Kalshi and Polymarket lost bids to block gambling cases in Nevada and Washington.

A three-judge Ninth Circuit panel denied emergency motions from both Kalshi and Polymarket to block lower court rulings, sending gambling enforcement cases in Nevada and Washington back to state courts. The orders came down on Thursday.

The judges concluded that raising a defense under the Commodity Exchange Act does not create federal jurisdiction that would move the cases out of state courts. “The CEA preemption defense is an affirmative defense, which cannot by itself give rise to federal question jurisdiction,” the panel wrote.

Why this matters for prediction market regulation

The court also rejected Polymarket’s argument that it was operating under federal direction through its compliance with CFTC oversight requirements. “Polymarket’s actions merely demonstrate its own compliance with federal law, which cannot alone show that it is acting under a federal officer,” the judges stated.

Nevada’s cases center on both platforms’ lack of state gaming licenses. Washington’s lawsuit focuses on whether Kalshi offers illegal gambling products through its sports event contracts.

Key Takeaways

• Bloomberg reports Uber is considering a complete acquisition of Delivery Hero, a major European food delivery player
• Uber disclosed earlier this week it owns a 19.5% stake in Delivery Hero, with an additional 5.6% through options
• Investment bank Morgan Stanley assisted Uber in rapidly accumulating its position through derivative instruments
• Uber shares declined approximately 1.9% following the announcement; rival DoorDash climbed 1.9%
• Delivery Hero’s stock has surged almost 110% in Frankfurt during the last half-year, reaching a market capitalization of approximately €10.2 billion

According to a Friday Bloomberg report, Uber has entered preliminary discussions regarding a potential full acquisition of Delivery Hero, the Frankfurt-traded food delivery powerhouse.

The strategic initiative is designed to strengthen Uber’s competitive position against DoorDash in markets beyond American borders.

Following the report’s release, Uber’s stock price fell roughly 1.9%. Meanwhile, DoorDash—considered a primary competitor in global delivery markets—saw its shares rise 1.9% on the same information.

Uber Technologies, Inc., UBER

Just days ago, Uber revealed it had swiftly accumulated a 19.5% ownership position in Delivery Hero, complemented by options representing another 5.6%. The stake was built with assistance from Morgan Stanley, which leveraged derivative products to facilitate rapid execution.

Bloomberg’s sources indicate that Uber has been engaging in conversations with additional Delivery Hero shareholders regarding its potential acquisition interest.

Uber’s Official Position

In an official submission to German financial regulators, Uber declared it presently has no plans to increase its ownership to 30% or beyond—a key threshold that would normally require a mandatory takeover bid under European regulatory frameworks.

Nevertheless, the company acknowledged that it regularly evaluates its investment portfolio and remains open to acquiring additional shares should favorable circumstances emerge.

Uber further clarified it has no intentions to modify Delivery Hero’s capital framework or seek to influence board member selections beyond exercising standard shareholder voting privileges.

The company may still require regulatory clearance from antitrust authorities before exceeding specific ownership levels across European jurisdictions.

Delivery Hero’s Current Position

Delivery Hero’s stock has surged approximately 110% on the Frankfurt exchange during the previous six-month period, bringing its total market capitalization to around €10.2 billion.

The organization provides food and grocery delivery operations throughout numerous international markets excluding the United States, positioning it as a valuable strategic acquisition target for any platform seeking international expansion.

With support from financial advisory firms, Uber is carefully evaluating various approaches to expand its ownership stake, according to Bloomberg’s reporting.

Discussions remain in progress, though sources emphasized that no guarantee exists that negotiations will culminate in a completed transaction.

THORChain said a malicious node operator exploited a vulnerability in its GG20 threshold signature system to drain about $10.7 million from one of the protocol’s vaults.

The GG20 threshold signature scheme is used to secure THORChain vaults by splitting key control across multiple node operators, meaning no single node normally holds the full private key.

The vulnerability allowed the malicious node operator to reconstruct a full private key for one vault, through “progressive key material leakage,” the protocol said in a post-mortem report released on Wednesday.

THORChain said its automatic solvency checks triggered within minutes and halted signing and trading across multiple chains without human intervention. Node operators subsequently coordinated via Discord for a full network halt within two hours after and deployed a patch to fix the vulnerability.

The post-mortem report shows that the protocol’s automatic solvency checks functioned and stopped the exploiter from draining more funds. The report comes a week after blockchain investigator ZachXBT first flagged the $10 million exploit, shortly before THORChain announced a halt to all trading and signing.

The incident adds to a resurgence in crypto exploits, which stole more than $634 million in April, according to DefiLlama data.

Timeline of the $10 million THORChain exploit. Source: THORChain

THORChain weighs recovery path without RUNE sales

THORChain said Friday that the post-exploit recovery path will be determined by a community consensus and published governance proposal ADR-028, with votes currently open for node operators.

The proposal would have THORChain absorb losses first through protocol-owned liquidity and spread the remainder across synth holders. It would deplete protocol-owned liquidity but redirect a portion of protocol income to replenish it over time, without minting or selling THORChain (RUNE) tokens.

ADR-028 community proposal for recovery after $10 million exploit. Source: Gitlab

THORChain also offered a recovery bounty for the return of the stolen funds and said it would slash the attacker’s malicious node while protecting innocent nodes that were placed in the same vault as the exploiter.

Related: Polymarket team says user funds safe as exploit losses climb above $600K

ADR-028 proposes keeping the existing GG20 TSS framework in a patched and upgraded version and said it will resume trading only after the vulnerability is fixed, drawing mixed reactions from crypto industry watchers.

Pseudonymous crypto project analyst Bird said the initial vulnerability suggests that the GG20 TSS signing stack has a “flaw in randomness generation or local signing isolation,” but praised THORChain’s auto-safeguard for limiting the damage done by the exploit.

Other industry watchers were more critical of the decision. “My mental model is that GG20 has many brittle assumptions. You can keep patching it, but it will forever be a bit of a black box,” wrote crypto investor JP in a Wednesday X post.

RUNE/USD, 1-week chart. Source: CoinMarketCap

The RUNE token’s price fell 15.5% in the week following the exploit, but staged a 4% recovery in the 24 hours leading up to 11:00 a.m. UTC on Friday, CoinMarketCap data shows.

Magazine: The legal battle over who can claim DeFi’s stolen millions 

Gold fell below $4,500 per ounce on Friday as both spot prices and New York futures dropped about 0.94 percent, extending a sharp pullback from this year’s record highs.

Early on May 22, gold slipped below $4,500 as spot and New York futures fell 0.94 percent, after the metal broke a key psychological level during New York trading.

Why did gold fall below $4,500 today?

In a widely cited follow up post, market watcher OnChainHutan said gold “slipped below $4,500, closing around $4,497.29 – $4,535.60 depending on the contract,” adding that the drop came as the US dollar hovered near a six week high and oil pushed above $97 per barrel.

That combination reinforced a familiar macro squeeze for bullion, since a stronger dollar makes gold more expensive for buyers in other currencies while higher energy costs fan inflation fears and push traders to price in the risk of tighter policy rather than imminent cuts.

According to OnChainHutan, futures markets are now “fueling bets the Fed may hike rates later this year,” with markets “pricing in a roughly 58 percent chance” of another move, a shift that directly undermines the appeal of a non yielding asset that earlier soared on expectations of aggressive easing.

The pullback lands just months after gold repeatedly punched through records above $4,900 per ounce, driven by central bank buying, geopolitical stress and wagers that Federal Reserve chair would have to slash borrowing costs into a slowing US economy.

In April, analysts surveyed by Investing.com still projected a median 2026 gold price of about $4,916 per ounce, underscoring how far sentiment has swung in a matter of sessions as spot now tests the lower edge of a $4,300 to $4,700 trading corridor highlighted in prior rate cut driven rallies.

What does the gold slide signal for risk assets and crypto?

Reactions on X captured the emotional whiplash, with one user noting that “gold drops 1 percent and suddenly everyone becomes a long term investor again,” while another user quipped that a “tiny red candle creates more panic than ten green ones create excitement.”

OnChainHutan argued that “gold pulling back while risk assets stay strong says a lot about current market sentiment,” pointing to an environment where equities and high beta plays have held up despite renewed Iran war risks, a dynamic also visible in recent crypto market outlook coverage of how traders fade geopolitical headlines.

Earlier this month, gold briefly fell back toward $4,500 per ounce on “heightened inflation fears” after a three percent intraday drop wiped out two weeks of gains, a move that foreshadowed today’s breach of the same level as investors reassessed whether bullion had outrun its macro narrative.

Analysts have warned that if the Fed leans more hawkish into the summer, bullion could spend extended time below $4,500 before any renewed push toward the $4,700 to $5,000 band that technical strategists previously mapped out once prices cleared $4,300 and $4,400.

For crypto traders, the move matters because this year’s record breaking gold surge above $4,900 per ounce ran alongside a powerful rally in Bitcoinm (BTC), as both assets traded like alternative macro hedges on US policy risk and Middle East tension.

If the market now believes the Federal Reserve is more likely to hike than cut, that same macro repricing could pressure high flying digital assets, just as it has started to bleed some air from bullion’s record run, something earlier crypto market outlook and ceasefire reports have highlighted whenever rate expectations flip.

Security exploits are weighing on institutional appetite for decentralized finance (DeFi), even as broader crypto adoption continues through stablecoins and tokenized assets.

In an April research note, JPMorgan analysts said that bridge security remains a challenge for the industry, raising questions on whether DeFi can grow to support further institutional adoption. 

The recent exploit on the Versus-Ethereum bridge was the eighth major attack against DeFi bridges in 2026 so far, with cumulative losses totalling $328.6 million.

DeFi bridges remain prime targets for hackers seeking to steal millions of dollars. Source: PeckShield

Misha Putiatin, CEO of smart contract security firm Statemind and co-founder of DeFi protocol Symbiotic, said he regularly fields calls from major traditional institutions exploring DeFi exposure, often with bad timing. 

“Five minutes before I have a call with a big traditional institution, another big hack,” he told Cointelegraph. 

“They sit there looking at me like, ‘Is this normal? Is this every day for you?”

Still, institutions may get into DeFi, but the terms on which they arrive could reshape it into something that looks a lot more like traditional finance than the open, permissionless system its builders envisioned. 

DeFi has become too complex for DYOR

At the beginning of April, North Korea’s Lazarus Group was implicated in the $285 million Drift Protocol exploit, carried out through a months-long social engineering campaign in which infiltrators approached Drift contributors at an in-person crypto conference.

The same actors were blamed for the KelpDAO breach a few weeks later, which drained about $290 million from the protocol’s cross-chain bridge. 

Total value locked across DeFi fell to around $86 billion from just under $100 billion in two days following the KelpDAO hack in April. The outflows came from pools with no direct exposure to compromised assets, said JPMorgan analysts.

DeFi pools lost around $14 billion following the attack on KelpDAO. Source: DefiLlama

Related: Wall Street’s tokenization boom has a liquidity problem: Axis CEO

Putiatin said the complexity of modern DeFi makes it nearly impossible for ordinary users to know where their risk actually sits. “Do your own research doesn’t work anymore,” he said. “It hasn’t been working for a really long time.”

He explained that the system has become too interconnected and complex to trace. 

For example, when a user deposits Ether (ETH) to earn yield while never touching any other token, they can still get hit by a breach on a bridge connected to a token they’ve never even heard of. 

Do your own research, or DYOR, is an industry mantra born in the early days of Bitcoin, when protocols were simple enough that a user could read a whitepaper and make an informed decision. 

Today, with smart contracts running up to tens of thousands of lines of code, protocols layered on top of one another, and new services and tokens launching at breakneck speed, that expectation has become almost impossible to meet.

“I’m not ever expecting people that just want to invest their money to ever figure out every part of the stack themselves,” Putiatin said.

“I’m not going to spend the next two years of my life trying to figure out how to get a 6% yield,” he added, claiming that traditional finance alternatives are close enough in return that the DeFi’s security risk rarely makes sense for most investors.

A shrinking premium for an unquantifiable risk

Tether (USDT), the world’s largest stablecoin, offers a supply APY of 2.74% on Aave’s Ethereum market, the biggest DeFi lending protocol. That’s below the 3.57% available on a three-month US Treasury bill. Circle’s USDC (USDC) fares better at 4.14%.

Supply and borrow APY on Aave’s Ethereum market. Source: Aave

Related: Why stablecoins and SWIFT may have to coexist

Putiatin said institutions see this clearly, even if they struggle to quantify it precisely. The problem is that institutions have no reliable framework for pricing the hack risk sitting underneath them. 

“They can’t price risk properly,” he said. “So they discount the yield we provide by a lot.”

DeFi yields have compressed as the market has matured, eroding the premium that once justified the risk. 

At the same time, the hacks have not slowed down. For investors used to underwriting risk with actuarial precision, shrinking upside and unquantifiable downside is a hard sell.

The cost of DeFi’s seat at the table

Putiatin’s benchmark for when DeFi has genuinely turned a corner is an onchain insurance system capable of underwriting hack risk across the entire ecosystem and pricing it with the kind of actuarial precision that institutions require.

“When we have circuit breakers, curators that can do due diligence, and a framework for that — we will get the fourth one that we desperately need as an industry,” he said. “We will get insurance.”

DeFi has lost over $7.76 billion to exploits, according to DeFiLlama data tracing back to 2016. Though DeFi insurance providers exist, their capacity remains too small to backstop anything approaching institutional scale.

Without that infrastructure, institutions that do come in will do so on their own terms, demanding full know-your-customer checks, custodial controls and tokens that can be frozen at any time.

The open, permissionless architecture that made DeFi worth building gets stripped to satisfy compliance requirements.

“All of the benefits that we have as an industry, they kind of go away,” he said. “Blockchain becomes just a database.”

It is an outcome Putiatin finds more troubling than the hacks themselves. The hacks, at least, are a problem the industry can work on. A version of DeFi that institutions have hollowed out to make it safe enough for their mandates is a surrender of everything the technology was supposed to change.

Magazine: 5 tech predictions the mainstream media got horribly wrong