A Polymarket market tracking whether Kelp DAO will spread the weekend's $292 million exploit losses beyond directly impacted users is leaning firmly toward "no." Traders assign a 14% probability that Kelp will "socialize the losses"—a move that would require rsETH holders on Ethereum, which was not affected, to share losses with users on other networks. Attackers siphoned about 116,500 rsETH from a LayerZero-powered bridge that held reserves backing the token across more than 20 blockchains. The breach left parts of the system undercollateralized, meaning some rsETH is no longer fully backed by ether (ETH). In practice, socializing losses would spread the shortfall across all rsETH holders, including those on Ethereum mainnet, instead of concentrating losses among users and protocols connected to the compromised bridge. The best-known example dates to 2016, when Bitfinex imposed losses across its user base following a $60 million hack to keep the exchange operating. Derivatives venues have also deployed related approaches via autodeleveraging (ADL), where winning positions are forcibly reduced to cover deficits once insurance funds are depleted. During the October flash crash, ADL was triggered at some exchanges, closing even market-neutral positions and exposing traders. Such measures are uncommon and contentious, typically reserved for system-stabilization in extreme conditions. Kelp's case adds additional complexity: the reserve drain spanned more than 20 chains, splintering losses across multiple user groups and platforms. Some networks face impaired backing while others remain largely insulated. A broad redistribution would require cross-chain coordination, clear liability accounting, and a decision to impose losses on users who may not view themselves as affected—a mix of technical and political hurdles that may help explain Polymarket's skepticism.

Spot crypto ETFs returned to net inflows on April 21, with both Bitcoin and Ethereum products finishing in the green. Daily figures show Bitcoin spot ETFs drew $11.84 million, while Ethereum spot ETFs led with $43.36 million. Products tied to SOL and XRP reported $0 million each. The latest flow data points to continued investor demand, though it remains uneven across major assets. Ethereum attracted nearly four times the capital seen by Bitcoin, signaling stronger near-term interest in ETH exposure as market participants monitor how institutional allocation develops across digital assets. ETF flows are a closely followed gauge because they can indicate where institutional capital is moving through regulated vehicles. Net inflows typically reflect fresh money entering the market, which can support sentiment when price action is choppy. While a single session does not establish a trend, positive flows into BTC and ETH can reinforce confidence that large-investor demand remains intact. Cointelegraph summarized the day's flows as follows: BTC +$11.84M, ETH +$43.36M, SOL $0M, XRP $0M. With SOL and XRP flat, April 21's activity was concentrated in the two largest crypto assets. The session delivered a modest inflow for Bitcoin and a notably stronger result for Ethereum, underscoring that institutional demand is still present, but selective.

SoFi has added XRP to its crypto offering, prompting Ripple to hail the move as a milestone. The response from the XRP community has been more mixed, largely because one key feature is still missing. Users of the nationally chartered bank can now deposit and hold XRP alongside Bitcoin, Ethereum and Solana. Ripple positioned the listing as progress toward broader participation, arguing that placing XRP inside a regulated banking app lowers barriers for everyday investors. The catch: XRP can't be withdrawn to external wallets. That limitation has shifted the discussion from increased adoption to whether the integration delivers meaningful utility. Holders vs. users Supporters argue that broader availability inside regulated platforms can build long-term utility and visibility. Critics counter that without the ability to move XRP off-platform, it can't be used for cross-border payments, DeFi activity or self-custody. For a token whose primary pitch is fast, low-cost settlement, the lack of portability is a significant constraint. One community member questioned how utility increases when XRP remains locked inside a SoFi account, contrasting it with SoFi's use of the Bitcoin Lightning Network. SoFi's support team replied publicly that crypto withdrawals are "coming soon," without providing a timeline. A longer rollout? Some observers see the limited release as strategic. Analyst Bill Morgan said Ripple may be playing a longer-term game, with fuller functionality potentially introduced after deposit volumes build. He also pointed to RLUSD, Ripple's stablecoin, as a possible next step if the relationship expands. Market context XRP is currently the fourth-largest cryptocurrency by market capitalization, at roughly $89B. SoFi's listing adds a retail banking distribution channel, but without withdrawal support, the near-term impact on real network usage appears limited. The episode underscores a long-running debate among XRP holders: price exposure versus actual utility. Tags: Crypto news; Ripple (XRP)

SoFi has added XRP deposits to its crypto lineup, joining Bitcoin (BTC), Ether (ETH) and Solana (SOL). The move makes SoFi one of the first nationally chartered U.S. banks to enable XRP trading directly through FDICinsured accounts.

Ethereum ($ETH) spot ETFs have pulled ahead of Bitcoin ($BTC) ETFs in recent flow momentum. Data from SoSoValue Crypto show ETH products logged more than $43 million in net inflows on April 21, stretching their streak to nine straight days. BlackRock's ETHA accounted for roughly $37 million of the total. Bitcoin ETFs attracted $11.84 million in net inflows, extending their run to six consecutive days.

On-chain data shows 119,999,999 USDC, valued at US$119,960,999, was transferred from Paxos to an unidentified wallet.

Another nine-figure DeFi security event has hit the onchain market. On April 18, an attacker abused Kelp DAO's LayerZero routing setup—specifically a 1-of-1 DVN configuration without optional verifiers—to fabricate cross-chain messages and trigger an erroneous release of 116,500 rsETH. The fallout left Aave facing potential bad debt estimated between about $123.7 million and $230.1 million, depending on how losses are allocated. Beyond the headline number, the incident lands a more uncomfortable blow: it undermines a long-standing DeFi assumption that the industry can keep boosting efficiency, liquidity, and yield while quietly placing security on a small set of trusted middleware components. I. What the Kelp DAO Incident Actually Broke Treating this as just another bridge-style hack misses why it matters. Kelp DAO, an Ethereum-based liquid restaking protocol, lets users deposit ETH and receive rsETH as a receipt token. That receipt circulates on mainnet and has been wrapped into LayerZero's OFT standard, with deployments on more than 20 chains including Base, Arbitrum, Linea, Blast, Mantle, and Scroll. The architecture is straightforward: the Ethereum mainnet cross-chain contract holds the full ETH reserve, while rsETH on other chains is effectively a redeemable claim on that mainnet pool. The system only works if one constraint always holds: the reserve locked on mainnet must remain greater than or equal to the amount minted across L2s. The attacker targeted that constraint directly by forging what appeared to be a valid LayerZero cross-chain message. The mainnet bridge contract interpreted it as a compliant redemption instruction from another chain and released 116,500 rsETH. At the center of the failure was LayerZero verification configuration. Kelp DAO ran a 1/1 DVN (Decentralized Verification Network) setup, where a single validator signature can approve a cross-chain message. LayerZero's own guidance favors 2/2 or broader multi-validator redundancy. Security researchers had flagged the 1/1 risk as early as January 2025; it went unaddressed for roughly 15 months. That is why the event is hard to dismiss as merely "a bridge got hacked" or "risk controls were weak." It exposed two stacked single points of failure: - Single-point message verification: DVN is designed as a composable X-of-Y-of-N security model, but in Kelp DAO's deployment, message legitimacy effectively collapsed into the assumption that one verification node would never fail. - Single-point reserve dependency: once the mainnet reserve pool is compromised, rsETH on other chains stops behaving like a cross-chain asset and reveals itself as an IOU anchored to a single mainnet pool. When those two points overlap, the damage doesn't stay inside one protocol. It propagates through DeFi composability. That spillover is why Aave moved quickly to freeze rsETH/wrsETH markets across multiple chains, adjust the WETH interest rate model, and freeze additional WETH markets to limit contagion. Aave itself was not hacked, but collateral distortions, impaired liquidations, and borrowers clustered near liquidation thresholds created a material path to bad debt. Zooming out, the same "outsourced security to one trusted point" pattern isn't limited to bridges and validators. It also sits in the place users touch every day and rarely evaluate: the interface. II. The Overlooked Trust Assumption: Interaction Layers Web3's mantra "Don't trust, verify" is often explained in node terms: if you run your own node, you can verify chain data yourself instead of trusting centralized providers. The principle applies equally to wallets and DeFi interactions. Noncustodial wallets like imToken are access tools: they show balances, construct transactions, and connect users to apps. They do not custody funds and do not control private keys. The industry has made real progress in understanding self-custody at the asset layer. The weaker link is the interaction layer. Even as users take custody of assets, they commonly outsource meaning: they trust frontends to interpret transactions, describe contract calls, and honestly represent what will happen once a signature is produced. The core question is simple: is the transaction a user signs actually the transaction they believe they are signing? Most users do not interact with the chain directly. They interact through stacked interfaces: DApp web frontends, wallet popups, aggregator routing instructions. Soon, that list expands to agent-generated calls and agent-produced confirmations that state things like "You are depositing 100 ETH into strategy X" or "This is a standard approval." In practice, few users can verify whether the calldata being signed and executed matches the interface description. Frontend hijacks, address substitution, and malicious approval spoofing may look like different incidents, but they converge on the same outcome: users sign something other than what they think they are signing. This is where "Verifiable UI" comes in. The goal is not prettier UX or simpler signature screens. It is to cryptographically and semantically bind what the interface displays to what will execute onchain—in a way users can check, wallets can validate, and auditors can review after the fact. Practically, that means wallets should not just display raw hex strings or repeat frontend-provided descriptions. They should reconstruct calldata into human-readable, semantically precise actions. Each step shown in the interface should map to verifiable onchain evidence, instead of relying on the assumption that "what the user believes" equals "what is true." When that gap closes, the interface stops being a glass pane users must trust blindly. It becomes a set of instructions users can confirm before execution and trace afterward. III. Why Verifiable UI Becomes the Next Security Perimeter If Kelp DAO highlighted single-point trust in legacy DeFi plumbing, Verifiable UI speaks to the next phase already underway. Ethereum UX work has repeatedly identified the same pain clusters: transaction clarity, cross-chain flow, and safety & security. Blind signing, signature fatigue, bridging friction, and asset fragmentation remain daily realities. The deeper takeaway is that UX and security are inseparable onchain. Not understanding what's happening is often the biggest security risk. That risk rises as interaction shifts from "users clicking through a DApp step by step" to "users express intent and the system executes automatically." In the classic frontend era, users at least saw buttons, pages, and popups. Even without full comprehension, they could sense whether they were approving, transferring, bridging, or depositing. In an Agent-driven era, those visible steps compress. Instead of opening routers, bridges, vaults, and lending markets one by one, users will tell an AI wallet: "Move my ETH into a more stable yield strategy," "Bridge to Base with slippage controlled," or "Let this agent spend only 100 USDT within 24 hours," then wait for "completed." Efficiency improves, but paths, parameters, approvals, and execution sequences become less visible. Against that backdrop, imToken has outlined two parallel tracks: continued work on intent-based interactions, and a push toward "Unified & Verifiable UI," treating the interface itself as a long-term security surface. This reframes what next-generation wallets must be. Historically, wallets acted mainly as signing conduits, forwarding confirmations to the chain. As agents enter the workflow, wallets must become the final deterministic checkpoint. AI can interpret intent and propose plans, but the wallet has to translate probabilistic outputs into deterministic execution that users can verify, systems can validate, and rules can enforce. In that sense, Verifiable UI is less a design trend than an interaction-security model—a missing piece self-custody wallets will need as the ecosystem enters its next stage. The industry slogan has long been "Not your keys, not your coins." In an intent-and-agent world, an additional baseline emerges: if you can't verify the interface, you can't truly verify the transaction. Conclusion After the Kelp DAO exploit, discussion quickly focused on DVN setup, LRT risk controls, bridge routes, and single-point risk scoring. Those debates matter. Still, reducing a multihundred-million-dollar event to "someone didn't add enough multisig signatures" misses the larger lesson. Many onchain products still lean on single points of failure users cannot see or independently verify, even as users enjoy the efficiency, liquidity, and returns those shortcuts enable. Decentralization is not the opposite of efficiency; it is the security baseline. The era of relying on single-point assumptions needs to end.

BlackRock, Mastercard, Gemini and Ripple have completed a pilot that used a regulated stablecoin to settle card payments on the XRP Ledger, highlighting how major financial firms are moving from observing blockchain to deploying it in live payment workflows. The test centered on RLUSD, a stablecoin positioned for bank-grade payments, aiming to improve speed and transparency versus legacy rails. Ripple executive Odelia Torteman discussed the initiative at an industry forum in London. She said that while XRP is often seen primarily as a trading token, institutions including BlackRock and Franklin Templeton are evaluating the underlying ledger for institutional finance use cases. Designed for cross-border transfers and multi-asset settlement, the XRP Ledger includes a built-in decentralized exchange and an automated market maker, enabling large firms to trade and move value with less dependence on traditional intermediaries. In September, Franklin Templeton partnered with Ripple and DBS Bank to explore lending and trading structures using money market funds tokenized to increase liquidity. By pairing tokenized funds with regulated stablecoins, the firms aim to improve capital efficiency while staying within regulatory requirements, a framework intended to appeal to large investors wary of broader crypto volatility. The model is also extending into Treasury-style products. Ripple and Securitize reportedly built a mechanism that allows investors in BlackRock's BUIDL fund to convert holdings into RLUSD, enabling 24/7 liquidity via smart contracts. Redemptions from similar funds typically occur only during banking hours and can take time; the setup is designed to provide continuous access. Data indicates the XRP Ledger is being positioned for institutions that require strict identity and compliance controls. The network uses "trust lines" and tools designed to support know-your-customer processes. As participation grows, XRP's role is shifting from primarily speculative exchange trading toward use as a liquidity bridge, enabling banks to settle different forms of value globally in seconds. Featured image from The Wall Street Experience, chart from TradingView.

Volo Protocol, a yield platform built on the Sui blockchain, has disclosed a security breach that siphoned roughly $3.5 million from three of its yield-generating vaults. Volo lets users deposit assets into pooled vaults, which deploy tokens such as bitcoin, stablecoins and tokenized assets through on-chain strategies to generate returns. The protocol said the exploit was limited to three specific vaults and did not impact the rest of the platform. "The ~$28M in TVL across all other Volo vaults is safe. The exploit was isolated to 3 specific vaults, and we have confirmed no shared attack vector exists with the remaining vaults," Volo wrote on X, adding it is "prepared to absorb" the loss rather than pass costs on to users. The affected vaults held wrapped bitcoin (WBTC), Matridock's tokenized gold token XAUm, and the dollar-pegged stablecoin USDC. Volo said it has frozen all vaults while working with the Sui Foundation and on-chain investigators to contain the incident and trace the stolen funds. The protocol also reported freezing $500,000 in assets through coordination with ecosystem partners, immobilizing those funds on-chain to prevent movement or withdrawals. The bulk of the stolen assets remains under investigation. The incident lands amid renewed scrutiny of DeFi security, following a series of high-profile exploits that have raised questions about smart-contract risk and protocol controls. It comes days after the weekend's KelpDAO exploit, where an attacker drained millions by artificially minting unbacked liquid restaking tokens (rsETH). The fallout spread across DeFi, including to Aave, where users rushed to withdraw amid elevated uncertainty. DeFi has suffered about $7.78 billion in hack-related losses to date, according to DeFiLlama. Bridge protocols have recorded an additional $2.90 billion in losses, bringing the combined total above $10 billion—roughly comparable to the market capitalization of cryptocurrencies ranked between 10th and 15th globally. Volo said it will publish a full postmortem after its investigation concludes and remediation measures are finalized.