Kelp DAO reported a $292 million loss on April 18, 2026, after attackers siphoned 116,500 rsETH through a vulnerability tied to its LayerZero-based cross-chain bridge. The exploiter then used 89,567 rsETH as Aave collateral to borrow $190.86 million in wrapped Ether before markets repriced the asset. Aave later saw $8.45B in deposit outflows over the next 48 hours, alongside more than $13B leaving DeFi.

The U.S. Securities and Exchange Commission has pushed back work on a planned exemption meant to clarify how it views tokenized assets, after concerns surfaced around third-party token issuance. SEC staff has been meeting with stock-exchange officials and market participants over the past few days and is weighing feedback, while the agency chair has said the proposal is intended to serve as a sandbox for onchain equities.

After the May 17 exploit of the Verus-Ethereum bridge, the attacker returned $8.5 million to the Verus team while keeping $2.8 million as a white-hat bounty. The project had offered a 1,350 ETH reward if 4,052 ETH was sent back within 24 hours, alongside a pledge to halt investigations if the terms were met.

On 22 May 2026, Intercontinental Exchange (ICE) and OKX said they launched perpetual oil futures tied to ICE Brent and West Texas Intermediate (WTI) benchmarks. The products have no expiry date and are set to be offered to OKX's 120 million retail users in jurisdictions where the exchange holds the required licenses. The rollout follows ICE's March 2026 strategic equity investment in OKX at a $25 billion valuation.

Polymarket was targeted on May 22 in an incident tied to its rewards payout system, with more than $700K in USDC and POL reportedly drained. The compromise appears linked to a private key, while the team said user funds and market resolution were not affected as it rotates backend keys and continues investigating.

On May 22, 2026, on-chain investigator ZachXBT said a Polymarket admin address on Polygon appeared to be compromised, initially estimating losses at about $520,000. Later updates suggested the stolen amount may have surpassed $600,000, with the attacker splitting funds across 15 addresses. Polymarket’s Shantikiran Chanal said the team is investigating while claiming user funds and market resolutions remain safe.

Polymarket is navigating a high-stakes week marked by global expansion pushes into Japan and regulatory bans in India, alongside a recent $520,000 smart contract exploit that left main user positions secure. Despite subdued Polygon (POL) token performance, the prediction giant continues to dominate 2026 trading volumes ahead of rumored token airdrops and an IPO.

Polymarket suffered an exploit on Polygon targeting its UMA CTF Adapter smart contract, with losses reported near $600,000. On-chain investigator ZachXBT flagged the incident and linked activity to wallet 0x8F98075db5d6C620e8D420A8c516E2F2059d9B91, while users were warned to pause platform activity. On-chain data showed 5,000 $POL being removed roughly every 30 seconds during the drain phase.