🌴 Where industry leaders found signal in Miami At The Capital Lunch, we brought together a curated guest list of investors, digital asset leaders, and Web3 innovators to connect while surrounded by tropical greenery in Cecconi's open-air courtyard. A special shoutout to @humafinance for co-hosting, and thank you to all who joined us in the sunshine!

Another incredible week for PayFi and our ecosystem partners. From global payment giants to the largest allocators, PayFi was the theme of the past week. Headlines ↓ 1️⃣ @WesternUnion, one of the largest payment networks, launched @USDPT_ on @solana via @Anchorage. 2️⃣ Kraken parent @Payward acquired @reapglobal for $600 million, expanding @PaywardServices with globally regulated card issuance and stablecoin payments. 3️⃣ @Visa expanded stablecoin settlement to Arc, Base, Canton, Polygon, and Tempo as volume reaches $7B with 50% QoQ growth. 4️⃣ @a16zcrypto raised $2.2B for their new fund, highlighting payments and on-chain finance as the leading use cases. 5️⃣ @HaunVentures raised $1B to invest in the new financial infrastructure including payments, banking, capital markets, custody, foreign exchange, as well as the agentic economy. 6️⃣ Huma selected @chainlink’s CCIP for cross-chain expansion of yield products, enabling the expansion of PST across chains while maintaining the highest level of security. 7️⃣ @raincards is now a @mastercard Principal Member. Stablecoin card infrastructure, now with global network reach. 8️⃣ @jpmorgan's 2026 Payments Outlook Report reiterates, “The next generation of payments will be defined by liquidity." 9️⃣ @Tether launched Developer Grants Program to fund local-first AI and payments infrastructure. 🔟 @fun announced $72 million Series A, co-led by @multicoin and @SignalFire to modernize global payments for modern fintechs. 1️⃣1️⃣ @Meta begins offering USDC creator payouts to wallets on Solana and Polygon.

J.P. Morgan’s 2026 Payments Outlook Report reinforces a shift that has been building across financial infrastructure for some time: Liquidity is becoming a core design layer of modern payments. Access to liquidity, instantly, across currencies, geographies, and market conditions, is increasingly central to how institutions think about resilience, capital efficiency, and operational continuity. This is reflected in evolving treasury priorities: • Real-time liquidity visibility and access • More distributed, cross-border liquidity structures • Greater automation in treasury decisioning • Continuous working capital optimization At a structural level, this reflects a simple change in constraint: It is no longer just about moving money efficiently. It is about ensuring liquidity is available where and when it is needed. This is where the PayFi lens becomes useful. PayFi describes the convergence of payments and liquidity infrastructure, where funding, settlement, and optimization begin to operate in a more continuous system rather than fragmented cycles across intermediaries, time zones, and balance sheets. Within this shift, new infrastructure approaches are emerging that reduce friction between liquidity availability and liquidity movement. Arf operates in this evolving landscape, focused on improving how cross-border liquidity is accessed and managed between financial institutions, as part of a broader transition toward more real-time, connected financial systems. The direction of travel is clear:Payments infrastructure is moving beyond transaction execution toward liquidity orchestration, how capital is accessed, deployed, and optimized globally in real time. For institutions building in this direction, liquidity is becoming the defining constraint and opportunity of the next phase of financial infrastructure.

Our RWA USDC Vault on @kamino today crossed $40m in total supply. Depositors are currently earning ~5.25% APY via exposure to OnRe, Solstice, Huma, and Figure. RWAs scale on Kamino 🫡

We’ve been working with @blockaid_ on investigating the legacy @humafinance v1 protocol exploit, and for transparency I’m sharing their excellent root cause analysis (link in the first reply). Here is a TL;DR and the key architectural learnings from the incident. 👇 TL;DR The Exploit: An attacker found a smart contract bug and drained ~$101K in leftover protocol and pool owner fees from three legacy v1 pools on Polygon. User Funds: Zero user funds were impacted. Isolation: This is strictly a v1 issue. It is completely unrelated to PayFi Strategy Tokens (PST), the permissioned v2 pools, or the permissionless programs (PST & Prime). Solana Programs: The Solana programs feature a fully redesigned architecture and do not contain the exploited functions or logic. Status: All v1 pools have been paused. Key Architectural Learnings On the surface, this was a smart contract bug in v1, launched in early 2023, but it highlights several critical protocol design and operational considerations where different paths should have been pursued: 1. Decouple state transitions from complex logic. Functions like _updateDueInfo() and _getDueInfo() carried high complexity to calculate dues and fees. Embedding state transitions within these complex functions is an anti-pattern. This complexity was recognized as unsatisfactory and was completely abandoned during the architecture of Huma v2 smart contracts. 2. Ruthlessly eliminate unused functions. requestCredit() was built to support future expansion but never actively utilized in operations. Non-critical functions inherently receive less testing and security scrutiny, creating an unnecessary attack vector. We even discussed removing it before launch, but kept it under the assumption that it doesn’t add much complexity. If a function isn't required for current operations, it shouldn't be in the contract. 3. Proactively migrate and close legacy pools. Leaving older contracts out on the blockchain creates unnecessary liabilities. With developers and attackers both leveraging AI extensively today, legacy contracts that haven't undergone AI-assisted audits are naturally more vulnerable. Older pools should be actively migrated and fully closed, rather than left running. We were in the process of sunsetting the v1 pools, but didn't have a chance to complete it. This is a hard lesson. But a hard lesson should never be wasted. Sharing these reflections to help the entire ecosystem in the joint defense against attackers. DeFi United, DeFi Strong! 🛡️

🚨JUST IN: @humafinance says its deprecated V1 BaseCreditPool contracts on Polygon were exploited for about $101K in USDC and USDC.e. The team says no user funds are at risk and its Solana V2 system is not impacted.

Huma's legacy v1 pools on Polygon were exploited earlier today. The impacted ~$101K funds are all protocol fee and pool owner fee. No user funds were impacted. All v1 pools are now paused. Huma’s Solana systems are completely rebuilt. The vulnerability in this exploit does not apply to our Solana systems. More update to follow.

Earlier today a vulnerability in Huma’s legacy v1 contracts on Polygon was exploited for 101,400 USDC. No user funds at risk and PST is not impacted. Huma’s v2 system on Solana is a complete rewrite and this issue does not apply to v2 systems. The teams were already in the process of sunsetting all the legacy v1 pools, and have paused v1 completely now.

The Capital Lunch in Miami, wrapped. Huma and @RockawayX brought together industry builders, digital asset leaders and innovators for an afternoon of high-signal conversation on tokenized finance, stablecoin credit rails, and institutional market structure. Great to have Jupiter, Bitwise, Fasanara, Fluid, Turtle and more industry leaders in the room. Thanks to everyone who joined.

Incorrect HUMA unlock data was identified across CoinMarketCap, Coingecko, and Binance. CoinMarketCap now reflects correct figures following direct coordination with the team. Coingecko and Binance updates are in progress. Reminder: As outlined in the HUMA: Built to Last article, the first Investor & Team unlock has been postponed from May 26 to Nov. 26, 2026.