Drift Protocol, the largest decentralized perpetuals exchange on Solana, was exploited for $285 million on April 1 in what analysts describe as a months-long governance attack. The breach unfolded in just 12 minutes through 31 rapid automated withdrawals. Blockchain intelligence firms Elliptic and TRM Labs both flagged alleged involvement by North Korea, marking what they characterize as the 18th North Korean crypto attack of 2026, with more than $300 million stolen this year alone.
The operation reportedly began in October 2025, when attackers posing as a quantitative trading firm made contact with Drift contributors at a major crypto conference. Over the following six months, they cultivated relationships with protocol insiders at multiple industry events. When the moment came, they used that access to socially engineer multisig signers into pre-approving concealed transactions through a Solana feature called durable nonces, which allowed the authorizations to remain dormant for weeks. The attackers also created a fraudulent token called CarbonVote, seeded with minimal liquidity and wash trading, to manipulate Drift’s price oracles into accepting it as legitimate collateral worth hundreds of millions of dollars.
Charles Schwab confirmed to reporters this week that it will launch spot Bitcoin and Ethereum trading for clients before the end of the current quarter. The firm manages $12.2 trillion in client assets, and the rollout will allow existing account holders to purchase the assets directly within the same interface they use for stocks and retirement funds. Unlike exchange-traded funds, clients will hold spot Bitcoin directly, custodied through Charles Schwab Premier Bank. The phased launch begins with employees, moves to invited clients, and then opens to the general public.
Google published a research paper this week showing that quantum computers could break elliptic curve cryptography — the cryptographic foundation underlying Bitcoin and Ethereum — using roughly 20 times fewer qubits than previously estimated. The necessary hardware does not yet exist, but the paper significantly lowers the theoretical threshold for a viable attack. Google consulted the US government before publication and employed zero-knowledge proofs so independent parties could verify resource estimates without accessing the underlying attack circuits.
Ethereum Foundation researcher Justin Drake, who joined the paper as a late co-author, estimated at least a 10 percent chance that by 2032 a quantum computer will be capable of recovering a Bitcoin private key from an exposed public key. The paper’s use of zero-knowledge verification methods was noted as an indicator of how seriously the matter is being treated by researchers and government officials alike.
Coinbase received conditional approval from the Office of the Comptroller of the Currency for a national trust bank charter this week. The approval does not make Coinbase a bank, but it grants the exchange federal regulatory uniformity for custodying digital assets across all 50 states, replacing a fragmented state-by-state licensing structure. The Independent Community Bankers of America and the Bank Policy Institute both filed opposition letters, with the latter arguing the approval would exceed the OCC’s authority under federal law.
Circle, the company behind the USDC stablecoin, announced the launch of cirBTC, a wrapped Bitcoin token backed one-to-one by native on-chain Bitcoin reserves. The product launches first on the Ethereum mainnet and on Arc, Circle’s own stablecoin-focused blockchain. Circle VP of product Rachel Mayer framed the offering as a solution to longstanding trust concerns around wrapped Bitcoin products. The dominant wrapped Bitcoin token, WBTC, holds roughly $8 billion in market capitalization but has faced scrutiny over its custody arrangements, while Coinbase‘s competing product cbBTC has grown to approximately $6 billion since launching last year.
Originally reported by Decrypt.
