Hyperliquid is continuing to take perpetuals trading share from centralized exchanges, according to ChainThink citing The Block. In March, the decentralized perpetuals platform accounted for nearly 6% of total perpetuals volume, up from about 3.5% a year earlier, with monthly trading volume close to $200 billion. The gains come even as Hyperliquid's overall trading activity has been trending lower since peaking in August 2025, suggesting the platform is capturing share rather than simply riding a broader rise in volumes. Hyperliquid has widened its lead among decentralized perpetuals venues, while onchain rivals dYdX and GMX have not matched its pace in volume growth or product expansion. A key driver is the push into noncrypto markets: commodities such as oil now trade on Hyperliquid 24/7, and noncrypto volume is taking a larger share of overall activity. The shift underscores a structural edge for decentralized venues. Traditional traders often must wait for the CME to reopen on Sunday evening to adjust oil exposure, leaving them vulnerable to weekend gap risk. Hyperliquid's around-the-clock market removes that constraint.

On-chain data shows a transfer of 194,405,381 USDC, valued at 194,409,987 USD, from the USDC Treasury to Coinbase Institutional.

Circle, issuer of the world's second-largest stablecoin USDC, is facing criticism after blockchain investigator ZachXBT alleged the firm failed to act as more than $230 million in stolen USDC moved through its own cross-chain bridge. The funds trace back to the Drift Protocol exploit on April 1, a theft estimated at $280 million to $285 million, now among the largest DeFi hacks on record. ZachXBT said the attacker moved USDC from Solana to Ethereum via Circle's Cross-Chain Transfer Protocol (CCTP), splitting the transfers across more than 100 transactions over roughly six hours. Drift exploit: admin access, not a smart-contract bug ZachXBT's write-up describes an operational-layer compromise rather than a typical smart-contract vulnerability. The attacker allegedly gained administrative permissions and used pre-signed transactions enabled by durable nonces to line up withdrawals and execute them rapidly. The exploit unfolded in about 12 minutes. Following the incident, the DRIFT token collapsed, falling about 98% from its $2.65 all-time high and trading around $0.041 to $0.06 afterward. Why Circle's response is the focus USDC differs from decentralized stablecoins in a critical way: Circle can freeze USDC at the wallet level. The company has previously frozen about $110 million in USDC across wallets, typically tied to law enforcement requests or sanctions compliance. ZachXBT argues that the Drift exploit was public while the funds were still moving, and that the bridging activity occurred during regular business hours. In that window, he says Circle had time to flag and freeze the stolen USDC as it passed through CCTP. Instead, more than $230 million crossed chains without interruption. The allegation is drawing added scrutiny because, according to observers, Circle had blacklisted other wallets only days earlier under circumstances some in the industry viewed as questionable—suggesting the capability to move quickly when it chooses. Broader implications for USDC and DeFi The incident is resonating beyond Drift because of USDC's scale. USDC processed $9.6 trillion in on-chain volume in February 2025 alone and is widely used across DeFi lending, trading, and liquidity infrastructure. Critics argue the episode highlights a long-running tension around centralized stablecoins: the freeze function is marketed as a safety feature, but it also concentrates discretion in a single issuer. If freezes occur for compliance reasons but not during a high-profile theft, skeptics say the mechanism can look more like selective enforcement than user protection. For institutional participants, the episode may challenge assumptions that centralized stablecoin issuers act as an effective backstop during crises. Risk frameworks that treated USDC as quasi-insured could face renewed scrutiny. Circle has not publicly detailed why it did not intervene. Possible explanations include internal requirements for specific law enforcement requests before action is taken, even in apparent theft cases. Still, the optics have fueled debate over what the compliance apparatus is designed to accomplish, a conversation likely to surface in ongoing stablecoin policy discussions in the U.S. and abroad. The event could also sharpen interest in alternative stablecoin models, including decentralized options such as DAI and newer collateralized designs, as protocols reassess issuer risk. For Drift Protocol, the outlook remains difficult. A 98% token drawdown undermines treasury value, compensation capacity, and the ability to retain users and developers, with recoveries from exploits of this magnitude historically rare. Bottom line The Drift Protocol theft was already a landmark DeFi exploit. The allegation that Circle had a multi-hour window to freeze over $230 million in stolen USDC moving through CCTP—and did not—has turned it into a broader test of what centralized stablecoin control is meant to deliver in a crisis.

Hyperliquid continues to gain traction against centralized exchanges, with its share of the perpetual futures market climbing toward 6%.

Ripple has executed a burn of nearly 40 million RLUSD on the Ethereum network.

Circle, the issuer of major stablecoins, said in a post on X that it will soon launch a wrapped Bitcoin product called cirBTC. The token will be backed 1:1 by Bitcoin, with reserves verifiable on-chain. Circle said cirBTC is designed to plug directly into its existing infrastructure and the broader DeFi ecosystem, aiming to provide a neutral base layer for new on-chain applications.

Squads update: Our investigation into the @DriftProtocol incident is still underway. Early indicators suggest two signers on Drift's admin multisig were compromised and used to execute a transaction that altered Drift's program configuration. The Squads programs were not compromised. We also have not seen evidence of a breach of Squads infrastructure, and we are continuing work to confirm this with full confidence. We will share additional findings as they become available. Best practices for operationally critical multisigs Thresholds: Any multisig with operational or administrative control over a program should use a signing threshold of 3+ to force an attacker to compromise multiple independent signers at the same time. Where feasible, distribute signers geographically and across organizations. Co-located signers, shared devices, or shared org structures create correlated risk. Timelocks: Multisigs with program-level control should enable a timelock (available in the Settings of your Squads multisig). A timelock doesn't stop a malicious proposal from being created, but it provides time to detect and reject it before execution. The tradeoff is slower response time during legitimate emergencies such as bugs or active exploits. Alerts & monitoring: We recommend monitoring and alerts for all operationally critical multisigs via our security partner @RangeSecurity. Range offers (1) an independent interface to verify transaction contents outside the Squads UI and (2) proactive Slack alerts so signers are notified before a proposal advances. If you'd like help getting set up, reach out and we'll connect you directly. A high threshold, a timelock, and monitoring form the baseline for any multisig with program-level control. Signing process: Use dedicated devices and hardware wallets for signing, not general-purpose machines. Signatures are valid for about 2 minutes, so introduce at least a 2-minute delay between each signer's actions to reduce the risk that an attacker can collect and bundle signatures. Independently verify transaction content using all three sources: the Squads UI, Range's interface, and Solana Explorer or Solscan. Durable nonces: The Drift attack leveraged durable nonces to gather signatures without time pressure, bypassing the standard ~2-minute transaction expiry that would otherwise constrain this attack path. We are exploring ways to block durable nonce usage across all of our programs at the program level and through additional enforcement mechanisms, with the goal of extending this protection to our immutable programs V3 and V4, as well as our current Smart Account Program. More broadly, the Solana ecosystem is also moving to address this at the protocol level with a new transaction format that removes durable nonces entirely. We'll share more soon. Beyond multisig: operational security Technical controls have limits. Many recent high-profile compromises have stemmed from social engineering aimed at the people holding keys rather than the contracts themselves. If your protocol operations are mission-critical, invest in internal opsec processes and culture: how proposals are initiated, communicated, and approved matters. We recommend working with dedicated security advisors. @zeroshadow_io and @0xGroomLake are trusted starting points, and we're happy to facilitate introductions.

Injective (@Injective) has published a proposal for its RealTime $USDC Mainnet Upgrade, aiming to position the network as a primary settlement layer for institutional stablecoin infrastructure. The proposed upgrade is designed to deliver high-speed, programmable payment rails for $USDC at scale, supporting decentralized finance use cases and institutional applications. With native real-time settlement built into the chain's architecture, $INJ is being positioned as a "central nervous system" for global digital-dollar flows.