In the summer of 2020, a governance token called COMP turned decentralized finance inside out. Compound, a lending protocol on Ethereum, began distributing COMP tokens to anyone who lent or borrowed on the platform, and within weeks, hundreds of millions of dollars flowed into smart contracts that had held a fraction of that the month before. Users were not just earning interest on deposits; they were earning a second layer of rewards, governance tokens, on top of the base yield, and then depositing those tokens elsewhere to earn a third layer. The practice acquired a name, yield farming, and for a brief, fevered period, annual returns exceeded 1,000% on major platforms. The rates were unsustainable, the risks were poorly understood, and the strategies were genuinely novel. Three years later, the fever broke, the unsustainable yields collapsed, and what remained was a permanent feature of the DeFi economy: the practice of actively deploying capital across protocols to maximize returns. Yield farming did not disappear after DeFi Summer. It grew up.

The term “farming” is borrowed from gaming culture, where players repeat actions to accumulate resources. In DeFi, the resource is yield, and the repeated action is depositing capital wherever the return is highest. The analogy extends further than most people realize: farming in games is tedious, repetitive, and rewards those who optimize ruthlessly. DeFi yield farming is the same. The casual farmer deposits stablecoins into Aave and earns 4%. The professional farmer splits capital across eight protocols on four chains, compounds rewards hourly through automated strategies, hedges impermanent loss with options positions, and earns 12-20% while monitoring smart contract risk across every position. The difference between the casual and professional farmer is not just in returns; it is in the understanding of where yield comes from, because yield that appears to come from nowhere always comes from somewhere, and the farmer who does not know the source is usually the source.

The mechanics: what happens when you deposit

Yield farming, stripped to its simplest form, involves three steps: you deposit tokens into a smart contract, the protocol uses your tokens for some productive purpose, and you receive a share of the value that purpose generates. The productive purposes vary by protocol type, but they fall into a small number of categories.

On a decentralized exchange like Uniswap or Curve, the productive purpose is market-making. You deposit a pair of tokens, say ETH and USDC, into a liquidity pool, and the DEX uses your tokens to facilitate trades between those assets. Every time a trader swaps ETH for USDC or vice versa, they pay a fee (typically 0.3% on Uniswap v2, variable on v3), and that fee is distributed proportionally among all liquidity providers in the pool. Your return depends on the volume of trades flowing through the pool relative to its total size: a pool with $10 million in deposits and $1 million in daily trading volume generates a different return profile than one with $10 million in deposits and $100,000 in daily volume. The yield is real, it comes from fees paid by real traders, but it is not free: providing liquidity exposes you to impermanent loss, a cost that can exceed the fees earned if the price ratio of your deposited tokens changes significantly.

On a lending protocol like Aave, Compound, or Morpho, the productive purpose is credit intermediation. You deposit tokens, the protocol lends them to borrowers who pay interest, and you receive a share of that interest. Borrowers must overcollateralize their loans (deposit more value than they borrow), which protects lenders from default risk at the protocol level, though smart contract risk remains. Lending yields fluctuate with demand: when lots of people want to borrow USDC (often to lever up during bull markets), the interest rate rises; when borrowing demand drops, yields compress. Stablecoin lending rates have ranged from below 1% to above 15% in recent years, driven almost entirely by the market cycle.

On a yield aggregator like Yearn Finance, Beefy, or Sommelier, the productive purpose is strategy execution. You deposit tokens into a vault, and the vault’s smart contract automatically executes a farming strategy: depositing into lending protocols, providing liquidity, claiming reward tokens, swapping them for the base asset, and redepositing. The vault automates the compounding and rebalancing that a manual farmer would need to do themselves, charging a performance fee (typically 10-20% of profits) in exchange. Vaults are the passive farmer’s tool: they abstract away the complexity of multi-protocol strategies and reduce gas costs by batching operations across all depositors. The tradeoff is opacity, you are trusting the vault’s strategy and its smart contract code, and a layered risk: the vault contract can fail, the underlying protocol contracts can fail, and the strategy itself can underperform if market conditions change faster than the vault rebalances.

The taxonomy: types of yield farming

The yield farming landscape has diversified into several distinct categories, each with different return profiles and risk characteristics.

Liquidity provision farming is the oldest and most straightforward form. You deposit token pairs into DEX pools and earn trading fees. On concentrated liquidity DEXs like Uniswap v3, you can specify a price range for your liquidity, concentrating your capital where trading activity is highest and earning more fees per dollar deployed. The tradeoff is that concentrated liquidity amplifies impermanent loss when prices move outside your range, and managing positions actively requires constant attention or automated position managers.

Incentivized farming adds a second yield layer. Protocols distribute their own governance tokens to liquidity providers as a subsidy to attract deposits. During DeFi Summer 2020, COMP, SUSHI, and dozens of other tokens were distributed this way, producing triple-digit APYs that attracted billions in capital. The incentive model has evolved: modern incentive programs tend to be more targeted (rewarding specific pools or behaviors) and time-limited (vesting schedules, lock-ups, or decreasing emission rates). The fundamental dynamic has not changed: incentivized yields are subsidized by token inflation, and the sustainability of the return depends entirely on whether the token’s price holds while emissions dilute the supply.

Lending farming is lower-risk and lower-return. Depositing stablecoins into Aave or Compound earns a base interest rate from borrower payments. Some lending protocols add governance token incentives on top, creating a total yield that exceeds the base rate. The appeal is simplicity and the absence of impermanent loss: your deposit stays in the asset you deposited, and your return is denominated in the same asset. The risk is primarily smart contract exposure and, for non-stablecoin deposits, the underlying token’s price volatility.

Points farming emerged in 2024-2025 as a new incentive model. Instead of distributing tokens directly, protocols award off-chain “points” for depositing capital or using the product. Points are expected to convert to governance tokens at a future token generation event, but the conversion ratio is unknown until that event occurs. EigenLayer’s restaking points, Blast’s ecosystem points, Ethena’s shard system, and Hyperliquid’s points program all used this model. Points farming introduces a unique risk: you are earning a claim on a future asset whose value, issuance, and distribution rules are all unknown. The speculative element is explicit, and the returns are entirely dependent on the eventual token’s price and your share of the total point supply.

Recursive or leveraged farming amplifies returns and risks. A farmer deposits collateral into a lending protocol, borrows against it, deposits the borrowed tokens into another protocol (or the same one), and repeats. Each loop earns an additional layer of yield but also increases the farmer’s exposure to liquidation risk: if any of the underlying assets drops in price, the chain of positions can unwind in a cascade of forced sales. Leveraged farming was responsible for some of the most spectacular blowups in DeFi’s history, and it remains a strategy reserved for operators who understand exactly what they are leveraging and what triggers their liquidation.

The math that lies: APY, APR, and what the numbers actually mean

Yield farming returns are universally quoted as APY or APR, and both numbers lie, though in different ways.

APR, annual percentage rate, is the simple interest rate without compounding. If a pool earns 1% per month on deposits, its APR is 12%. The number is honest about what the rate has been but says nothing about what it will be: APR is backward-looking, a measurement of recent performance extrapolated to a year, and DeFi rates change daily or hourly based on capital flows and demand. A pool showing 50% APR when you check it may show 5% APR a week later because $100 million in new deposits arrived and diluted the yield.

APY, annual percentage yield, includes the effect of compounding. The same 1% per month, compounded, produces an APY of 12.68%. In DeFi, the compounding frequency varies: some vaults compound daily, others weekly, and the difference in APY can be significant for high-yield positions. The number is useful for comparing strategies with different compounding frequencies but adds a layer of abstraction that can obscure the underlying rate.

Both metrics share a critical flaw when applied to incentivized farming: they value the reward tokens at their current price. A pool showing 200% APY in governance token rewards assumes the governance token maintains its current price for the entire year. If the token drops 80%, which is not unusual for newly-launched DeFi tokens, the real APY is 40%, and if everyone who farmed the token sells their rewards simultaneously (which is what typically happens), the selling pressure itself drives the price down, creating a reflexive loop where the advertised yield self-destructs.

The honest way to evaluate yield farming returns is to decompose the yield into its sources and assess the sustainability of each. Fee-based yield from trading volume is sustainable as long as the trading volume persists. Interest from lending is sustainable as long as borrowing demand exists. Governance token incentives are sustainable only if the token’s price absorbs the emission schedule without collapsing. Points-based yields are entirely speculative until the token launches. Any headline APY above 15-20% for stablecoin strategies or 30-50% for volatile pair strategies should be treated with skepticism and decomposed into its sources before capital is committed.

Impermanent loss: the cost the headline yield hides

Impermanent loss is the single most important concept in yield farming, and it is the one most farmers understand least well. It occurs whenever you provide liquidity to a constant-product AMM (like Uniswap) and the price ratio of your deposited tokens changes relative to when you deposited them.

The mechanism is mathematical and unavoidable. A constant-product AMM maintains the invariant x * y = k, where x and y are the quantities of the two tokens in the pool and k is a constant. When an external price change occurs, arbitrageurs trade against the pool to bring its internal price in line with the market price, and this rebalancing changes the composition of your position. If you deposited 50% ETH and 50% USDC and ETH doubles in price, arbitrageurs will buy ETH from the pool (cheap relative to the market) and sell USDC into it, leaving the pool with less ETH and more USDC. Your position is now worth less than if you had simply held the original tokens in your wallet.

The magnitude depends on the price change. A 1.25x price move produces approximately 0.6% impermanent loss. A 2x move produces 5.7%. A 5x move produces 25.5%. For concentrated liquidity positions, where capital is allocated to a narrow price range, the impermanent loss is amplified proportionally to the concentration factor, creating a tradeoff between higher fee earnings and higher impermanent loss exposure.

The term “impermanent” is misleading. The loss is impermanent only in the sense that it reverses if the price ratio returns to its original value. In practice, prices rarely return to exactly where they were, and for trending assets, the loss is permanent and growing. For stablecoin-stablecoin pairs (USDC/USDT), impermanent loss is negligible because both tokens track the same price. For volatile pairs (ETH/MEME, SOL/bonk), impermanent loss can easily exceed the trading fees earned, producing a net loss despite a seemingly positive APY.

The practical implication: impermanent loss must be subtracted from the headline yield to determine the real return. A pool showing 30% APY in trading fees but experiencing 15% impermanent loss is actually yielding 15%. A pool showing 10% APY with 12% impermanent loss is losing money. Tools like APY.vision, Revert.finance, and DeBank allow farmers to track their actual P&L including impermanent loss, and anyone providing liquidity without tracking this number is flying blind.

The risk stack: what can go wrong, ranked by frequency

Yield farming risks form a hierarchy, and the most common risks are not the ones that make headlines.

Token price decline is the most frequent source of loss. If you farm with volatile tokens and the token price drops 40%, your 15% APY is irrelevant: you lost money. This is not a DeFi-specific risk but a market risk that yield farming amplifies because it encourages deploying capital into the highest-yield (often the highest-volatility) opportunities.

Impermanent loss, as described above, is the second most common source of loss for liquidity providers. It is predictable, measurable, and almost universally underestimated.

Smart contract exploits are the most consequential risk. DeFi protocols are code, and code has bugs. In 2024, over $1.7 billion was stolen from DeFi protocols through smart contract exploits, oracle manipulation, and governance attacks. Your deposited funds are held in smart contracts that can be exploited, and the composability of DeFi, where one protocol deposits into another which deposits into a third, creates cascading risk: a bug in a downstream protocol can affect every protocol built on top of it. Audits reduce but do not eliminate this risk; some of the largest exploits have targeted audited code.

Rug pulls and protocol abandonment are distinct from exploits. In smaller, newer protocols, the development team may drain the protocol’s funds and disappear, or simply stop maintaining the code and let the protocol decay. Rug pulls are less common on major, established protocols but remain a significant risk in the long tail of DeFi, particularly on newer chains where the protocol ecosystem is less mature.

Liquidation risk applies to leveraged farming strategies. If you borrow against your deposits and the collateral value drops, the protocol liquidates your position, selling your collateral to repay the loan, often at a significant loss. During sharp market downturns, cascading liquidations create forced selling that amplifies the crash, and leveraged farmers are the first casualties.

Regulatory risk is the slowest-moving but potentially the most disruptive. Centralized yield products, Celsius, BlockFi, Gemini Earn, were shut down or restructured under SEC enforcement. Pure DeFi yield farming, interacting directly with permissionless smart contracts, has not been directly targeted, but the regulatory boundary between “decentralized” and “centralized” is legally ambiguous, and the DeFi frontends that most users interact with are operated by companies subject to jurisdiction.

The Curve Wars and the economics of liquidity incentives

No discussion of yield farming is complete without the episode that revealed the mechanism’s deepest dynamics: the Curve Wars.

Curve Finance, a DEX optimized for stablecoin and similar-asset swaps, introduced a system where CRV token holders who locked their tokens for up to four years (receiving vote-escrowed CRV, or veCRV) could direct the protocol’s token emissions to specific liquidity pools. Pools receiving more emissions attracted more liquidity providers, which deepened liquidity, which improved trading execution, which attracted more volume, which generated more fees. The right to direct CRV emissions became, in effect, the right to attract liquidity, and protocols whose stablecoins or tokens needed deep Curve pools began competing for that right.

The competition took the form of bribes: protocols paid veCRV holders to vote for their preferred pools. Convex Finance emerged as the dominant intermediary, aggregating CRV deposits and voting power and selling governance votes to the highest bidder. At the peak of the Curve Wars, protocols were paying $1.50-2.00 in bribes per $1 of CRV emissions directed to their pools, a ratio that only made sense because the liquidity those emissions attracted was worth more to the protocol than the bribe cost.

The Curve Wars revealed a fundamental truth about yield farming economics: liquidity is a commodity that goes to the highest bidder, and yield farming returns are, in the long run, determined by the cost protocols are willing to pay to rent that liquidity. When protocols pay high incentives, yields are high. When they stop paying, yields collapse and capital migrates elsewhere. The farmer who understands this dynamic, that they are selling a service (liquidity) to protocols willing to rent it, has a fundamentally clearer view of their position than the farmer who believes high yields are a natural property of DeFi.

Yield farming and US taxes: the compliance reality

US tax treatment of yield farming is complex, largely ungoverned by specific guidance, and imposes significant record-keeping burdens on active farmers.

Every yield farming reward is a taxable event. The IRS treats tokens received as farming rewards, whether from trading fees, lending interest, governance token distributions, or vault profits, as ordinary income at fair market value when received. If you claim 100 COMP tokens worth $50 each, you owe income tax on $5,000, regardless of whether you sell the tokens. If you later sell those tokens at $80 each, you owe capital gains tax on the $3,000 gain ($30 per token times 100 tokens). If you sell at $20 each, you have a $3,000 capital loss that can offset other gains.

Compounding creates a tax nightmare. Vaults that auto-compound, selling reward tokens and redepositing the proceeds, generate a taxable event at every compound cycle. A vault that compounds daily creates 365 taxable events per year, each requiring the fair market value of the tokens at the moment of compounding. No DeFi protocol issues 1099 forms. The burden of tracking every event falls entirely on the farmer.

Impermanent loss has no clear tax treatment. The IRS has not addressed whether impermanent loss constitutes a realized loss (deductible against income) or an unrealized loss (not deductible until the LP position is closed). Most tax advisors treat impermanent loss as realized only upon withdrawal of the LP position, but the treatment is not settled.

Token swaps within a strategy are taxable. If a vault sells governance tokens for stablecoins as part of its compounding strategy, each swap is a taxable disposition. Multi-hop strategies that involve three or four token swaps per cycle generate taxable events at each hop.

The practical advice for US yield farmers: use a crypto tax tracking platform (Koinly, CoinTracker, TokenTax, ZenLedger) from day one. Retroactive tracking across multiple chains, protocols, and wallet addresses is exponentially harder than real-time tracking. Budget for tax compliance as a cost of farming, because the marginal gains of active yield farming can be significantly reduced by the tax and accounting costs of documenting them.

How to start: a practical path for beginners

If you want to explore yield farming, a progressive approach minimizes your risk while building your understanding.

Begin with stablecoin lending. Deposit USDC or USDT into Aave on Ethereum mainnet or Arbitrum. The yield is modest, currently 3-8% depending on market conditions, but the risk profile is the simplest in DeFi: no impermanent loss, single-asset exposure, and Aave is one of the most audited and battle-tested protocols in the ecosystem. This step teaches you the mechanics of connecting a wallet, approving transactions, depositing, and monitoring a position.

Graduate to stablecoin LP positions. Providing USDC/USDT liquidity on Curve earns trading fees from stablecoin swaps with minimal impermanent loss (both tokens track the dollar). The yield is typically higher than pure lending, and the experience teaches you how LP positions work, how to read pool statistics, and how to claim and compound rewards.

Explore yield aggregator vaults. Depositing into a Yearn or Beefy vault automates the compounding process and exposes you to the vault’s strategy, which may span multiple protocols. Read the vault’s strategy description, understand what protocols it deposits into, and check the TVL and age of the vault (older, larger vaults have been more heavily tested).

Only after you are comfortable with these steps should you consider volatile pair liquidity provision, concentrated liquidity positions, or leveraged strategies. Each step up the complexity ladder adds risk, and the most common yield farming losses come from farmers who jumped to advanced strategies before understanding the basics.

Regardless of strategy, follow these operational principles: use established protocols with multiple audits and significant TVL. Deploy capital you can afford to lose. Monitor your positions regularly. Use hardware wallets for large deposits. Diversify across multiple protocols and chains. Track your taxes from day one. And remember the fundamental question: if you do not know where the yield comes from, you are the yield.

Frequently asked questions

Disclaimer: This article is for informational purposes only and should not be considered financial or investment advice.

On November 29, 2024, a perpetual futures exchange called Hyperliquid distributed 31% of its total token supply to users who had traded on the platform. There was no venture capital allocation to dilute the drop. There was no points program with opaque conversion ratios. The protocol simply looked at who had used the product, calculated their allocation based on trading activity, and sent the tokens. Some active traders received allocations worth six figures. A few exceeded a million dollars. The HYPE token launched at $2 and traded above $30 within weeks, making it the most valuable airdrop in crypto’s history and, briefly, a larger market-cap asset than some of the tokens it traded. The event was exceptional, but the mechanism behind it, distributing tokens to reward early users and bootstrap a decentralized community, has become one of the defining patterns of the crypto economy. This guide explains how airdrops work, the models that have evolved, the strategies that position wallets for eligibility, the scams that exploit the format, and the US tax obligations that most recipients discover too late.

The word “airdrop” entered the crypto vocabulary early, borrowed from military supply drops: tokens delivered to wallets from above, unsolicited and (initially) unexpected. The earliest airdrops were crude: protocols would distribute tokens to every Ethereum address that had ever transacted, or to holders of a specific token, as a marketing exercise to generate awareness. The tokens were often worthless and the strategy was indiscriminate, the crypto equivalent of dropping flyers from a plane. What transformed airdrops from a marketing gimmick into a serious economic mechanism was the retroactive model: rewarding people who had already used a product before they knew a reward was coming. This subtle shift changed everything. Instead of distributing tokens to build awareness, protocols began distributing tokens to reward genuine early adoption, aligning incentives between the protocol and its most committed users. The retroactive airdrop became, in effect, a delayed equity grant for early users, a mechanism without precedent in traditional technology. No web2 company has ever retroactively compensated its earliest users with ownership stakes. Crypto protocols do it routinely, and the practice has distributed billions of dollars to millions of wallets since Uniswap established the template in September 2020.

How airdrops work: the mechanics from snapshot to claim

The mechanics of a modern airdrop follow a consistent pattern, though the details vary between protocols.

The process begins with a snapshot: at a specific block number, the protocol records the state of every wallet that interacted with it. The snapshot captures a moment in time, a frozen record of who used the product, how much they used it, and what they did. Snapshot dates are typically announced only after they have passed, preventing users from gaming the system by rushing to interact before the cutoff. Some protocols take multiple snapshots across different dates, weighting allocations toward sustained usage rather than one-time interactions.

After the snapshot, the protocol calculates allocations. The criteria vary but generally reward a combination of factors: total transaction volume, number of interactions, duration of usage (how many months was the wallet active), breadth of activity (how many different protocol features were used), and, increasingly, qualitative assessments of whether the usage appears organic or synthetic. The allocation formula is the airdrop’s most consequential design decision, because it determines who benefits and how much. Broad formulas that give every user a minimum allocation (Uniswap’s 400 UNI floor) maximize reach but dilute per-user value. Narrow formulas that heavily weight volume or duration concentrate value in power users but risk excluding the community members who would benefit most from governance participation.

Once allocations are calculated, the protocol publishes a claim page, typically a dedicated web application where users connect their wallet and claim their tokens. The claim process involves signing a transaction that triggers the distribution smart contract to release the allocated tokens to the connected wallet. Most airdrops impose a claim deadline, usually 30-90 days, after which unclaimed tokens revert to the protocol treasury or are redistributed. The deadline creates urgency and ensures that allocations reach active community members rather than sitting indefinitely in dormant wallets.

Some airdrops skip the claim process entirely and send tokens directly to eligible wallets, though this approach has fallen out of favor for two reasons: it creates an immediate tax liability for US recipients who did not ask for the tokens (more on this below), and it can trigger phishing confusion, where users see unknown tokens in their wallets and interact with them, potentially connecting to malicious contracts.

The evolution: from holder drops to retroactive rewards

The history of crypto airdrops is a story of increasing sophistication in answering a deceptively simple question: who deserves tokens?

The first generation of airdrops, roughly 2017-2019, answered “everyone.” Projects distributed tokens to all ETH holders, all users of a specific DeFi protocol, or anyone who filled out a form. The tokens were typically worthless or nearly so, and the primary purpose was awareness: getting the token name into wallets and onto portfolio trackers in the hope that some recipients would investigate further. The model was spray-and-pray, and its success rate matched that description.

The second generation, inaugurated by Uniswap’s September 2020 UNI airdrop, answered “people who used our product.” Uniswap distributed 400 UNI tokens (worth approximately $1,200 at launch) to every wallet that had ever made a swap on the platform, with larger allocations for liquidity providers. The airdrop was retroactive: users who had interacted with Uniswap months or years before the token existed received allocations based on their historical usage. The model was elegant in its incentive alignment: it rewarded genuine early adopters who had taken the risk of using an unproven protocol, and it distributed governance power to users who presumably understood the product they were governing. The UNI airdrop is the most important single event in airdrop history because it established the template that every subsequent major airdrop has followed.

The third generation, spanning 2022-2024, refined the retroactive model with tiered criteria and anti-sybil measures. Optimism’s OP airdrop weighted allocations across multiple criteria: Ethereum usage history, governance participation, multi-protocol interaction, and bridging activity. Arbitrum’s ARB airdrop used a point system that rewarded specific behaviors: bridging to Arbitrum, transacting regularly over time, using multiple protocols on the chain. These airdrops were more targeted than Uniswap’s flat-minimum approach, rewarding depth and duration of usage rather than mere existence.

The fourth generation, peaking in 2024-2025, introduced points programs as a pre-airdrop incentive layer. Instead of a retroactive surprise, protocols openly told users: “use our product, earn points, and points will convert to tokens at some future date.” EigenLayer’s restaking points, Blast’s ecosystem points, Ethena’s shards, and dozens of others used this model. Points programs solved one problem, they aligned user behavior in real time rather than retroactively, but created another: they transformed organic usage into calculated farming, attracted capital that would leave the moment points stopped accruing, and introduced a speculative dynamic where the uncertain conversion ratio spawned secondary markets for points trading. The fifth generation, represented by Hyperliquid’s direct distribution model, was in part a reaction against the fourth: no points, no VC allocation, just retroactive rewards to genuine users. Whether this approach becomes the new standard or an anomaly depends on whether protocols can sustain themselves without the VC funding that points programs are designed to complement.

The biggest airdrops in crypto history

The financial significance of airdrops is best understood through the events that defined the category. Each case study illustrates different design choices and their consequences.

Uniswap’s UNI airdrop (September 2020) distributed 15% of the total supply to past users. The minimum allocation of 400 UNI was worth roughly $1,200 at launch and reached $16,800 at UNI’s all-time high. The airdrop reached approximately 250,000 addresses and distributed $1.1 billion in value at peak prices. It established the retroactive model and created a governance structure for the most important decentralized exchange.

ENS’s airdrop (November 2021) rewarded users who had registered Ethereum Name Service domains, with allocations weighted by the duration and number of registrations. Early domain registrants who had held names for years received allocations worth tens of thousands of dollars. The airdrop was notable for rewarding long-term commitment to a public good rather than financial activity.

Arbitrum’s ARB airdrop (March 2023) distributed 11.5% of the total supply to early users of the layer-2 network. Allocations were calculated on a points basis with criteria including bridging, transaction frequency, duration of usage, and interaction with multiple protocols. Maximum allocations exceeded $10,000, and the airdrop reached over 600,000 addresses. The concurrent creation of the Arbitrum DAO, with a $3.5 billion treasury, made ARB one of the most consequential governance token launches in crypto history.

Jupiter’s JUP airdrop (January 2024) rewarded users of Solana’s leading DEX aggregator. The airdrop was notable for its scale on Solana, reaching hundreds of thousands of wallets, and for the turbulence of its launch, where high demand overwhelmed the claim interface and created a chaotic first hour of trading. Jupiter subsequently conducted additional airdrop rounds, distributing tokens over multiple events rather than a single drop.

Hyperliquid’s HYPE airdrop (November 2024) distributed 31% of the total supply to platform users with no VC allocation. The airdrop was the most valuable in crypto history by per-user value, with some active traders receiving allocations worth hundreds of thousands of dollars. HYPE launched at approximately $2 and traded above $30 within weeks, reaching a fully diluted valuation that briefly exceeded $30 billion. The drop was widely celebrated for its fair distribution model and for demonstrating that a protocol could bootstrap a community without venture capital dilution.

EigenLayer’s EIGEN airdrop (May 2025) distributed tokens to users who had restaked ETH through the protocol’s restaking infrastructure. The airdrop was one of the most anticipated in crypto’s history, given the billions of dollars deposited in EigenLayer’s contracts, but also one of the most controversial: the points-to-token conversion ratio was lower than many depositors expected, and geographic restrictions excluded users in several jurisdictions. The episode crystallized the risks of points-based airdrop farming: uncertain conversion, geographic risk, and the mismatch between depositor expectations and protocol decisions.

How to position yourself: strategies that have worked

While no airdrop is guaranteed, retroactive analysis of successful airdrops reveals consistent patterns that have historically qualified wallets for significant allocations.

Use protocols early and consistently. The most valuable airdrop allocations go to wallets that used a product during its earliest months, before it had significant traction. Early usage signals genuine interest rather than airdrop farming, and protocols consistently weight allocations toward users who took the risk of trusting unproven code with their capital. The corollary: a single interaction months before the snapshot is typically worth more than dozens of interactions in the week before, because early usage is harder to fake.

Be a genuine, multi-dimensional user. Protocols increasingly use breadth of activity as a quality signal. A wallet that bridged to a chain, swapped on its DEX, provided liquidity, participated in governance, and used multiple dApps across multiple months reads as an organic user. A wallet that made one swap of exactly $100 on the first of every month for six months reads as a bot. The more closely your on-chain behavior resembles how someone who actually uses and cares about the protocol would behave, the more likely you are to qualify for meaningful allocations.

Provide liquidity and stake. Protocols value capital commitment because it directly benefits the ecosystem. Depositing tokens into liquidity pools, lending markets, or staking contracts signals that you are contributing to the protocol’s function, not just passing through. Liquidity provision, lending deposits, and staking consistently trigger higher-tier airdrop allocations than transactional usage alone.

Participate in governance and community. Voting on proposals, delegating governance tokens, and participating in governance forums have qualified wallets for airdrops from Optimism, Gitcoin, and ENS. Community participation signals alignment with the protocol’s long-term goals rather than extractive, farm-and-dump behavior.

Use multiple chains. The cross-chain ecosystem rewards users who bridge and transact across Ethereum, Arbitrum, Optimism, Base, Solana, Cosmos, and emerging chains. Bridging activity is a common airdrop criterion because it demonstrates willingness to explore the broader ecosystem rather than staying on a single chain.

Track announcements but do not trust secondary sources. Airdrop eligibility criteria are published by the protocol team on their official website, blog, or X/Twitter account. Third-party aggregator sites (airdrops.io, earni.fi, DeFi Llama’s airdrop page) compile upcoming opportunities but should be verified against primary sources. Never connect your wallet to a site you discovered through a DM, an ad, or an unsolicited link.

The sybil problem: farming, filtering, and the arms race

The most significant challenge facing the airdrop model is the tension between rewarding genuine users and resisting industrial-scale farming.

Sybil farming is the practice of operating dozens or hundreds of wallets, each executing a scripted set of interactions designed to qualify for airdrop allocations, effectively multiplying one person’s allocation by the number of wallets they control. At its peak, airdrop farming operations ran thousands of wallets, each with automated transaction flows that mimicked organic user behavior, and the operators treated farming as a business with calculable costs (gas fees, bridging costs, time) and expected returns (airdrop allocations across the wallet fleet).

The countermeasure is sybil detection: analyzing on-chain activity patterns to identify clusters of wallets controlled by the same entity. Common detection signals include: wallets funded from the same source, wallets that execute identical transaction sequences within the same time window, wallets that all bridge identical amounts on the same day, and wallets that interact with the same set of contracts in the same order. LayerZero’s 2024 airdrop was the most aggressive sybil filtering exercise to date: the protocol invited users to self-report sybil activity in exchange for a reduced (but nonzero) allocation, then used on-chain analysis to identify and disqualify wallets that did not self-report. The exercise disqualified thousands of addresses and demonstrated that the days of low-effort sybil farming producing outsized returns are likely over.

On-chain identity systems are the next frontier of sybil resistance. Gitcoin Passport aggregates identity signals, social media accounts, government ID verification, participation in specific communities, into a composite score that protocols can use as an eligibility criterion. Worldcoin’s proof of personhood, based on iris scanning, offers a more extreme version: cryptographic proof that a wallet belongs to a unique human. The tradeoff between sybil resistance and privacy is explicit: the more identity information you provide, the harder it is to farm, but the more you sacrifice the pseudonymity that attracted many users to crypto in the first place.

The arms race between farmers and protocols is permanent. Every new filtering technique inspires new evasion strategies: more realistic transaction patterns, more diversified funding paths, human-assisted farming operations that blend automated and manual behavior. The equilibrium is that farming remains profitable for sophisticated operators but increasingly unprofitable for casual copy-paste farming, and the majority of airdrop value flows to genuinely organic users, which is the outcome protocols want even if it is never perfectly achieved.

Airdrop scams: the taxonomy and how to survive

For every legitimate airdrop, there are orders of magnitude more scam attempts, and the scam ecosystem is industrialized, creative, and dangerous.

Fake claim sites are the most common and most effective scam vector. Within minutes of a legitimate airdrop announcement, scammers launch dozens of websites that visually clone the official claim page. They distribute links through social media ads, phishing emails, fake project accounts, and paid promotions. When a user connects their wallet and signs a transaction on the fake site, the transaction does not claim tokens but instead approves a malicious contract to drain the wallet’s existing assets. The defense is verification: never use a claim link from a tweet, DM, email, or ad. Go directly to the protocol’s official website (bookmarked, not searched) and find the claim link from there. Verify the contract address on Etherscan before signing anything.

Phishing tokens are the second major vector. Scam tokens appear in your wallet unsolicited, showing a deceptive name (“AIRDROP,” “Claim at [malicious URL],” or the name of a legitimate protocol). The tokens are designed to bait you into interacting with them: swapping, transferring, or visiting the URL embedded in the token name. Any interaction can trigger a transaction that grants a malicious contract access to your real assets. The rule is absolute: never interact with tokens you did not expect to receive. Hide them in your wallet interface and ignore them entirely.

Social engineering exploits trust and urgency. Scammers impersonate project team members on Discord and Telegram, sending direct messages about “early access” to airdrops, “whitelisting” opportunities, or “unclaimed allocations” that will expire soon. Legitimate project teams never initiate direct messages about airdrops. Any DM claiming to offer an airdrop is a scam, without exception.

“Send to receive” scams are the simplest and oldest form. A scammer claims you can unlock or multiply your airdrop allocation by sending tokens to a specific address. No legitimate airdrop requires you to send crypto first. If someone asks you to send tokens to receive tokens, it is a scam, full stop.

Operational security for airdrop claims should be routine: use a dedicated claiming wallet that does not hold your main assets. Check contract addresses against verified sources before signing. Never sign unlimited token approvals. Revoke approvals after claiming (tools like revoke.cash make this straightforward). Treat every claim interaction as potentially hostile until verified through primary sources.

US taxes: the IRS position and the trap it creates

The US tax treatment of airdrops is one of the least understood and most consequential aspects of the crypto tax landscape, and it creates a trap that catches thousands of recipients every airdrop season.

The IRS position is clear: airdropped tokens are taxable as ordinary income at fair market value on the date of receipt. For claimable airdrops, the receipt date is when you claim the tokens, not when the snapshot was taken and not when the tokens were announced. For direct-send airdrops where tokens appear in your wallet without any action on your part, the receipt date is when the tokens arrive. The income is taxed at your ordinary income tax rate, which can be as high as 37% federal plus state taxes.

The trap operates as follows. A user claims 10,000 tokens worth $5 each on claim day: $50,000 in ordinary income. They owe approximately $15,000-20,000 in taxes (depending on their bracket and state). They hold the tokens because they believe the price will rise. The token’s price drops 80% over the following months, as many airdropped tokens do when the initial distribution wave triggers selling pressure. The user’s tokens are now worth $10,000, but they still owe $15,000-20,000 in taxes on the original $50,000 income event. Selling the tokens at $10,000 creates a $40,000 capital loss ($50,000 cost basis minus $10,000 sale price), which can offset capital gains from other sources, but capital losses in excess of $3,000 per year can only be carried forward, not applied against ordinary income. The result: a net tax liability on tokens that produced an actual loss. The farmer who claimed and immediately sold at least locked in the proceeds to cover the tax bill. The farmer who held and watched the price decline is paying taxes on money they never received.

The compliance burden is entirely on the recipient. No DeFi protocol issues 1099 forms for airdrops. No centralized claim page reports your allocation to the IRS. You are responsible for tracking the date of receipt, the fair market value at that moment, and the subsequent cost basis for every airdropped token. For active airdrop farmers who claim tokens from multiple protocols across multiple chains, the record-keeping burden is substantial and the consequences of noncompliance are the same as for any other unreported income.

The practical advice is to make the tax decision at the moment of claiming. If you claim tokens worth $X, decide immediately whether you are holding or selling. If holding, set aside the estimated tax obligation in cash. If selling, sell enough to cover the tax bill and treat the remainder as risk capital. The worst outcome, and the most common one, is claiming tokens, doing nothing, watching the price decline, and discovering the tax bill at filing time.

Where airdrops go from here

The airdrop model is at an inflection point. Several forces are reshaping how protocols think about token distribution.

Points fatigue is real. After two years of points-based programs with uncertain conversion ratios, the community has developed meaningful skepticism toward programs that ask for capital commitment without concrete token commitments. Hyperliquid’s success was partly a reaction to points fatigue: its clean, direct distribution was perceived as more honest than the opaque points systems that preceded it. Protocols launching in 2026 face higher expectations for transparency about token allocation and distribution timelines.

Sybil resistance is improving but imperfect. On-chain analysis, identity verification, and machine learning are making industrial farming less profitable, but they have not eliminated it. The arms race continues, and the equilibrium will likely stabilize at a point where farming remains viable for sophisticated operators but unprofitable for casual copy-paste approaches. The cost of being identified as a sybil, permanent exclusion from future airdrops and potential reputation damage, is increasing.

Regulatory pressure is building. As airdrops distribute larger amounts of value and more US residents participate, the IRS and SEC’s interest grows. Future airdrops to US recipients may require KYC verification, which would fundamentally change the permissionless character of the mechanism. Some protocols have already geo-blocked US users from claiming, either out of regulatory caution or because the legal analysis of whether their token constitutes a security has not produced a comfortable answer.

Revenue sharing is emerging as an alternative. Instead of one-time token airdrops, some protocols are shifting toward ongoing revenue sharing with active users, paying a portion of protocol fees to users who contribute liquidity, volume, or other measurable value. This model is more sustainable than one-time drops because it rewards continued engagement rather than past usage, and it avoids the sell-pressure dynamics that plague token launches. Whether revenue sharing replaces airdrops or complements them is an open question, but the trend toward more sustainable, less speculative distribution mechanisms is clear.

The underlying dynamic will not change: protocols need users, users respond to incentives, and the most effective incentive crypto has ever produced is the retroactive distribution of value to early adopters. The format will evolve, the filtering will improve, the regulatory environment will tighten, and the tax obligations will persist, but the fundamental mechanism, rewarding those who bet on a product before the crowd arrives, is too powerful to abandon. The airdrop is not going away. It is growing up.

Frequently asked questions

Disclaimer: This article is for informational purposes only and should not be considered financial or investment advice.

U.S. spot Bitcoin ETFs attracted $233.1 million in net inflows on July 30, recording their strongest daily result in more than three weeks. 

BlackRock’s iShares Bitcoin Trust led the session with $183.4 million, according to Farside Investors’ daily flow table.

The inflow returned the funds to positive territory for both the week and July. However, the session represents renewed buying rather than proof of a lasting reversal. The SoSoValue Bitcoin ETF dashboard reported total net assets of about $78.76 billion after the July 30 session.

Bitcoin ETFs returned to positive weekly flows

BlackRock’s IBIT accounted for 78.7% of the daily total. Bitwise’s BITB followed with $20.7 million, while Fidelity’s FBTC added $15.5 million. Morgan Stanley’s MSBT received $7.4 million, VanEck’s HODL added $2.3 million and Grayscale’s Bitcoin Mini Trust recorded another $2.3 million.

ARK 21Shares’ ARKB added $1.5 million, while the remaining products recorded no flows. No fund reported a net outflow during the session, making the rebound broader than an IBIT-only increase, although BlackRock still supplied most of the demand.

The funds entered July 31 with about $203.9 million in weekly net inflows, based on Farside’s figures for Monday through Thursday. A Friday outflow larger than that amount would return the week to negative territory. Otherwise, the products would complete a fourth consecutive positive week.

However, Bitcoin ETFs began July by ending a ten-day withdrawal run with $221.7 million in inflows. Demand then strengthened and weakened several times, showing that institutional flows remained uneven rather than moving in one direction.

BlackRock’s IBIT controlled most of the rebound

IBIT’s $183.4 million inflow was its largest since July 6, when the fund attracted $209.4 million. That earlier session helped the broader ETF group collect $265.7 million, which remains July’s strongest daily result through July 30.

BlackRock’s official IBIT fund page listed $47.67 billion in net assets and almost 1.3 billion shares outstanding on July 30. The fund’s net asset value rose 1.26% that day to $36.68, while its Bitcoin benchmark stood at $64,764.70.

IBIT therefore represented more than 60% of the approximately $78.76 billion held across the U.S. spot Bitcoin ETF group. Its size means changes in BlackRock’s creations and redemptions can heavily influence the combined daily total.

As crypto.news reported earlier in July, IBIT’s return to inflows followed a prolonged period of weak activity and repeated withdrawals. The latest session extends that recovery, but BlackRock also recorded outflows on July 27 and July 28 before returning to positive flows.

July may end two months of Bitcoin ETF outflows

Farside’s daily figures show approximately $438.2 million in net Bitcoin ETF inflows from July 1 through July 30. SoSoValue’s total was slightly lower at about $437.8 million, reflecting small differences in data timing and calculation methods.

A positive July would end two consecutive months of withdrawals. Farside data indicate that the products lost about $2.41 billion in May and $4.51 billion in June. The July recovery has therefore regained only a small part of the capital removed during those months.

crypto.news examined the record 13-day outflow streak that removed approximately $4.37 billion between May 15 and June 3. Total ETF assets fell sharply during that period as redemptions combined with Bitcoin’s declining market price.

The latest daily inflow is constructive, but it remains modest compared with the fund group’s total assets. A longer sequence of positive sessions would provide stronger evidence that investors are rebuilding exposure rather than making short-term allocations.

Bitcoin’s price has not confirmed a wider reversal

Bitcoin traded near $63,144 on July 31, according to CoinGecko market data. Its 24-hour range extended from approximately $62,785 to $65,006, leaving the asset below the benchmark price used for BlackRock’s July 30 fund valuation.

ETF assets and Bitcoin’s price rose strongly through much of 2024 and 2025 before declining from their later peaks. The July 30 inflow interrupted a more inconsistent flow pattern, but one session cannot establish that the longer decline has ended.

ETF creations can support demand because authorized participants facilitate new fund shares and the trusts increase their Bitcoin exposure. However, Bitcoin also responds to derivatives positioning, macroeconomic conditions, exchange activity and sales by existing holders. ETF flows should therefore be treated as one market indicator rather than a standalone price signal.

Ethereum ETFs added a smaller $13M inflow

U.S. spot Ethereum ETFs also returned to positive daily flows. SoSoValue’s Ethereum ETF dashboard reported approximately $13.29 million in net inflows on July 30, led by BlackRock’s ETHA with $16.24 million.

Farside calculated a slightly lower group total of $12.8 million. Its table showed ETHA adding $16.2 million, while Fidelity’s FETH lost $2.9 million and Grayscale’s ETHE recorded $1.6 million in outflows. Smaller inflows into Bitwise’s ETHW and 21Shares’ TETH partially offset those withdrawals.

BlackRock’s official ETHA page listed $5.57 billion in net assets on July 30. Its NAV increased 1.11% to $14.50, while the fund’s Ether benchmark stood at $1,922.06.

The final July result will depend on flows recorded during the July 31 U.S. trading session. Investors will watch whether Bitcoin ETFs preserve their weekly and monthly gains and whether Ether products extend their more frequent July inflows.

AFX has announced that it has prepared a goodwill plan for users affected by last week’s $24.15 million bridge exploit, with the recovery proposal scheduled for release on Aug. 3.

According to an announcement shared by AFX, the decentralized derivatives protocol is finalizing a goodwill plan following the July 22 security incident and will publish the details on Monday, Aug. 3. The team said investors, employees and early supporters had all been affected by the attack and asked the community to remain patient while it completes the final proposal.

The update comes after AFX completed its technical investigation into the exploit, which resulted in the theft of about 24.15 million USDC from an AFX-operated custody bridge. The protocol has not yet disclosed how compensation or recovery will be structured, but said its next announcement will focus on the goodwill plan.

Earlier public statements confirmed the exploit targeted infrastructure operated by AFX rather than Arbitrum’s native bridge. At the time, blockchain security firm Blockaid and the Arbitrum team investigated the incident, while Offchain Labs co-founder Steven Goldfeder said the suspicious transaction originated from a third-party protocol instead of Arbitrum’s core bridge.

AFX says attack started with a developer

In a detailed post-mortem released after the incident, AFX said the breach originated from a social engineering campaign against one of its developers rather than a vulnerability in its smart contracts or blockchain infrastructure. According to the protocol, the attacker posed as a recruiter from a company called Oddium Lab on July 9 and convinced the developer to clone what appeared to be a legitimate software repository.

AFX said the repository contained a malicious Git configuration that executed a hidden payload during a routine Git workflow, giving the attacker an initial foothold inside the developer’s workstation. Using the compromised device, the attacker gradually expanded access across internal development systems before downloading project source code several days later.

The investigation said the attacker later uploaded a malicious Groovy plugin into the protocol’s JFrog artifact repository, obtaining remote code execution inside the software delivery environment. According to AFX, repeated out-of-memory events on the JFrog server were initially treated as operational problems with assistance from the vendor, allowing the malicious plugin to survive multiple restarts without triggering a security response.

Forensic analysis later found that the attacker had replaced system binaries with trojanized versions, injected malicious shared libraries and attempted to erase security logs before portions of the malware crashed. SELinux logs captured outbound command-and-control traffic, shell execution and in-memory code execution that became important evidence during the investigation, according to the report.

Validator compromise enabled the bridge theft

The protocol said the attacker eventually pivoted from the compromised development environment into its operational infrastructure using an internal Ansible-based management service that already held privileged access to validator nodes. Rather than stealing new credentials or exploiting an external service, the attacker used existing trust relationships to deploy malicious payloads across a subset of validators.

AFX said the infected validator nodes downloaded a second-stage payload from a remote server before interfering with consensus-message handling. At 9:27 p.m. UTC on July 22, the affected validators co-signed a bridge transaction that transferred roughly 24.15 million USDC from the AFX-operated custody bridge.

The protocol said its investigation found no evidence that the Arbitrum network or Arbitrum’s native bridge had been compromised. The attack remained confined to infrastructure managed by AFX, matching statements previously issued by Offchain Labs and Blockaid during the initial response.

On-chain investigators later tracked the stolen USDC after it moved from Arbitrum to Ethereum, where the proceeds were converted into approximately 12,467 ETH. At the time of the initial investigation, no public reports confirmed that any portion of the stolen assets had been recovered.

Investigation points to supply chain compromise

According to AFX, the incident demonstrated that software supply chain attacks can bypass blockchain security without exploiting smart contracts directly. The protocol concluded that the attack relied on trusted development tools, internal deployment systems and validator infrastructure instead of weaknesses in on-chain code.

The report said the protocol has rebuilt affected infrastructure, rotated operational credentials, increased monitoring sensitivity and migrated production systems into a more isolated environment with zero-trust segmentation. Additional work planned over the coming months includes stronger behavioral monitoring, mandatory security reviews before restarting production services, expanded threat-hunting exercises and employee training against social engineering attacks.

Based on forensic evidence, attack techniques and infrastructure observed during the investigation, AFX said its findings are consistent with independent attribution linking the incident to UNC4899, also known as TraderTraitor, a DPRK-linked threat group tracked by Mandiant, Microsoft Threat Intelligence, the FBI and CISA. The protocol said it continues working with external security partners to trace the stolen assets and support ongoing response efforts.

Off-chain attacks have surfaced in multiple DeFi exploits

The latest findings add to a series of incidents in which protocols have concluded that attackers compromised supporting infrastructure instead of exploiting flaws in smart contracts.

On July 30, Ostium said its investigation into a separate 23.75 million USDC exploit found that unauthorized access to off-chain infrastructure allowed fraudulent BTC-USD price reports to drain funds from its liquidity vault, while its smart contracts and governance multisigs remained uncompromised. 

Earlier this month, Singapore-based stablecoin payments firm Triple-A also disclosed unauthorized access to treasury wallets holding company-owned digital assets, although it said customer funds and payment operations were unaffected.

Blockchain asset management protocol Swan Treasury has suffered an estimated $625,000 loss after attackers exploited a leaked off-chain signer key to buy STY tokens at a steep discount before selling them for profit.

According to blockchain security firm Defimon Alerts, the exploit took place on BNB Chain after the protocol’s off-chain signer key, hardcoded as the _signer address in the ZhaiquanBuy contract, was compromised.

The attacker used the leaked key to generate valid signatures for their own wallet, allowing them to bypass the protocol’s intended purchase restrictions.

Swan Treasury exploit relied on leaked signer key

Defimon Alerts said the attacker manipulated the buy() function, which calculates the amount of STY a user receives based on a signed discount value. By generating a valid signature with the discount parameter set to one, the attacker purchased STY at roughly one-hundredth of its intended price.

Using a PancakeSwap flash loan worth about 19,700 USDT, the attacker acquired nearly 687,000 STY tokens through the discounted purchase mechanism.

The security firm said the exploit did not stop there. Valid signatures were also forged for the protocol’s claim() and transfer() functions on related contracts, giving the attacker additional access to STY before selling the tokens into the STY/USDT liquidity pool.

After unwinding the position, the attacker realized about 625,000 USDT in profit, according to Defimon Alerts.

STY traded at approximately $2.87 at the time of the incident, the firm’s alert noted.

Transaction analysis points to a compromised private key

In its technical assessment, Defimon Alerts said every ecrecover operation observed during the exploit resolved to the protocol’s hardcoded signer address rather than any attacker-controlled account.

The firm said this behavior indicates the private signer key itself had been compromised instead of the protocol containing a flaw in its signature verification logic. Because the generated signatures matched the expected signer exactly, the transactions appeared valid to the affected smart contracts.

The finding narrows the likely cause of the exploit to unauthorized access to the protocol’s signing credentials rather than an error in the cryptographic verification process.

At the time of publication, Swan Treasury had not publicly explained how the signer key was exposed or whether additional mitigation measures had been implemented.

Private key compromises continue to drive crypto losses

The incident adds to a series of crypto attacks in which compromised privileged keys, rather than smart contract bugs, allowed attackers to access protocol funds.

In June 2025, blockchain security company Hacken disclosed that a compromised private key tied to a contract with minting privileges enabled an attacker to create 900 million HAI tokens across Ethereum and BNB Chain. 

Hacken said the key was exposed while the company was making architectural changes to its blockchain bridge infrastructure, allowing the attacker to realize about $250,000 before the affected minting account was revoked and bridge operations were paused.

Separate research has also continued to identify private key exposure as one of the industry’s most persistent security risks. A Hacken report cited by crypto.news previously found that access control failures, including private key leaks, accounted for 78% of crypto hack losses recorded during 2024.

More recently, Zilliqa disclosed a flaw in its native Ledger application that could allow attackers to recover private keys from public transaction signatures. The network suspended native ZIL transactions after determining that a weakness in nonce generation made it possible to reconstruct affected keys once enough signatures had been collected. 

Zilliqa said the issue stemmed from its own Ledger application rather than Ledger hardware itself and instructed affected users to wait for recovery guidance instead of moving funds immediately.

Security researchers continue warning about key exposure

Academic researchers and crypto industry players have likewise warned that private key security remains vulnerable outside traditional smart contract exploits.

Researchers from the University of California reported earlier this year that some third-party AI routing services were capable of accessing sensitive credentials, including cryptocurrency private keys and seed phrases, because they process user requests in plaintext. 

During controlled testing, the researchers observed malicious behavior from several routing services and demonstrated that one intermediary successfully drained Ether from a test wallet after receiving its private key.

While the university study was unrelated to the Swan Treasury incident, the researchers concluded that developers should avoid exposing private keys or seed phrases to intermediary systems and instead rely on stronger cryptographic protections to reduce credential theft risks.

Bitcoin miners entered one of their longest periods of contraction by July 31, even as shares of several listed operators climbed on expectations for AI data-center revenue.

Bitcoin Magazine Pro calculated that mining difficulty had fallen 19.9% from its peak, making the decline the third deepest since application-specific integrated circuits replaced graphics processors as the industry’s main hardware.

Independent network data confirm the broader contraction. Bitcoin’s difficulty fell 0.74% on July 25 to 126.23 trillion after a larger 5% cut on July 11. The current level is about 19% below the record of roughly 156 trillion set in November 2025.

Bitcoin traded near $63,100 on July 31, down about 47% over 12 months and almost 50% below its October 2025 record. That price decline has reduced dollar revenue for miners while the protocol continues issuing only 3.125 BTC per block.

Bitcoin miner capitulation is visible in network data

Bitcoin’s seven-day average hashrate stood near 868 exahashes per second on July 29, down from more than one zettahash per second at its late-2025 peak. Hashrate Index placed the broader 30-day measure near 940 EH/s in its third-quarter review, about 12% below the December record of 1,066 EH/s.

Different data providers use different averaging windows, so they may not identify the same starting date for the decline. Bitcoin Magazine Pro’s claim that the drawdown had lasted 287 days reflects its chosen hashrate series. The precise duration may vary, but the downward direction is clear across public datasets.

NEAR Protocol has launched a staking-based payment system for its AI platform, allowing users to access confidential inference and autonomous AI agents by locking NEAR tokens instead of paying with a credit card.

According to an announcement published by NEAR Protocol on X, the new feature converts staked NEAR into monthly compute credits that can be used across the platform’s artificial intelligence services. 

Quantum Solutions and Hyperscale Data each redirected part of their crypto treasuries toward AI data centers on July 30. 

Tokyo-listed Quantum sold 1,000 ETH for $1.903 million, while U.S.-listed Hyperscale monetized about 100 BTC and established a Bitcoin-backed credit facility.

The transactions show two approaches to using digital assets as operating capital. Quantum converted Ethereum directly into cash. Hyperscale combined a Bitcoin sale with collateralized borrowing to finance its Michigan AI data center.

Quantum Solutions converts ETH into AIDC funding

Quantum’s subsidiary GPT Pals Studio sold 1,000 ETH at $1,903 per token, generating $1.903 million after transaction fees. The company expects to record a $100,970 loss, equal to about ¥17 million, because the sale price was below its May 31 carrying value of $2,003.97 per ETH. The accounting loss is not measured against the original purchase price.

The July transaction followed a June 16 sale of 904 ETH for about $1.61 million. Together, the two disposals raised roughly $3.51 million and reduced Quantum’s balance from 6,668.8 ETH to 4,764.8 ETH, a decline of about 28.6%.

Quantum increased its cumulative sale limit from 1,875 ETH to 4,375 ETH through October 30. The company may therefore sell another 2,471 ETH. However, its filing states that the higher ceiling “does not constitute a decision to immediately sell” the full amount. Future transactions will depend on ETH prices, funding requirements and progress in the AI Infrastructure Data Center business.

Most of Quantum’s remaining ETH is pledged

Of Quantum’s remaining 4,764.8 ETH, 3,050 ETH is pledged as collateral to a Singapore-based financial services company. Another 1,714.8 ETH remains in GPT Pals’ crypto trading account. The company has not identified the lender publicly.

The unused sale authorization exceeds Quantum’s freely held trading-account balance by 756.2 ETH. Selling the full authorized amount would therefore appear to require the release or replacement of some collateral, additional ETH purchases or another arrangement. Quantum has not announced plans to take any of those steps.

The sale also changed Quantum’s position among Japanese corporate Ethereum holders. Def Consulting reported 4,976 ETH on June 30, which is 211.2 ETH more than Quantum’s post-sale balance. Based on the companies’ latest disclosed figures, Quantum no longer appears to be Japan’s largest listed ETH holder, although the balances were reported on different dates.

Ascrypto.news previously reported, Quantum had become the largest Ethereum treasury company outside the U.S. after rapidly accumulating ETH in October 2025. Its latest disposals mark a shift from treasury expansion toward business funding.

In addition, Quantum said the proceeds would support data center contracts, GPU equipment and preparations for its AIDC business. In June, it signed a memorandum of understanding with Hong Kong-based Integrated Capital to examine financing and resource cooperation for a Japanese AI data center.

The proposed infrastructure would focus on systems using NVIDIA B300 and GB300 GPUs. However, the memorandum is nonbinding. Quantum said “specific investment amounts, financing conditions and implementation timing remain undecided.” The ETH sales therefore provide capital flexibility but do not confirm that a completed data center investment has been agreed.

Hyperscale Data monetizes 100 BTC for Michigan

Hyperscale Data separately said it monetized approximately 100 BTC and invested the proceeds into its Michigan AI data center campus. The company also created a Bitcoin-backed facility with an expected variable interest rate of 4.5% to 5%.

The release did not identify the lender, borrowing limit, maturity, collateral ratio or amount of Bitcoin pledged. Hyperscale had reported 1,106.0467 BTC on July 27, valued at about $71.7 million. Subtracting the stated sale would leave roughly 1,006 BTC, but that figure is an estimate because the company has not disclosed a precise post-transaction balance.

Hyperscale is building capacity for a neocloud provider under a definitive master services agreement. The initial deployment covers about 20 megawatts and has a ten-year term with two optional five-year extensions. The company estimates that the maximum term could produce more than $1.2 billion in revenue.

The customer also has an option for another 32 MW. Hyperscale said the expanded arrangement “would be expected” to raise total contract revenue above $3 billion if the capacity and extension options are exercised. Those amounts are conditional forecasts, not revenue already earned.

Crypto treasuries become operating finance tools

The announcements show digital-asset treasuries moving beyond passive holding. Quantum is selling ETH to fund a project that remains at an early stage. Hyperscale is selling and borrowing against Bitcoin to support a data center tied to a signed customer agreement.

The model is spreading across crypto-linked infrastructure companies. In related coverage, Core Scientific sold 2,385 BTC during the first quarter to fund AI capital expenditure. Crypto.news also found that listed miners had secured more than $70 billion in announced AI and high-performance computing contracts while selling Bitcoin to cover development costs.

Quantum’s next deadline is October 30, when its expanded ETH sale authorization expires. The company has promised disclosures if it makes additional sales and expects to recognize the ¥17 million loss in its fiscal second quarter.

Hyperscale said it will issue further construction, financing and operational updates. Investors will be watching for the credit facility’s full terms, an updated Bitcoin balance and evidence that planned Michigan capacity is delivered according to schedule.

KSNet has partnered with the Solana Foundation to test blockchain payments and AI-driven transaction systems for South Korea’s financial market.

KSNet announced on July 30 that it has signed a memorandum of understanding (MOU) with the Solana Foundation to jointly develop a next-generation digital asset payment infrastructure, with the partnership beginning through proof-of-concept projects focused on Solana Pay and AI-powered payment technology.

The agreement brings together KSNet’s domestic payment network and Solana’s blockchain infrastructure as both companies evaluate digital asset payments that can work alongside South Korea’s existing financial system. The first phase centers on technical verification rather than a commercial rollout.

Solana Pay will be tested on KSNet’s merchant network

As part of the first proof-of-concept, KSNet said it will test the integration of Solana Pay with the online and offline merchant payment network the company has built over the past 26 years. The demonstration will examine whether Solana Pay’s payment standard can operate within South Korea’s existing payment environment while remaining compatible with local merchant infrastructure.

The companies also said compliance requirements will form part of the testing process. KSNet plans to incorporate anti-money laundering (AML) controls into the payment system to prevent abnormal fund flows before any commercial deployment is considered.

In addition, the proof-of-concept will connect blockchain-based settlements with KSNet’s existing won settlement network. According to the company, the structure is intended to comply with domestic financial guidelines while reducing exchange-rate fluctuations and liquidity risks that can arise during digital asset settlements.

Rather than replacing traditional payment rails, the companies are testing how blockchain payments can operate alongside existing financial infrastructure under domestic regulatory requirements.

AI payment model will use the x402 protocol

A second proof-of-concept under the agreement focuses on artificial intelligence payments using the x402 protocol.

KSNet said it will evaluate the protocol by integrating it into an AI-based payment system that is already undergoing internal testing. The review will determine whether the technology is suitable for future payment services that rely on autonomous software agents.

The x402 protocol uses the HTTP 402 “Payment Required” status code, allowing AI agents to make small payments automatically when accessing APIs or paid online services without relying on conventional logins or credit card authentication.

According to the companies, machine-to-machine payment models require transactions to settle quickly while keeping processing costs low. Existing card payment systems have long faced cost challenges when handling very small payments because multiple intermediaries contribute to the overall fee structure.

The proof-of-concept will therefore examine whether blockchain infrastructure can support those payment models more efficiently while remaining compatible with existing financial systems.

Park Han-han, chief executive officer of KSNet, said the company plans to build on its payment and settlement experience to provide what it described as a secure payment infrastructure for users.

Following the technical validation, KSNet and the Solana Foundation said they intend to gradually explore commercialization models suitable for South Korea’s financial market.

Solana has continued expanding payment partnerships

The KSNet partnership adds another enterprise payments initiative to the Solana Foundation’s recent activities across financial services.

Earlier this month, the Solana Foundation partnered with SBI Holdings to establish SBI Solana Global, a venture focused on regulated on-chain financial infrastructure in Japan. According to the companies, the initiative includes work on yen-backed stablecoins, tokenized financial products, institutional settlement services, cross-border payments, and AI-related payment applications.

South Korea has also become part of Solana’s payment strategy. In April, Shinhan Card announced a proof-of-concept with the Solana Foundation to test stablecoin payments on Solana’s testnet. According to Shinhan Card, the pilot evaluates transaction performance, non-custodial wallet security, and blockchain payment infrastructure while examining hybrid financial services that combine conventional payment systems with decentralized finance.

Artificial intelligence has become another area of development for the blockchain network. Earlier this month, the Solana Foundation and Google Cloud introduced Pay.sh, a payment gateway that allows AI agents to purchase API access using stablecoins on Solana. According to the companies, the platform enables per-request payments for Google Cloud services, including Gemini, BigQuery, and Vertex AI, without requiring traditional API subscriptions.

Enterprise adoption has also extended into corporate finance. On July 22, Ramp launched Solana-powered stablecoin accounts that allow businesses to hold USDC and USDT, manage treasury balances, and make cross-border payments through a single financial workflow. Ramp said more than 70% of stablecoin payment volume on its platform occurs outside traditional banking hours, indicating continued demand for around-the-clock settlement.

Consumer payment products have also incorporated Solana’s infrastructure. Last year, Gemini introduced a Solana Edition credit card that automatically stakes SOL rewards earned from purchases, allowing users to participate in network validation while earning staking rewards through Gemini’s platform. 

The launch followed the exchange’s addition of USDC and USDT transfers on Solana, which Gemini said benefited from the network’s low fees and fast settlement times.

Ethereum price fell nearly 2% to about $1,883 on July 31 after another rejection below $2,000 weakened momentum and pushed the token toward a key technical support zone.

Ethereum price action today

According to data from crypto.news, Ethereum (ETH) price extended its retreat on Thursday after buyers failed to sustain a move toward the $2,000 psychological level.

The token traded at approximately $1,883 at the time of the charts, down 1.82% on the day. ETH reached an intraday high of $1,936 before falling to a low near $1,878, showing that sellers remained active above $1,900.

Price action on the 4-hour chart shows Ethereum breaking below the middle Bollinger Band at $1,906. The move placed ETH close to the lower band at $1,875, where buyers may attempt to stabilize the decline.

Short-term momentum has also deteriorated. The 4-hour Relative Strength Index fell to 43.02, below its moving average of 50.13. An RSI below 50 generally indicates that sellers have gained control, although the reading remains above the oversold threshold of 30.

Ethereum’s retreat follows several failed attempts to establish support above $1,930. Each rebound produced renewed selling, leaving the token inside a broader consolidation range instead of confirming a breakout.

What is driving the ETH decline?

Profit-taking near $1,950 and the continued defense of $2,000 appear to be the immediate technical drivers behind the decline.

The $2,000 level also sits close to the 50% Fibonacci retracement at $1,986.33 on the daily chart. That overlap has created a wider resistance zone where short-term traders may be closing positions rather than adding exposure.

Derivatives positioning likely amplified the pullback. The 3-day CoinGlass liquidation heatmap shows that ETH dropped sharply after trading around $1,920, passing through liquidity near $1,900 before reaching the upper $1,880s.

Leveraged traders who positioned for an immediate breakout above $2,000 faced pressure as the price moved in the opposite direction. Forced long closures can accelerate a decline because exchanges sell the underlying position when margin requirements are no longer met.

Broader conditions remain challenging for risk assets. The Federal Reserve’s decision to maintain elevated interest rates has kept financing conditions restrictive for US investors, while geopolitical uncertainty in the Middle East has supported a more defensive market posture.

Ethereum has also lacked the sustained spot demand needed to separate from those macro pressures. Weak on-chain activity and redemptions from spot Ethereum exchange-traded products have reduced two potential sources of buying support.

Ethereum support at $1,873 faces a test

Ethereum is now testing an important technical area between $1,873 and $1,875.

The daily chart places the 0.618 Fibonacci retracement at $1,873.50, while the 4-hour lower Bollinger Band stands at $1,875.19. The convergence makes this range the first level bulls need to defend.

A daily close below $1,873 would weaken the recovery structure that developed from the late-June low. The liquidation heatmap points to additional liquidity between approximately $1,850 and $1,870, making that area the next potential downside target.

Below $1,850, attention would shift toward $1,800. Losing that psychological support could expose the 0.786 Fibonacci retracement at $1,712.86, although ETH would need a much deeper correction to test that level.

Some longer-term indicators remain constructive. Chaikin Money Flow stood at 0.08 on the daily chart, suggesting capital flows were still marginally positive despite the price decline. The Aroon readings also showed Aroon Up at 71.43 and Aroon Down at zero, indicating that the broader July recovery had not been fully invalidated.

Those signals contrast with the weaker 4-hour RSI, showing a market in which the medium-term recovery remains intact but near-term momentum favors sellers.

Liquidation heatmap points to $1,940 resistance

The largest nearby concentration of liquidation leverage sits around $1,935–$1,940, according to the 3-day heatmap.

That cluster could act as a price magnet if Ethereum rebounds from current support. A recovery above $1,906, the middle Bollinger Band, would be the first indication that short-term momentum is improving.

ETH would then face resistance at $1,938, which marks the upper Bollinger Band and overlaps with the main liquidation pocket. Clearing that area could open another test of $1,986 and $2,000.

Additional liquidity appears near $1,950–$1,965 and immediately below $2,000. These clusters could fuel a short squeeze if buyers reclaim $1,940, but they may also attract fresh selling as traders defend the wider resistance zone.

Failure to recover $1,900 would keep the downside scenario active. In that case, leveraged positions accumulated around $1,875 and $1,850 could become vulnerable.

What analysts are saying about Ethereum

Crypto analyst Michaël van de Poppe described the current decline as a lower-timeframe correction while maintaining a positive longer-term view.

“ETH is holding above $1,800 and as long as that’s the case, there’s not much to worry,” van de Poppe said. He added that he still expects Ethereum to reach $2,500 in the coming months.

Analyst Ted Pillows identified a narrower support range. He said momentum was weakening after ETH fell below $1,900 but noted that the token remained above its $1,850 support zone.

“As long as it holds, I think ETH is more likely to rally towards $2,000.”

The charts therefore place Ethereum at a decision point. Holding $1,873–$1,850 would preserve the possibility of another move toward $1,940 and $2,000. A sustained breakdown below that range would instead reinforce the rejection and raise the risk of a deeper pullback toward $1,800.