised internal nodes and caused a verifier to approve a forged cross-chain message. In that account, the theft was enabled by the bridge’s reliance on a single decentralized verifier network (DVN) as its only verification path.

In practical terms, once LayerZero’s verifier approved the forged message, Kelp’s bridge released rsETH. LayerZero argued that the risk of this outcome was tied to the bridge architecture—specifically, the lack of a second independent verification step.

LayerZero said it had recommended using multiple DVNs and later stopped serving as the sole required verifier for applications that depend on a single DVN arrangement. That position effectively shifts responsibility toward KelpDAO’s configuration choices, even if LayerZero acknowledges that its infrastructure components were involved.

KelpDAO contests that shift. In May, KelpDAO said its DVN configuration had been discussed with LayerZero and “confirmed as secure,” while accusing LayerZero of failing to adequately warn it about relevant risks. KelpDAO has since announced plans to migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol, reflecting a move away from the LayerZero-dependent architecture that was implicated in the dispute.

Why configuration decisions matter in cross-chain security

This case highlights a persistent tension in cross-chain protocols: even when a cross-chain platform provides verification infrastructure, the security outcome can depend heavily on how applications select and combine verification paths.

LayerZero’s incident narrative emphasizes that using only one DVN created a structural vulnerability—meaning that if that verification path were compromised, the bridge could still process fraudulent messages. KelpDAO’s counter-narrative focuses on what it says were assurances and endorsements from LayerZero, arguing that the risks were not properly communicated and that LayerZero accepted responsibility for the setup.

For investors and users, the distinction is not academic. Cross-chain incidents rarely fit neatly into a single bucket of “infrastructure failure” versus “application misconfiguration.” Instead, the legal question tends to revolve around whether the infrastructure provider warned partners about known failure modes and whether the integration conformed to what both sides understood to be secure at the time.

That uncertainty is also a practical concern for builders operating in this space: a protocol’s incident report may focus on one set of technical causes, while an application’s complaint may spotlight integration assumptions, documentation, and prior guidance.

What to watch next as the dispute moves into court

With KelpDAO now asking the court to rule on LayerZero’s alleged failures—alongside the decision to include Pellegrino personally—the next phase of the case will likely center on evidence about risk disclosure and integration oversight. KelpDAO’s claims that LayerZero reviewed and endorsed the deployment in writing will be particularly important if the parties present documentary records.

At the same time, LayerZero’s defense will need to reconcile its earlier incident framing—compromised internal nodes and a forged message—with KelpDAO’s argument that the configuration was previously validated. Readers should watch for how each side explains the boundary between verifier-level security and application-level bridge design, because that boundary may determine whether the court treats the incident as primarily an infrastructure problem, a configuration problem, or a combination of both.

The Federal Reserve’s two September 24 proposals describe more than the assets behind a dollar token. One proposal sets the terms for an insured state member bank to seek approval for a stablecoin subsidiary; the other would govern the issuer, its reserves and its capital. The distinction determines which firms can use the Fed’s application route at all.

The Federal Reserve has proposed two stablecoin rule packages that put an approval test in front of insured state member banks and an operating rule around issuers under its supervision.

The Board of Governors published the proposals on September 24 at 2:30 p.m. Eastern time. Its 60-page application notice is Docket R-1900, RIN 7100-AH30. A separate, 392-page notice would implement reserve, capital, redemption, custody and related requirements under the GENIUS Act. Both are proposals open for comment, not licenses granted or final regulations. The comment period closes 60 days after publication in the Federal Register, a date the notices had not supplied when released.

The scope deserves care. The application notice addresses an insured state member bank seeking permission for a subsidiary to issue payment stablecoins. It does not offer every fintech a direct route to the Fed. The broader operating notice covers issuers supervised by the Board through the paths described in that proposal. An OCC application, a state-qualified issuer and a state member bank subsidiary do not become the same legal entity simply because all three propose dollar tokens.

Crypto.news reported the Fed proposals on September 24. Reading the two notices side by side reveals a more useful question than whether a proposed issuer can buy Treasury bills. Which legal entity submits the application, who controls the subsidiary, when does the review clock actually start, and how much capital would its chosen reserve mix consume?

The application belongs to the bank

The GENIUS Act permits three domestic issuer categories described in the Fed’s application notice: a qualifying subsidiary of an insured depository institution approved by its primary federal regulator, a federal qualified issuer approved by the Office of the Comptroller of the Currency, and a state-qualified issuer approved by its state regulator. Different supervisors handle the different paths. An insured state member bank applies to the Federal Reserve for approval of its subsidiary under section 5 of the statute, codified at 12 U.S.C. 5904.

That legal distinction can be obscured by a familiar phrase, a bank stablecoin. In the Fed’s proposed application procedure, the bank is the applicant and its controlled subsidiary is the contemplated issuer. A technology company supplying wallets or software is not the applicant on that basis. A bank with a national charter has a different primary regulator. An uninsured state member bank does not use the insured-bank procedure in this notice. The notice says such a bank may approach its home state stablecoin regulator, while its existing Federal Reserve obligations continue to apply.

The proposed rule defines control using existing bank holding company concepts. Ownership or voting power of at least 25% of a class of voting securities is one path; control over a majority of directors is another; a controlling influence determined by the Board after notice and hearing is a third. A prospective issuer formed by multiple banks raises a practical question: which bank controls the company, and which regulator reviews it? The Fed asks that question explicitly in Questions 1 through 4 of its application notice.

For a consortium, the Board says it may accept one application on behalf of multiple insured state member banks if the venture counts as a subsidiary of each. The notice does not say that every multi-bank venture automatically meets that test. A structure in which a bank owns a small minority interest and a separate commercial company directs issuance needs analysis of who actually controls the issuer. A named bank on a consortium’s promotional list does not settle the question.

The distinction is timely because 21 financial institutions committed in September to form a stablecoin company, with a proposed launch in the first half of 2027 subject to conditions. The announcement is evidence of a planned venture, not evidence that its eventual entity will apply through the Fed’s insured state member bank route. Banks can collaborate through a company that uses another licensing path. The proposal leaves the legal design consequential.

The 120-day clock starts after a completeness decision

The proposed application process contains two clocks. Under section 247.30, the Board would tell an applicant within 30 days of receiving its materials whether the filing is substantially complete and identify missing information if it is not. The 120-day decision period runs from the submission date of a substantially complete application. If the Board does not decide a complete application within that period, the proposal restates the statute’s deemed-approval provision.

Filing a letter on day one therefore does not guarantee approval on day 120. The Fed says the submission date is the date its Reserve Bank received the final material needed for substantial completeness, not the later date when the Board sends its completeness notice. An application with omitted material needed to evaluate statutory factors is not substantially complete. A material change can cause a previously complete application to be treated as new if the information on hand is no longer sufficient.

The notice supplies examples: deteriorating financial condition, a material change to the issuer’s business plan, or another change affecting review. This is a procedural limit on a headline claim that applications are approved automatically if the Fed waits. Automatic approval is tied to a complete application and a defined 120-day period. A company cannot make the clock run by sending an incomplete business plan and calling it a filing.

Nor can the Board deny a substantially complete application for any reason it likes. The GENIUS Act, as described in the notice, limits denial to a determination that the applicant’s activities, including those of the proposed issuer, would be unsafe or unsound based on statutory factors. The proposal supplies a process for a denied applicant to seek a hearing and appeal. Those limits support the opposing reading of the application rule: the 30-day notification, 120-day decision period, limited denial grounds and appeal procedures constrain regulatory delay as much as they screen applicants.

There is an important difference between missing a deadline and refusing an application. The deemed-approval provision addresses a regulator’s failure to issue a decision on a complete file within 120 days. A timely denial triggers a separate process in which the applicant can contest the grounds. The proposed procedural rule details hearings and final determinations, while the statute restricts the substance of a denial. A prospective issuer should therefore distinguish three statuses in any public account of its progress: submitted, substantially complete and approved. None can safely be substituted for another. A press release that says an application was filed tells readers nothing by itself about when the 120-day clock began.

The Board says an applicant should send its letter to the appropriate Federal Reserve Bank, which would forward a copy to the Board. The applicant has to sign, describe the proposal, state the action sought and explain why approval meets the statutory factors. Existing information that the supervisor already holds can in some cases reduce duplication, but the proposed rule still requires the information needed to assess the stablecoin subsidiary. The detail becomes especially relevant where an established bank launches a new entity: examination history for the parent does not itself supply a business plan, governance scheme and redemption process for the proposed issuer.

The disclosure burden remains substantial. The proposed application includes a business plan, financial information, policies and procedures, relevant agreements, governance and material third-party relationships. It asks who does what across the proposed program. A bank can outsource technical tasks, but the Board still wants to see the issuer’s operating structure and the bank’s oversight of it. The notice invites pre-filing feedback for complex proposals, an option that does not itself constitute approval.

Reserve choice changes the capital calculation

The operating proposal separates the dollars backing outstanding tokens from the issuer’s own loss-absorbing capital. A dollar of qualifying reserves for a dollar of coins is a backing requirement. Capital is a second layer, intended to absorb risks to the issuer’s continued operations and certain exposures. Describing a fully reserved issuer as needing no capital confuses those two accounts.

The Fed proposes a $5 million initial minimum during a three-year de novo period, indexed to nominal U.S. GDP. The applicable minimum would be the higher of that floor and a calculated risk-based requirement. The Board could set a different amount in specified circumstances, including when the calculated minimum does not match an issuer’s exposures. The $5 million is neither an application fee nor a universal final capital requirement. It is a proposed floor for a newly approved Board-supervised issuer in its initial period.

One line of the 392-page notice makes the reserve decision measurable. Proposed section 247.17(a)(1) assigns a 2% capital requirement to uninsured eligible deposit claims held as reserve assets. The Fed links that treatment to bank credit risk. A bank failure could delay recovery or leave a loss in the issuer’s reserves. The notice specifically recalls Circle’s approximately $3.3 billion in uninsured USDC reserves held at Silicon Valley Bank when regulators closed that lender in March 2023.

Apply the proposed rate to simple, hypothetical exposures. If an issuer holds $250 million in uninsured eligible deposits, the 2% component is $5 million. At $1 billion, it is $20 million. At $3.3 billion, matching the approximate historical exposure cited in the notice without implying that today’s Circle would hold that sum in such accounts, the arithmetic reaches $66 million. These are illustrations of one proposed component, not complete regulatory capital calculations, final costs or findings about a named issuer.

The arithmetic exposes the point at which the initial $5 million floor ceases to tell a reader much about the reserve bank choice. Even before operational risk and any other applicable charges enter, a hypothetical $1 billion uninsured deposit exposure produces a $20 million component. The proposal asks whether the 2% calibration should instead range from 1% to 4%, or vary with the credit standing of the deposit bank. At 1% the same $1 billion example produces $10 million; at 4% it produces $40 million. Those alternative rates are questions for commenters, not adopted rules.

The Fed’s framework considers other categories as well, including undercollateralized reverse repurchase agreements, eligible funds, operational risk and non-reserve assets. The calculation uses different measurement periods for some exposures. It would be false precision to treat the deposit example as the entire capital bill. The comparison does show why a prospective issuer should model its custody and reserve structure alongside its licensing application. A plan naming a reserve bank but leaving the size of uninsured exposure unspecified omits information central to its capital needs.

The proposal’s treatment of operating risk cannot be replaced with the usual argument that short Treasury bills have little credit risk. A redemption desk must work on weekends when a Treasury market does not; software access, failed transfers, custody controls, reconciliation and customer screening can each demand money even when reserves remain intact. The Fed’s separate capital calculation for operational risk therefore depends on inputs other than the market value of government securities. The agency proposes quarterly measurement for the revenue-based component and asks whether other measurement frequencies would work better.

The choice between depositing cash at a bank and holding short government securities is not binary in practice. An issuer needs settlement balances to pay redemptions, while it can hold another part of its backing in permissible liquid instruments. A design promising rapid redemptions but putting every dollar into instruments that must first be sold depends on the sale and payment chain working when customers want out. Conversely, an issuer that keeps large uninsured bank deposits may have immediate access to cash in normal conditions but incurs the proposed deposit credit-risk component. Neither observation proves one reserve mix is right for every program. Both follow from the Fed’s distinct treatment of liquidity and bank exposure.

Custody creates another decision. Proposed sections on covered custodians describe protection for reserve property and for the private keys that allow token issuance. An issuer that relies on an outside bank to hold Treasury securities and a separate technology firm to manage minting permissions needs to map which party controls each asset, who can authorize movement, and how the issuer reconciles outstanding coins with eligible backing. The application asks for material third-party relationships and relevant agreements for that reason. A marketing statement that the reserves are safe does not disclose the chain of authority.

The Fed describes a possible increase or decrease in the de novo capital requirement when it finds a different amount sufficient to support operations. It asks commenters whether the three-year period is appropriate and whether the initial $5 million level, indexed to nominal GDP, should be higher or lower. For a prospective issuer, a model that merely budgets $5 million as a fixed, permanent cost misses both the proposed higher-of test and the regulator’s reserved authority. The precise requirement would emerge from the adopted rule and the issuer’s actual exposures.

Different agencies have already taken their own steps. The FDIC proposed bank issuer standards in April, and the OCC published its stablecoin proposal in February. The Fed notice compares its proposed $5 million starting floor with those agencies’ approaches. Similar figures across proposals do not remove the differences in jurisdiction, application process or final text. None of these proposals should be described as a final license for a specific company.

The $10 billion boundary is a second eligibility test

State supervision is a route for eligible issuers below a statutory scale threshold. Proposed section 247.51 addresses a state-qualified issuer whose consolidated outstanding issuance passes $10 billion. The Board proposes a transition to its federal framework within 360 days, unless the issuer stops issuing new payment stablecoins on a net basis while above the line or obtains an available waiver permitting continued state supervision.

The notice asks an issuer crossing that level to notify the Board within five calendar days. Its notice would identify the supervising state, the outstanding amount, the crossing date and whether it has stopped net new issuance. A capital analysis would follow within 270 days. A request for a waiver, if sought, would be due within 240 days under the proposed procedure. A transition is not simply a new label on the same business; the issuer would need to meet the applicable federal requirements within the timetable.

Consider an issuer at $9.9 billion. A $200 million net issuance would take it to $10.1 billion, above the threshold, under a simple point-in-time calculation. The proposal asks whether measurement should instead use a rolling average and whether issuance by nonconsolidated affiliates should count. Those questions remain open. It is therefore premature to assert that splitting tokens among subsidiaries would keep a program permanently below the line. The Board expressly asks commenters how affiliated issuance should be treated.

The U.S. stablecoin licensing landscape already includes different supervisors and unfinished implementing rules. A growing state issuer faces the timing question earlier than a startup seeking its first license. It may need to prepare for federal supervision while current growth, reserve composition and capital remain moving targets. The $10 billion provision does not mean a coin above that value instantly becomes illegal. The notice specifies a transition period, a possible waiver and an alternative of halting net new issuance.

A promise to redeem has its own operating requirements

The proposed reserve rule would require eligible assets backing outstanding coins on a one-to-one basis. The Board would require a public redemption policy setting out a timeframe, fees, minimum redemption quantity and procedures. Proposed section 247.12 says timely redemption may not exceed two business days after a request, subject to applicable requirements. Onboarding and customer screening still apply. An exchange customer who can sell a token in seconds is not necessarily the same person as an eligible customer redeeming directly with its issuer.

That distinction can be missed when an issuer’s market price stays close to one dollar. Secondary-market trading shows what buyers and sellers will accept; it does not answer who has a contractual redemption claim on the issuer and through which channel. The application notice asks about redemption policies precisely because the issuer needs an operational route from token presentation to payment. A banking partner, custodian and transfer system sit in that route.

Safekeeping requirements in the other notice reach reserve assets, tokens used as collateral and private keys used to issue payment stablecoins. The Fed would apply requirements to certain Board-supervised custodians holding covered assets, including protections intended to keep customer property separate from a custodian’s creditors. The scope differs from a generic wallet software provider that does not control the customer’s keys. The proposal asks where those boundaries should fall.

Governor Michael Barr, in his September 24 statement accompanying the notices, supported safeguards that address runs and payment system risks. The strongest case for the Fed’s approach is therefore operational: clear redemption terms, eligible liquid reserves, capital where bank deposits are uninsured and documented custody arrangements could make an issuer’s promise easier to evaluate before a stress event. The strongest concern from a prospective entrant is the amount of upfront work and uncertainty while separate agencies finish rules that are meant to fit together. Both readings are compatible with the text; the eventual requirements depend on comments and final decisions.

What the proposal cannot tell applicants yet

The Fed has not published a list of approved issuers under these new proposals. Its application notice does not reveal which prospective companies will apply through a state member bank, an OCC-supervised entity or a state regulator. A charter, a pending application, a partnership announcement and permission to issue under a final regime are distinct milestones.

Several variables remain open on the face of the notices: the final capital calibration, whether the $10 billion threshold uses a momentary observation or an average, how multi-bank issuers document control, and how final rules across agencies line up. The notices are extensive because the Board is asking questions on these points, not because it has resolved all of them. A claim that a specific issuer qualifies today would require its organizational documents, supervisory status, application and regulator decision.

There is a checkable way to follow the process. Federal Register publication starts the stated 60-day comment period. Final rule text determines whether the proposed $5 million floor and 2% deposit charge survive. Application notices and decisions would show which banks actually seek approval. Consortium ownership documents would show whether a bank controls the issuer. Outstanding issuance disclosures would identify state issuers nearing $10 billion.

The Fed’s application notice says it will notify an applicant within 30 days whether its filing is substantially complete. Once the final required materials reach the appropriate Reserve Bank, the proposal defines the submission date from that receipt, which starts the statutory 120-day decision period.

What to watch

• Federal Register publication: Check the publication date to calculate the 60-day comment deadline.
• Final Fed rules: See whether the $5 million initial floor, 2% deposit charge and 360-day state-issuer transition survive.
• Public application decisions: Look for an identified insured state member bank and the subsidiary it proposes to control.
• Issuer ownership disclosures: Check public filings for who controls any multi-bank venture before assigning it a Fed application route.
• Outstanding coin disclosures: Track whether a state-qualified issuer approaches or crosses $10 billion in consolidated issuance.

FAQ

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Figures reflect regulatory filings and reporting available at the time of writing and change with each disclosure. Nothing here is a recommendation to buy, sell, or hold any security or asset. Always do your own research. Information is accurate as of September 25, 2026.