MetaMask developer and security researcher Taylor Monahan said North Korean IT workers have been embedded in crypto companies and DeFi projects for at least seven years, alleging involvement across 40+ DeFi platforms. Her comments followed Drift Protocol's statement of "medium-high confidence" that its recent $280 million exploit was conducted by a North Korea state-affiliated group.

HypurrFi said on April 6, 2026 that it detected what it believes may be a domain hijack and told users to avoid its website and lending platform while it investigates. The team said its social media accounts remain in its control, and added it has not seen evidence that user funds were impacted, suggesting the issue is limited to the front-end.

On Mar. 29, 2026, a Kelman.Law commentary recapped late-March legal shifts spanning tokenized securities, exchange licensing, and cross-border enforcement. Highlights included the SEC approving Nasdaq's plan to enable tokenized trading of certain equities and ETFs, plus Hong Kong's warning to platforms that licensing deadlines could trigger enforcement. The piece also flagged Nigeria's tax-evasion case involving Binance executives, U.S. scrutiny after an SEC enforcement leadership resignation, proposed Labor Department guidance on crypto in 401(k)s, and federal-state clashes over prediction-market oversight.

Japan's Financial Services Agency expanded the country's crypto travel rule coverage on April 25, 2025 by adding 30 jurisdictions, bringing the total scope to 58 markets. The change increases compliance and information-sharing requirements for licensed exchanges and stablecoin-related service providers handling cross-border transfers.

Drift Protocol was exploited for $280 million on April 1, 2026, in an incident initially dismissed by some due to its April Fools' timing. Investigators later attributed the breach to the UNC4736 group, saying the attackers blended long-running social engineering with device compromises that enabled multi-sig approvals.

Drift Protocol released a detailed Saturday update on its April 1 incident that drained about $280 million from its Solana perpetuals exchange, describing a roughly six-month social engineering campaign that began around fall 2025. The attackers allegedly posed as a quant firm, met contributors at multiple conferences, and deposited over $1 million into an Ecosystem Vault before obtaining pre-signed approvals and taking control within minutes. Drift and SEAL 911 said they have “medium-high” confidence the operation matches the North Korea-aligned actors behind the $50 million Radiant Capital hack in October 2024, while Mandiant has not yet issued formal attribution.

Anthropic changed how Claude Pro and Max subscriptions apply to third-party agent frameworks on April 4, 2026, starting with Openclaw, pushing heavier users toward pay-as-you-go "extra usage" or API keys. The shift has raised expected costs for always-on crypto automation, with extreme one-day agent runs estimated at $1,000 to $5,000. Enforcement is expected to broaden to other third-party harnesses starting April 2026.

X plans to automatically lock any account the first time it mentions cryptocurrency, forcing additional verification before it can post again. X Head of Product Nikita Bier said the change removes "99%" of incentives for phishing-driven account takeovers, though it could add friction for legitimate first-time crypto posters.