vault

According to Bitcoin News monitoring, Coldcard thieves are prioritizing the emptying of the largest portion of the third wave vaults. Galaxy Research indicates that these wallets have transferred out 97.09 BTC, worth approximately 7.7 million dollars, accounting for about 45% of the assets in this batch.The attackers created 293 2/2 vaults themselves, and had transferred some tokens through THORChain on September 2, subsequently moving them into multiple rounds of CoinJoin over the weekend. The vulnerability originated from a firmware flaw in 2021, which reduced the seed entropy to a minimum of 40 bits. Of the tokens stolen in this exploit, approximately 82% have not yet been transferred.

According to Businesswire, Nasdaq-listed company Datavault AI announced that it will officially launch the asset tokenization trading platform Information Data Exchange (IDE) on September 15, 2026.The platform supports the identification, certification, scoring, valuation, tokenization, and monetization of data and other real-world assets (RWA), while allowing data owners to retain ownership and control of the underlying data.

According to Decrypt, Michael Gubbins, the head of the Criminal Assets Bureau in Ireland, revealed to the Sunday Independent that organized crime gangs are renting private vaults to store cryptocurrency wallet private keys and mnemonic phrases along with cash, luxury watches, passports, and other valuables. This situation has been reported to the government's Anti-Money Laundering Steering Committee, which is preparing to implement new EU anti-money laundering rules in Ireland.The new EU regulations will take effect next summer, prohibiting cash transactions over 10,000 euros and requiring businesses to identify individuals for cash expenditures of 3,000 euros and above. Gubbins stated that crime gangs believe cryptocurrency offers anonymity, but the use of cryptocurrency in Ireland is still quite primitive, with cash remaining the primary form of payment for criminal activities such as drug trafficking.The bureau is handling its largest cryptocurrency seizure in history, involving 6,000 bitcoins confiscated from a cannabis grower in 2019, with the private keys written on paper and hidden in a tackle box, which was later lost. With the assistance of Europol, the bureau has cracked the first of 12 wallets in March, with over 130 million euros already liquidated from assets totaling 360 million euros.

Term Labs released a technical report on the security incident, confirming that all fixed-rate loan positions in the affected vault have been restored as of August 25. The incident was limited to the liquid balance within the Term vault, and Term V1 and V2 contracts were not compromised, with the direct lending market remaining open.Attack process: From August 17 to 18, the attacker funded an operational wallet through Tornado Cash and submitted a malicious proposal disguised as a governance proposal, setting the governance delay parameter to zero and removing the window for LP blocking changes. On August 23, the attacker executed two batches of attacks, extracting assets from the ETH and USDC strategies and transferring them to the attacker's wallet. Term Labs stated that it has cooperated with law enforcement, the affected vault and strategies have been closed, and the contracts have been upgraded and migrated before expiration.

Bitwise announced the launch of the Bitwise Premium RWA Vault (PAPY) on Morpho, in collaboration with the Agora stablecoin AUSD.Users can deposit AUSD into PAPY, and the vault will programmatically lend out the funds, secured by over-collateralized tokenized RWAs to generate on-chain lending yields.The collateral assets of PAPY include PST launched by Huma Finance, used for providing short-term cross-border payment financing to institutions; sUSDai launched by USDai, supported by AI computing GPU-related loans; and PRIME launched in collaboration with HastraFi and Figure, consisting of tokenized debt backed by high-quality residential equity.AUSD is fully backed by liquid assets such as short-term U.S. Treasury bonds, overnight and reverse repurchase agreements. Bitwise is responsible for screening the collateral acceptable for PAPY and setting programmatic risk parameters. The vault is now officially launched on Morpho.

Dialectic Meccanico announced plans to launch the on-chain vault Starloop based on Makina on Base, expected to go live in September 2026, for eligible tokenized SpaceX exposure holders to put their positions to use.After users deposit tokenized SpaceX exposure, the vault will borrow USDC against it as collateral and deploy it to approved on-chain opportunities, with net earnings flowing back to depositors while retaining exposure to the underlying assets. Dialectic is the first operator of Makina and has operated public vaults such as DUSD and DETH.

On-chain financial privacy infrastructure Primus announced that it has received investment from YZi Labs to support its ongoing work in on-chain financial privacy infrastructure. Primus also thanks YZi Labs and EASYResidency for their investment, support, and trust.Primus Confidential Vault is now live on the BNB Chain, providing private asset transfer and yield features for on-chain finance through FHE.

The development team of Term Finance, Term Labs, announced that after the governance attack incident, all Term Meta Vaults have been permanently closed, DAO governance rights have been revoked, but the withdrawal channel remains open. In an update on August 23, Term stated that this closure is irreversible and permanently prevents subsequent deposits, but did not disclose the scale of the remaining assets in the vault, only indicating that it will "explore pathways" to address any gaps, and the amount that depositors can recover remains undecided.Blockchain security company PeckShield estimates that the attacker stole approximately 2,843 ETH (worth about $6.87 million at the time) and 1.68 million USDC (which was later exchanged for about 1.68 million DAI), with total losses estimated at around $8.5 million. On-chain records confirm the related transfers: one transaction transferred 2,841.74 WETH to an address labeled "Term Finance Exploiter 1" by Etherscan, while another transaction transferred 1.68 million USDC to an address labeled "Term Finance Exploiter 2".Yearn stated that Term's vault contract uses its V3 architecture, but the attack occurred on Term's custom governance wrapper, which is not applicable to standard Yearn vaults. Term indicated that, according to the current investigation, its underlying protocol and direct lending market were not affected and is working with external security teams for remediation and recovery, but did not provide any compensation commitments or timelines.

According to official news, Mantle Vault has officially expanded from CeFi to DeFi, collaborating with Grove, CIAN, and Fluxion to launch a non-custodial yield vault aimed at stablecoin holders. Users can deposit USDC/USDT into Mantle to obtain institutional-level floating yields through the underlying strategy of sUSDS, along with incentives of Fluxion Points and 5.14 million GROVE tokens (with a target APY of up to 6.5%).The vault adopts a conservative non-leveraged structure, with strategies built by CIAN, capital base provided by Grove's Sky Savings Rate, and liquidity entry managed by Fluxion. Previously, Mantle Vault's AUM on Bybit had exceeded $200 million, and Mantle RWA TVL increased from $22 million to $257 million within the year, with DeFi TVL surpassing $755 million.Mantle stated that by expanding into the DeFi space through Mantle Vault, Mantle and its collaborators are committed to enabling all stablecoin holders to access institutional-level yields without borders, free from geographical restrictions and without the need for intermediary access, and all these components can be combined within Mantle's open financial network.

On August 24, the multi-chain decentralized over-collateralized stablecoin USDD announced the official launch of the Vault feature on Ethereum, allowing users to mint USDD using ETH and WBTC as core collateral assets. This upgrade is a further expansion based on the previous TRON chain Vault, meaning the USDD Vault module has officially entered the dual-chain driven phase and the ETH + BTC dual core mainstream asset collateral stage, providing more entry points for mainstream asset holders to participate in the USDD ecosystem.In April of this year, USDD successfully launched the WBTC Vault on the TRON network, achieving the first Bitcoin collateralized minting of USDD, opening the channel for BTC assets to enter the USDD yield system. The launch of this new Vault extends this capability to the Ethereum chain and expands the range of collateral assets from BTC to ETH and a broader range of mainstream digital assets, forming a dual-chain parallel structure with the original Vault on the TRON chain, further enriching the minting methods and funding application scenarios of USDD.

The multi-chain decentralized over-collateralized stablecoin USDD has officially announced the launch of the Vault feature on Ethereum, allowing users to mint USDD using ETH and WBTC as core collateral assets.This upgrade is a further expansion based on the previous TRON chain Vault, meaning that the USDD Vault module has officially entered the dual-chain drive and ETH + BTC dual-core mainstream asset collateral stage, providing more entry points for mainstream asset holders to participate in the USDD ecosystem.

DeFi protocol Term Labs updates on the progress of the attack incident, disclosing that the affected entity is the Term Vault governance mechanism, rather than the underlying Term protocol and its direct lending market. All Meta Vaults have now been closed and DAO governance permissions revoked to prevent further inflow of funds. This closure operation is irreversible and will permanently block new deposits.Currently, the withdrawal function remains open, and they are working with external security teams to conduct repairs and recovery. If a funding gap is ultimately confirmed, corresponding solutions will be explored. Term Labs reminds users to pay attention only to information released by official accounts and to be wary of impersonators and fraud. Previously, it was reported that Term Labs suffered a governance attack resulting in losses of approximately $8.5 million.

According to Cointelegraph, the European Commission is assessing whether to include crypto lending (including DeFi vaults) in the Markets in Crypto-Assets Regulation (MiCA). The relevant targeted consultation was launched on May 20, 2026, with a feedback deadline of September 30. MiCA originally excluded crypto lending and completely decentralized activities, but Brussels is currently reviewing these gaps.EU digital asset lawyer Yuriy Brisov stated that there is no category of "vault" in EU law, and lawyers need to define by function rather than label. Vaults decentralize economic functions such as lending across smart contracts and multiple participants (such as owners, curators, distributors, and sentinels in Morpho Vault V2), making it difficult to correspond to a single regulated entity. Cahill partner Jonathan Galea cautioned against treating "DeFi lending" as a single label, as products with different structures may be subject to a one-size-fits-all approach. Curve founder Michael Egorov noted that if included in regulation, they should be treated differently, as DeFi does not require all the protections of traditional lending and may need different rules.

The Solana lending protocol Kamino announced the launch of Kamino Institutional Yield, a set of on-chain treasury infrastructure designed to connect real-world institutional credit markets with on-chain users. The first treasury built on this infrastructure, Commodity Yield, has now gone live, with an initial deposit size of 25 million USDC.This treasury connects on-chain users with institutional commodity trade financing needs, targeting an annualized yield of approximately 7-8%. The treasury conducts off-chain lending operations through a fund structure regulated by the Cayman Islands Monetary Authority (CIMA), featuring strict lending standards and ongoing portfolio transparency. Users depositing USDC can receive kicUSDC, with funds deployed to short-term commodity loans, secured by physical commodities and/or cash fully collateralized by top-tier banks.

The decentralized spot and perpetual contract trading platform RISEx announced that on August 3, an unauthorized withdrawal occurred related to the RWA strategy associated with the XLP treasury, involving 673,011.56 USDC. This issue stemmed from a configuration error since the deployment on July 13. The team discovered and fixed it within minutes and has fully compensated XLP depositors using part of the fees generated in July, with no impact on user funds.RISEx stated that the platform, RISE cross-chain bridge, and XLP treasury all have withdrawal limit mechanisms in place, and this amount was below the threshold. The team has reviewed the relevant transactions and configurations, confirmed that there are no other similar issues, and is tracking the funds, attempting to contact the relevant addresses to request a return. A post-analysis report will be released later.

According to Forbes, Vaulted CEO David McAlvany stated that he believes Bitcoin could disappear within the next four years due to quantum computing. He mentioned that once quantum computers can quickly solve the mathematical problems protecting Bitcoin private keys, "that will be the end of Bitcoin."However, McAlvany later admitted that he cannot determine whether the relevant breakthrough will occur in four years, five years, or two months. As of mid-2026, there are no quantum computers capable of cracking Bitcoin's encryption algorithms. His viewpoint is mainly based on concerns about the future development speed of quantum computing, rather than on already occurred security events.Galaxy Digital estimates that approximately 7 million BTC addresses have exposed public keys on-chain, worth about $470 billion; Glassnode's estimate is 6.04 million, accounting for 30.2% of the Bitcoin supply. Exposing public keys does not equate to assets being stolen; only when quantum computers can reverse-engineer private keys from public keys might these addresses face actual theft risks.McAlvany also compared Bitcoin to gold and questioned whether Bitcoin could exist for 5,000 years. He expressed relative confidence that gold will still exist by then, but Bitcoin "might exist, or it might not."Bitcoin developers currently have differing opinions on solutions. BIP-360 proposes to add quantum-resistant address types; BIP-361 plans to phase out support for old-style signatures, with assets that do not migrate in time potentially being permanently frozen, including those believed to belong to Satoshi Nakamoto. Supporters argue that freezing assets is better than allowing quantum attackers to steal and sell them, while critics view it as confiscation.Companies like BOLTS Technologies and American Fortress are also developing cross-chain quantum-resistant solutions. American Fortress completed an $8 million seed round in May and claims its technology can protect assets without requiring users to migrate addresses, but the relevant technical papers have not yet been published, and the design has not undergone public auditing.

According to Globenewswire, the stablecoin issuer Mandela Digital announced the completion of a $5 million financing round, with participation from Datavault AI. The new funds will be used for the construction of stablecoin infrastructure, compliance, exchange integration, liquidity and marketing, as well as to accelerate the launch of the 1:1 dollar-pegged stablecoin Mandela Dollar (MUSD).It is reported that Datavault AI will also provide technical support for MUSD, including an AI platform, blockchain tokenization, SanQtum quantum-resistant encryption, and a framework for real-world assets (RWA).

According to the SEC official website, Commissioner Hester M. Peirce issued a statement highlighting the intersection of cryptocurrency vaults and on-chain lending strategies with federal securities laws. Peirce pointed out that migrating activities to the blockchain does not automatically exempt them from the regulatory scope of securities laws. Cryptocurrency vaults allocate user assets to yield activities such as staking and lending through smart contracts, and if the managers are involved in selecting yield strategies or reallocating assets, it may trigger compliance obligations under securities laws; some vault structures may be deemed joint enterprises or fall under the regulation of investment companies.Regarding on-chain lending strategies, management actions such as interest rate setting, asset admission, and liquidation thresholds may also involve securities laws, and related loans may be classified as securities under certain conditions. Peirce stated that the SEC welcomes proactive communication from market participants in the vault and on-chain lending space and seeks input from all parties to explore whether there is a need to revise rules to protect investors while allowing space for innovation.

Kraken Institutional announced a partnership with the on-chain yield platform Upshift, allowing qualified institutional clients to earn yields directly on idle Bitcoin, Ethereum, stablecoins, and other crypto assets within Kraken's compliant custody framework.Unlike traditional pooled vaults, Upshift will build a dedicated customized vault for each client, tailored entirely to the client's investment strategy, risk parameters, liquidity needs, and asset portfolio. Assets will be allocated to these non-custodial vaults and subsequently deployed to selected on-chain contracts, with the client's isolated Kraken custody account receiving a receipt token.

The perpetual contract DEX Ostium has confirmed that there is an anomaly in its OLP treasury. All trading on the platform has been suspended, and the team is investigating the related issues.