Drift Hack Fallout, Morgan Stanley Unveils MSBT, Sun–WLFI Battle Heats Up

Crypto swung hard again this week as Drift Protocol officially pinned its $285 million exploit on a North Korean state-affiliated group, Morgan Stanley launched its spot Bitcoin ETF, Circle minted a record $3.25 billion USDC on Solana in seven days, and the CLARITY Act drew public backing from both the Treasury Secretary and the SEC Chair. 

Justin Sun went public against Trump-backed World Liberty Financial over a frozen $70 million token position, Bhutan kept trimming its bitcoin reserves, and three more protocols were drained.

Welcome to this week’s cryptocurrency market update. If last week was defined by the shock of the Drift exploit and Bitcoin’s first green monthly close since September 2025, this week was about the fallout, the institutional counter-push, and a fresh round of political drama inside crypto itself.

In this edition, we cover the DPRK attribution on the Drift hack and the USDC freeze debate around Circle, Morgan Stanley’s MSBT Bitcoin ETF debut, Strategy and Bitmine adding to their treasuries, Bhutan’s strategic bitcoin sales, the CLARITY Act push from the Treasury and the SEC, India’s fresh tax notices, CME listing AVAX and SUI futures, CZ’s memoir revelations, the Tornado Cash and Arizona prediction market cases, the Justin Sun vs WLFI standoff, and a string of new exploits at Denaria, Aethir, and RaveDAO. Let’s get into it.

Drift Hack: DPRK attribution confirmed, Circle under fire

The biggest story of the week is still the Drift exploit, but the framing has now changed. Drift Protocol formally confirmed what on-chain analysts had suspected since April 1. The $285 million drain was the work of UNC4736, a North Korean state-affiliated threat group also tracked as AppleJeus and Citrine Sleet. The SEAL 911 team, Elliptic, and TRM Labs independently landed on the same conclusion. 

Fund flows used to stage and test the operation trace back to the Radiant Capital attackers, and the on-chain laundering pattern matches previous DPRK-linked operations, including the Bybit heist from earlier this year.

Drift has frozen all remaining protocol functions, removed compromised wallets from the multisig, and brought in Asymmetric Research and OtterSec to lead a coordinated recovery plan. Attacker wallets have been flagged across major exchanges and bridges, but no material recovery has been announced yet. The DRIFT token is still sitting roughly 98% below its all-time high.

The second half of this story is Circle. ZachXBT published a detailed analysis of leaked server data from the DPRK crypto network and accused Circle of being “asleep” while more than $230 million in stolen USDC was bridged via CCTP from Solana to Ethereum during US hours. Circle publicly defended its freeze process, arguing that premature intervention on active investigations can tip off attackers and compromise recovery. The irony is that in the same seven-day window, Circle minted a record $3.25 billion USDC on Solana, making this both Circle’s biggest Solana week on record and its most reputationally exposed one.

Morgan Stanley’s MSBT and the Treasury Company race

The institutional side of the market kept moving. Morgan Stanley confirmed on April 8 that its spot Bitcoin ETF would debut the same day under the ticker MSBT, and the product pulled in roughly $32 million on its debut session. It is a modest number next to IBIT, but the signal matters more than the size. Morgan Stanley is the first of the old-guard wirehouses to put its own name on a spot Bitcoin ETF rather than just distributing someone else’s.

On the corporate treasury side, Strategy restarted its accumulation program with a 4,871 BTC buy, keeping Michael Saylor’s publicly stated one million BTC goal firmly on the table. Bitmine pushed its ether treasury past 4.8 million ETH, cementing its position as the largest corporate ETH holder. Ether Machine, however, walked away from its $1.6 billion SPAC merger with Dynamix, a reminder that not every treasury company story ends in a public listing.

Bhutan went the other way. The sovereign miner moved $22 million in bitcoin midweek and followed it with a $180 million sale, signaling a clear shift in how the country is managing its digital asset reserves. It is not panic selling, but it is a strategic trim, and it aligns with a broader wave of miner selling that has kept a lid on spot price action.

CLARITY Act gains public backing from Treasury and SEC

Washington had a loud week on crypto policy. Treasury Secretary Scott Bessent publicly called for swift passage of the CLARITY Act, warning that failing to pass it would hand market structure leadership to other jurisdictions. A day later, SEC Chair Paul Atkins backed fast-track approval of the bill, echoing the same framing.

The Senate side lined up behind them. Senator Bill Hagerty said the Senate could advance the crypto bill in April, and Senator Cynthia Lummis urged action on the CLARITY Act before the 2026 midterms, warning that the political window after November will be narrower than people assume. Between the Treasury, the SEC, and two Senate crypto champions all pushing in the same direction in the same week, CLARITY is as close to a coordinated policy sprint as crypto has seen in Washington this year.

Tornado Cash, CFTC vs Arizona, and India’s tax push

Two enforcement stories sat next to the legislative push. The DOJ rejected the Supreme Court argument put forward by Tornado Cash co-founder Roman Storm’s legal team, signaling the criminal case will keep moving through the lower courts. And the CFTC sued the state of Arizona, seeking an injunction to block Arizona’s state gambling laws from applying to federally regulated prediction markets. This is a direct federal preemption fight and the biggest prediction market case in the US since the Kalshi ruling.

India made its own move. The Income Tax Department began issuing Section 148A notices to crypto investors for AY 2022-23, reopening old assessment years for anyone with material crypto activity during that period. This is not a new policy; it is the enforcement of existing law, but the timing matters because it overlaps with a consultation paper on crypto regulation that the government has still not published. 

Separately, a Crypto Times deep dive looked at how Russia is rewiring cross-border payments through Africa using crypto rails, a reminder that the stablecoin story is also increasingly a geopolitics story.

Justin Sun vs WLFI: The political story of the week

The most explosive story of the week was Justin Sun publicly breaking with World Liberty Financial. In a long post on X on April 12, the Tron founder accused the Trump-backed DeFi project of embedding a hidden blacklist function in the WLFI smart contract and using it to freeze investor tokens without disclosure or due process. Sun called the design a “trap door marketed as an open door” and declared himself the “first and single largest victim.”

Roughly 545 million WLFI tokens tied to Sun have been locked since September 2025, when WLFI blacklisted his wallet after he moved around $9 million worth of tokens through HTX and Binance. Sun said at the time the transfers were exchange deposit tests, not sales. 

With WLFI trading near $0.09, down more than 74% from its debut, Sun’s frozen position is now worth under $50 million, a paper loss of roughly $70 million on that tranche alone. His total exposure to the Trump-linked crypto ecosystem still stands at around $175 million, including $100 million in the TRUMP memecoin.

WLFI responded hours later, accusing Sun of “playing the victim” and closing its post with “See you in court pal.” Sun demanded that whoever runs the official WLFI account identify themselves. This is the first time a major early WLFI backer has gone fully public against the project, and it will reshape the political conversation around Trump-era crypto deals for the rest of this cycle.

Derivatives, ETFs, and the CZ memoir sideshow

CME Group added AVAX and SUI futures to its crypto derivatives suite, giving institutional desks regulated exposure to two of the more actively traded alt-L1s. Canary Capital filed an S-1 with the SEC for a spot PEPE ETF, while PEPE itself dropped 5% on the news. On Hyperliquid, oil perpetuals briefly dethroned bitcoin as the most traded market, a small but telling sign that 24/7 commodity perps are finding a real audience inside crypto-native venues.

CZ’s memoir dropped and instantly generated two storylines. First, the revelation that Binance’s early $3 million investment in Terra had swelled to $1.6 billion at the peak before the Luna collapse erased it. Second, a fresh round of public sparring with OKX founder Star Xu, who disputed CZ’s version of events around several Binance-OKX flashpoints. Entertaining, but also a reminder that the post-FTX cleanup of exchange-era rivalries is not actually over.

On the data side, XRP’s 365-day MVRV ratio fell to its lowest level since the FTX collapse, meaning the average XRP holder from the past year is sitting in a loss. And VanEck’s head of digital asset research urged MARA shareholders to reject the reelection of one of its long-standing directors, calling the board “too small and insular” for a company of MARA’s size.

More exploits: Denaria, Aethir, RaveDAO, VDOR

The security beat did not get any quieter. Denaria suffered a $165K exploit on Linea and paused user access. Aethir’s adapter was drained for $400K, with the stolen funds bridged to TRON. The RaveDAO token spiked 250% after a suspicious on-chain deposit, triggering pump-and-dump concerns and a sharp reversal. And VDOR, a Solana memecoin that had been loosely riding Middle East ceasefire headlines, crashed 93% in what looks like a classic rugpull.

On the defensive side, StarkWare announced it is working on making Bitcoin quantum-resistant using STARK-based proof systems. Quantum risk has been the low-grade panic topic of the year. It is useful to see at least one team shift from warning posts to actual engineering.

Top Headlines of the week

Below are the major headlines, giving an overview of what happened in the crypto market this week.

• Strategy’s 4,871 BTC Buy: Michael Saylor’s Strategy restarted its bitcoin accumulation program with a fresh 4,871 BTC purchase, pushing the company closer to its publicly stated goal of holding one million BTC on its balance sheet.
• Bitmine Hits 4.8M ETH: Bitmine continued stacking ether, crossing 4.8 million ETH in its corporate treasury and cementing its status as the largest publicly disclosed ETH holder among treasury companies.
• Russia’s Crypto Backdoor Through Africa: A Crypto Times investigation detailed how Russia is using crypto rails and stablecoin routes through African jurisdictions to move value around Western sanctions, adding a new geopolitical layer to the stablecoin conversation.
• MARA Governance Pushback: VanEck’s head of digital asset research publicly urged MARA shareholders to reject the reelection of a long-serving director, calling the board “too small and insular” for a company of MARA’s scale.
• India Reopens Old Crypto Tax Years: The Income Tax Department started issuing Section 148A notices to crypto investors for assessment year 2022-23, signaling fresh scrutiny of old crypto transactions even before a formal regulatory framework is in place.
• XRP Holders Deep in Red: XRP’s 365-day MVRV ratio dropped to its lowest reading since the FTX collapse, meaning the average XRP buyer over the past year is now sitting on an unrealised loss.
• CME Adds AVAX and SUI Futures: CME Group expanded its crypto derivatives suite with AVAX and SUI futures, opening regulated institutional exposure to two of the more actively traded alt-L1s beyond BTC, ETH, SOL, and XRP.
• Oil Perps Dethrone BTC on Hyperliquid: Oil perpetuals briefly overtook bitcoin as the most traded market on Hyperliquid, as 24/7 commodity perps picked up serious volume inside crypto-native venues.
• VDOR Memecoin Rugpull: A Solana memecoin called VDOR, which had been loosely riding Middle East ceasefire headlines, crashed 93% in what looks like a textbook rugpull.
• Canary Files PEPE ETF: Canary Capital filed an S-1 with the SEC for a spot PEPE ETF, pushing the meme coin ETF race forward even as PEPE itself dropped 5% on the filing.
• Denaria Exploit: Denaria suffered a $165K exploit on Linea and paused user access shortly after the drain, pulling its frontend offline while the team investigated.
• Aethir Adapter Hack: An Aethir adapter was drained for roughly $400K, with the stolen funds quickly bridged over to TRON, following a familiar laundering pattern seen in smaller DeFi exploits.
• RaveDAO Suspicious Spike: The RaveDAO token spiked 250% after a suspicious on-chain deposit, triggering pump-and-dump concerns before a sharp reversal wiped out most of the move.
• StarkWare’s Quantum Fix: StarkWare announced it is working on making Bitcoin quantum-resistant using STARK-based proof systems, shifting the quantum debate from warning posts to actual engineering.
• CZ Memoir vs Star Xu: CZ’s memoir dropped with the revelation that Binance’s early $3 million investment in Terra had grown to $1.6 billion before Luna collapsed, and it also sparked a fresh public feud with OKX founder Star Xu over their old competitive flashpoints.
• DPRK Server Data Leak: ZachXBT published a detailed breakdown of leaked server data from the North Korean crypto network, giving the clearest public look yet at how DPRK-linked teams organise, launder, and move stolen funds across protocols.

Buzz of the week

The buzz this week belonged to the widening gap between crypto’s institutional glow-up and the governance mess underneath it. On one side, Morgan Stanley is on NYSE Arca with its own bitcoin ETF, Circle is minting USDC on Solana at record speed, CME is listing AVAX and SUI futures, the CLARITY Act has both the Treasury and the SEC publicly pushing for it, and Strategy is buying bitcoin again. Crypto has never had more institutional cover than it does right now.

On the other side, the biggest DeFi exploit of 2026 is officially a North Korean intelligence operation, Circle is defending how it responded to that exploit, a Trump-backed DeFi project is being accused by its largest early investor of hiding a blacklist backdoor, Bhutan is trimming sovereign bitcoin, and three more protocols got exploited in a single week.

The pattern is the same one we flagged last week, just louder. Institutionalization is not slowing down, and neither is the security and governance crisis underneath it. The CLARITY Act, if it passes, will not fix the human layer. Social engineering, opaque smart contract privileges, and centralized intervention decisions by stablecoin issuers are going to keep defining the risk surface of this cycle.

That is the wrap for this week. See you next Sunday.

Disclaimer: The information researched and reported by The Crypto Times is for informational purposes only and is not a substitute for professional financial advice. Investing in crypto assets involves significant risk due to market volatility. Always Do Your Own Research (DYOR) and consult with a qualified Financial Advisor before making any investment decisions.