⚠️Top 10 Security Incidents (January–June 2026) 1：KelpDAO, April 18, loss of approximately $292 million. The attacker exploited a verification flaw in the LayerZero-related cross-chain bridge validation flow, released a large amount of unbacked rsETH, and rapidly supplied it to protocols including Aave, Compound, Euler, and Fluid for borrowing and cashing out, ultimately evolving into a cross-protocol bad debt contagion event. 2：Drift Protocol, April 1, loss of approximately $285 million. The attacker obtained protocol administrative control by leveraging durable nonce, social engineering, and weaknesses in multisig governance, then introduced forged collateral assets and manipulated protocol parameters to drain a large amount of real assets from the protocol. 3：Step Finance, January 31, loss of approximately $40 million. The compromise of high-privilege devices and the treasury private key system resulted in significant asset losses. On February 24, the project announced it would cease operations. 4：Humanity Protocol, June 9, loss of approximately $31 million to $36 million. The root cause was improper management of private keys and multisig keys. After compromising critical devices, the attacker took over bridge administrative privileges and carried out fund transfers and abnormal minting across multiple chains. 5：Truebit, January 8, loss of approximately $26.6 million. The attacker exploited an integer overflow/pricing logic flaw in a legacy contract to mint a large amount of TRU at low cost and dump the tokens on the market, causing the token price to collapse rapidly. 6：Resolv Labs, March 22, loss of approximately $25 million. After obtaining high-privilege signing capabilities, the attacker exploited the lack of supply caps and ratio validation in the minting logic to mint approximately 80 million unbacked USR and cash them out. 7：SwapNet, January 25, loss of approximately $13.4 million. Its closed-source contract contained arbitrary-call / approval abuse risks. The attacker leveraged users' existing approved allowances to trigger malicious transferFrom calls and drained users' assets at scale. 8：Verus-Ethereum Bridge, May 18, loss of approximately $11.58 million. The cross-chain bridge failed to strictly verify whether the source-chain input amount matched the destination-chain release amount during the validation process. The attacker exploited this flaw to forge valid payloads and withdraw assets. 9：YieldBlox, February 22, loss of approximately $10.97 million. The attacker manipulated the price of USTRY in a low-liquidity market, causing the oracle to overestimate the collateral value, and then executed excessive borrowing from the Stellar lending pool. 10：THORChain, May 15, loss of approximately $10.7 million. A newly joined node operator exploited weaknesses in the GG20 threshold signature scheme, compromised a single vault, and withdrew assets across multiple chains, exposing the systemic risks of cross-chain signing infrastructure.

The rsETH markets on Aave V3 and Aave V4 have been frozen. Aave's contracts have not been exploited and this is an exploit related to rsETH. The freeze follows an exploit of the Kelp DAO rsETH bridge. Freezing the rsETH markets prevents new deposits and borrowing against rsETH collateral while the situation is assessed. We are reviewing information about rsETH borrows on Aave that occurred after the exploit and will share more details as soon as possible. If the protocol accumulates bad debt from this incident, we'll explore paths to offset the deficit.

As part of streamlining our SolvBTC ecosystem, we’re sunsetting bridging support for multiple lower-usage chains and strategies. Affected chains include: → Merlin, Taiko, Mode, Sonic, Corn, Soneium, Berachain, Linea, Rootstock, Polygon, Movement, zkSync Era, HyperEVM, TAC, + related variants. ⚠️Bridging for these will be disabled by end of June.⚠️ If you hold SolvBTC on any of these, please bridge back to our maintained chains (BTC Mainnet, BNB, ETH, Base, Ink, Solana, Starknet, Stellar, XLayer) before the deadline. We’re focusing resources on high-liquidity chains and core strategies to deliver better security, deeper integrations, and sustained performance for SolvBTC, xSolvBTC, and BTC+. Full related questions, feel free to submit a ticket to our discord.

Last week had over $53 million in onchain losses, with 10 major incidents spanning key management, signer/validator control, upgrade authority, and more AFX (Anti-Fragile Exchange): $24.15M USDC. AFX is a Layer 1 chain running a perpetuals exchange with an onchain orderbook. Compromised validator hot keys reportedly met the quorum with enough signatures to clear the threshold. AFX suspended the bridge and said trading infrastructure and mainnet were untouched; a 70% white-hat offer went unanswered. Triple-A: estimated $9.7M to $11.8M. Triple-A is a Singapore payments processor that lets merchants accept crypto and get paid in fiat. Attackers took control of operational and treasury wallets across at least four chains. Triple-A says client funds weren't touched, and the Singapore Police Force is involved. VerusCoin Ethereum Bridge: $7.54M. VerusCoin is a blockchain that lets people launch their own interoperable chains. This is the bridge’s second loss in two months, after the attacker abused submitImports to trigger Ethereum-side payouts unbacked on the Verus source chain. @blockaid_ calls it the same entry point and bug class as the $11.58M May loss. Wanchain Cardano-BNB Bridge / NIGHT: $9M to $13M (depending on NIGHT's price, 515.2M taken in nine minutes). Wanchain operates cross-chain bridges. NIGHT is the token of Midnight, a privacy sidechain on Cardano. BlockSec's early read blames non-injective signed-message encoding in the Cardano-side TreasuryCheck validator, which let an approval for ~3,110 NIGHT on BNB Chain be reused to pull 203M. Wanchain took the bridge offline and acknowledged unauthorised withdrawals, the Midnight Foundation called it contained, and exchanges added precautions. B² Network B2 staking: $3.86M (~$3.01M to $3.11M realised after ~$850K of slippage). B² Network is a Bitcoin Layer 2 and a staking service on BNB Chain. The draining address had held the staking contract's upgrade authority since 2025 and only lost it after the transfer, so this was likely a compromised or insider key rather than a seizure, though B² hasn't disclosed which. B² suspended staking, promised full compensation, and offered the hacker a white-hat bounty. WEMIX: $5.22M (only ~$724K realised as the token collapsed from $1 to ~$0.0008). The attacker compromised owner authority on a WEMIX$-related contract (WEMIX is the blockchain arm of Korean game publisher Wemade), and minted 5.2M tokens outside DIOS, the stabiliser that only mints against incoming USDC, so the new supply had no reserve behind it. WEMIX suspended bridges, paused the WEMIX$ Module and PNIX DEX, withdrew foundation liquidity, requested exchange and issuer freezes, and has a contract-wide audit underway. 42DAO / Balance Protocol: $914K (plus ~$3.5M of nominal BLC erased as the token fell from $0.9954 to ~$0.0014). 42DAO is a MakerDAO fork on BNB Chain, critically missing the original’s Oracle Security Module. The attacker manipulated the BTCB feed through the Spotter/VAT liquidation path, which lacked TWAP, bounds, floor, drawdown and delay controls. Lien Finance: $542K USDC. An attacker exploited this options protocol via a logic exploit that allowed for price manipulation in their OTC pools. SlowMist blames exchangeEquivalentBonds in BondMakerCollateralizedEth, which lacked multiset integrity checks and minted BondTokens without consuming collateral, while Defimon and ExVul trace the drain through GeneralizedDotc OTC pools. These are the original Lien BondMaker contracts, and the bug class matches the September 2020 whitehat rescue of ~$10M. Garden Finance: $450K USDT across Ethereum, Base, Arbitrum and BNB Chain. Garden Finance is a Bitcoin bridge where solvers compete to fill cross-chain swaps. The bridge suffered an exploit after an offchain database breach let the solver release funds for unfunded swaps, its second such compromise in nine months after a ~$11M loss. Garden took the app offline, said nobody lost funds, and is investigating with zeroShadow, Quantstamp and Blockaid. Guru-fund Lotus deployments: $96K to $101K (~$61.5K realised after slippage). The fund management protocol suffered a loss after an attacker exploited a legacy, never-verified P2P adapter that was left enabled in the protocol registry and could grant arbitrary token allowances through the delegatecall function during normal deposits. The Guru-fund team paused the protocol and announced the protocol will be winding down in the wake of this hack. With the variety of attack vectors and pace of exploits, it’s clear that attackers are constantly looking for any way in. Whether you’re a protocol, investor, or fund looking for protection against these risks and more, get in touch with our team today. You’re Covered with Nexus Mutual

Excited to share this @WarOnTheRocks piece I've been contemplating and working on for a while now: "The Blind Spots in Chinese Military Studies." My contention is the authoritative textbooks and sources published by the PLA are dwindling or becoming outdated in the face of organizational reforms and data restrictions. The result is a community that is increasingly speculating or inferring Chinese military strategy from woefully outdated doctrinal texts, despite valiant efforts to stitch together incomplete pictures from a paucity of sources. This leads to the current challenge facing PLA watchers: deducing how the PLA will bridge the divide between military strategy and campaign-level and tactical-level operations based on outdated texts. Western analysts resort to using partial sources on particular issues to interpret the PLA's collective, authoritative guidance on the key principles of strategy and operational warfighting. This is a demanding task with a high degree of difficulty, and reasonable Western analysts can come to different conclusions. Less capable analysts are likely to mirror-image or get it wrong. I advocate restoring the Open Source Enterprise — formally called the Foreign Broadcast Information Service — back into the public domain. This can be done by empowering existing U.S. government platforms with the capability and experience to support a reconstituted FBIS — such as the Library of Congress — to revive taxpayer-funded open-source intelligence-gathering of translations of foreign military and political news, articles, and textbooks, in particular related to the PLA. This of course will not fundamentally solve the problem, but it will help. Thanks to David M. Finkelstein, @jwuthnow, Lonnie Henley, Dennis Blasko, Phil Saunders, Ken Allen, Chad Sbragia, Joshua Arostegui, and @NathanMBM for their helpful comments on previous drafts.

Intel’s EMIB Packaging Is Growing Rapidly — Silicon Capacitors Are Taking Off Too Silicon capacitors are poised for explosive growth in the AI semiconductor space. Intel has been found to be planning a large-scale adoption of silicon capacitors starting next year, in order to enhance the performance of its in-house 2.5D packaging technology, “EMIB.” The most clearly visible source of demand is Google. Google plans to launch its next-generation AI accelerator, “v8e,” in the second half of next year, and has adopted an EMIB substrate with embedded silicon capacitors for that chip. With other Big Tech companies such as Amazon also currently applying EMIB, analysts say demand could increase sharply. According to industry sources on the 27th, Intel plans to apply silicon capacitors to its 2.5D packaging starting next year. Intel Adopts “Silicon Capacitors” for 2.5D Packaging… Google AI Chip Gets First Application 2.5D is an advanced packaging technology that inserts a thin-film interposer between the semiconductor and the substrate. Because it can connect circuits at higher density compared with conventional packaging that uses only a substrate, demand is rising in the AI and HPC fields. To improve cost efficiency in 2.5D packaging, Intel devised its own technology called EMIB. Rather than using a broad, spread-out interposer, EMIB connects chip to chip using a small silicon bridge. Since bridges only need to be placed where chip-to-chip connections are required, chips can be arranged more flexibly and efficiently. Recently, EMIB has been drawing attention as an alternative to TSMC, which had been leading the existing 2.5D packaging market. This is because TSMC’s 2.5D packaging capacity is suffering from a supply shortage amid the rapid development of the AI industry. Indeed, global Big Tech player Google is also paying attention to EMIB. Google has decided to adopt EMIB for its in-house AI semiconductor “v8e,” which it plans to launch in the second half of next year. Under this structure, TSMC handles chip mass production, MediaTek handles design and manufacturing support, and Intel handles packaging. However, there have been concerns that EMIB is gradually showing limitations in providing stable power supply for AI semiconductors, which consume large amounts of power. Accordingly, Intel plans to introduce new technologies such as silicon capacitors and through-silicon vias (TSV) to ensure stable packaging for the v8e. A capacitor is a component that stores and releases electricity in an electronic circuit. In the case of silicon capacitors, their resistance (ESL/ESR) is more than 100 times lower than that of conventional multilayer ceramic capacitors (MLCC), minimizing the signal loss that occurs in high-performance semiconductors. They can also be designed in an ultra-thin structure based on a silicon wafer, enabling high-density integration. A semiconductor industry official explained, “Because the voltage drop (the phenomenon of voltage decreasing) that occurs in the high-frequency region within AI chips is difficult to solve with MLCC, we understand that Intel is adopting silicon capacitors as a solution,” adding, “The relevant supply chain is now in place, and mass production is set to begin in earnest next year.” EMIB-T Is Already on a Growth Trajectory — The Related Ecosystem and Market Are Expanding Together Intel has also inserted TSVs, which serve as power-delivery channels, into the silicon bridge. The key point is that by using TSVs to shorten the power-delivery path between the substrate and the chip, Intel has improved power efficiency and signal integrity. Intel calls this “EMIB-T.” The industry expects the EMIB-T and silicon capacitor markets to grow rapidly. This is because Japan’s Ibiden — one of the major companies that mass-produces semiconductor substrates for EMIB-T — is aggressively pursuing capital investment. Previously, Ibiden had planned to build its Kawashima (Gama) plant in Gifu Prefecture as a substrate plant for Intel CPUs. However, it postponed that schedule and decided in the first half of this year to officially convert the Gama plant into a mass-production line for EMIB-T substrates. The investment is 220 billion yen (about KRW 2.1 trillion). In its recent earnings announcement, Ibiden stated, “Operation of the Gama plant will begin in 2027 and enter full-scale mass production in 2028,” adding, “EMIB-T substrate capacity is currently far short of demand. However, adding further capacity is quite difficult, so we are discussing options with our customers.” A semiconductor industry official explained, “Ibiden’s EMIB-T-dedicated line is being built with most of the investment coming from customers such as Google, Amazon, and Intel,” adding, “This demonstrates that AI semiconductors based on EMIB-T will grow significantly going forward, and silicon capacitors are likely to expand alongside them.”

Breaking the "Memory Wall": Optical Interconnects Emerge in GPU–HBM Packaging As a solution to the "memory wall," one of the chronic challenges in AI semiconductors, the memory and packaging industries at home and abroad are weighing an approach that decouples the GPU and high-bandwidth memory (HBM) and packages them separately. The core idea is to move the HBM—until now mounted right next to the GPU—a certain distance away, and bridge the gap with light (optics), allowing several times more HBM to be installed than is possible today. On the 22nd, a researcher at a major domestic memory maker said, "We're currently struggling to expand HBM bandwidth and capacity, so we're discussing with customers a plan to overcome the GPU's shoreline limit through optical interconnects and mount more HBM." Shoreline refers to the length of the chip's perimeter. In today's AI computing environment, the key factor dragging down compute efficiency is the data transfer speed of memory chips. While GPU performance has grown by leaps and bounds with each generation, the speed at which memory stores and supplies data has failed to keep pace—creating a structural performance barrier, the memory wall. The arrival of HBM, with its wide data pathways, put out the immediate fire, but critics continue to point out that bandwidth and transfer speeds still fall short of handling the explosive growth in AI compute. Until now, the industry has focused on stacking HBM ever higher to increase memory capacity and bandwidth within a confined footprint. But as stack counts climbed past 12 and 16 layers toward 20 and beyond, process difficulty rose exponentially. The technology hit physical limits, including the growing difficulty of meeting fixed height specifications. Vertical stacking has reached an inflection point—so much so that the JEDEC standards body has relaxed its HBM height specifications. The bigger problem is that if stack counts can't be raised, the alternative is to add more HBM horizontally around the GPU—but that, too, is impossible. In the current 2.5D packaging structure, the GPU and HBM are mounted tightly together on a single substrate. Within this structure, the number of HBM units that can be placed is strictly limited by the finite length of the GPU chip's perimeter—its shoreline. Even when more HBM is desired, there is physically no room to place it, leaving the industry in a structural deadlock. The alternative now emerging across the semiconductor industry is to separate the GPU and HBM and package them independently. It overturns the conventional chip-design principle that components must sit close together to minimize data transfer time. Instead of keeping the two chips adjacent, the approach spaces them apart and links them with overwhelmingly fast optical signals to overcome the added physical distance. Placing the HBM slightly away from the GPU within the board frees the design from the GPU's shoreline constraint. With the spatial limitation gone, far more HBM can be spread out laterally and packed into the board—several times more than today—without having to push stack heights to extremes. This means the total memory capacity and data bandwidth of the AI accelerator system would expand dramatically, on a scale incomparable to current systems. "Discussing Placing HBM Beneath the GPU"… Form Factor Could Change The industry is now producing a range of architectural design proposals over where exactly to place the HBM within the GPU board. The same memory researcher said, "Options under discussion range from broadly utilizing the space immediately around the GPU to isolating the HBM beneath the GPU board." He added, "In the latter case—isolating it beneath the GPU board—the motherboard would have to be extended lengthwise, so we're discussing even an overall form-factor change with the GPU maker." Specifically, the HBM might surround the GPU from several centimeters away, or a separate HBM zone might be created in the center of the board. "We're keeping every possibility open as we discuss the optimal layout," he said. "Nothing has been confirmed as an official roadmap yet, but as part of preliminary research toward next-generation AI accelerators, we're in talks with our partners." The outsourced semiconductor assembly and test (OSAT) industry is also watching this trend closely. An executive at a global OSAT firm said, "Optical interconnects are a clear trajectory. The only question is timing," predicting that "rack-to-rack and server-to-server links will go optical first, and then chip-to-chip connections within the board will follow." He added, "The larger units will be connected by light first, but optical research is moving so fast that it may not be that far off." Technically, the optical-interconnect technology linking GPU and HBM shares the same underlying principle as the technology connecting server to server inside a data center. The difference is the high technical barrier of shrinking optical-conversion technology—once used for communication between large pieces of equipment—down to the microscopic scale of a single board and chipset. An executive at a domestic developer of co-packaged optics (CPO) components explained, "As HBM stack heights approach their limit, the industry is discussing spreading the memory out laterally to maximize how much can physically be mounted." He added, "The principle is the same as conventional data-center optical interconnects, but HBM optical links that have to operate within a confined board space require optical components to be miniaturized to far smaller sizes and far higher integration density—so the technical difficulty is greater."