DeFi Exploits Hit $36.7M as Humanity Protocol Loses $36M, CLARITY Act Stalls in Senate

Crypto News

Attackers drained at least $36.7 million from DeFi protocols running unverified smart contracts over the past six months, with on-chain data pointing to a sharp rise in AI-assisted exploit development. The largest single incident saw $26.2 million siphoned from Truebit through an integer overflow that had sat unverified on Ethereum since 2021, letting the attacker mint tokens for almost nothing before redeeming them for real ETH. Decompilers paired with large language models now scan thousands of closed-source contracts and triage them by exploitability, eroding the old assumption that hiding code provides protection. Trusted Volumes, Aperture Finance and Ekubo suffered comparable losses.

A NYSE American-listed digital infrastructure firm trading under AIB closed a roughly $55 million public offering, issuing 33.3 million common shares at $1.65 each, according to the company's investor-relations disclosure. Underwriters hold a 45-day option for up to 5 million additional shares. The proceeds will fund working capital and growth capital expenditure as the company accelerates its pivot from power-based blockchain mining toward AI and high-performance computing data centers. Management recently expanded a 15-year power services agreement at its CLT-01 campus from 40MW to 65MW, and reported first-quarter revenue of $4.9 million, up 9% year over year, with no traditional debt on the balance sheet.

Humanity Protocol disclosed that its roughly $36 million H token exploit stemmed from a catastrophic multisig key management failure rather than a flaw in the multisig design itself. An employee laptop was compromised, and that single device stored multiple private keys controlling the project's cross-chain bridge. On Ethereum the attacker secured three of six administrator keys, transferred bridge ownership, swapped in malicious code, and drained about 141 million H tokens in one transaction. A parallel attack on BNB Chain used three of five keys to insert unlimited-mint code, generating roughly 200 million new tokens. The H token, which traded near $0.67 before the breach, has only partially recovered. Cold storage discipline failed where it mattered most.

More than 200 crypto firms and trade groups pressed the U.S. Senate to advance the CLARITY Act, warning that further delay could close a narrow legislative window. The bill, which would divide oversight between the SEC and CFTC, cleared the Senate Banking Committee by 15 to 9 in May and was formally placed on the calendar on June 1, yet no floor vote has been scheduled. The White House has effectively set a July 4 target, and one research desk lowered the bill's 2026 passage odds from 75% to 60%. Banking-sector objections over stablecoin yield products and a 60-vote threshold remain the central obstacles.

A new analysis revived scrutiny of North Korea's reliance on stolen crypto, estimating that Pyongyang-linked hackers have siphoned billions of dollars over recent years. State-aligned group Lazarus has been tied to attacks on Ronin Bridge, Harmony Horizon, DMM Bitcoin and Bybit, with this year's Bybit breach ranking among the largest crypto thefts on record. Investigators believe much of the proceeds funds weapons programs, though some capital may have supported visible consumption growth in the capital, where roughly 10,000 new housing units were reportedly delivered last year. The pattern underscores how exploit revenue feeds sanctions evasion at national scale.

Centralized exchanges are aggressively expanding beyond altcoin trading into equities, derivatives and custody as fee revenue contracts. Binance began offering U.S. and Asian stock trading inside its app from June 1 via an ADGM-licensed broker-dealer, while Bybit listed perpetual futures on equities and commodities and Coinbase signaled pre-IPO access plans. The shift is driven partly by collapsing volumes—Binance altcoin spot turnover fell more than 80% from around $45 billion daily last October to $7.7 billion—and by the rise of on-chain venues. On one decentralized DEX, 23 of the top 30 perpetual markets were stocks and commodities rather than crypto.

Taken together, these developments map a single arc: capital and security pressure migrating wherever oversight is thinnest, even as institutions push for clearer rules. COINOTAG's aggregate market data frames the caution—the Fear & Greed Index sits at 9 out of 100, deep in Extreme Fear, while Bitcoin dominance has climbed to 70.2% and total crypto market capitalization stands near $1.75 trillion. That combination of capital concentration in Bitcoin and broad risk aversion explains why exploit-driven outflows, mining-to-AI pivots and stalled legislation are landing harder this cycle. On-chain data confirms unverified-contract targeting and bridge-key failures remain the dominant loss vectors, making verifiability and operational key hygiene the decisive defenses.