ol

According to market news, attackers exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool. The root cause is that the reserve pool administrator EOA delegated the code to the BatchExecutor contract via EIP-7702, and this contract set the permissionless BatchCall contract as the authorized caller.Since the BatchCall.batch() function did not have any permission checks set, any external caller could invoke it, ultimately leading to the depletion of the reserve pool assets.

According to on-chain analyst Onchain Lens (@OnchainLens), a giant whale deposited 211,694 $SOL (approximately $17.77 million) into Binance yesterday, with a holding period of about 11 months, incurring a loss of approximately $17.62 million.The giant whale initially withdrew 200,010 $SOL from Kraken, which was worth about $35.39 million at that time.

DeFi United announced a technical repair plan for the Kelp DAO rsETH cross-chain bridge vulnerability on Tuesday. Previously, attackers exploited a vulnerability in the LayerZero-driven Unichain to Ethereum bridge, releasing 116,500 rsETH by spoofing inbound packets, of which approximately 107,000 are currently still distributed as collateral across seven associated addresses in Aave and Compound.DeFi United stated that it has secured enough ETH commitments to restore the support for rsETH, which will be converted into rsETH in batches and injected into the bridge lock contract. LayerZero Labs pledged over 10,000 ETH on Tuesday to support the repair efforts. Regarding the liquidation of the attackers' positions, the alliance will execute controlled liquidations through Aave and Compound governance proposals, expecting to recover approximately 13,000 and 16,776 ETH, respectively.During the repair period, WETH and rsETH reserves on multiple chains will remain frozen. DeFi United also cautioned about execution risks, including governance approval progress, potential interference from attackers, and new security measures pending validation in the production environment.

According to GMGN monitoring, the price of the Meme coin SCAM on the Solana chain has plummeted 88% in 24 hours, with its market value dropping from a peak of nearly 20 million USD to around 1.43 million USD currently, and a 24-hour trading volume of 33.6 million USD.ChainCatcher reminds users that Meme coins generally have no practical use cases, and their prices are highly volatile, so investment should be approached with caution.

In response to external doubts about its data being "leaked," Polymarket issued a statement clarifying that the relevant data has never been leaked, and all data can be publicly accessed through its public endpoints and on-chain data, which is an inherent feature of on-chain data transparency, not a security vulnerability.Polymarket stated that one of the core advantages of on-chain data is that it is fully publicly auditable, and anyone can freely access the relevant data through its API without having to pay for it.According to previous news from ChainCatcher, the prediction market platform Polymarket is suspected of experiencing a data leak, with over 300,000 records and an exploit toolkit leaked.

The decentralized prediction market platform Polymarket is suspected to have been hacked, with the threat actor xorcat posting over 300,000 data records and a corresponding exploit toolkit on a well-known cybercrime forum.It is reported that the attacker extracted data through undisclosed API endpoints, pagination bypass, and CORS misconfigurations in Polymarket Gamma and CLOB API. The leaked content includes: 10,000 users' complete personal information (including names, proxy wallets, and base addresses), 4,111 comments, 1,000 reports (including 58 ETH addresses and administrator verification address identifiers), 48,536 Gamma market metadata, over 250,000 active CLOB market fixed product market maker addresses, and 9,000 social graph data of followers.The toolkit contains proof-of-concept code for multiple vulnerabilities, including CVE-2025-62718 (Axios NO_PROXY bypass, CVSS 9.9, which can trigger server-side request forgery), CVE-2024-51479 (Next.js middleware authentication bypass, CVSS 7.5), and CORS misconfigurations. Additionally, the toolkit includes automated continuous pull scripts and a complete red team report.

The Bitcoin lending protocol Tropykus announced the gradual shutdown process of the current version of the protocol. The deposit and lending functions will be permanently disabled, and users can perform withdrawal and repayment operations until the deadline of July 27, 2026. After this date, related operations will only support direct interaction with the smart contract.The official statement indicated that this shutdown decision is based on considerations of long-term strategic evolution. In the face of security challenges posed by emerging technologies such as artificial intelligence, the existing architecture can no longer meet long-term development needs. The team recommends that all users complete withdrawals and settle their lending positions before the deadline.

The re-staking protocol Puffer Finance officially announced that it will invest treasury funds into the DeFi United ecological rescue initiative led by Aave, but did not disclose the specific amount. Puffer believes that strong infrastructure and consistent incentive mechanisms are key to supporting DeFi at critical moments.

According to BBX data, yesterday the credit management of mining companies, the update of Ethereum treasury reserves, and the expansion of Bitcoin reserves were synchronized. The core dynamics are as follows:Riot Platforms, Inc. (NASDAQ: $RIOT) signed and publicly disclosed SEC Form 8-K reported by CoinDesk on April 28, stating that the company has completed the second amendment to its credit agreement with Coinbase Credit, Inc., switching the original floating rate $200 million secured term loan to a fixed rate and extending the maturity date by 364 days, while retaining the option for a further extension of 364 days; the loan scale and collateral structure remain unchanged, with the collateral still being Bitcoin, USDC, and cash held in Coinbase Custody. The company's Bitcoin holdings have decreased from 19,368 coins at the beginning of the year to 15,680 coins; if the BTC price continues to decline, the selling pressure under the loan-to-value ratio constraint will persist, which is an analytical judgment and not an official disclosure from the company.Bitmine Immersion Technologies, Inc. (NYSE: $BMNR) released its latest holdings update on April 27, stating that as of that day, it holds 5,078,386 ETH (valued at approximately $2,369 at the market price, with a market cap of about $12.04 billion), along with 200 BTC, $200 million in Beast Industries (under MrBeast) equity, and $91 million in cash, bringing the total of combined crypto assets and strategic investments to about $13.3 billion; the ETH holdings account for approximately 4.21% of the total circulating supply, which is the scale accumulated by the company since launching its Ethereum treasury strategy in June 2025.Strive, Inc. (NASDAQ: $ASST) disclosed through an official announcement on GlobeNewswire on April 27 that the company has purchased approximately 789 BTC (costing about $61.43 million, with an average price of about $77,890), bringing the total holdings to approximately 14,557 BTC as of April 24; during the same period, it held $90.5 million in cash and equivalents, and $50.3 million in Strategy preferred shares (STRC), with a total market value of BTC reserves of about $1.13 billion, surpassing Hut 8 to rank ninth among publicly listed companies in Bitcoin reserves globally.

According to monitoring by PeckShield, a user lost their Alchemix Yearn yvVault position yvWETH, worth approximately $1 million, due to previously authorizing an unverified contract. This unverified contract was created 10 days ago and has vulnerabilities that can be exploited to execute arbitrary calls.

After the death of ASOS co-founder Quentin Griffiths in a fall in Thailand, approximately $4 million in assets from his Bitcoin wallet were transferred out. The funds were moved to an unknown location through three separate transactions from his online account within days of Quentin Griffiths' death.His eldest son Joel reported to the police six weeks after his father's death. The Thai police are currently investigating the case of asset theft. Previously, Quentin Griffiths was under investigation for fraud and faced multiple legal lawsuits and family property disputes before and after his fall.

According to on-chain analyst PeckShield, the vault YieldCore-3rd-deal under Trading Protocol was attacked, resulting in a loss of approximately $398,000.The reason for the attack is a vulnerability due to the lack of caller permission verification in the contract. The attacker exploited this vulnerability to bypass the authorization mechanism and withdrew all funds from the vault. Currently, the relevant on-chain transaction records have been disclosed.

French national Maximilien de Hoop Cartier was sentenced to 8 years in prison by the U.S. District Court for the Southern District of New York for operating an unlicensed over-the-counter (OTC) cryptocurrency exchange, assisting in the transfer of over $470 million in drug trafficking and other criminal proceeds through the U.S. financial system to Colombia and other locations, and was ordered to forfeit approximately $2.362 million in commissions and related shell company accounts.Since 2018, Cartier converted cryptocurrency into fiat currency through more than a dozen U.S. shell companies, falsely claiming to banks that he was engaged in software development and forging contracts and invoices to cover the source of funds. After law enforcement agencies seized his accounts in 2021, he still submitted forged documents, resulting in some funds being returned. In October 2025, Cartier pleaded guilty to two charges of operating an unlicensed remittance business and conspiracy to commit bank fraud.

According to Bloomberg, JPMorgan Chase has appointed former Goldman Sachs executive Oliver Harris as the head of its blockchain division Kinexys.Harris officially joined the bank earlier this month and will primarily be responsible for advancing the commercialization of applications under Kinexys and deepening partnerships with institutional clients.

Eric Trump, the second son of Trump, responded to Forbes' criticism of his significant arbitrage through the Bitcoin business, which harms MAGA investors. Eric stated that Forbes has become a disgrace in the journalism industry. Just over a year ago, his Bitcoin company American Bitcoin (ABTC) did not exist. 7 months and 25 days ago, ABTC was listed on Nasdaq, and today it holds over 7,000 Bitcoins, becoming the 16th largest publicly traded Bitcoin company in the world, backed by a massive cluster of nearly 90,000 mining machines and a computing power of 28 EH/s, using the highest quality energy in the United States.In just the fourth quarter, the Bitcoin on the balance sheet increased by 58%, with mining costs 53% lower than the market price of Bitcoin, and fourth-quarter revenue reached $78.3 million, a quarter-over-quarter increase of 22%. American Bitcoin can be said to be the company that has entered the "top 100" ranking in this field at the fastest speed, and it is actively expanding its mining scale every day. This narrative is strikingly similar to Forbes' rhetoric from years ago.According to previous reports from ChainCatcher, Forbes published an article criticizing Eric Trump's Bitcoin business as a disaster, pointing out that Eric Trump promotes his Bitcoin company American Bitcoin (ABTC) as a money printer, but in reality, it is just an arbitrage tool specifically designed to exploit those investors who support MAGA (Make America Great Again).

Pump.fun has completed the destruction of all previously repurchased PUMP tokens, involving an amount of approximately $370 million, accounting for about 36% of the circulating supply. Meanwhile, Pump.fun announced the launch of a programmatic buyback and burn mechanism, which will use 50% of net income over the next year to repurchase $PUMP on the open market and immediately burn 100%. This mechanism is executed through an irreversible smart contract, covering the revenue sources of Pump.fun's three major product lines: the joint curve, PumpSwap, and Terminal. The execution process includes four steps: fee aggregation, intermediate wallet integration, and buyback and burn, which can be tracked in real-time via fees.pump.fun.The remaining 50% of the income will be used to support business operations and ecological development, including team expansion, strategic investments, and marketing. Pump.fun stated that this move aims to address the community's concerns about the long-term value of the token and the transparency of the buyback mechanism, with the goal of continuously reducing the circulating supply.

According to Gate market data, the dollar index, which measures the dollar against six major currencies, rose by 0.15% on April 29, closing at 98.639 in the forex market. 1 euro exchanged for 1.1714 dollars, down from 1.172 dollars the previous trading day; 1 pound exchanged for 1.3518 dollars, down from 1.3534 dollars the previous trading day; 1 dollar exchanged for 159.55 yen, up from 159.45 yen the previous trading day; 1 dollar exchanged for 0.7893 Swiss francs, up from 0.7856 Swiss francs the previous trading day; 1 dollar exchanged for 1.3679 Canadian dollars, up from 1.3627 Canadian dollars the previous trading day; 1 dollar exchanged for 9.2716 Swedish kronor, up from 9.2247 Swedish kronor the previous trading day.