Kelp DAO has completed the operational phase of its rsETH recovery plan more than five weeks after the Ethereum liquid staking protocol lost $293 million in a hack that investigators linked to North Korea’s Lazarus Group.

According to a Monday statement posted by Kelp DAO on X, the protocol transferred the final batch of 20,373.7 rsETH to the LayerZero smart contract responsible for handling token locking, minting, burning, and releases during cross-chain transfers.

Kelp DAO said the move completed the final operational step required to restore rsETH backing after the April 18 exploit drained 116,500 rsETH from its bridge infrastructure.

Kelp DAO had already reopened withdrawals and resumed rsETH bridging between the Ethereum mainnet and supported layer 2 networks after transferring an initial tranche of 25,000 rsETH on May 13.

In its latest update, the protocol added that rsETH minting, redemptions, and reward functions are now operating normally again.

Funds used to restore the token backing came partly through the DeFi United recovery initiative, where multiple decentralized finance protocols coordinated support following the exploit.

Aave still dealing with aftermath of exploit

In the meantime, the fallout from the Kelp DAO attack continues to weigh on lending activity tied to Aave.

After the exploit, attackers deposited a large portion of the stolen rsETH into Aave as collateral and borrowed wrapped Ether against it. Court filings and governance documents previously stated that the incident left nearly $190 million in bad debt across affected Aave markets.

In the weeks that followed, DefiLlama data showed Aave’s total value locked dropped from more than $26 billion to below $14 billion as users withdrew liquidity from lending pools. Although outflows have slowed over the past month, the protocol’s TVL has remained largely rangebound between roughly $13.9 billion and $15.1 billion.

AAVE TVL. Source: DefiLlama.

Recent governance actions have restored some protocol functions. On May 18, Aave founder Stani Kulechov confirmed that borrowing against wrapped Ether collateral had resumed across several Aave V3 deployments, including Ethereum, Arbitrum, Base, Mantle, and Linea. Governance participants had earlier approved emergency restrictions after the exploit allowed unbacked rsETH to enter lending markets.

LayerZero dispute and legal battle continue

At the same time, legal disputes tied to frozen Ether connected to the incident are still unresolved. Earlier court filings showed that approximately 30,765 ETH, valued at nearly $71 million when frozen by the Arbitrum Security Council on April 21, became the subject of competing legal claims after blockchain analytics firms attributed the exploit to North Korean-linked actors.

Gerstein Harrow LLP, representing families pursuing terrorism-related judgments against North Korea, argued in court that the assets could qualify as property tied to Lazarus Group activity. Aave has disputed that interpretation, stating in filings that no court has formally determined North Korea or Lazarus Group carried out the exploit and that the recovered assets belong to affected users.

Separate tensions also emerged between Kelp DAO and LayerZero after the exploit. Earlier this month, Kelp DAO announced plans to migrate rsETH infrastructure from LayerZero’s OFT framework to Chainlink’s Cross-Chain Interoperability Protocol. Kelp DAO said the migration was part of efforts to strengthen bridge security following the attack.

LayerZero co-founder and CEO Bryan Pellegrino, however, has rejected several claims made by Kelp DAO regarding bridge configurations and security approvals. 

Crypto users have continued losing funds to phishing campaigns promoted through Google Ads, with attackers now using fake Uniswap websites to steal hundreds of thousands of dollars from unsuspecting wallet holders.

According to on-chain analyst “b-block,” a malicious website impersonating decentralized exchange Uniswap drained multiple wallets and accumulated at least $400,000 in stolen assets.

One of the attacker’s wallet addresses with drained funds. Source: b-block on X.

The analyst shared two wallet addresses tied to the operation, which together held 146 ETH worth roughly $306,000 at the time of reporting, based on Etherscan data.

Meanwhile, Stacy Muur, founder of Web3 marketing agency Green Dots, said the phishing operation relied on sponsored Google search advertisements designed to appear above legitimate Uniswap links. 

Muur shared a screenshot showing the fake sponsored result and criticized Google for failing to stop such campaigns despite repeated incidents targeting crypto users.

Google Ads has repeatedly appeared in similar phishing cases over the past year. As previously reported by crypto.news in July, Scam Sniffer reported that a DeFi user lost more than $1.23 million in Uniswap NFTs after signing a malicious transaction on a fake website promoted through Google Ads. 

According to Scam Sniffer, the attackers used a phishing page that closely copied Uniswap’s interface and tricked the victim into approving unlimited asset transfers through a malicious smart contract.

At the same time, blockchain security firms have warned that attackers increasingly rely on Punycode domains and cloned interfaces that look nearly identical to legitimate crypto platforms. Once users connect wallets and approve transactions, scammers gain direct access to assets without needing private keys.

Security groups warn phishing attacks are increasing

Meanwhile, decentralized finance analytics platform DeFiLlama said fake Google advertisements remain one of the most common entry points for phishing attacks in crypto. 

Previously, the Security Alliance, also known as SEAL, reported that phishing activity tied to Google Search advertisements saw a “significant uptick” during March.

According to SEAL, attackers either purchase Google advertisements directly or compromise legitimate advertiser accounts to distribute fake links impersonating major crypto protocols and exchanges. The group said malicious actors routinely outbid legitimate companies so their phishing pages appear at the top of sponsored search results.

Fake Uniswap ad appearing on Google search. Source: SEAL.

SEAL said it blocked more than 356 malicious advertisement links over the past year and warned the campaign remained active with continued reports from affected users. The organization also stated that attackers use hidden iframes and secondary payloads that remain invisible to Google’s automated detection systems while showing users legitimate-looking URLs.

Victims who enter these fake websites often see nearly identical copies of real crypto applications. 

According to SEAL, all traffic from those cloned platforms gets routed through attacker-controlled servers that can intercept approvals and drain wallets. The group estimated that phishing attacks tied to Google ads stole roughly $1.27 million between March 13 and March 30 alone.

More recently, blockchain security firm PeckShield Alert warned about another phishing campaign involving fake Aave advertisements placed at the top of Google search results. 

As previously reported by crypto.news, the malicious websites prompted users to approve transactions that handed wallet access directly to attackers. Scam Sniffer issued a similar warning in June after spotting fake Aave ads ranking prominently in Google searches.

Ethereum traded near $2,100 on May 26, according to crypto.news price data. 

Meanwhile, the token was down 0.12% over 24 hours and 1.7% over seven days. Its 24-hour trading volume stood at $9.72 billion, while market capitalization reached $253.25 billion.

The same data showed Ethereum moving between $2,080 and $2,140 during the day. That kept ETH close to the wider $2,000 to $2,100 support zone that traders have watched since the latest pullback.

Short-term indicators still show weak momentum. The Awesome Oscillator was negative at -153.30, meaning sellers still control the current trend. The Chaikin Money Flow was also slightly negative at -0.04, pointing to mild capital outflow rather than strong accumulation.

Volume stood near 46.84K on the chart, which looked moderate compared with earlier selloff spikes. That means the move lower has not yet shown clear panic selling. A recovery above $2,300 to $2,400 would improve the setup, while a loss of $2,000 would raise downside pressure.

Vitalik Buterin denies selling Ethereum

Ethereum co-founder Vitalik Buterin also became part of the market discussion after Ali Martinez posted a price analysis titled “I’m NOT selling Ethereum!” The post linked the price setup to Buterin’s comments about the Ethereum Foundation’s future role.

As previously reported by crypto.news, Buterin said the Ethereum Foundation will prioritize long-term survival over wider activity. He also said the foundation will sell less ETH as it narrows its work around privacy, security, openness, and core protocol goals.

Advertisement

Buterin said the foundation holds about 0.16% of the total ETH supply. He also described the Ethereum Foundation as one part of the wider Ethereum system, not the center of the network.

The message matters because Ethereum traders have watched foundation treasury moves closely throughout May. The foundation had withdrawn 21,270 ETH from Lido staking and sold 10,000 ETH to BitMine on May 1 at an average price of $2,292.

Analysts watch $1,850 support and $2,400 resistance

Ali Martinez said Ethereum has failed to reclaim the mid-range of a multi-year structure, which also aligned with the 200-week Simple Moving Average. In that view, the most important level is $1,850.

The analyst warned that a weekly close below $1,850 could open the way toward $1,560, followed by a deeper move near $1,070. Those levels were framed as potential accumulation zones, not as a reason to chase short positions.

Advertisement

Ali also linked $1,850 to the 0.8 MVRV pricing band. The analyst said Ethereum has not usually stayed below that band for long in past cycles. Based on that view, weakness below $1,850 could create a staged dollar-cost averaging setup.

The planned tiers included 20% allocation at $1,850, 20% at $1,560, 20% at $1,230, 30% at $1,080, and 10% at $830. The bullish invalidation levels were also clear: Ethereum would need to reclaim the 200-week SMA near $2,500, then break above the 50-week SMA around $3,100.

As reported by crypto.news, Ethereum also faced resistance near $2,400 earlier this month. That report said sell walls around $2,400 kept upside limited, while $2,200 remained a key downside area at the time.

Low volatility leaves ETH waiting for direction

CryptoQuant analyst Arab Chain said Ethereum’s 30-day volatility index on Binance had fallen near 0.30, its lowest level since 2023, while ETH traded near $2,100.

Advertisement

Low volatility does not confirm a bullish or bearish move. It often shows that traders are waiting for a clearer signal before adding risk. After long calm periods, stronger moves can return quickly when volume and liquidity rise again.

CW also said Coinbase whales had formed a short-term sell wall near $2,400. The analyst said those whales were applying pressure but were not actually selling. That keeps the $2,400 area important for any recovery attempt.

A sell wall for $ETH whales exists at $2,400.

Coinbase whales are forming a short-term sell wall and pushing down, but they are not actually selling.

They are just applying downward pressure. pic.twitter.com/ouk6SeY7yA

— CW (@CW8900) May 26, 2026

Advertisement

A clean move above $2,400 would weaken the sell-wall setup and bring $2,500 into focus. That would also match Ali Martinez’ first bullish trigger near the 200-week SMA.

If Ethereum loses $2,000, traders may shift attention back to $1,850. A weekly close below that level would strengthen the bearish technical case and bring lower accumulation tiers into view.

Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.

Advertisement

Key Points

• Fraudulent Uniswap advertisements on Google Search successfully stole more than $400,000 from cryptocurrency investors
• Blockchain analysis revealed two suspicious wallet addresses containing approximately 146 ETH, valued at roughly $306,000
• SEAL (The Security Alliance) identified and blocked more than 356 dangerous ad links, with total losses reaching $1.27 million from March 13 through March 30
• Cybercriminals evade Google’s automatic screening by deploying authentic-appearing URLs combined with concealed iframes
• Malicious cryptocurrency advertisements have persisted as an ongoing threat for more than twelve months without meaningful reduction

Cybercriminals have orchestrated a sophisticated advertising campaign on Google Search that mimics Uniswap, a widely-used decentralized cryptocurrency platform. This fraudulent operation has successfully drained a minimum of $400,000 from unsuspecting victims who interacted with the deceptive advertisements.

Blockchain researcher known as “b-block” raised alarm bells on X, cautioning that a counterfeit Uniswap platform was systematically emptying funds from numerous digital wallets. Stacy Muur, who leads the Web3 marketing firm Green Dots, corroborated these findings and published evidence showing the fraudulent sponsored listing appearing prominently on Google.

“The fact that Google has allowed this problem to persist for years while fraudulent links consistently rank above legitimate ones and victims continue losing money is absolutely unacceptable,” Muur stated.

According to Etherscan records, two wallet addresses marked as suspicious contained approximately 146 ETH, representing about $306,000 in value when documented.

The Mechanics Behind the Fraud

The perpetrators employ one of two strategies: either purchasing Google Ads accounts outright or compromising existing legitimate advertiser profiles. They subsequently launch deceptive advertising campaigns that outbid authentic cryptocurrency platforms for premium positioning in the “Sponsored results” segment of Google Search.

These advertisements utilize convincing URLs designed to circumvent Google’s automated verification processes. An invisible secondary iframe subsequently loads the harmful code, which remains undetectable by Google’s monitoring infrastructure.

Upon clicking these advertisements, victims are redirected to meticulously crafted replicas of genuine crypto applications. Every network communication is covertly redirected through infrastructure controlled by the attackers, facilitating the theft of wallet contents.

DeFiLlama verified that fraudulent Google advertisements represent a prevalent phishing technique within cryptocurrency circles. SEAL (The Security Alliance), a nonprofit organization focused on crypto security, documented a significant surge in these attacks throughout March.

According to SEAL, they successfully blocked more than 356 malicious advertising links, characterizing it as “a consistent influx of attacker-deployed Google Ads weekly for over a year.” The organization emphasized that the offensive shows no indication of diminishing and that additional victims continue coming forward with reports.

During the period spanning March 13 to 30 exclusively, cumulative financial losses through these tactics amounted to $1.27 million.

The Threat Extends Beyond a Single Platform

This security challenge transcends any individual platform. During early May, threat actors leveraged Google Ads alongside shared conversations from Anthropic’s Claude AI assistant to execute a malvertising operation specifically designed to compromise Mac users.

Cybersecurity company Malwarebytes additionally identified Facebook as a significant distribution channel for fraudulent advertisements. In February, the firm documented scammers purchasing Facebook ad space to create convincing imitations of official Microsoft promotional materials.

Those unfortunate victims were directed to remarkably accurate duplicates of the Windows 11 download interface, where malicious software engineered to extract cryptocurrency assets and authentication credentials was deployed onto their systems.

This recurring pattern demonstrates that cybercriminals are exploiting major advertising networks to execute persuasive scams targeting both cryptocurrency enthusiasts and mainstream software consumers. Neither Google, Meta, nor other affected platforms have issued comprehensive public responses addressing the magnitude of these fraudulent campaigns.

Scammers have been using Google to deploy malicious phishing advertisements impersonating the crypto protocol Uniswap, which has reportedly netted the attackers at least $400,000. 

The on-chain analyst “b-block” posted to X on Monday that a website impersonating decentralized finance exchange Uniswap was draining funds from multiple wallets and the scammers were holding at least $400,000.

Stacy Muur, founder of Web3 marketing agency Green Dots, said that the scammers had stolen the funds from users through a phishing ad on Google that impersonated Uniswap, and shared a screenshot of a sponsored result from the search engine.

“It’s insane that Google has ignored this issue for years while fake links keep getting pushed above real ones and users keep getting drained,” she said.

Source: Stacy Muur

The two flagged addresses held a combined 146 ETH worth around $306,000, at the time of writing, according to Etherscan.

DeFiLlama said that “fake ads on Google are a common source of phishing attacks.” The crypto non-profit group Security Alliance (SEAL) reported in April that there was a “significant uptick” in phishing activity on Google search in March.

SEAL said that attackers pay Google or hack legitimate advertiser accounts to run convincing fake ads impersonating popular crypto protocols to lure users. Threat actors outbid legitimate crypto exchanges and protocols to achieve a superior position within the “Sponsored results” section on Google Search.

SEAL blocked over 356 malicious advertisement links, a number which is “representative of a steady volume of attacker-deployed Google Ads each week for more than a year,” it added. “The campaign is not slowing down, and we are receiving more reports from affected users.”

Related: ‘TrapDoor’ malware targets crypto dev tools in supply chain attack

The phishing ads used legitimate-looking URLs to bypass Google’s automated checks, while a hidden secondary iframe loads the malicious payload, also invisible to Google’s detection.

Victims land on convincing clones of real crypto apps, with all network traffic secretly routed through attacker-controlled servers, explained SEAL, reporting that $1.27 million in total funds were stolen between March 13 and 30.

In early May, it was reported that attackers were abusing Google Ads and legitimate shared chats from AI chatbot Claude in an active “malvertising” campaign targeting Mac users.

Facebook is also a hotbed of fake ads and scams, according to Malwarebytes, which reported in February that scammers were running paid ads that looked like official Microsoft promotions. 

Victims were directed to near-perfect clones of the Windows 11 download page, where malware designed to steal crypto and credentials was deployed. 

Magazine: Polymarket seeks Japan entry, Harvard dumps entire ETH position: Hodler’s Digest

Decentralized platform Hyperliquid is now competing with established betting platforms such as Polymarket, but with a differentiated mechanism for resolving bets.

The leading decentralized exchange has expanded its HIP-4 outcome contracts beyond crypto price milestones into real-world events. This native prediction-market infrastructure allows users to trade macro contracts, such as inflation data and interest-rate decisions, directly alongside their standard crypto perpetuals out of a single account.

Outcome markets mark a notable expansion for the decentralized derivatives venue, which built its business around crypto perpetual futures and initially tested the product using price‑outcome contracts settled against its own market data.

Hyperliquid first tested the product on exchange‑native outcomes, such as whether bitcoin would trade above a specific level by a fixed time using Hyperliquid’s own reference prices. The latest rollout expands that model into real‑world macro events, or offchain outcomes, like U.S. inflation and Federal Reserve decisions, directly competing with prediction market platforms like Polymarket.

Native resolution

What sets it apart is that HIP‑4 brings dispute resolution and settlement in‑house, rather than depending on an external oracle network like Polymarket.

Here’s why it matters. Offchain events introduce a new problem: determining truth.

Polymarket handles this through UMA, an external oracle protocol that uses an optimistic dispute system. A proposed settlement stands unless challenged, at which point UMA tokenholders vote on the final result. That model has faced criticism following controversial resolutions, prompting accusations that large tokenholders could influence outcomes.

Hyperliquid uses a more vertically integrated model. Validators themselves ingest external information through automated newsfeed software, determine whether markets should launch, and vote on settlement outcomes.

Multi-purpose platform

The launch also fits into Hyperliquid’s broader effort to evolve into a multi‑asset trading venue. FalconX said in a recent report that the exchange’s expanding product stack could position it as a challenger not just to crypto‑native rivals but also to traditional exchanges.

“For example, you could pair a HIP‑3 perps position on NVDA with outcome markets that NVDA will miss or beat earnings,” CoinDesk previously reported.

Hyperliquid’s outcome markets are structured as fully collateralized contracts rather than leveraged bets, thereby limiting losses to the amount paid upfront. Traders buy “Yes” or “No” positions tied to a defined event, with contracts settling at either 1 USDC or zero USDC depending on the result. If a trader buys a “Yes” contract at 0.65 USDC, their maximum loss is limited to that upfront amount, unlike perpetual futures, where leverage can trigger liquidations.

That makes the product sit somewhere between a prediction market and a simplified binary options contract.

If Hyperliquid’s outcome markets gain traction, traders could eventually use the same venue to express directional crypto views, hedge macro risks, and speculate on event outcomes without moving collateral between platforms.

Bitcoin is sliding into a high-risk environment due to continued institutional selling, primarily from US spot exchange-traded funds, according to crypto analytics platform Swissblock.

Swissblock said on Tuesday that its Bitcoin risk index was at a high risk score of 33 out of 100, adding that “every time the Risk Index signals that selling pressure is structurally overwhelming the market, what sits underneath is institutional distribution.”

The platform’s proprietary risk index was developed to gauge the overall risk level in the Bitcoin market by measuring the relative balance between selling pressure and buying pressure, helping to assess how “risky” it currently is to buy or hold Bitcoin.

After strong accumulation in March and April, May has flipped back into distribution, and the risk index is now “moving into high-risk territory while ETF flows are deteriorating simultaneously,” said Swissblock.

It added that spot Bitcoin ETF demand is no longer absorbing selling pressure effectively, and without strong ETF support underneath, “the risk index can continue accelerating higher.”

Bitcoin risk index accelerates with increasing ETF outflows. Source: Swissblock

Related: $1.26B Bitcoin ETF outflows spark ‘contrarian’ buy signal: Santiment

On-chain analytics provider Glassnode reported on Monday that US Bitcoin ETFs have recorded net outflows on nearly every trading day since May 7, showing “a persistent institutional sell signal now running for more than two weeks.”

“This steady drip of outflow continues to add to the supply side without a visible demand offset,” it said. 

Jeff Ko, chief analyst at CoinEx, told Cointelegraph on Tuesday that the broader crypto market “remains in a holding pattern.”

“Spot ETF flows have posted more than $2 billion in outflows over the past two weeks, highlighting that institutional risk appetite is still sensitive at the margin,” he added. 

Bitcoin dips as US strikes Iran

Risk was accelerated even further on Tuesday morning amid multiple reports that the US had launched fresh strikes on Iran despite the two countries recently making progress on a peace deal.

US Central Command said the strikes targeting Iranian missile sites and boats attempting to place mines were in “self-defense” and were to protect US troops from threats posed by Iranian forces.

Bitcoin reacted with a 1% decline, falling from over $77,000 to just below $76,500 on Coinbase, according to TradingView, but it has remained range-bound for almost four months.

Ko said that “despite Washington’s latest ‘self-defence’ operation, the very short-term market reaction may still lean risk-on, particularly as investors appear to be looking through the geopolitical noise and focusing on the possibility of a US-Iran peace deal.”

Magazine: Polymarket seeks Japan entry, Harvard dumps entire ETH position: Hodler’s Digest

Fundamental backdrop

In late April 2026, Japan’s Ministry of Finance moved from verbal warnings to direct action, carrying out a currency intervention worth roughly ¥5.5 trillion ($35 billion) — the first since July 2024. The move was triggered by the yen weakening beyond the psychologically significant level of 160 against the dollar.

Additional context comes from the divergence in monetary policy between the ECB and the Bank of Japan: the European regulator continues to leave the door open to tighter policy amid rising inflation expectations, while Tokyo maintains a cautious normalisation path without providing clear guidance on the timing of its next move.

Technical picture

After reaching a local peak near 188 in mid-April, the EUR/JPY pair experienced two impulsive declines. The first occurred on 30 April, when the candlestick recorded an abnormal spike in vertical volume — a direct consequence of the Japanese Ministry of Finance intervention, which saw the yen strengthen by roughly 3% during the session. A second bout of sharp selling pressure followed in early May.

As a result, a horizontal profile formed with boundaries at 183.800–185.000, while the point of control is concentrated within the 184.50–184.70 range.

The price is now testing the upper boundary of the profile — an area where sellers have already shown activity on two separate occasions. The 182 region has held since February and could once again come into focus if pressure resumes: both May sell-offs reversed precisely from this zone, failing to break lower. Meanwhile, the 185.500 area could act as resistance should the current advance continue.

RSI + MA readings stand at 57 / 55 / 53 respectively — all three lines remain in neutral territory, with no clear signs of momentum.

Key takeaways

The current situation is shaped by the clash between interest-rate differentials and the willingness of the Japanese authorities to intervene again if necessary. For now, with RSI offering no directional impulse, the point of control and the profile boundaries remain the key reference levels for assessing the current trading range.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.