Crypto Briefing — April 28, 2026

🔥 Top Story

The Kelp DAO exploit is still reverberating. An attacker drained 116,500 rsETH (~$292 million) on April 18 through a LayerZero cross-chain bridge bug, stranding wrapped ether reserves across 20+ L2s and knocking rsETH's peg. Aave immediately froze rsETH markets and is now spearheading "DeFi United," a coalition that has pledged over $300 million in donations, deposits, and credit lines to backstop the damage. Aave's own exposure sits at $123–230 million in bad debt, depending on how losses are shared. The industry response is coordinated and fast, but the root cause—how the bridge's validation logic was bypassed—remains undisclosed. This is the largest DeFi hack of 2026 and the clearest signal yet that cross-chain infrastructure is the new frontier for systemic risk.

📊 Market Snapshot

• BTC: $77,068 (-1.65% / 24h) | ETH: $2,294 (-2.81% / 24h)
• Fear & Greed: 47 (Neutral) — sentiment has cooled alongside prices but isn't panicked
• Bitcoin ETFs: U.S. spot ETFs logged eight straight days of inflows through April 23, pulling in ~$2.4 billion in April. Cumulative net inflows now total $58.23 billion.
• DeFi TVL hit: Aave TVL dropped from $26.4B to ~$17.9B post-exploit. Ethereum DeFi TVL fell roughly 7% in 24 hours. Total crypto market cap sits at $2.66T, down 1.6% on the day.

💰 Crypto Highlights

• BitMine keeps buying ETH regardless of price. BitMine Immersion Technologies (BMNR) acquired another 101,000 ETH this week, bringing total holdings to over 5 million ETH—roughly 4% of total supply. The firm is sitting on more than $6.5 billion in unrealized losses but continues to stake aggressively, generating ~$180 million annually in yield. Chairman Tom Lee is targeting 5% of all ETH, betting tokenized finance will eventually justify the accumulation. The stock rose 12% on the news; the market likes the conviction even if the P&L doesn't.

• April is now the worst month for crypto hacks since February 2025. Protocols have lost $606 million across 12 incidents in just 18 days—3.7x Q1's total. Kelp DAO ($292M) and Drift Protocol ($285M) account for 95% of April losses and 75% of the year's $771.8M total. DeFi incident frequency is up 68% year-over-year. The attacker profile is shifting: instead of exchange breaches, infrastructure-layer and bridge exploits are driving the damage.

• SEC and CFTC issued coordinated guidance in March clearing staking, wrapping, and certain airdrops from securities treatment. The guidance names 18 tokens as digital commodities (including BTC, ETH, SOL, XRP) and establishes five categories for classification. However, restaking and liquid restaking tokens were deliberately omitted—a notable gap given the Kelp fallout. This is interpretive guidance, not binding statute, but it gives builders the most concrete U.S. regulatory map in years.

• Canada is advancing a bill to ban crypto political donations, while the EU rolled out fresh sanctions targeting Russian crypto exchanges, stablecoins, and CBDC infrastructure. The regulatory perimeter is tightening on both sides of the Atlantic.

🎯 What to Watch

• Aave governance votes on the DeFi United relief fund structure and how the $123–230M bad debt will be socialized or covered. The outcome sets a precedent for protocol-level bailouts.
• LayerZero root cause disclosure from Kelp DAO's security investigation. Until the validation bypass is explained, every bridge using similar architecture carries latent risk.
• April 28–29 FOMC meeting. Crypto markets are pricing in macro sensitivity; any hawkish surprise could test ETF inflow resilience at current BTC/ETH levels.