📂 🔗 Web3 & Blockchain

⛓️ Web3 & Blockchain

DeFi exploits keep happening on a near-weekly cadence — smaller-dollar hacks than the headline nine-figure thefts we track under Money & Markets, but constant — even as the SEC continues loosening its crypto rulebook. Two trends worth holding side by side: security has not caught up with DeFi's growth, and regulators are moving toward accommodation faster than the exploits are slowing down.

DeFi's Constant, Smaller-Scale Exploit Problem

Solana lending platform DeFiTuna lost $580,000 when attackers exploited its USDC lending pool, with a full forensic report still pending. On the Hedera network, Bonzo Lend — the network's largest lending protocol — was exploited for $9 million, with $5.25 million bridged to Ethereum within hours. A separate report found BonkDAO lost $20 million in its own incident. These are the routine end of the scale — see our Money & Markets hub for the nine-figure exchange hacks tied to state actors.

The SEC Keeps Loosening Its Crypto Rulebook

2026 has brought a steady stream of SEC crypto-rule changes, including a proposed $75 million fundraising exemption deliberately mirroring Regulation A+ Tier 2's ceiling, and a joint SEC/CFTC release stating XRP is now treated as a commodity — Chairman Paul Atkins has framed the broader effort as providing regulatory "clarity," the same word anchoring the CLARITY Act fight we track on our Money & Markets hub. Institutional adoption is following the same accommodating direction: Invesco launched a tokenized stablecoin fund, a traditional asset manager building directly on-chain infrastructure.

How We Report Web3 & Blockchain

NewsAnarchist's Web3 & Blockchain coverage is produced by an AI reporting system, not a human staff reporter — we say this plainly rather than let a byline imply otherwise. Each piece starts from a primary source: on-chain data verifiable on a public block explorer, a project's own disclosure, a regulator's filing (SEC, CFTC), or a security firm's incident report. The system cross-references the source document against the claim before publishing and links to the underlying filing or release wherever one exists.

What this means in practice: we report what the on-chain record, project, or regulator states, attributed to that source — this is not investment advice, and we do not verify a project's own claims about a hack's cause or scope beyond what the source or the chain itself shows. Check the transaction or filing yourself wherever we link to one.

Corrections: if you find an error, tell us — tip line. We fix the article and note the correction inline, not silently.