Ripple is feeding North Korea–linked threat intelligence into Crypto ISAC, hoping shared context on DPRK operatives and DeFi exploits can blunt a 2026 hack wave led by Drift and KelpDAO.

Ripple said it has begun sharing internal threat intelligence on North Korean hacking activity with members of Crypto ISAC, a not-for-profit cyber collective focused on the digital asset sector.

In a joint blog, Crypto ISAC growth director Christina Spring wrote that the data “ranges from domains and wallets known to be associated with fraud, to Indicators of Compromise (IOCs) from active DPRK hack campaigns.”

Ripple’s threat feeds go to Crypto ISAC

She stressed that what differentiates Ripple’s feeds is not just raw indicators but “contextual enrichment from a security team with deep expertise of the threat actors impacting the crypto ecosystem,” giving defenders more actionable context than a typical IOC list.

Ripple’s own announcement on X argued that “the strongest security posture in crypto is a shared one,” adding that “a threat actor who fails a background check at one company will apply to three more that same week. Without shared intelligence, every company starts from zero.”

The intelligence reportedly includes enriched profiles of suspected North Korean IT workers attempting to embed themselves inside crypto and fintech firms, tying together email addresses, domains, on-chain wallets, and malware infrastructure used across multiple campaigns.

Drift and KelpDAO show a shift to social engineering

Ripple’s move comes in response to a wave of DPRK-linked attacks that have targeted DeFi in 2026, most notably the hacks on Solana-based Drift Protocol and re-staking platform KelpDAO.

Advertisement

TRM Labs estimates that those two incidents alone netted North Korean groups about $577 million—$285 million from Drift and roughly $292 million from KelpDAO—accounting for 76% of all crypto hack value through April.

Chainalysis and TRM note that North Korea–linked actors stole more than $2 billion in 2025, bringing their cumulative haul above $6.7 billion, and that DPRK’s share of global crypto hack losses climbed from under 10% in 2020 to 64% by 2025.

The April 1 Drift exploit followed what The Hacker News and Chainalysis describe as a six‑month social engineering campaign that began in late 2025, during which North Korean proxies held in‑person meetings with Drift contributors and used that trust to convince signers to pre‑authorize withdrawals via Solana’s “durable nonce” feature.

Attackers then executed 31 pre‑signed transactions in about 12 minutes, draining $285 million in assets before bridging most of the funds to Ethereum; TRM says the stolen ETH has largely remained dormant, indicating a cautious, long‑horizon laundering plan.

Advertisement

The April 18 KelpDAO exploit used a different playbook: DPRK-linked actors compromised two internal RPC nodes, DDoS’d external nodes, and fed false data into LayerZero Labs’ DVN to mint 116,500 unbacked rsETH, then used that collateral to borrow about $196 million in ETH on Aave.

Subsequent analysis from TRM and others shows that while the Arbitrum Security Council froze roughly $71.5 million in downstream ETH, the attackers quickly pivoted to swap remaining funds into BTC via THORChain and Chinese intermediaries, underscoring the sophistication and adaptability of their laundering operations.

In response, Aave-led coalition DeFi United has raised more than $300 million in a recovery plan for KelpDAO, while Arbitrum’s emergency freeze and the rapid formation of cross‑protocol recovery task forces highlight a growing willingness to coordinate defensive measures at the ecosystem level.

A recent Decrypt feature and Ripple’s own messaging frame the new data‑sharing initiative as an attempt to get ahead of this evolution in tactics—moving the industry from fragmented awareness to shared, real‑time intelligence against what security researcher Natalie Newson at CertiK calls “a state-directed financial operation running at institutional scale and speed.”

Strategy executive chairman Michael Saylor said his firm could sell Bitcoin to “inoculate” the market against sudden panic or to reinforce confidence in the company, in contrast to its long-standing “never sell” Bitcoin strategy.

“We’ll probably sell some Bitcoin to fund a dividend, just to inoculate the market, just to send the message that we did it,” Saylor said during the Strategy’s first-quarter earnings call on Tuesday.

Market participants will realize that “the company’s fine, the Bitcoin’s fine, the industry’s fine, the world didn’t come to an end,” Saylor said after Strategy reported a $12.5 billion net loss, driven mostly by unrealized losses on its Bitcoin (BTC) holdings as Bitcoin fell 23.8% in the first quarter.

Michael Saylor (top left) speaking during Strategy’s Q1 earnings call. Source: Strategy

Strategy has been a consistent Bitcoin buying force since August 2020, when it began its strategy of holding Bitcoin as a primary treasury asset. 

In February, Saylor dismissed concerns that the company could be forced to sell its holdings during a crypto market downturn, telling CNBC’s Squawk Box, “I expect we’ll buy Bitcoin every quarter forever.” 

Saylor also said Strategy could withstand an extreme drawdown in Bitcoin’s price to as low as $8,000 and still cover its debt obligations without needing to sell.

Saylor wants Stretch to be world’s biggest credit instrument

Strategy has been leaning on dividend-paying perpetual preferred stock offerings like Stretch (STRC) to fund its Bitcoin purchases in recent months.

Stretch has helped Strategy fund a large portion of the 145,834 Bitcoin it has bought this year, bringing its total holdings to 818,334 Bitcoin, worth $66.7 billion. 

Saylor said Strategy is aiming to build Stretch into the “biggest credit instrument in the world,” adding that as its assets under management grow, liquidity will increase, enabling broader adoption and creating a “network effect.”

Saylor hopeful neobanks will build Bitcoin credit products

Saylor said several Bitcoin-focused decentralized finance protocols, including Pendle and Saturn, have started tokenizing STRC’s 11% monthly dividends, allowing them to be traded and improving liquidity for Bitcoin-backed credit. 

Saylor added that he is hopeful that a neobank will start offering Bitcoin-backed “digital yield accounts” in the near future.

“We had none of these conversations going on eight weeks ago or 12 weeks ago, and now I see like three dozen initiatives,” Saylor said.

Related: Capital B raises $1.3M from Adam Back for Bitcoin strategy

Saylor said Bitcoin-backed digital yield accounts could offer investors up to 8%, arguing that they are far more lucrative than what many stablecoins offer.

“Check back in 12 more weeks, I think we’ll have some exciting news,” Saylor said of the broader Bitcoin credit market.

Meanwhile, MSTR fell 4.33% in after-hours trading to $178.80 on Tuesday after the company reported its first-quarter earnings.

Strategy is on track to record a stronger second-quarter performance, with Bitcoin up nearly 20% to $81,250 since April 1.

Magazine: Adam Back says current demand is ‘almost’ enough to send Bitcoin to $1M

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Ripple CEO Brad Garlinghouse defended Clarity Act progress at Consensus 2026, calling the past week a “big positive shift.”

Ripple CEO Brad Garlinghouse took the Consensus 2026 stage in Miami today and told attendees the Clarity Act is gaining genuine ground in Washington. He called the past week a “big positive shift,” pointing specifically to growing Senate support as proof that the bill is moving.

His confidence arrives at a tense moment for the legislation. The Clarity Act has secured backing from major crypto trade groups, with Coinbase and Circle both urging the Senate Banking Committee to advance the bill after a stablecoin yield compromise was brokered by Senators Tillis and Alsobrooks. Banking associations have pushed back against those yield provisions, arguing the deal introduces systemic risk to traditional financial institutions.

The regulatory backdrop behind Garlinghouse’s optimism

Garlinghouse has made regulatory clarity the centrepiece of Ripple’s public positioning for years. A Ripple survey published earlier this year found 72% of institutional respondents consider digital assets essential to their financial operations. Garlinghouse has used that figure repeatedly to press the case for federal legislation that gives institutions a clear legal framework to operate under.

Ripple’s own legal history with the SEC has made Garlinghouse one of the most closely watched figures on crypto regulation. His Consensus 2026 remarks put him at the centre of what is shaping up to be the most consequential stretch for US digital asset legislation since the FTX collapse triggered regulatory urgency in late 2022.

Consensus 2026 drew over 20,000 attendees to Miami, with SEC Chair Paul Atkins and CFTC Chair Brian Selig both in attendance, signalling the highest level of regulatory engagement the conference has seen. Whether Senate momentum translates into a committee markup in the coming weeks will determine whether Garlinghouse’s optimism proves well-founded.

Bitcoin BTC$81,567.93 zoomed past $81,000 in Asian hours Tuesday, according to CoinDesk market data, up 6.7% on the week and riding the broader risk-on tape that has equities printing records on fading Iran tensions and renewed AI optimism.

Other crypto majors caught the bid. Solana zoomed 3% to $87.35. Dogecoin added another 4% to $0.1158, extending its weekly gain to 14.5% as futures open interest sits at year-highs. XRP, BNB and TRX all printed green on the day.

Ether is the laggard, off 0.3% over 24 hours despite holding a 3.9% weekly gain at $2,376. Spot ETH ETF flows turned negative last week, ending a three-week inflow streak.

Wall Street gauges closed at all-time highs Tuesday after President Donald Trump signaled progress toward a “final agreement” with Iran and announced a pause on Operation Project Freedom for a short period. Brent crude fell 1.7% to about $108 a barrel. The dollar, which had been the haven of choice through the US-Israel war on Iran, weakened against all its G-10 peers.

Asian equities zoomed to an all-time high on Wednesday morning, with the MSCI Asia Pacific index advancing 1.8%. South Korea’s Kospi jumped more than 6% to a record, with Samsung Electronics surging 15% to reach a $1 trillion valuation, the second Asian company ever to clear that mark.

Strong earnings from Advanced Micro Devices and Super Micro Computer added to the AI-trade momentum, with Nasdaq 100 futures up 0.6%.

A key development came as Strategy executive chairman Michael Saylor told in the company’s Q1 2026 earnings call that it may sell a portion of its bitcoin holdings to fund dividend payments.

“We will probably sell some bitcoin to pay a dividend just to inoculate the market and send the message that we did it,” Saylor said.

The world’s largest corporate bitcoin holder, sitting on 818,334 BTC at an average acquisition cost of $75,537, has not sold any of its position before. The model has always been to buy and hold.

Strategy posted a $12.54 billion Q1 net loss as bitcoin’s slide from October’s $126,000 peak weighed on the company’s mark-to-market accounting. The firm carries roughly $1.5 billion in annual dividend obligations across preferred stock and outstanding debt, with about 18 months of USD reserves to cover them at current run-rates.

MSTR shares dumped over 4% in after-hours trading on the announcement and BTC briefly slipped under $81,000 before recovering.

Saylor framed the move as a feature of the model rather than a break from it.

“You buy bitcoin with credit, you let it appreciate, and then you sell bitcoin to pay the dividend.”

That is a different sentence than every prior Strategy quarter, where the playbook was to issue more debt or equity to fund obligations rather than touch the BTC stack.

TLDR

• Coinbase selected Centrifuge as its preferred tokenization infrastructure and took an equity stake in the firm.
• The agreement positions Centrifuge as the default issuance layer for tokenized assets across Coinbase’s ecosystem, including Base.
• The companies expect to launch the first wave of institutional assets on Base in the coming weeks.
• Coinbase Asset Management continues expanding tokenized offerings through partnerships with Superstate and Apex Group.
• Tokenized real-world assets have reached about $27 billion onchain, with treasuries and fixed income products accounting for $16 billion.

---

Coinbase selected Centrifuge as its preferred tokenization infrastructure and disclosed a strategic equity investment on Tuesday. The agreement sets Centrifuge as the default issuance layer for tokenized assets across Coinbase’s ecosystem, including Base. The companies said they will launch the first wave of institutional assets on Base in the coming weeks.

Coinbase and Centrifuge Formalize Tokenization Partnership

Coinbase positioned Centrifuge as its core infrastructure partner for onchain asset issuance. The company will use Centrifuge as the default layer across its products, including those built on Base. The firms confirmed that institutional assets will begin launching on Base within weeks.

Coinbase said the arrangement supports asset managers seeking to issue products onchain. However, the deal does not appear to grant exclusivity to Centrifuge. Coinbase Ventures had already invested in Centrifuge during a 2022 strategic funding round.

Centrifuge provides infrastructure for tokenized investment strategies. It powers onchain products for Apollo, Janus Henderson, and S&P Dow Jones Indices. The platform crossed $1 billion in total value locked in mid-2025 and now reports $1.66 billion, according to DeFiLlama.

Coinbase expanded its tokenized capital markets strategy across several asset classes. The exchange targets ETFs, credit products, and structured offerings through blockchain issuance. This partnership adds a dedicated issuance framework within its ecosystem.

Coinbase Expands Onchain Asset Issuance Across Base

Coinbase Asset Management advanced separate tokenization initiatives in recent weeks. Last week, it said it would issue its CUSHY stablecoin credit fund through Superstate’s FundOS platform. In March, it worked with Apex Group to tokenize a share class of its Bitcoin Yield Fund on Base.

The exchange continued building infrastructure for institutional access to tokenized products. It aligned its Base blockchain as a primary venue for these issuances. The Centrifuge partnership supports this rollout with a standardized issuance layer.

The broader real-world asset sector has expanded onchain in recent months. Tokenized real-world assets total about $27 billion across blockchain networks. Tokenized treasuries and other fixed income products account for roughly $16 billion of that figure.

Securitize and Ondo Finance currently lead the RWA sector by issuance volume. Tether and Circle also operate tokenized products, including tokenized gold and money market funds. These platforms compete across stablecoin and asset-backed offerings.

Centrifuge CEO Bhaji Illuminati addressed asset selection standards. He said, “What matters now isn’t getting assets onchain, it’s getting the right assets onchain in the right way.” He made the statement as the companies outlined their partnership.

Coinbase CEO Brian Armstrong also announced workforce reductions on Tuesday. He said the exchange would lay off 14% of employees. Armstrong stated that AI tooling had made certain roles redundant.

Pi Network co-founders took the Consensus 2026 stage in Miami, six days before Protocol 23 activates on May 11

Pi Network co-founders Dr. Chengdiao Fan and Nicolas Kokkalis both appeared at Consensus 2026 in Miami this week, speaking to over 20,000 attendees including institutional investors and government representatives. Fan addressed the Convergence Stage on May 6, delivering a session titled “Aligning Web3, AI, and Blockchain for Utility,” while Kokkalis joined a May 7 panel called “How to Prove You’re Human in an AI World (Without Doxing Yourself).”

The appearances are precisely timed. As crypto.news reported, Pi Network’s Protocol 23 activates on May 11, four days after the conference closes, introducing full smart contract functionality to the Pi blockchain for the first time. The Consensus stage gives the co-founders maximum public visibility immediately before their most consequential technical upgrade.

Identity and AI as Pi’s central argument

Kokkalis’s panel placed Pi Network’s KYC-verified user base at the centre of one of the most pressing problems in the AI era: how to confirm that a user is human when AI can simulate human behaviour convincingly. Pi Network argues its 18 million verified users and 526 million completed KYC validation tasks give it a structural answer that pure code-based blockchains cannot replicate.

Fan’s session argued that utility, not speculation, must drive the next phase of crypto adoption. Pi Network’s official X account confirmed that Fan stated on stage: “This is the infrastructure Pi has been building since 2019,” directly connecting the network’s years of identity verification work to the AI era’s governance challenge.

With Protocol 23 days away, Consensus 2026 gave Pi Network’s founders a high-profile window to frame what the upgrade delivers before the launch itself defines the story. As crypto.news tracked, PI rose more than 5% on April 29 when both founders were confirmed as speakers, with the token near $0.187 entering conference week.