Connect with us
DAPA Banner

Crypto World

Cross-Chain Governance Attacks – Smart Liquidity Research

Published

on

Cross-Chain Governance Attacks - Smart Liquidity Research

The Governance Exploit Nobody Is Pricing In. Bridges get hacked. That’s old news. We’ve seen the carnage: nine-figure exploits, drained liquidity, emergency shutdowns, Twitter threads filled with “funds are safu” copium.

From Ronin Network to Wormhole, bridge exploits have become a recurring tax on innovation. But here’s the uncomfortable truth. The next systemic risk in crypto probably won’t be a bridge exploit. It’ll be a governance exploit enabled by cross-chain voting power. And almost nobody is pricing it in.

The Shift: From Asset Bridges to Power Bridges

Cross-chain infrastructure has evolved.

We’re no longer just bridging tokens for yield. We’re bridging:

Protocols increasingly allow governance tokens to exist on multiple chains simultaneously — often via wrapped representations or omnichain token standards (like those enabled by LayerZero Labs).

Advertisement

This improves capital efficiency and participation.

But it also introduces a new attack surface:

The separation of voting power from finality.

The Core Problem: Governance Is Local. Voting Power Is Not.

Governance contracts typically live on a single “home” chain.

Advertisement

But voting power can be represented across multiple chains.

This creates a dangerous gap:

  1. Tokens are locked on Chain A

  2. Voting power is mirrored on Chain B

  3. Governance decisions are executed on Chain A

If the system relies on cross-chain messaging to sync voting balances, any delay, exploit, or manipulation in that messaging layer becomes a governance vector.

You don’t need to drain liquidity.

Advertisement

You just need to distort voting power long enough.

And governance proposals often pass with shockingly low turnout.

The Attack Path Nobody Talks About

Let’s walk through a hypothetical.

Step 1: Acquire or Manipulate Voting Power Cross-Chain

An attacker:

Advertisement
  • Borrows governance tokens

  • Bridges them to a secondary chain

  • Exploits a delay in balance updates

  • Or abuses inconsistencies in wrapped token accounting

In poorly designed systems, the same underlying tokens may temporarily influence voting in multiple domains.

Even if briefly.

Even if “just a bug.”

Governance doesn’t need hours. It needs one block.

Advertisement

Step 2: Flash Governance

We’ve already seen governance flash-loan exploits in DeFi.

The most infamous example? The attack on Beanstalk in 2022.

The attacker used flash loans to acquire massive voting power, passed a malicious proposal, and drained ~$182M.

Now imagine that dynamic — but across chains.

Advertisement

Flash-loaned tokens → bridged representation → governance vote → malicious proposal executed → unwind.

All before the watchers even understand what happened.

Step 3: Proposal Payloads as Weapons

Governance proposals can:

If cross-chain voting power is compromised, the proposal payload becomes the exploit.

Advertisement

No bridge drain required.

Just governance “working as designed.”

Why Markets Aren’t Pricing This Risk

Three reasons.

1. Everyone Is Still Fighting the Last War

After major bridge hacks, teams hardened signature validation and multisig thresholds.

Advertisement

But governance-layer risk is subtler.

It doesn’t show up as “TVL at risk” on dashboards.

It shows up as “who controls protocol direction.”

That’s harder to quantify.

Advertisement

2. Voting Participation Is Low

Many DAOs struggle to get 10–20% participation.

Which means:

You don’t need 51%.

You need slightly more than apathy.

Advertisement

Cross-chain voting power distortions don’t need to be massive. They just need to be decisive.

3. Composability Multiplies Complexity

Modern governance stacks combine:

  • Delegation contracts

  • Token wrappers

  • Cross-chain messaging

  • Snapshot systems

  • Execution timelocks

Each layer introduces potential inconsistencies.

And composability means failures cascade.

Advertisement

Where the Real Risk Lives

This isn’t about one protocol.

It’s systemic.

The more governance tokens become:

The more fragile governance assumptions become.

Advertisement

If a governance token is:

You’ve built a multi-dimensional voting derivative.

And derivatives break under stress.

Ask TradFi. They have scars.

Advertisement

The Governance Exploit Nobody Is Pricing In

Markets price:

  • Smart contract risk

  • Bridge exploit risk

  • Oracle manipulation risk

But they do not price:

Cross-domain voting synchronization risk.

No dashboards are tracking:

Advertisement
  • Governance message latency

  • Cross-chain vote desync windows

  • Wrapped-token vote inflation

  • Double-counted delegation

Yet these variables may determine who controls billion-dollar treasuries.

What Builders Should Be Doing (Now)

If you’re designing cross-chain governance:

1. Separate Voting Power from Bridged Liquidity

Avoid naïve 1:1 mirroring without strict finality checks.

2. Introduce Vote Finality Windows

Require:

Advertisement
  • Cross-chain state verification

  • Message settlement delays

  • Proof-of-lock confirmations

Before votes are counted.

3. Use Decay or Cooldowns on Newly Bridged Tokens

Voting power shouldn’t activate instantly after bridging.

If tokens just moved chains 5 seconds ago, maybe they shouldn’t decide protocol destiny.

4. Simulate Governance Stress Scenarios

Run adversarial simulations:

Advertisement

If your governance model breaks under simulation, it will break in production.

What Investors Should Be Asking

Before allocating to a multi-chain DAO:

  • Where does governance live?

  • How is voting power mirrored?

  • Can voting power be double-counted during bridge latency?

  • What happens if the messaging layer stalls?

  • Is there a time lock between the vote and execution?

If the answers are vague, the risk is real.

And it’s not priced in.

Advertisement

The Inevitable Wake-Up Call

Crypto learns through catastrophe.

  • Smart contract exploits → audits became standard.

  • Oracle exploits → TWAP and redundancy

  • Bridge hacks → validator hardening

Governance-layer cross-chain exploits are likely next.

And when it happens, it won’t look like a hack.

It’ll look like a proposal that “passed.”

Advertisement

That’s the scary part.

Final Thought

Cross-chain infrastructure is powerful. It enables capital mobility, global participation, and modular design.

But it also decouples authority from location.

And when authority becomes fluid across chains, attackers don’t need to steal funds.

Advertisement

They just need to win a vote.

That’s the governance exploit nobody is pricing in.

And by the time the market does, it’ll already be too late.

REQUEST AN ARTICLE

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Is Hyperliquid’s $3.64B whale book about to pick a side?

Published

on

Is Hyperliquid’s $3.64B whale book about to pick a side?

Hyperliquid whale positioning hits $3.64B as leverage splits evenly between longs and shorts.

Leverage on decentralized derivatives venue Hyperliquid (HYPE) has reached eye‑watering levels, with on‑chain data showing whale positions almost perfectly balanced between longs and shorts even as individual traders rack up eight‑figure unrealized profits. According to Coinglass figures cited by ChainCatcher, total whale exposure on Hyperliquid now stands at about 3.644 billion dollars, split into 1.821 billion dollars of long positions and 1.823 billion dollars of shorts. That leaves the long‑short ratio effectively at 1:1, a rare equilibrium that suggests aggressive positioning on both sides of the tape rather than a one‑sided bet on continued upside.

Advertisement

At a P&L level, the skew is less balanced. Long positions are currently sitting on roughly 57.38 million dollars in profits, while shorts are down about 11.16 million dollars, reflecting how the recent grind higher in majors like BTC (BTC) and ETH (ETH) has quietly rewarded leveraged bulls. One address stands out: the whale wallet 0x6c85…f6 has taken a 20x leveraged long on ETH at an entry price of 2,012.11 dollars and is now running an unrealized gain of about 15.14 million dollars. That single trade captures the core dynamic on Hyperliquid right now—a structurally high‑leverage environment where a handful of well‑timed positions can print institutional‑scale P&L in days, but where a sharp reversal could erase paper profits just as quickly.

For market structure, the 3.6 billion‑dollar positioning and near‑perfect long/short balance turn Hyperliquid into a leverage fulcrum for the broader alt and perp complex. When books are this tightly matched, the direction of the next large move often comes down to exogenous catalysts—ETF flows, macro surprises, or idiosyncratic headlines—rather than slow positioning drift. With longs in aggregate comfortably green and shorts nursing losses, the path of least resistance in the near term is still higher; but if the tape turns, those same profitable longs become forced sellers, and the 20x ETH whales that look brilliant today are exactly the ones that can drive a cascade tomorrow.

Source link

Advertisement
Continue Reading

Crypto World

Solana survived six years of near-death experiences

Published

on

Solana survived six years of near-death experiences

The Solana blockchain turned six years old yesterday, and the community has taken the opportunity to reiterate its motto, “Just one more hard quarter.” 

Although intended as a source of pride about the grit and determination of workers under the leadership of founder Anatoly Yakavenko, the motto could just as easily describe the experience of using the Solana blockchain.

Since its first multi-hour outage in 2020, Solana users have endured weeks of combined mainnet disruption, bridge collapses, wallet drains, market manipulation, and the criminal conviction of its once-most influential tokenholder and supporter, Sam Bankman-Fried (SBF). 

However, after six years of near-death experiences, Solana is still here. Whether it can credit resilience or stubbornness for its success depends on the user’s perspective on those difficult times.

Advertisement

Even its own social media manager was conflicted, posting a birthday message with a picture that hinted at a solider in the trenches.

After six years of near-death experiences, Solana is still here.

Solana outages since its founding year

Solana’s mainnet, built by former Qualcomm engineer Anatoly Yakovenko, co-founder Raj Gokal, and other developers, went live on March 16, 2020.

Their first catastrophe struck before the network’s first birthday.

On December 4, 2020, a bug in Turbine, Solana’s block propagation system, halted the entire blockchain for six hours. A validator transmitted two conflicting blocks for the same slot, and the network split into partitions.

Nine months later, a series of misfortunes began that would eventually make Solana outages so well-known that its offline status became a meme. 

Advertisement

On September 14, 2021, bots flooded the network during Grape Protocol’s IDO on Raydium. Over 300,000 transactions per second overwhelmed validator memory. The chain went dark for 17 hours.

Then 2022 arrived. There’s no other year containing more media attention about a blockchain repeatedly failing than Solana’s outages across almost every month of 2022.

The miracle of Solana surviving 2022

Between January 6 and 12, bots spamming duplicate transactions degraded Solana’s network so badly that transaction success rates dropped 70%. 

Another wave of outages from January 21 to 23 repeatedly knocked Solana’s public RPC endpoints offline.

Advertisement
  • On February 2, hackers exploited the Wormhole inter-blockchain bridge between Solana and Ethereum, minted 120,000 fraudulently wrapped ether, and stole over $320 million. Within hours, Jump Trading covered the loss from its corporate balance sheet.
  • On April 30, NFT minting bots hit the Candy Machine program with millions of requests per second, crashing Solana’s blockchain’s consensus-making. The blockchain was down for about seven hours.
  • On June 1, a durable nonce bug stalled blocks for over four hours.
  • On August 2, a hacker drained over 9,000 wallets of millions of dollars worth of Solana assets. Slope, a once-popular Solana wallet, had leaked private keys through a misconfigured Sentry server.
  • Less than two months later on September 30, a validator’s malfunctioning hot-spare node produced duplicate blocks. A fork-selection bug halted consensus for over eight hours. 
  • On October 11, Avraham Eisenberg manipulated Mango Markets’ MNGO price oracle and drained over $110 million from the Solana-based exchange. A jury convicted him in April 2024.

Read more: CHART: It’s been 262 days since Solana’s last major outage

‘Sam coin’ crashes as Sam crashes

Solana’s worst days in history began on November 11, 2022. FTX, Alameda Research, and over 100 affiliates filed for Chapter 11 bankruptcy. 

Founder SBF had held massive solana (SOL) positions and had become so influential in the Solana community that many people called SOL a “Sam coin” alongside FTT and his other doomed darlings. 

The panic around SBF’s demise sent SOL from roughly $33 to under $10 by late December, a 97% collapse from its November 2021 cycle high of $259.

SOL bottomed below $8 in December 2022.

Advertisement

Going into 2023, Solana’s ecosystem hemorrhaged developers, projects, and credibility. 

In fact, the bankruptcy estates of Alameda and FTX still hold hundreds of millions of dollars worth of SOL as of writing time. Bankruptcy trustees periodically unstake and liquidate tokens for creditor distributions.

Survival and Solana’s 6th birthday

Unfortunately, Solana kept breaking. On February 25, 2023, a malfunctioning validator broadcast an abnormally large block which overwhelmed Solana’s “Turbine” deduplication logic. 

Advertisement

Yet again, the blockchain was offline for nearly an entire day.

Almost a year later, on February 6, 2024, an infinite recompile loop halted Solana’s mainnet for five hours. The bug had been spotted a week earlier but never patched.

With at least seven total blockchain outages totaling at least three full days of combined downtime, Solana users have suffered weeks of degraded performance and years of uncertainty about whether mainnet will remain stable.

Moreover, users have suffered hundreds of millions of dollars in a bridge hack, manipulations of DEX exchanges, and multiple drains of wallets affecting thousands of users. 

Advertisement

At its worst moment, they suffered alongside the collapse of one of history’s most notorious fraudsters and dubiously generous patron, SBF.

With SOL now trading at roughly $96 per coin on its sixth birthday, Yakovenko called the celebration “six years of perfection.”

The community motto describes history more aptly: “Just one more hard quarter.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

Source link

Advertisement
Continue Reading

Crypto World

ZEC Rallies 20% After Cypherpunk Reports First Annual Profit

Published

on

the-defiant

The Winklevoss-backed Zcash treasury company reported $4.8 million in net income in 2025, driven by unrealized gains on its ZEC holdings.

Zcash (ZEC) surged as much as 20% on Monday evening, March 16 — spiking from $231 to as high as $284 — after ZEC digital asset treasury (DAT) firm Cypherpunk Technologies (Nasdaq: CYPH) released its full-year 2025 financial results showing a swing to profitability.

ZEC remains up roughly 9% on the day as of press time today, March 17, trading over $270, making it the top performer among the top-100 large-cap crypto assets, per CoinGecko data.

the-defiant
ZEC 7-day price chart. Source: CoinGecko

ZEC’s rally over the past 24 hours appears to be driven by Cypherpunk’s positive financials for 2025, which is the year the company rebranded from a biotech firm to a Zcash-focused DAT. Per the release, Cypherpunk reported net income of $4.8 million for the year ended Dec. 31, 2025, a dramatic reversal from a net loss of $67.8 million in 2024.

According to the firm, the turnaround was driven by $50.4 million in unrealized gains on the fair value of its ZEC treasury holdings, marked to market at period end, Dec. 31. At that time, ZEC was trading near $530 and those holdings were valued at $147.4 million on its balance sheet, according to the firm’s press release.

Advertisement
the-defiant
ZEC 1-year price chart. Source: CoinGecko

Shares of CYPH also rallied yesterday and today, and are currently up over 13% today at nearly $0.80, and up over 40% in the past five days, per Yahoo Finance data.

Biotech to DAT Pivot

Cypherpunk was launched in mid-November last year and is backed by Gemini founders Tyler and Cameron Winklevoss, and the firm is the only publicly traded focused on Zcash.

Like several other DATs that launched last year as the experimental strategy exploded into a trend, Cypherpunk pivoted to a DAT via a rebrand from an entirely different industry, namely biotech. The company’s biotech past as Leap Therapeutics still shows up in the books, and the release notes that R&D expenses for what is now the company’s subsidiary fell by more than half last year from the previous year, which also helped it achieve net income.

Buying High, Reporting Profitable

As The Defiant previously reported last month, ZEC had fallen more than 50% since Cypherpunk’s last disclosed purchase on Dec. 30, 2025, when the company added 56,418 ZEC at around $514 per token.

According to the release, total holdings now stand at 294,743.10 ZEC at an average purchase price of $335.89 per token — about 19% higher than current prices, meaning the treasury remains underwater on a cost basis.

Advertisement

Still, Monday’s move suggests markets read the first-ever profit report as a validation of the DAT model applied to ZEC.

ZEC was the top-performing large-cap crypto asset of the year, as The Defiant previously reported, having surged more than 800% over the course of 2025.

The privacy-focused cryptocurrency, which is the second-largest privacy coin by market cap after Monero (XMR), began its extended price rally in the fall, starting in early September. The timing coincided roughly with the Winklevoss’ investment into Leap.

This article was written with the assistance of AI workflows. All our stories are curated, edited and fact-checked by a human.

Advertisement

Source link

Continue Reading

Crypto World

Kalshi faces criminal charges in Arizona over sports and election contracts

Published

on

Kalshi faces criminal charges in Arizona over sports and election contracts

Arizona Attorney General Kris Mayes filed criminal charges against Kalshi Tuesday, charging the prediction markets platform with operating an unlicensed gambling business and offering election wagering in the state, actions she said violated the state’s laws.

Mayes charged KalshiEx LLC and Kalshi Trading LLC with 20 counts, alleging the platform accepted bets from Arizona on a wide range of events in violation of Arizona law, including sports and elections, like contracts betting on the outcomes of the 2028 presidential race and 2026 state gubernatorial race.

“Arizona law prohibits operating an unlicensed wagering business, and separately bans betting on elections outright,” the attorney general said in a statement.

The charges come just days after the Commodity Futures Trading Commission (CFTC) signaled a more supportive federal stance toward prediction markets, issuing new guidance and launching a rulemaking process under Chairman Mike Selig.

Advertisement

That effort asserted the CFTC’s “exclusive jurisdiction” over event contracts and frames platforms like Kalshi as regulated derivatives venues rather than gambling operators, setting up a direct clash with states such as Arizona that continue to treat sports and election-related contracts.

“Sadly, a state can file criminal charges on paper thin arguments,” a Kalshi spokesperson said in a statement. “States like Arizona want to individually regulate a nationwide financial exchange, and are trying every trick in the book to do it. As other courts have recognized and the CFTC affirms, Kalshi is subject to federal jurisdiction. It’s different from what sportsbooks and casinos offer their customers, and it should not be overseen by a patchwork of inconsistent state laws.”

Different courts have ruled in different ways on whether prediction market providers are subject to state laws. A federal judge in Nevada ruled last year that the company’s sports-related contracts are subject to state gaming regulators. A Massachusetts state court similarly found that sports-related conduct might be subject to state regulations in that state. A federal judge in Tennessee ruled the other way earlier this year, at least temporarily blocking state regulators from enforcing a cease-and-desist against Kalshi.

Notably, most of these contracts and cases were related to sports gambling, and not election-related bets, as Arizona’s case is.

Advertisement

In her statement, Mayes said, “Kalshi may brand itself as a ‘prediction market,’ but what it’s actually doing is running an illegal gambling operation and taking bets on Arizona elections.”

She added that state law prohibits both unlicensed wagering businesses and betting on elections outright.

The charges escalate a widening legal fight between Kalshi and state regulators. The company sued Arizona on March 12 in a preemptive move, part of a broader strategy that has recently included litigation against Iowa and Utah, Mayes’ filing added. Arizona officials also criticized the approach, saying Kalshi is attempting to bypass state-level gambling rules by turning to federal courts.

“Kalshi is making a habit of suing states rather than following their laws,” Mayes said. “In the last three weeks alone, the company has filed lawsuits against Iowa and Utah, and now Arizona.”

Advertisement

Mayes criticized Kalshi saying that instead of operating within the legal frameworks such as Arizona’s, “Kalshi is running to federal court to try to avoid accountability.”

The filing also cited a recent federal court setback for Kalshi in Ohio, where a judge denied the firm’s request for a preliminary injunction and affirmed the state’s authority to enforce its gambling laws.

Kalshi has positioned its event contracts as federally regulated derivatives rather than gambling products, a distinction now being tested across multiple jurisdictions.

Source link

Advertisement
Continue Reading

Crypto World

GSR Acquires Autonomous, Architech in $57M Crypto Deal

Published

on

Coinbase, Tokens, ICO, Binance, Monad

Crypto trading and investment company GSR has acquired advisory companies Autonomous and Architech in a $57 million deal to expand its services for tokenized projects, combining launch support, treasury management and capital markets infrastructure under one platform.

The acquisition brings together Autonomous’s operational and financial services for token launches with Architech’s focus on token design and liquidity strategy, integrating both into GSR’s existing trading, market-making and asset management business.

To be sure, many crypto projects face challenges due to their reliance on different providers for structuring, token economics, fundraising, and exchange listings, which can lead to inefficiencies and a lack of coordination, according to Philipp Maume and Mathias Fromberger, writing recently in the Chicago Journal of International Law.

GSR said that its platform will provide treasury services, including liquidity planning, risk management and capital allocation for digital asset reserves.

Advertisement

Architech, founded in 2024, has advised on token launches with a combined peak fully diluted value of more than $10 billion, according to the company. Autonomous provides treasury operations, financial management and coordination with exchanges, custodians and market makers.

Autonomous will continue operating under its existing brand within GSR, while Architech will be integrated into a new digital asset advisory unit.

Related: Mastercard agrees to acquire BVNK in $1.8B stablecoin deal

Advertisement

From ICOs to structured token launches

Token fundraising in crypto has shifted significantly since the initial coin offering (ICO) boom of 2017 and 2018 saw projects raise capital directly from retail investors with minimal coordination across service providers. Today, token launches are often structured through private funding rounds, followed by coordinated exchange listings and liquidity provisioning.

Projects such as Monad raised $225 million in 2024 in a funding round led by Paradigm ahead of a planned token launch.

In November, Coinbase launched a platform for regulated primary token offerings, giving US retail investors access to token sales with compliance requirements, lockups and controlled distribution. The platform debuted with the token sale from Monad, marking one of the first broad opportunities for US retail investors to participate in public token sales in recent years.

Coinbase, Tokens, ICO, Binance, Monad
Source: Monad

Projects are also experimenting with new issuance models tied to broader financial strategies.

Crypto exchange Backpack said its planned token distribution will be linked to business milestones and a potential IPO, with a portion of supply managed within a corporate treasury. In February, the company was reportedly in talks to raise $50 million at a $1 billion pre-money valuation.

Advertisement

Magazine: What’s a ‘Network State’ and are there real-life examples? Big Questions