A new feature shipped in Sui’s v1.72 release exposed an edge case in the Layer-1 blockchain’s gas-charging logic that halted mainnet three separate times across May 28 and May 29, with each fix either triggering or exposing the next failure, the Sui Foundation said in a post-mortem published Sunday.

The first outage began at roughly 7 a.m. PT on Thursday and lasted close to seven hours.

According to the foundation, it stemmed from a rare issue in how the network charged gas for transactions paying with a mix of the new address-balance feature and traditional coin objects. The bug caused validators to crash with an underflow error when a transaction was canceled for insufficient funds, but the gas-smashing routine still tried to spend those same funds.

Think of a coin object as a digital banknote. A user’s SUI balance isn’t a single number — it’s a stack of distinct “notes,” each with its own ID, that can be moved or combined. The wallet might hold three coin objects worth 60, 30, and 10 SUI rather than a single 100-SUI balance. To pay for something, the network combines the notes it needs.

Validators are computers (and the operators behind them) that run the network by processing transactions, voting on which ones are valid, and keeping the chain alive.

The core team brought the network back up around 1:30 p.m. PT with what it called an “interim fix” that addressed the most common version of the bug but carried “a known issue with a low probability of causing a halt.” The team accepted that risk to restore the mainnet quickly while a more robust fix was developed.

The known risk materialized the next morning. A second outage began around 5 a.m. PT on Friday, when a transaction triggered a masked variant of the same bug, in which the insufficient-funds error was overridden by another cancellation reason, bypassing the interim patch. The core team finished a more robust fix, and validators adopted it by about 9:40 a.m. PT.

The third halt was a knock-on from the second. When validators restarted to install the robust fix, validator participation in the protocol that bootstraps the network’s on-chain randomness fell below the required threshold, and randomness disabled itself as designed.

(On-chain randomness is a protocol the network uses to produce a number nobody can predict or fake, even though every validator has to agree on the same value. Apps that depend on chance — lotteries, certain games, random NFT mints — can’t run without it.)

A latent bug then failed to persist that disabled state to disk, leaving validators unaware on the next restart that randomness had been turned off. The next epoch change stalled for close to six hours as randomness-dependent transactions piled up in a paused queue.

No user funds were at risk during any of the outages, and no committed transactions were reverted, the foundation said.

SUI dropped roughly 8% during the cascade to a low of $0.90 and was trading near $0.90 on Monday, leaving the token down about 19% on the week, per CoinDesk data.

The events represent Sui’s third major reliability incident since its 2023 mainnet launch, following a two-hour transaction scheduling bug in November 2024 and a six-hour consensus divergence in January 2026.

The most expensive DeFi attack of 2026 began with KelpDAO’s restaked ether (rsETH) bridge, not a bug in Aave’s code. That, the lending protocol argues in an official postmortem published this week, is precisely why the industry needs to rethink how it measures risk.

Aave said it is launching a review of every asset listed on V3 and rewriting its listing standards after April’s $230 restaked ETH exploit exposed a new class of DeFi risk.

The protocol’s postmortem traced the attack not to a flaw in Aave’s smart contracts but to a LayerZero bridge verification failure, where a single verifier approved a forged cross-chain message that released 116,500 unbacked rsETH.

Going forward, Aave says collateral assessments will weigh bridges, oracle dependencies, custodians and operational security alongside the financial and smart-contract risks it has traditionally screened for.

KelpDAO is a “restaking” service, which lets users take their ether that is already locked into Ethereum to earn staking rewards and reuse it as collateral to earn additional yield from other protocols. The token rsETH represents a user’s claim on that restaked ether. To move rsETH between blockchains, KelpDAO uses LayerZero, a piece of infrastructure called a cross-chain bridge that passes messages between networks so a token issued on one chain can show up on another.

Bridges rely on a set of independent verifiers who confirm each message is real before the receiving chain releases the equivalent tokens.

In April’s attack, just one of those verifiers approved a fake message, which let the attacker mint 116,500 rsETH on the receiving chain with no actual ether backing it.

Those tokens were then deposited into Aave, a lending protocol where users borrow against collateral they post, and used to take out loans Aave could not recover once the rsETH was revealed as worthless. Aave’s own code worked exactly as designed. The collateral it accepted turned out to be fake because the bridge that delivered it had been compromised.

While LayerZero acknowledged earlier this month that it “made a mistake” by allowing its own verification system to secure high-value assets in a one-of-one configuration, Aave’s postmortem goes further by using the incident to justify a broader overhaul of DeFi risk management.

The protocol argues that traditional reviews focused on volatility, liquidity and smart contract audits failed to capture the risks created by bridges, verification networks and other infrastructure that sits outside application code.

Beyond smart contract audits and financial risk analysis, Aave said it will now evaluate bridge infrastructure, oracle dependencies, third-party contracts, custodial arrangements, operational security practices, and secondary-market liquidity before approving or expanding collateral listings.

The protocol is also building new automated defenses designed to react faster when collateral assets show signs of distress. Among the proposals outlined in the postmortem is a system that would automatically reduce an asset’s loan-to-value ratio to zero once predefined risk thresholds are breached, removing its borrowing power before losses can spread through the broader market.

Since the exploit, Aave says its risk managers have already executed roughly 295 parameter changes across V3 markets, including 168 supply-cap reductions and 66 borrow-cap reductions aimed at limiting exposure to individual assets.

As DeFi protocols become more interconnected, Aave’s postmortem suggests the industry may need to scrutinize not only the assets it lists, but also the infrastructure those assets depend on

TLDR:

• SEC says only 3% of $12.3M was traded, while the rest was funded for personal use and Ponzi payouts.
• Operator allegedly marketed fake AI crypto bots with claims of automated high-frequency returns.
• About 150 investors were affected through misleading performance reports and fabricated statements.
• Case signals tighter scrutiny on AI-branded crypto products and retail fundraising practices.

U.S. regulators have taken action against a Texas operator accused of misleading investors through artificial intelligence trading claims tied to crypto assets, as court filings reveal alleged misuse of funds, fabricated performance data, and widespread retail investor exposure across multiple jurisdictions.

AI Trading Narrative and Investor Fund Breakdown

The SEC alleges that the operator promoted these tools as proprietary bots capable of scanning exchanges and executing high-frequency arbitrage strategies. Investors entered the program expecting algorithm-driven returns supported by consistent and verifiable trading activity.

Investigators found that the system did not operate as described and lacked a transparent execution infrastructure.

Instead, the operator allegedly used promotional material and fabricated performance reports to sustain investor inflows. The structure attracted around 150 investors and accumulated approximately $12.3 million during its run.

The regulator reports that only about 3% of the funds entered actual crypto trading markets. A significant portion moved toward personal expenses, while another portion financed payments to earlier investors. These payments created a cycle that mimicked steady returns without underlying trading profits.

Authorities say the operator distributed about $6.2 million for personal use across various expenditures. Another $5.5 million reportedly went to investor payouts designed to maintain confidence in the system. 

Fake account statements and misleading communications reinforced the perception of stable performance over time.

Promotional claims included promises of high returns within short periods, sometimes exceeding 40% to 100%. The filings state that these promises lacked supporting documentation or audited trading records.

Investigators continue to examine transaction histories using blockchain analysis and banking records to map fund movement patterns.

Regulatory Pressure and Market Reaction to AI Crypto Schemes

Regulators have increased scrutiny on investment products that rely on artificial intelligence branding in crypto markets. They now focus on whether firms can prove actual algorithmic trading activity behind marketing claims.

This approach reflects growing concern over misleading narratives targeting retail investors in digital asset spaces.

The enforcement action shows how authorities trace funds through exchanges, wallets, and traditional banking channels.

Investigators rely on blockchain analytics tools to reconstruct how investor capital moves across different layers. These methods help identify discrepancies between advertised trading performance and actual fund usage patterns.

Market participants reacted cautiously after news of the case emerged across trading communities. The development prompted renewed attention on risk exposure tied to AI-themed crypto investment platforms.

Regulated exchanges such as Coinbase and Kraken often benefit from differentiation during enforcement cycles due to compliance frameworks.

The case also pushed global regulators to review disclosure standards for automated trading claims. Agencies across jurisdictions now share intelligence on similar schemes through financial crime coordination networks.

Authorities aim to improve transparency requirements and prevent misuse of AI narratives in fundraising operations.

Investor sentiment remains sensitive as enforcement actions continue to shape expectations around crypto marketing practices.

The sector now faces stronger pressure to validate trading systems before presenting performance-based claims to the public.

XRP slid to its weakest level in more than three months as heavy selling overpowered signs of exchange outflows, leaving the market stuck between two competing signals. Tokens moving off exchanges usually point to accumulation, but price action is saying sellers still have control whenever XRP tries to recover.

News Background

• More than 25 million XRP left exchanges after a large inflow earlier in the week, suggesting some investors used the drop to move tokens into longer-term storage.

• Spot XRP ETFs recorded fresh inflows, bringing cumulative flows to about $1.42 billion, though that demand has not yet been enough to reverse the downtrend.

• Leverage was heavily flushed during May, with most high-risk long positions already liquidated as XRP bounced from the $1.28 area.

Price Action Summary

• XRP dropped from $1.3384 to $1.3208, hitting a 15-week low during the session.
• The key breakdown came on 55.03 million in volume, which pushed price through support near $1.3320.
• Selling later extended toward $1.314 before a modest bounce brought XRP back toward $1.32.

Technical Analysis

• The key issue is that accumulation signals are not yet showing up in price. Exchange outflows are constructive, but XRP continues to get sold into recovery attempts.
• The breakdown below $1.3320 keeps the short-term structure weak, with $1.34 now acting as the first level buyers need to reclaim.
• A large short-liquidation cluster sits between $1.34 and $1.40, meaning a sharp move higher is possible if XRP can break back into that range.
• Until then, the tape remains defensive, with sellers still controlling the lower highs.

What traders should watch

• $1.31 is the immediate support. Losing it would put $1.28 and then $1.20 back in play.
• $1.34 is the first recovery level. A reclaim could trigger momentum toward $1.37 and $1.40.
• The setup is unstable because exchange outflows point one way while price action points the other. One side will have to give.

TLDR:

• Coinbase now supports direct INR deposits and withdrawals in India through IMPS with no deposit fees.
• Indian traders can access spot markets and perpetual futures contracts on major crypto assets via Coinbase.
• Coinbase is registered with FIU-IND and fully compliant with Indian tax laws for long-term operations.
• Over $1 million has been invested by Coinbase into India’s builder community through Base grants and hackathons.

Coinbase has officially launched direct Indian Rupee (INR) support in India, enabling users to deposit and withdraw funds via IMPS.

The platform now offers spot trading and perpetual futures contracts on major crypto assets. Coinbase is registered with FIU-IND and fully compliant with Indian tax laws.

This move marks a major step in the exchange’s long-term commitment to one of the world’s fastest-growing crypto markets.

Coinbase Opens Full INR Trading Access for Indian Users

Indian customers can now deposit and withdraw INR directly through IMPS, removing the need for P2P rails or third-party intermediaries.

The process is straightforward — users fund their accounts from a bank, trade, and withdraw back to the same account.

Coinbase has built dedicated local INR order books to provide liquidity specifically for Indian traders. At the same time, users retain access to the platform’s global exchange infrastructure.

Spot trading is available across a range of crypto assets, alongside perpetual futures contracts covering major markets.

For traders seeking professional-grade tools, Coinbase Advanced offers APIs built to institutional standards and WebSocket order book streaming.

TradingView charting is also integrated for those who prefer a technical, discretionary approach. A full suite of order types supports both casual and high-frequency trading strategies.

On fees, taker charges on Coinbase Advanced are competitive when compared against local Indian platforms. There are no deposit fees on INR transfers, which reduces the upfront cost for new users.

Beyond headline fees, execution quality plays a role in total trading costs. As Coinbase noted, “Deep global liquidity tends to mean tighter spreads and lower slippage compared to thinner local order books, which affects total cost of trading in ways that aren’t always visible upfront.”

Coinbase’s FIU-IND registration places the exchange under the compliance framework for virtual digital asset service providers in India.

This gives Indian users a regulated environment consistent with local law. The exchange also complies fully with Indian taxation requirements, reinforcing its long-term presence in the market.

Coinbase’s Prior Investment Lays the Ground in India

Coinbase’s entry into Indian retail trading did not happen overnight. The exchange previously invested in CoinDCX, one of India’s leading crypto platforms, signaling early strategic interest.

Through its Ethereum Layer 2 network Base, Coinbase has directed over $1 million into the Indian builder community. That funding covered hackathons, direct grants, and fellowships across the country.

More than 4,000 builders in India have developed projects on Base, with around 150 growing into active startups. Coinbase has also sponsored Indian students and founders to the Network School in Malaysia.

Teams have been flown to New York and San Francisco for demo days and pitch events. As the company stated, “India has long been one of the most important markets in crypto: in terms of developer talent, trading activity, and the broader adoption of blockchain technology.”

Coinbase is listed on NASDAQ under the ticker $COIN and is a member of the S&P 500. The exchange publishes audited quarterly financials and serves as a custody partner for BlackRock.

It holds the majority of customer crypto in cold storage and maintains dedicated crime insurance. Regular security audits further support its standing as a trusted institutional-grade platform.

A record 10-session, $2.97 billion outflow streak from spot bitcoin ETFs and a fresh rally in oil prices on stalling U.S.-Iran ceasefire talks have kept bitcoin BTC$73,854.62 and the wider crypto market under pressure even as Wall Street’s AI trade pushed global equities to new records in Asian trading Monday.

The MSCI All Country World Index gained 0.2% on Monday and Asian equities advanced 1.1% to an all-time high, with bellwether tech indexes in South Korea, Taiwan and Japan all setting records, Bloomberg reported.

Nasdaq 100 futures rose 0.6% after Nvidia said it would enter the Windows laptop market in direct competition with Intel and AMD, and SoftBank Group jumped as much as 11% on its OpenAI and Arm holdings, putting the Japanese conglomerate on track to become the country’s most valuable listed company.

The mood was complicated by oil. Brent crude climbed above $93 a barrel as efforts to reopen the Strait of Hormuz showed little progress and Middle East tensions stayed elevated, sending Treasuries lower across the curve.

Crypto failed to track the equity rally. Bitcoin fell 4.6% over the past seven days to $73,397, ether (ETH) lost the same 4.6% to $1,996, solana (SOL) 3.7% to $81.89 and TRON’s TRX 3.7%, according to CoinDesk data. DOGE$0.1001 slipped 1.6%.

Spot bitcoin ETFs in the U.S. logged a tenth consecutive day of outflows on Friday, with $2.97 billion drained between May 15 and May 29, per SoSoValue data. The streak broke the previous record of eight consecutive outflow sessions set in early 2025, and was headlined by a $733 million single-day exit on May 27, the largest since January.

Total net assets across U.S. spot bitcoin ETFs fell from $104.29 billion on May 15 to $94.17 billion by Friday. Ether ETFs are running an even longer 14-session outflow streak, with roughly $2.6 billion drained from net assets over the same window.

Hyperliquid’s HYPE was the lone outlier in the top 10 by market value.

The token gained 18.7% over the past seven days to $73.17 and the U.S. spot HYPE ETF, which launched May 12, has logged inflows in every single trading session since, lifting cumulative net assets above $122 million by Friday.

Crude’s bounce above $93 and the stalled Iran deal mean the macro lift crypto was waiting on is no longer obviously coming. The ETF flows that powered last year’s rally have gone the other way for ten straight sessions.

Crypto liquidity provider and trading firm Wintermute says it is providing liquidity on prediction markets as the industry continues to expand.

The firm, which handles $3.5 trillion in annual trading volume, said on Friday that it is extending its institutional trading to prediction markets and would provide “two-sided markets across event contracts on leading venues,” without specifying the platforms. 

Jake Ostrovskis, head of OTC trading at Wintermute, said prediction markets have the “demand profile” of a major asset class but the liquidity profile of an “early-stage one.”

“For these markets to become a reliable real-time source of probability estimates, they need sustained two-sided liquidity. That depth tightens spreads, supports larger trade sizes, and in turn improves the signal embedded in market prices,” he added.

Wintermute said prediction markets are moving from a “niche forecasting tool” into a broader venue for trading event risk, and it will be posting continuous bid and offer prices across event contracts.

Source: Wintermute

This helps reduce spreads, support larger trade sizes, and improve the reliability of market-implied probabilities, it said.

Wintermute added that the market also overlaps with its existing crypto infrastructure, as it already manages spot, derivatives, decentralized finance and over-the-counter crypto markets.

The move could accelerate integration between prediction markets and broader DeFi protocols for collateral reuse, yield strategies on locked capital, or oracle feeds derived from prediction market prices.

Related: Kalshi backs prediction markets lobby group with former Trump official

The two leading prediction markets, Kalshi and Polymarket, have a notional weekly volume of around $5.8 billion, with almost 400,000 active markets and 42.7 million weekly transactions, according to DeFiRate. 

Kalshi, which is regulated by the Commodity Futures Trading Commission, has the largest market share of the volume with 70%. Politics and sports dominate the betting on both platforms. 

Comparison of stats between Kalshi (green) and Polymarket (purple). Source: DeFiRate

Magazine: HYPE chases $100 target, ETH could dump below $1800: Market Moves

A decade-old Ethereum ICO with a failed launch has found new life as a case study in retroactive bug hunting and asset recovery. A pseudonymous white-hat hacker going by the name 0xflorent has recovered about 1,003 ETH from the Hong Coin (HONG) ICO, roughly $2 million at current prices, after identifying a flaw in the refund mechanism that left investors’ funds stranded for years. The disclosure surfaced on Sunday via a post on X, where 0xflorent explained how the funds were unlocked and subsequently recovered from 48 investors who had participated in the project’s fundraising push.

The HONG project, pitched in 2016 as a community-driven venture capital fund governed by a decentralized autonomous organization, offered investors a plan to receive 250 million HONG tokens across five stages. The ICO began on August 29, 2016, and wrapped up on October 28, 2016. Although the minting goal was not reached, investors were promised refunds of their ETH contributions. But a bug in the refund function prevented those refunds from being processed, leaving the stash of ETH effectively frozen for nearly ten years.

Data from Ethereum explorer Etherscan corroborates the partially completed refunds: at least one investor received 96 ETH (roughly $192,500 at current prices), and another was refunded 0.5 ETH. These refunds are part of the larger 1,003 ETH tied to the unresolved pool, which 0xflorent says has now been unlocked and reclaimed with the project’s cooperation.

“The contract held all the investors’ ETH and was supposed to auto-refund them. However, a bug in the refund function quietly broke that, and the funds got stuck.”

0xflorent outlined how the unlock was accomplished by working with the HONG creators to exploit a flawed admin function that reset token holders’ balances and triggered the refund mechanism. The hacker described the root cause as an admin function with an integer overflow vulnerability. When invoked with a precise input, the function reset balances and effectively unblocked the refund check, enabling the retrieval of the locked funds.

The developer’s public thread also noted prior retrospective movements: on May 24, 0xflorent reported recovering a total of 19.33 ETH in separate actions—comprising funds from a different failed ICO project in January 2018 and a Liquality Wallet user whose funds were trapped in a cross-chain transfer protocol. This broader pattern—identifying legacy vulnerabilities and responsibly reclaiming stranded assets—appears to be a recurring theme in the late-2010s era of ICOs and cross-chain tooling.

The Hong Coin episode sits at an intersection of crypto history and modern risk management. HONG’s narrative began in the era when many projects sought to bootstrap communities around decentralized governance and venture funding. The team described the treasury and refund flow as central to the project’s promise. With the ICO failing to hit its fundraising target, the expectation was that contributors would be refunded automatically by the contract—an expectation that proved fragile in the presence of programming oversights.

From a practical perspective, the episode underscores two enduring lessons for the crypto ecosystem. First, even well-conceived refund logic can be compromised by small but critical coding flaws in smart contracts. An administrator function with an overflow bug can silently break the intended payout path, effectively trapping funds that would otherwise flow back to investors. Second, the story illustrates the potential value of responsible disclosure and cooperative remediation when legacy contracts surface vulnerabilities after years of dormancy. In this case, the HONG creators were engaged to facilitate the recovery rather than face a protracted dispute or forks that could have left investors without a clear path to restitution.

For investors and builders, the Hong Coin recovery is a reminder that historical projects carry latent security and governance risks. The 2016-era ICO wave left behind a broad spectrum of contract designs, some of which were never fully audited or battle-tested against edge-case inputs. The fact that a white-hat could unlock funds years later—without destabilizing the broader chain—speaks to the resilience of Ethereum’s ecosystem when legitimate custodians step forward. Yet it also raises questions about whether more such retroactive recoveries are feasible across other dormant ICOs and what standards should govern such interventions in the future.

Looking ahead, observers will want to see how the Hong Coin case influences current and future retroactive fixes. Will the original developers publish the complete patch and audit trail for the refund function to prevent recurrence in similar contracts? Are there other dormant ICOs with analogous refund or governance vulnerabilities awaiting discovery? And how will communities balance the ethics of white-hat intervention with the risk of unintended consequences in legacy contracts?

Key takeaways

• A decade-old ICO (HONG) saw about 1,003 ETH recovered from 48 investors after a flaw in the refund function left funds stranded for years.
• Public data shows refunds already issued to some investors, including one recipient of 96 ETH and another of 0.5 ETH, highlighting real-world asset recovery in legacy contracts.
• The vulnerability stemmed from an admin function with an integer overflow, which, when triggered with a specific input, reset balances and enabled refunds to proceed.
• 0xflorent’s actions illustrate a white-hat approach to unlocking funds in collaboration with project creators, not through hostile exploitation or disruption.
• The episode reinforces broader lessons about smart contract security, particularly around admin controls and refund mechanisms in ICO-era designs, and it emphasizes the ongoing value of responsible disclosure in the ecosystem.

Historical context and present implications

Hong Coin’s 2016 ICO is a snapshot of an era when decentralization and community governance were thrust to the forefront of fundraising narratives. The project’s ambition—to enable community members to decide which ventures receive backing—was appealing to many supporters of the DAO-era ethos. Yet the fundraising outcome, the unlaunched product, and the refund complications illustrate how technical fragility can precede governance ambitions in crypto ventures.

The incident also exemplifies how the crypto ecosystem can evolve a form of retrospective accountability. When a fault is discovered in a long-dormant contract, the community can mobilize to recover value rather than leave it forever stranded. The collaboration between 0xflorent and the HONG creators demonstrates that constructive, technically informed interaction can yield tangible asset recovery without igniting controversy or legal disputes.

From an investor-relations perspective, the case provides a tangible data point about the latency of asset recovery. While the exact amount recovered will likely continue to evolve as more refunds are confirmed, the initial figures and subsequent disclosures indicate that even long-dormant assets can find a path back to participants when structural vulnerabilities are identified and addressed in a coordinated manner.

For researchers and developers, the Hong Coin narrative is a prompt to prioritize robust refund logic and guardrails in contract design. It also highlights the value of clear intervention pathways—whether through formal bug-bounty programs, sanctioned audits, or cooperative remediation processes—that can facilitate responsible asset recovery in legacy contracts without compromising overall network security or governance.

As the story unfolds, observers should monitor whether the remaining locked funds will continue to be released and whether developers will publish further technical details or patch records that could guide similar retroactive recoveries elsewhere. The Hong Coin saga may become a teachable moment for how to handle legacy contracts with dormant funds in a manner that protects investor interests and preserves the integrity of the ecosystem.

Source: 0xflorent.eth