protocol
Aave V4 goes live on Avalanche with hub-and-spoke, first V4 chain beyond Ethereum
Aave activated V4 on Avalanche on July 15 with one Liquidity Hub, three Spokes and a $15M Avalanche Foundation milestone-based incentive envelope.
Stories tagged: #defi
exploit
DeFiTuna suspends Solana lending after $580K USDC pool drained via zero-round
DeFiTuna disclosed on July 16 that an attacker used a self-created illiquid TUNA/USDC pool routed through Jupiter to round a position's asset value to zero, bypassing the solvency check.
exploit
Cascade's Arbitrum CLS vault drained for ~$1.34M USDC before the platform ever went live
Polychain/Variant-backed neo-brokerage Cascade lost 1.34M USDC from pre-launch First Wave deposits on July 16; funds were bridged Arbitrum→Solana→Ethereum and swapped into unfreezable DAI.
exploit
Ostium's Arbitrum perp DEX drained for up to $18M USDC after oracle-signer key compromise
An attacker with an authorized oracle-signer key and a registered PriceUpKeep forwarder booked twenty round-trip BTC/USD trades, draining ~28% of Ostium's OLP vault; trading paused.
exploit
Bonzo Lend loses $9.05M on Hedera after Supra oracle accepts zeroed BLS signature
Bonzo Lend drained of ~$9.05M on July 11 after a Supra oracle verifier accepted a zeroed BLS signature. Attacker inflated SAUCE price 12 orders of magnitude, bridged $5.25M via LayerZero.
governance
Uniswap v4 protocol-fee temp check clears at ~93%, binding on-chain vote follows
Uniswap Labs' Snapshot temperature check on activating v4 protocol fees closed July 12, 2026, with roughly 93% support. Binding on-chain vote runs the week of July 13.
exploit
Summer.fi drained of $6M as attacker donates stale-priced Silo token into Lazy Summer vault
Summer.fi's Lazy Summer vaults lose $6.04M in an ERC-4626 donation attack. Root cause: a Silo Varlamore USDC vault token stale-priced since November's Stream Finance collapse. Vaults paused.
exploit
Summer.fi loses $6M as attacker manipulates FleetCommander totalAssets()
A flash-loaned donation to Summer.fi's Ark inflated FleetCommander.totalAssets() and let an attacker redeem $70.9M from a $64.8M deposit. Lazy Summer vaults paused; funds are moving to Tornado Cash.
exploit
Hinkal drained for ~$820K on Ethereum after proofless-deposit bug bypasses ZK verification
An attacker skipped Hinkal's zk verification with a 'Proofless Deposit', drained ~$820K in USDC on Ethereum, and laundered 410 ETH via Tornado Cash plus 44.7 ETH bridged to Bitcoin over THORChain.
exploit
Edel Finance halts V1 after wGOOGLx wrapping bug drains $403K to Tornado Cash
A flash-loan-assisted exchange-rate manipulation between GOOGLx and wGOOGLx on Edel's xStock lending market inflated collateral 78×, opening ~$403K of bad debt routed through Tornado Cash.
regulation
80 Catholic leaders ask Thune, Schumer to revisit CLARITY Act Section 604
Alliance to End Human Trafficking and Catholic Charities deliver a letter signed by ~82 leaders urging Senate leadership to revisit the developer carve-out in CLARITY Act Section 604.
regulation
Singapore MAS adds Hyperliquid to Investor Alert List
On June 26, MAS placed Hyperliquid on its IAL — a consumer warning, not a ban or enforcement action. Hyperliquid says it never claimed MAS authorization and runs as permissionless infrastructure.
exploit
Jaredfromsubway.eth MEV bot drained for $7.5M in counter-MEV trap
Attacker farmed approvals from Ethereum's largest sandwich bot using 66 fake WETH/USDC/USDT tokens, then swept ~1,474 WETH, 2.87M USDC and 2M USDT in a single sweep tx.
exploit
Raydium loses $1.34M as forged LP mint drains 5 legacy AMM V3 pools
An attacker minted a counterfeit LP token, called withdraw on Raydium's deprecated AMM V3 program, and drained 150,177 RAY, 5,603 SOL and 893,700 USDC from 5 Serum-era pools.
exploit
Yuga Labs whitehats 68 NFTs out of a live Flooring Protocol exploit
Yuga's blockchain lead 0xQuit and researcher Coffee pulled 29 BAYC, 2 CryptoPunks and 37 other blue-chips out of Flooring before an attacker could redeem them through the fpToken bug.