protocol
The XRP Ledger bug-fix bundle hits the 29-validator threshold with zero spare votes. The Lending amendment it partly repairs is still 10 votes shy of mainnet activation.
on-chain
Token Terminal data compiled October 17 pins Uniswap's September 2026 fee take at $14.81M, with Robinhood Chain alone contributing roughly $7.8M at a 0.465% capture rate.
protocol
Ripple Prime opens RWA perpetual swaps on 100+ markets referencing Trade.xyz futures on Hyperliquid, 24/7, with RLUSD as collateral and Virtu among first users.
The October 8 audit covers Universal Router PRs #469–#470 and v4-periphery #516: 17 issues, 2 Medium (one resolved, one disputed), 7 Low, 8 Notes. One finding could silently disable per-hop slippage.
exploit
A single wallet booked about $1.28M on Papertrade in its first hours by moving Hyperliquid's ETH midpoint. The 1000x venue says it is tightening open-interest caps.
October 8 differential audit covers PR #457 (cross-chain via Across) and PR #497 (per-hop slippage) — one low finding on router allowances, fixed in PR #461.
governance
Greenfield Capital asked Switzerland's Federal Supervisory Authority for Foundations to intervene at the Safe Ecosystem Foundation after months of failed board-reform talks.
governance
A Snapshot vote would liquidate remaining collateral to ETH and pay MIM holders roughly $0.04 per token, closing out a stablecoin whose effective backing has collapsed.
protocol
Aave activated V4 on Avalanche on July 15 with one Liquidity Hub, three Spokes and a $15M Avalanche Foundation milestone-based incentive envelope.
exploit
DeFiTuna disclosed on July 16 that an attacker used a self-created illiquid TUNA/USDC pool routed through Jupiter to round a position's asset value to zero, bypassing the solvency check.
exploit
Polychain/Variant-backed neo-brokerage Cascade lost 1.34M USDC from pre-launch First Wave deposits on July 16; funds were bridged Arbitrum→Solana→Ethereum and swapped into unfreezable DAI.
exploit
An attacker with an authorized oracle-signer key and a registered PriceUpKeep forwarder booked twenty round-trip BTC/USD trades, draining ~28% of Ostium's OLP vault; trading paused.
exploit
Bonzo Lend drained of ~$9.05M on July 11 after a Supra oracle verifier accepted a zeroed BLS signature. Attacker inflated SAUCE price 12 orders of magnitude, bridged $5.25M via LayerZero.
governance
Uniswap Labs' Snapshot temperature check on activating v4 protocol fees closed July 12, 2026, with roughly 93% support. Binding on-chain vote runs the week of July 13.
exploit
Summer.fi's Lazy Summer vaults lose $6.04M in an ERC-4626 donation attack. Root cause: a Silo Varlamore USDC vault token stale-priced since November's Stream Finance collapse. Vaults paused.
exploit
A flash-loaned donation to Summer.fi's Ark inflated FleetCommander.totalAssets() and let an attacker redeem $70.9M from a $64.8M deposit. Lazy Summer vaults paused; funds are moving to Tornado Cash.
exploit
An attacker skipped Hinkal's zk verification with a 'Proofless Deposit', drained ~$820K in USDC on Ethereum, and laundered 410 ETH via Tornado Cash plus 44.7 ETH bridged to Bitcoin over THORChain.
exploit
A flash-loan-assisted exchange-rate manipulation between GOOGLx and wGOOGLx on Edel's xStock lending market inflated collateral 78×, opening ~$403K of bad debt routed through Tornado Cash.
regulation
Alliance to End Human Trafficking and Catholic Charities deliver a letter signed by ~82 leaders urging Senate leadership to revisit the developer carve-out in CLARITY Act Section 604.
regulation
On June 26, MAS placed Hyperliquid on its IAL — a consumer warning, not a ban or enforcement action. Hyperliquid says it never claimed MAS authorization and runs as permissionless infrastructure.
exploit
Attacker farmed approvals from Ethereum's largest sandwich bot using 66 fake WETH/USDC/USDT tokens, then swept ~1,474 WETH, 2.87M USDC and 2M USDT in a single sweep tx.
exploit
An attacker minted a counterfeit LP token, called withdraw on Raydium's deprecated AMM V3 program, and drained 150,177 RAY, 5,603 SOL and 893,700 USDC from 5 Serum-era pools.
exploit
Yuga's blockchain lead 0xQuit and researcher Coffee pulled 29 BAYC, 2 CryptoPunks and 37 other blue-chips out of Flooring before an attacker could redeem them through the fpToken bug.