South Korean financial authorities investigated more than 40 cases of unfair crypto trading during the first two years of the Virtual Asset User Protection Act, according to Financial Services Commission Chair Lee Eog-won.

The cases covered suspected market manipulation and other fraudulent trading activity.

Authorities reported or referred more than 30 cases to investigative agencies and identified 25 suspects. Lee said average unlawful gains reached about 1.4 billion Korean won, or roughly $940,000, per case. He published the figures as the law marked two years since taking effect in July 2024.

“Today marks the second anniversary of the enactment of the Virtual Asset User Protection Act,” Lee wrote. 

He said the law brought the crypto market into a formal legal framework and created a system aimed at protecting users.

Regulators plan wider market surveillance

The Virtual Asset User Protection Act sets rules for how virtual asset service providers handle customer funds and assets. It requires providers to separate customer holdings from company assets and keep user deposits with banks. The law also gives regulators powers to inspect service providers and act against practices such as insider trading, wash trading and market manipulation.

South Korea has used those powers in several recent cases. As crypto.news reported earlier this month, the FSC referred two suspected market manipulation cases to prosecutors. One case involved a trader accused of buying close to half of a token’s circulating supply before selling into rising demand. The regulator warned users about sharp price and volume moves linked to low-liquidity tokens.

The latest two-year figures show that enforcement has moved beyond individual cases. The FSC said authorities have targeted short-term price manipulation and other trading patterns that can distort markets. Lee added that regulators plan to improve surveillance, investigation and monitoring systems with artificial intelligence and focus more closely on high-risk areas.

“We will continue to enhance market surveillance, investigation and monitoring systems based on AI,” Lee said. The regulator has not disclosed a full public list of the 40-plus cases or detailed the status of every referral.

Meanwhile, South Korea continues to expand its digital asset rules.The government is moving to bring cryptocurrencies and other digital assets under a new state asset management framework. The proposal would extend state asset rules beyond traditional holdings such as real estate.

Authorities have also increased scrutiny of unregistered crypto operators. Crypto.news reported in June that the Financial Intelligence Unit had referred about 40 unregistered operators to law enforcement and warned users about risks tied to platforms operating outside the country’s registration system.

The Virtual Asset User Protection Act took effect on July 19, 2024, as South Korea’s first dedicated law focused on crypto user protection and unfair trading. Two years later, regulators are using the framework to pursue alleged market abuse while preparing wider digital asset rules and new monitoring tools.

Equities and technology bets are still recovering from Friday. Moonshot AI’s Kimi K3, a Chinese open-weight model that took the top spot in a widely watched coding benchmark, triggered a semiconductor selloff that dragged crypto down with it to close last week.

The aftershock ran through Asia on Monday, with South Korea’s Kospi falling 3.5% as traders returned from their own holiday. U.S. futures steadied, with the Nasdaq 100 up 0.5%, but the question the release raised has not gone away.

For crypto the two forces roughly cancel. War-driven oil is inflationary, which is bad for risk assets and for the case that the Federal Reserve holds rates steady. Meanwhile, a Chinese model undercutting the AI trade pressures the chip stocks that bitcoin has tended to track all month.

The week’s test is corporate, not macro. There are no major U.S. economic releases, so the read on the AI trade comes from earnings, with Alphabet reporting Tuesday, Tesla Wednesday and Intel Thursday.

After last week’s wobble in AI and semiconductor shares, those results will set whether the capital spending underwriting the sector, and the miner-to-AI pivot riding on it, still has a floor.

That interpretation is intuitive given that ETFs, which let investors gain exposure to the cryptocurrency without owning it directly, are widely seen as a cleaner crypto market gateway for institutions. As a result, positive ETF inflows are taken to mean BTC is receiving institutional support, while outflows suggest the opposite.

Bitcoin’s price too has stabilized between $64,000 and $65,000 lately, offering hope that a bottom may be in. Prices peaked above $126,000 in October last year.

On the surface, it looks like the tide has turned. However, there is a massive caveat that makes these ETF inflows look like statistical noise rather than a structural shift.

The peanuts reality check

The hype surrounding this $273 million inflow quickly evaporates when compared to the carnage of the preceding eight weeks. During that two-month outflow streak, the market watched billions of dollars walk out the door.

To put the current “recovery” in perspective: the total amount of money that has entered the market over the last 14 days ($273 million) is barely more than the smallest single-week outflow recorded during that eight-week slump, which was $226.84 million in the week ended June 18.

In other words, it took two full weeks of “renewed optimism” just to offset the quietest week of the recent sell-off.

Cardano has activated the van Rossem hard fork, moving its mainnet to Protocol Version 11 after the upgrade took effect at the epoch boundary on July 18. 

Intersect confirmed that the hard fork had been successfully enacted after weeks of testing, infrastructure updates, and governance voting.

The upgrade follows its ratification on July 13 by Cardano’s delegated representatives, stake pool operators, and Constitutional Committee. The Cardanoscan governance record shows that the proposal called for Protocol Version 11. Intersect reported 77.63% DRep support and 52.7% SPO support when the required thresholds were met.

Van Rossem is an intra-era hard fork, so Cardano remains within the Conway era while updating parts of its protocol. The upgrade introduces new Plutus capabilities and cost model changes designed to make some smart contract operations cheaper. It also includes technical updates aimed at improving Plutus performance and other parts of the network.

The mainnet activation followed earlier testing on the Preview and Preprod networks. Preview moved to Protocol Version 11 in May, while the Preprod upgrade followed in June after developers addressed tooling compatibility issues. As previously reported by crypto.news, the mainnet proposal arrived in June after those testing and preparation stages.

Dijkstra and Ouroboros Leios come next

The van Rossem hard fork also prepares Cardano for its next planned protocol upgrade. Input Output said, “As well as Plutus improvements and Plutus Cost Model enhancements, this upgrade lays the foundation for the next upgrade, the Dijkstra era hard fork, which will introduce Ouroboros Leios to Cardano.”

Leios is a proposed upgrade to Cardano’s Ouroboros proof-of-stake system that aims to raise transaction throughput while keeping its existing security model. Development remains underway. According to the latest Cardano weekly report, the consensus team has continued stabilizing the Leios testnet, released two new prototype builds, and worked on changes intended to improve block certification rates. Crypto.news previously reported that Leios forms part of Cardano’s wider protocol development roadmap.

Onchain governance takes control of the upgrade process

Van Rossem also marks the first Cardano hard fork to move through the network’s Voltaire onchain governance system rather than relying on the earlier coordination model led by founding development groups. Cardano said the final decision to ratify and execute the upgrade rested with DReps, SPOs, and the Constitutional Committee after technical teams completed the required preparation.

The process follows Cardano’s broader move toward community-led decisions. The same system has also produced different outcomes for funding proposals. As crypto.news reported earlier, the community rejected a 7.8 million ADA request for the 2026 Cardano Summit, leading to its cancellation. Meanwhile, other treasury funding has supported protocol work that includes Leios, Hydra, and Mithril.

With van Rossem now active, Cardano is operating on Protocol Version 11 while development continues on Dijkstra and Ouroboros Leios. The network has not announced a final mainnet launch date for Leios, although recent ecosystem coverage has placed the planned scaling upgrade later in 2026.

Allbridge Core has paused its cross-chain stablecoin protocol after a security incident on Solana that PeckShield estimated at about $1.65 million. 

The protocol told users with funds in affected liquidity pools to withdraw while its team investigates. PeckShield also said the attacker moved the stolen assets from Solana to Ethereum.

The incident appears to involve manipulation of Allbridge Core’s USDC/USDT liquidity pool. Onchain Lens said the attacker used a $1.12 million USDC flash loan from Kamino, changed the pool balance through rapid swaps and withdrew liquidity at distorted rates. The exact loss figure remains under review, with Onchain Lens describing more than $1.1 million extracted and PeckShield estimating the broader exploit at about $1.65 million.

Allbridge pauses Core and warns liquidity providers

“Allbridge Core is experiencing a security incident,” the team said in its public notice. It added that the protocol had been paused as a precaution while the investigation continued. The project also issued a direct warning: “If you have liquidity in affected pools, please withdraw now.”

Allbridge said the attack left some pools temporarily out of balance. That imbalance created an arbitrage window that allowed some traders to profit from unusual pricing. The team asked anyone who benefited to consider returning funds to a recovery address. It said returned assets would go toward compensating affected liquidity providers. At the time of writing, the notice did not give a reopening date or publish a technical report.

In addition, according to Onchain Lens, the attacker borrowed $1.12 million in USDC through a flash loan from Kamino. The attacker then carried out rapid USDC and USDT swaps that changed the ratio inside the Allbridge stablecoin pool. After the pool price moved, the attacker withdrew liquidity using the distorted rate and repaid the flash loan within the same transaction.

Flash loans allow users to borrow and repay funds in one blockchain transaction without posting normal collateral. In this case, the loan itself was not described as the vulnerability. Instead, the borrowed liquidity allegedly gave the attacker enough capital to move the pool ratio and extract value before the transaction ended. PeckShield later said the stolen funds were bridged from Solana to Ethereum.

Allbridge faces another bridge security incident

The latest Allbridge Core exploit follows an earlier attack against the project. As crypto.news previously reported, Allbridge suffered a separate exploit in April 2023 after an attacker manipulated the swap price of a BNB Chain pool. The loss was estimated at about $573,000, and the project later recovered roughly $465,000 after offering the attacker a white-hat reward.

The new incident also comes during another active period for cross-chain security breaches. In May,the Verus-Ethereum bridge lost more than $11.5 million in an attack linked by researchers to missing validation checks. A separate crypto.news report said Transit Finance lost about $1.88 million in another cross-chain protocol exploit. Allbridge has not said whether the Solana incident shares technical similarities with those attacks.

Allbridge, the firm behind the cross-chain stablecoin bridge Allbridge Core, has paused its protocol after a reported security incident on Sunday that investigators and on-chain analysts say resulted in roughly $1.65 million being drained. The company said the pause is a precaution while it investigates, and it urged users with liquidity in impacted pools to withdraw.

According to Allbridge Core’s own announcement on X, the exploit affected Allbridge Core’s deployment on Solana. Monitoring accounts cited in the incident also claim the attacker moved funds from Solana to Ethereum and then funneled proceeds into privacy-related pools, illustrating how quickly bridge exploits can turn into multi-chain extraction events.

Key takeaways

• Allbridge Core has paused its protocol following a reported cross-chain stablecoin bridge incident affecting its Solana deployment.
• The incident reportedly involved ~$1.65 million drained, with on-chain monitoring suggesting the attacker bridged funds from Solana to Ethereum.
• Liquidity providers were urged to withdraw from affected pools to limit exposure while the team investigates.
• On-chain analysis points to a flash-loan and rate-manipulation pattern that allowed the attacker to profit from a temporary pool imbalance.
• Bridge exploits are recurring: multiple reported attacks have hit different bridge systems since May, highlighting structural risk across the sector.

Allbridge Core pauses after Sunday incident

Allbridge said in a Sunday post on X that Allbridge Core was “experiencing a security incident” and that it had paused the protocol while it investigates. The firm added a direct instruction to users: if they have liquidity in affected pools, they should withdraw immediately.

The breach was reported to involve Allbridge Core’s Solana deployment. CertiKAlert later posted that the stolen funds had already been bridged from Solana to Ethereum before moving into privacy pools, according to the monitoring thread referenced by reporting shared on social media.

While the company did not provide additional technical details in the initial communication, the operational response—pausing the protocol and prompting LP withdrawals—suggests that Allbridge recognized ongoing risk rather than treating the event as a fully contained, already-resolved failure.

What on-chain reports say happened

On-chain analytics highlighted a specific mechanism consistent with recent DeFi bridge exploitation patterns. According to Onchain Lens, the attacker made a $1.12 million USDC flash loan from Kamino. The attacker then used rapid USDC/USDT swaps to distort the exchange rate inside the Allbridge Core stablecoin pool.

The same reporting indicates the attacker took advantage of the manipulated pricing by withdrawing liquidity at unfavorable-to-others rates. After extracting the difference created by the temporary imbalance, the attacker reportedly repaid the flash loan and retained the profit from the rate disruption.

Allbridge Core’s own follow-up language, as reflected in the incident discussion, referenced a “pool imbalance” that created a “temporary positive arbitrage window.” The company also suggested that if anyone took advantage of the window, they should consider returning funds, with any returned amounts intended to support compensation for affected liquidity providers.

Why this kind of bridge attack keeps repeating

This incident did not occur in isolation. The reporting notes that it is at least the sixth attack targeting a cross-chain bridge since May. Bridges are frequently attacked because they manage large pools of assets across networks—assets that back bridged tokens on the destination chain. If an attacker can manipulate pricing, liquidity, or settlement logic, the bridge’s pooled reserves can amplify losses.

In practice, these attacks often combine speed (to exploit temporary state changes) with cross-chain movement (to break the attacker’s funds away from any single environment). Sunday’s event appears to align with that playbook: on-chain monitoring suggested stolen value moved from Solana to Ethereum before being moved into privacy pools, underscoring the challenge for recovery once funds change hands across chains.

The case also highlights a persistent tension for investors and LPs: even when bridge designs rely on liquidity pools and token accounting rather than direct custodian control, attackers can still reach profit by exploiting assumptions around swap paths, price discovery, and pool invariants—especially when flash loans are available.

Allbridge Core isn’t new to flash-loan style exploits

Allbridge Core’s Sunday incident is not the company’s first exposure to flash-loan-driven manipulation. Earlier coverage and related documentation indicate that in April 2023 Allbridge was exploited for about $573,000 through a flash loan attack on Allbridge’s pool on BNB Chain.

That earlier event, as described in an analysis of the hack, involved an attacker acting as both liquidity provider and swapper, exploiting a flaw in smart contract logic that allowed them to manipulate swap prices. The outcome included drains denominated in BUSD and USDt, totaling roughly $573,000 based on the figures cited in the underlying analysis.

With Sunday’s report pointing to a similar exploitation pattern—flash loan funding, fast swaps, pool imbalance, then liquidity withdrawals—the renewed incident raises a practical question for LPs: even if a team responds by pausing the protocol, what controls exist to prevent the same class of risk from reappearing under different market conditions or on different deployments?

Cross-chain bridge attacks remain a sector-wide problem

Broader reporting shows that cross-chain bridges have faced repeated pressure from exploits across multiple ecosystems in recent months. In June, for example, Taiko urged users to withdraw assets from its bridges after a $1.7 million exploit, later reopening its bridge 11 days after completing a recovery plan. Weeks earlier, Secret Network was reportedly exploited through an “infinite mint” bug that created unbacked versions of Axelar-wrapped assets, resulting in a $4.67 million incident. Other widely reported bridge failures included Gravity Bridge, Verus Bridge, and Butter Network.

Together, these cases reinforce an important takeaway for anyone using or providing liquidity to bridge-related systems: cross-chain infrastructure concentrates both technical complexity and financial value, and the attack surface expands as protocols integrate multiple chains, wallets, swap venues, and liquidity mechanisms.

Readers should watch closely for two things next: whether Allbridge Core can determine the full scope of the impacted liquidity pools on Solana and any related deployments, and whether the team’s investigation leads to specific changes that reduce the likelihood of similar flash-loan-driven pool imbalances recurring.