exploit
Summer.fi's Lazy Summer vaults lose $6.04M in an ERC-4626 donation attack. Root cause: a Silo Varlamore USDC vault token stale-priced since November's Stream Finance collapse. Vaults paused.
regulation
Luxembourg's CSSF upgrades Ripple Markets Luxembourg to full MiCA CASP status on July 6, 2026 — Ripple can passport crypto services into the EEA. RLUSD EMT approval still pending.
governance
SCRT Labs proposes moving native SCRT off Cosmos to Arbitrum via a Sept 1 snapshot. Inflation drops 9%→5%; sSCRT, bridged and IBC balances excluded. Vote pending.
governance
BonkDAO confirmed a ~$20M treasury drain on July 6, 2026 after malicious proposal BIP-76 'Sowellian BonkDAO' passed on its own governance platform. Upbit and Kraken paused BONK.
exploit
A flash-loaned donation to Summer.fi's Ark inflated FleetCommander.totalAssets() and let an attacker redeem $70.9M from a $64.8M deposit. Lazy Summer vaults paused; funds are moving to Tornado Cash.
protocol
VALR, Africa's largest regulated exchange, ships 200+ cross-asset perps on July 6 by natively integrating Hyperliquid's L1 — the first CEX to route perp order flow to an on-chain DEX.
exploit
Security firm Hexens disclosed a stale-cache type-confusion in the Aptos Move VM in late February. Aptos patched within days; no funds lost. Coverage went public on July 4.
protocol
Consensys launched MetaMask Money Account on June 30 on Monad, paying up to 4% variable APY on mUSD routed through Morpho vaults curated by Steakhouse Financial, with Mastercard spending.
exploit
An attacker skipped Hinkal's zk verification with a 'Proofless Deposit', drained ~$820K in USDC on Ethereum, and laundered 410 ETH via Tornado Cash plus 44.7 ETH bridged to Bitcoin over THORChain.