Ethereum spot ETFs logged over $43 million in net inflows on April 21, extending a nine day streak, according to SoSoValue Crypto. BlackRock's ETHA led with about $37 million. Bitcoin ETFs added $11.84 million in net inflows, marking a six day streak.

Blockchain investigator ZachXBT urged users to avoid Bitcoin Depot's Bitcoin ATMs, pointing to a recent case in which an elderly U.S. fraud victim was allowed to swap $25,000 in cash for BTC at what he described as an excessive rate. According to ZachXBT, the customer was quoted $108,000 per bitcoin while BTC was trading near $75,000. The transaction reportedly delivered 0.232 BTC, valued at about $17,500 based on the prevailing market price. He also said Bitcoin Depot was recently exploited for a $3.26 million loss—roughly 54 BTC—that allegedly went unnoticed for several days.

On-chain data shows 119,999,999 USDC, valued at US$119,960,999, was transferred from Paxos to an unidentified wallet.

Justin Sun has filed a lawsuit in U.S. federal court against Trump-linked crypto project WLFI, alleging the protocol froze his tokens and stripped his voting rights. Sun claims the project's smart contract contains a concealed blacklist function that can lock assets—and that hundreds of millions of dollars' worth of tokens were effectively immobilized, with warnings they could be burned. Sun says he invested about $75 million in the project. The case is likely to amplify scrutiny over governance claims in crypto, including whether a protocol can credibly call itself "decentralized" if assets can be frozen unilaterally.

Tiger Research says Bitcoin's long-term upside case remains intact and reiterates a 12-month target of $143,000, even as macro support cools and network fundamentals lose some momentum. The firm notes global liquidity is still expanding, institutional flows have begun to turn, and on-chain indicators have moved out of Q1's panic zone. At the same time, an oil-driven inflation shock tied to the Iran conflict has reduced the Federal Reserve's room to cut rates as quickly as markets had expected. Macro conditions: supportive, but slower Global M2 has climbed to a record $13.44 trillion, yet Bitcoin has fallen about 27% since Tiger Research's Q1 report, with early-April prices averaging roughly $70,500. The report attributes the gap between rising liquidity and falling prices to where that liquidity is coming from. More than 60% of M2 growth across China, the U.S., the eurozone and Japan over the past year is said to have come from China, driven by the People's Bank of China's reserve-requirement cuts and a shift to a more dovish stance in Q1. The U.S. accounts for about 10% of the increase. Tiger Research argues that Chinese liquidity has limited pathways into Bitcoin due to domestic crypto trading restrictions. Indirect channels via Hong Kong and Singapore are seen as serving mainly institutional allocations, meaning the portion of global liquidity that actually reaches the Bitcoin market is shrinking. Iran conflict complicates the Fed's easing path With U.S. dollar liquidity still the dominant driver for Bitcoin, the report flags the Iran conflict as a key headwind. After U.S. and Israeli strikes on Iran on February 28, the Strait of Hormuz was blocked, pushing Brent crude to $118 per barrel in mid-March and lifting Dubai crude to a record $166. The surge fed into U.S. inflation, with March CPI rising to 3.3% from 2.4% in February, the highest level in two years. Tiger Research says this squeezed the Fed's flexibility, and the March dot plot cut expected 2026 rate cuts to one. By mid-April, parts of the Strait of Hormuz had reopened, oil fell back to around $90, and core CPI held at 2.6%, suggesting the shock has not fully spread through the broader economy. The report also notes that President Trump nominated Kevin Warsh as the next Fed chair at the end of January and that Senate confirmation hearings are in progress. Powell's term ends May 15, and Tiger Research expects a dovish bias to persist even if the total number of cuts is reduced. Institutional flows: early signs of a turn Spot Bitcoin ETFs posted their worst monthly outflows since launch in November 2025 and recorded five straight months of net outflows. Tiger Research says the trend shifted in March, when monthly net flows turned positive. By mid-April, year-to-date net flows were positive again and total AUM had rebounded to $96.5 billion. On the corporate side, accumulation is accelerating among existing participants. Strategy bought 34,164 BTC for $2.54 billion during April 13–19, lifting total holdings to 815,061 BTC. The report adds that the number of companies joining the buying trend has not expanded meaningfully. Macro score cut to +20% Tiger Research says structural supports—liquidity expansion, an easing bias in policy, improving institutional flows and progress on the U.S. CLARITY Act—remain in place. Oil shocks and a slower pace of Fed cuts offset part of that support, leading the firm to revise its Q2 macro indicator down by 5 percentage points from Q1 to +20%. On-chain: from undervaluation toward early equilibrium Key on-chain indicators including MVRV-Z, NUPL and aSOPR have moved out of Q1 panic territory and into what the report describes as an early recovery zone. Tiger Research does not expect the type of sharp rally often seen in panic rebounds, but says historical data shows average one-year returns from this zone have remained in double digits, keeping risk-reward attractive. The report highlights that the short-term holder (STH) cost basis is falling, consistent with speculative capital exiting while new buyers accumulate at lower prices. This, it argues, lines up with the return of ETF inflows and large purchases by Strategy, reinforcing the view that institutions are averaging in during discount phases. Two price levels are framed as pivotal. The key downside risk is $54,000, described as the network-wide average cost basis; a break below it would place the network in an unrealized loss position and could act as an extreme-case bottom. The strongest resistance is $78,000, the average entry cost of long-term holders. With Bitcoin around $70,500, the market sits about 13% below that level. Tiger Research says a clean break above $78,000 would be a primary signal of a short-term trend reversal. Usage data: transactions up, participation down In the first half of April, daily average transactions reached 564,000, up 37.9% year over year. The report cautions that underlying activity looks weaker: active addresses fell to 428,000 (down 13.2% year over year and 4.2% quarter over quarter) and average transaction size dropped to 1.19 BTC from 1.80 BTC in the prior quarter, a 34.1% decline. Tiger Research interprets this as repeated small transfers by a limited user set, with much of the volume likely tied to mechanical flows such as exchange deposits rather than broad-based economic use. BTCFi thesis weakens; fundamentals reset to 10% Tiger Research had held fundamental metrics at 0% in Q1 on expectations of BTCFi expansion. Entering Q2, it says that case has weakened. Citing The Block's "2026 Digital Assets Outlook," the report notes Bitcoin L2 TVL is down 74% year to date, while total BTCFi TVL has slipped 10% and represents just 0.46% of Bitcoin's total supply (91,332 BTC). While Babylon and Lombard have grown, the broader ecosystem has contracted. As a result, the firm revises Q2 fundamentals to a baseline of 10%. Target reiterated: $143,000 and roughly 2x upside Using a TVM framework, Tiger Research sets a neutral baseline of $132,500 based on the early-April 2026 average price. Applying a 10% fundamental adjustment and a +20% macro adjustment yields a 12-month target of $143,000. That is about 23% below the Q1 target of $185,500, but the firm says the pullback in spot prices has increased the upside from current levels. On its average-price calculation, upside expands from +93% in Q1 to +103% in Q2. Tiger Research stresses that the downward revision reflects slower momentum, not a bearish shift, arguing that the macro trend and on-chain structure still support a long-term bull market. It highlights three short-term conditions to watch: a decisive move above the $78,000 global mid-term equilibrium level, continued ETF net inflows, and a Fed policy shift enabled by easing geopolitical risk. If all three align, the firm says the $143,000 target remains within reach.

Another nine-figure DeFi security event has hit the onchain market. On April 18, an attacker abused Kelp DAO's LayerZero routing setup—specifically a 1-of-1 DVN configuration without optional verifiers—to fabricate cross-chain messages and trigger an erroneous release of 116,500 rsETH. The fallout left Aave facing potential bad debt estimated between about $123.7 million and $230.1 million, depending on how losses are allocated. Beyond the headline number, the incident lands a more uncomfortable blow: it undermines a long-standing DeFi assumption that the industry can keep boosting efficiency, liquidity, and yield while quietly placing security on a small set of trusted middleware components. I. What the Kelp DAO Incident Actually Broke Treating this as just another bridge-style hack misses why it matters. Kelp DAO, an Ethereum-based liquid restaking protocol, lets users deposit ETH and receive rsETH as a receipt token. That receipt circulates on mainnet and has been wrapped into LayerZero's OFT standard, with deployments on more than 20 chains including Base, Arbitrum, Linea, Blast, Mantle, and Scroll. The architecture is straightforward: the Ethereum mainnet cross-chain contract holds the full ETH reserve, while rsETH on other chains is effectively a redeemable claim on that mainnet pool. The system only works if one constraint always holds: the reserve locked on mainnet must remain greater than or equal to the amount minted across L2s. The attacker targeted that constraint directly by forging what appeared to be a valid LayerZero cross-chain message. The mainnet bridge contract interpreted it as a compliant redemption instruction from another chain and released 116,500 rsETH. At the center of the failure was LayerZero verification configuration. Kelp DAO ran a 1/1 DVN (Decentralized Verification Network) setup, where a single validator signature can approve a cross-chain message. LayerZero's own guidance favors 2/2 or broader multi-validator redundancy. Security researchers had flagged the 1/1 risk as early as January 2025; it went unaddressed for roughly 15 months. That is why the event is hard to dismiss as merely "a bridge got hacked" or "risk controls were weak." It exposed two stacked single points of failure: - Single-point message verification: DVN is designed as a composable X-of-Y-of-N security model, but in Kelp DAO's deployment, message legitimacy effectively collapsed into the assumption that one verification node would never fail. - Single-point reserve dependency: once the mainnet reserve pool is compromised, rsETH on other chains stops behaving like a cross-chain asset and reveals itself as an IOU anchored to a single mainnet pool. When those two points overlap, the damage doesn't stay inside one protocol. It propagates through DeFi composability. That spillover is why Aave moved quickly to freeze rsETH/wrsETH markets across multiple chains, adjust the WETH interest rate model, and freeze additional WETH markets to limit contagion. Aave itself was not hacked, but collateral distortions, impaired liquidations, and borrowers clustered near liquidation thresholds created a material path to bad debt. Zooming out, the same "outsourced security to one trusted point" pattern isn't limited to bridges and validators. It also sits in the place users touch every day and rarely evaluate: the interface. II. The Overlooked Trust Assumption: Interaction Layers Web3's mantra "Don't trust, verify" is often explained in node terms: if you run your own node, you can verify chain data yourself instead of trusting centralized providers. The principle applies equally to wallets and DeFi interactions. Noncustodial wallets like imToken are access tools: they show balances, construct transactions, and connect users to apps. They do not custody funds and do not control private keys. The industry has made real progress in understanding self-custody at the asset layer. The weaker link is the interaction layer. Even as users take custody of assets, they commonly outsource meaning: they trust frontends to interpret transactions, describe contract calls, and honestly represent what will happen once a signature is produced. The core question is simple: is the transaction a user signs actually the transaction they believe they are signing? Most users do not interact with the chain directly. They interact through stacked interfaces: DApp web frontends, wallet popups, aggregator routing instructions. Soon, that list expands to agent-generated calls and agent-produced confirmations that state things like "You are depositing 100 ETH into strategy X" or "This is a standard approval." In practice, few users can verify whether the calldata being signed and executed matches the interface description. Frontend hijacks, address substitution, and malicious approval spoofing may look like different incidents, but they converge on the same outcome: users sign something other than what they think they are signing. This is where "Verifiable UI" comes in. The goal is not prettier UX or simpler signature screens. It is to cryptographically and semantically bind what the interface displays to what will execute onchain—in a way users can check, wallets can validate, and auditors can review after the fact. Practically, that means wallets should not just display raw hex strings or repeat frontend-provided descriptions. They should reconstruct calldata into human-readable, semantically precise actions. Each step shown in the interface should map to verifiable onchain evidence, instead of relying on the assumption that "what the user believes" equals "what is true." When that gap closes, the interface stops being a glass pane users must trust blindly. It becomes a set of instructions users can confirm before execution and trace afterward. III. Why Verifiable UI Becomes the Next Security Perimeter If Kelp DAO highlighted single-point trust in legacy DeFi plumbing, Verifiable UI speaks to the next phase already underway. Ethereum UX work has repeatedly identified the same pain clusters: transaction clarity, cross-chain flow, and safety & security. Blind signing, signature fatigue, bridging friction, and asset fragmentation remain daily realities. The deeper takeaway is that UX and security are inseparable onchain. Not understanding what's happening is often the biggest security risk. That risk rises as interaction shifts from "users clicking through a DApp step by step" to "users express intent and the system executes automatically." In the classic frontend era, users at least saw buttons, pages, and popups. Even without full comprehension, they could sense whether they were approving, transferring, bridging, or depositing. In an Agent-driven era, those visible steps compress. Instead of opening routers, bridges, vaults, and lending markets one by one, users will tell an AI wallet: "Move my ETH into a more stable yield strategy," "Bridge to Base with slippage controlled," or "Let this agent spend only 100 USDT within 24 hours," then wait for "completed." Efficiency improves, but paths, parameters, approvals, and execution sequences become less visible. Against that backdrop, imToken has outlined two parallel tracks: continued work on intent-based interactions, and a push toward "Unified & Verifiable UI," treating the interface itself as a long-term security surface. This reframes what next-generation wallets must be. Historically, wallets acted mainly as signing conduits, forwarding confirmations to the chain. As agents enter the workflow, wallets must become the final deterministic checkpoint. AI can interpret intent and propose plans, but the wallet has to translate probabilistic outputs into deterministic execution that users can verify, systems can validate, and rules can enforce. In that sense, Verifiable UI is less a design trend than an interaction-security model—a missing piece self-custody wallets will need as the ecosystem enters its next stage. The industry slogan has long been "Not your keys, not your coins." In an intent-and-agent world, an additional baseline emerges: if you can't verify the interface, you can't truly verify the transaction. Conclusion After the Kelp DAO exploit, discussion quickly focused on DVN setup, LRT risk controls, bridge routes, and single-point risk scoring. Those debates matter. Still, reducing a multihundred-million-dollar event to "someone didn't add enough multisig signatures" misses the larger lesson. Many onchain products still lean on single points of failure users cannot see or independently verify, even as users enjoy the efficiency, liquidity, and returns those shortcuts enable. Decentralization is not the opposite of efficiency; it is the security baseline. The era of relying on single-point assumptions needs to end.

Russia's State Duma has approved a cryptocurrency regulation bill on its first reading, TASS reported. The draft would establish a legal framework for crypto market participants, with the Bank of Russia responsible for licensing and regulatory enforcement. Crypto exchanges, brokers and other financial institutions would be permitted to operate under the new rule set. The bill also proposes a tiered investor access regime. Non-qualified investors could face tight purchase limits, with reports indicating a cap of about 300,000 rubles for retail buyers. Professional investors would be exempt from these restrictions. The approach is designed to expand access while containing risk.

SEC Chair Paul Atkins said a forthcoming taxonomy could classify most digital assets as falling outside U.S. securities regulations. The agency is also considering a potential exemption that would allow tokenized securities to trade onchain.

Volo Protocol said it has identified a $3.5 million exploit impacting its Sui-based vaults. The team noted that roughly $500,000 has already been frozen as recovery efforts continue. Volo Protocol added it will cover the losses and ensure users face no financial impact.