Welcome to this week’s cryptocurrency market update. If last week was dominated by the aftermath of KelpDAO and the collapse of RaveDAO, this week saw the conversation shift toward the CLARITY Act’s sudden momentum, a fresh wave of DeFi exploits across ZetaChain and Syndicate Commons, and a deepening institutional commitment to Bitcoin and Ethereum treasuries.
Bhutan quietly sold off more BTC, Western Union announced a stablecoin, and Polymarket had a rollercoaster week of its own. Let’s get into it.
Top headlines for this week
Below are the major headlines, giving an overview of what happened in the crypto market this week.
CLARITY Act breaks deadlock, Senate signals vote is near
The biggest regulatory story of the week was the sudden shift in momentum around the CLARITY Act. After weeks of stalling over stablecoin yield language and aggressive banking lobby pushback, the bill appears to have broken through its deadlock.
Senator Lummis hinted at a Bitcoin conference that the Act could get to the finish line in May, while Sen. Tim Scott followed up by signaling lawmakers are in the “red zone” for a vote. Polymarket odds on the bill passing surged to 61% as the deal reportedly broke the deadlock that had stalled progress since April.
The timeline is still tight. The Senate has roughly 9 to 10 working weeks before the August recess, and FISA reauthorization, the budget resolution, and DHS funding are all competing for floor time. But this is the most momentum the bill has had in months, and the crypto industry is watching every signal closely.
ZetaChain pauses after $333K GatewayEVM exploit
ZetaChain, the interoperability-focused Layer 1 that markets itself as a universal blockchain bridging EVM chains, Bitcoin, Solana, Sui, and TON, halted all cross-chain activity after an attacker drained $333,868 in stablecoins from its GatewayEVM smart contract.
The post-mortem revealed a“perfect storm” of three independent bugs that together gave the attacker access to internal team wallets. The attacker routed funds across four chains via nine transactions, converted stablecoins to ETH through DEXs, and used Tornado Cash to obscure the trail. No user funds were lost, but the incident raised pointed questions about access control practices and approval hygiene at one of crypto’s most ambitious cross-chain projects.
ZetaChain disclosed the exploit publicly a day after the attack and paused mainnet cross-chain transactions while the team patched the vulnerability.
Syndicate Commons Bridge drained for ~$400K
ZetaChain was not alone. The Syndicate Commons Bridge fell victim to a separate DeFi exploit this week, with roughly $400K stolen. The attack adds to a growing list of bridge-related security failures in 2026, reinforcing the pattern that cross-chain infrastructure remains the softest target in DeFi.
Arbitrum DAO votes on releasing $71M in frozen Kelp hacker ETH
The KelpDAO fallout continued to evolve. Aave Labs and Kelp DAO pushed Arbitrum to release the exploiter’s frozen funds, and by May 1, the Arbitrum DAO formally started a vote on whether to release the $71 million in frozen ETH to DeFi United, the coalition coordinating the recovery effort.
Justin Sun’s TRON and HTX added to the recovery push by injecting $20 million into Aave’s DeFi United initiative, expanding the backstop that has now drawn support from across the DeFi ecosystem.
Bitcoin and Ethereum treasury buying accelerates
Corporate accumulation hit another gear this week. Strategy added 3,273 Bitcoin to its treasury in yet another weekly purchase. Strive bought 789 BTC, pushing its holdings to $1.3 billion. Tether confirmed it now holds 140,000 Bitcoin and announced plans for a merger with Twenty One Capital, a move that underscores its ambition to become a central pillar of Bitcoin infrastructure.
On the Ethereum side, Bitmine added over 100,000 ETH to boost its holdings past 5 million, then doubled down with a $366 million staking deposit. The ETH treasury trade is no longer a sideshow.
U.S. Bitcoin ETFs capped the accumulation narrative with $1.9 billion in April inflows, their strongest month since launch. April nearly doubled the pace of prior months, flipping year-to-date flows positive and pushing cumulative inflows since the 2024 launch to roughly $58 billion.
Bhutan quietly sells off 9,579 BTC
While institutions were buying, Bhutan was selling. The kingdom has offloaded 9,579 BTC since October 2024, trimming more than 70% of its peak holdings through repeated transfers to exchanges, OTC desks, and unlabeled wallets.
The sell-off has been gradual and largely under the radar, but it represents one of the largest sovereign Bitcoin liquidations on record.
Bitcoin ‘eCash’ hard fork divides the community
Longtime Bitcoin developer Paul Sztorc announced plans for a controversial Bitcoin hard fork called eCash, slated for August 2026. The most explosive element is the plan to reassign up to half of the roughly 1.1 million BTC attributed to Satoshi Nakamoto’s “Patoshi-pattern” wallets. The fork would create a near-identical copy of Bitcoin’s core software while introducing upgrades aimed at scalability and functionality.
The proposal has divided BTC maximalists, with some seeing it as a necessary evolution and others calling it a direct assault on Bitcoin’s foundational principle that no entity should have the power to redistribute coins.
Litecoin hit by 13-block MWEB exploit and reorg
Litecoin experienced a 13-block chain reorganization after an attacker exploited a bug in the MWEB (MimbleWimble Extension Blocks) privacy feature. The reorg rewound roughly 32 minutes of block history, putting an estimated $600K at risk.
Litecoin developer Loshan urged immediate node upgrades, warning that the exploit combined a consensus bug with a denial-of-service attack.
Polymarket launches CLOB v2, then faces breach allegations
Polymarket had a mixed week. The prediction market platform rolled out its long-awaited CLOB v2 upgrade with $1 million in rewards and a new pUSD token. But the celebration was short-lived. Within a day, reports emerged that Polymarket had allegedly been breached, with 300,000+ records and an exploit kit leaked on a cybercrime forum.
The platform denied any hack, while researchers pointed to API flaws, undocumented endpoints, and exposed datasets. The timing, right after a major product launch, could not have been worse.
Western Union enters crypto with USDPT stablecoin
In a significant TradFi-to-crypto crossover, Western Union announced the launch of its USDPT stablecoin in May. The move puts one of the world’s oldest money transfer companies directly into the stablecoin market at a moment when the CLARITY Act could reshape the regulatory landscape for exactly this kind of product.
News you might have missed
- Worldcoin faces fresh scrutiny: Elon Musk jabbed Sam Altman with the “Scam Altman” label, and on-chain investigator ZachXBT piled on with new claims as Worldcoin came under renewed pressure.
- Fake Arthur Hayes email scam: A phishing campaign impersonating BitMEX co-founder Arthur Hayes targeted crypto users with a fake trading scheme.
- India’s MHA warns on Trust Wallet drainers: India’s Ministry of Home Affairs issued an advisory on Trust Wallet drainer scams, the latest sign that Indian regulators are taking crypto-specific fraud seriously.
- Mysterious wallet drains 326 ETH: A mysterious wallet drained 326 ETH from over 570 Ethereum addresses, raising alarms about potential private key compromise or phishing at scale.
- Solana bot turns 23 cents into $696K: A Solana arbitrage bot converted 23 cents into $696,000 after the ANB token crashed, a reminder of how fast MEV extraction operates on high-speed chains.
- Hyperliquid enters prediction markets: Hyperliquid launched prediction markets in a direct challenge to Polymarket’s dominance.
- Solana co-founder warns on quantum risk: Solana co-founder said Ethereum L2s are “not quantum safe”, continuing the quantum security conversation that has been building across the industry.
- Brazil bans crypto in eFX settlements: Brazil banned virtual assets in eFX cross-border payment settlements, taking a sharply different path from other major economies.
Buzz of the Week
The buzz this week belonged to the CLARITY Act. After weeks of false starts and banking lobby gridlock, the bill finally showed real signs of life. Senator Lummis, Senator Tim Scott, and Polymarket odds all pointed in the same direction: a vote is coming, possibly within weeks.
What makes this moment different from the previous false alarms is the convergence of political pressure. The Senate has a shrinking window before the August recess, both parties have members who need to show legislative progress before the midterm campaign season, and the yield compromise that killed prior attempts appears to have found enough middle ground to move forward.
If the CLARITY Act passes, it becomes the most consequential piece of crypto legislation in U.S. history. If it slips again, the bill effectively dies for the year.
The DeFi exploit cycle, meanwhile, shows no sign of slowing. ZetaChain, Syndicate Commons, the Litecoin MWEB bug, and a mysterious mass drain of 570 Ethereum addresses all landed in the same seven-day stretch. The common thread is not any single vulnerability but a systemic shortage of security rigor across bridges, cross-chain protocols, and privacy features that were deployed before they were truly battle-tested.
On the accumulation side, the numbers are becoming hard to ignore. Between Strategy, Strive, Tether, Bitmine, and the $1.9 billion in ETF inflows, the institutional bid for Bitcoin and Ethereum is accelerating at exactly the moment when sovereign sellers like Bhutan are creating supply. That dynamic, steady institutional buying meeting sovereign profit-taking, is the quiet structural story underneath all the exploit headlines.
What to expect for next week?
Next week comes down to three things: whether the CLARITY Act clears committee and gets a floor vote date, whether the Arbitrum DAO votes on releasing the $71 million in frozen Kelp hacker ETH passes, and what precedent that sets, and whether the DeFi exploit pace finally slows or another protocol joins the list.
The regulatory outcome matters the most. If the CLARITY Act makes it to the Senate floor in May, it reshapes the entire regulatory landscape for stablecoins, exchanges, and market structure. Western Union’s USDPT timing suddenly looks prescient rather than speculative. If the bill stalls again, the industry goes back to operating in a regulatory vacuum through the rest of 2026.
On the security front, bridges and cross-chain infrastructure need a visible reset. Three separate exploit events in one week is not a coincidence; it is a pattern. Protocols that have not completed rigorous audits of their access control and approval hygiene should treat the ZetaChain post-mortem as required reading.
And watch the treasury trade. With Tether moving toward a Twenty One Capital merger and Bitmine staking hundreds of millions in ETH, the line between crypto-native companies and traditional financial infrastructure is blurring faster than regulators can keep up.
