Crypto Chaos: North Korea, Morgan Stanley, and Justin Sun’s $70M Battle

Weekly Wrap: Drift Hack Fallout, Morgan Stanley Unveils MSBT, Sun–WLFI Battle Heats Up

Key Highlights

Drift Protocol traced its $285 million exploit to a North Korean-linked hacking group, confirming early on-chain suspicions.
Morgan Stanley entered the Bitcoin ETF race with MSBT, signaling deeper Wall Street adoption of crypto markets.
The feud between Justin Sun and World Liberty Financial turned public and hostile, with both sides preparing for a legal battle.

The cryptocurrency market experienced significant volatility this week. Drift Protocol confirmed a $285 million hack was carried out by a group linked to North Korea. In positive news, Morgan Stanley began offering a spot Bitcoin ETF, and Circle created $3.25 billion worth of USDC on the Solana network in just one week. Additionally, the CLARITY Act received public support from the Secretary of the Treasury and the Chair of the Securities and Exchange Commission.

Justin Sun publicly challenged World Liberty Financial, a company supported by Donald Trump, regarding a $70 million cryptocurrency position that was frozen. Meanwhile, Bhutan continued to reduce its Bitcoin holdings, and three additional cryptocurrency platforms suffered losses due to security breaches.

Here’s your cryptocurrency market update for this week. Last week brought the surprise of the Drift exploit and Bitcoin finally ending a month in positive territory for the first time in over a year. This week, we’ve seen the consequences of that, a response from larger financial institutions, and new political issues within the crypto world.

This issue covers a lot of ground, including the investigation into the Drift hack and who was behind it, the discussion around Circle freezing USDC, and the launch of Morgan Stanley’s Bitcoin ETF. We also look at how Strategy and Bitmine are investing in crypto, Bhutan’s approach to Bitcoin, and new regulations being proposed by the Treasury and SEC. Plus, we’ll cover recent tax issues in India, new futures listings on the CME, insights from CZ’s new memoir, ongoing legal cases involving Tornado Cash and prediction markets, a dispute between Justin Sun and WLFI, and recent security breaches at Denaria, Aethir, and RaveDAO. Let’s dive in.

Drift Hack: DPRK attribution confirmed, Circle under fire

The major news story this week remains the exploit of Drift Protocol, but details are becoming clearer. Drift has now officially confirmed suspicions from blockchain analysts that the $285 million loss was caused by UNC4736, a hacking group linked to North Korea. This group is also known as AppleJeus and Citrine Sleet. Multiple cybersecurity firms – including SEAL 911, Elliptic, and TRM Labs – all reached the same conclusion independently.

As a crypto investor, I’ve been following the Radiant Capital attack, and it’s looking increasingly concerning. The money used in the initial stages and to test the attack seems to be directly linked to the attackers themselves. What’s even more worrying is that the way they’re trying to hide the stolen funds – ‘laundering’ them on the blockchain – is the same pattern we’ve seen with previous hacks linked to North Korea, including the one on Bybit earlier this year. It’s a clear signal this isn’t just some random attack.

Drift has shut down all core functions to address a security issue, and has secured its funds by removing affected wallets. They’ve partnered with Asymmetric Research and OtterSec to lead the effort to recover from the incident. While the wallets used in the attack have been identified to major exchanges and bridges, no funds have been recovered so far. The value of the DRIFT token remains significantly down, currently trading around 98% below its peak.

The latter part of this situation involves Circle, a company behind the USDC stablecoin. ZachXBT, a researcher, revealed that hackers linked to North Korea moved over $230 million in stolen cryptocurrency using Circle’s CCTP bridge between Solana and Ethereum during regular business hours, and criticized Circle for not acting faster. Circle responded by explaining that freezing funds too early could alert the attackers and hinder efforts to recover the stolen money. Interestingly, during that same week, Circle created a record $3.25 billion USDC on Solana, making it both their most successful and most problematic week in terms of public image.

Morgan Stanley’s MSBT and the Treasury Company race

Activity continued among institutional investors. On April 8th, Morgan Stanley launched its spot Bitcoin ETF, trading under the symbol MSBT, and it attracted around $32 million in its first day. While this is a relatively small amount compared to the IBIT ETF, the fact that Morgan Stanley offered its own branded ETF is significant. They are the first of the major, established financial firms to do so, rather than simply offering ETFs from other companies.

MicroStrategy resumed its Bitcoin purchases, buying 4,871 BTC and reaffirming its goal of holding one million Bitcoin. Bitmine significantly increased its Ethereum holdings, now possessing over 4.8 million ETH, making it the largest corporate holder of Ethereum. However, Ether Machine cancelled its planned $1.6 billion merger with Dynamix, illustrating that not all companies building digital asset treasuries will ultimately go public.

Bhutan took a different approach with its bitcoin holdings. It first moved $22 million worth of bitcoin, then sold $180 million, indicating a change in how the country manages its digital assets. This isn’t an emergency sale, but a planned reduction, and it’s part of a larger trend of bitcoin sales by miners that has prevented significant price increases.

CLARITY Act gains public backing from Treasury and SEC

Washington saw a flurry of activity regarding cryptocurrency regulations this week. Treasury Secretary Scott Bessent urged lawmakers to quickly approve the CLARITY Act, stating that inaction could cause the U.S. to lose its position as a leader in the crypto market. SEC Chair Paul Atkins followed up by also supporting the bill’s swift approval, reinforcing this concern.

Senators are increasingly supporting new crypto legislation. Senator Bill Hagerty suggested the bill could move forward as early as April, while Senator Cynthia Lummis stressed the need to pass the CLARITY Act before the 2026 elections, believing opportunities will diminish afterward. With support from the Treasury Department, the Securities and Exchange Commission, and key senators, this week marks the strongest coordinated effort to establish crypto policy in Washington this year.

Tornado Cash, CFTC vs Arizona, and India’s tax push

Alongside efforts to change laws, regulators have taken two significant actions. The Department of Justice dismissed arguments made by the legal team of Roman Storm, co-founder of Tornado Cash, meaning his criminal case will continue. Separately, the Commodity Futures Trading Commission is suing Arizona, asking a court to prevent state gambling laws from interfering with federal prediction markets. This lawsuit marks a major battle over federal authority in this area and is the largest case involving prediction markets in the US since the Kalshi decision.

India’s tax authorities are now looking into cryptocurrency investments made in the 2022-23 tax year. They’re sending notices to investors, effectively re-examining past tax returns for anyone who actively traded or invested in crypto during that time. While this isn’t a new rule – it’s based on existing tax laws – it’s happening at the same time the government is considering new crypto regulations, which haven’t been released yet.

A recent report from Crypto Times revealed Russia is using cryptocurrency to change how it makes international payments, specifically by routing them through Africa. This highlights how stablecoins are becoming increasingly tied to global political issues.

Justin Sun vs WLFI: The political story of the week

The biggest news this week was Justin Sun’s public split with World Liberty Financial. In a detailed post on X (formerly Twitter) on April 12th, the founder of Tron claimed that the DeFi project, which has ties to Donald Trump, secretly included a feature in its code that allowed them to freeze investors’ tokens without warning or a fair process. Sun described this as a deceptive practice – appearing open when it was actually a hidden control – and stated he was the project’s biggest investor and first to be affected.

Around 545 million WLFI tokens belonging to Sun have been locked since September 2025. This happened after his wallet was blacklisted because he transferred approximately $9 million worth of tokens through the HTX and Binance exchanges. Sun explained these transfers were simply tests of exchange deposits, not actual sales.

WLFI, currently trading around $0.09—down over 74% from its initial price—has reduced Sun’s investment value to under $50 million, resulting in an estimated $70 million loss on that specific investment. His overall investment in cryptocurrencies connected to Trump remains around $175 million, with $100 million tied up in the TRUMP memecoin.

WLFI quickly fired back at Sun, accusing him of pretending to be a victim and ending their statement with a challenge to meet in court. Sun then asked for the person behind the official WLFI account to reveal their identity. This marks the first time a significant early supporter of WLFI has publicly opposed the project, and it’s expected to significantly change how people discuss cryptocurrency deals made during the Trump administration for the foreseeable future.

Derivatives, ETFs, and the CZ memoir sideshow

CME Group now offers futures contracts for Avalanche (AVAX) and Sui (SUI), allowing institutional investors a regulated way to trade these popular alternative layer-1 blockchains. Meanwhile, Canary Capital has applied to the SEC to launch a spot exchange-traded fund (ETF) for PEPE, causing the PEPE cryptocurrency to dip 5% in value. Separately, on the Hyperliquid exchange, trading volume for oil futures briefly surpassed that of Bitcoin, suggesting growing interest in 24/7 commodity trading within the crypto space.

Changpeng Zhao’s recently released memoir immediately sparked two main discussions. The first was the revelation that Binance’s initial $3 million investment in Terra grew to $1.6 billion at its highest point before the Luna crash wiped it out. The second was a new public disagreement with Star Xu, the founder of OKX, who challenged CZ’s account of past conflicts between Binance and OKX. While interesting, this highlights that the process of resolving old rivalries among cryptocurrency exchanges, following the collapse of FTX, isn’t finished yet.

Looking at the data, XRP’s long-term profitability has dropped to its lowest point since the FTX crash, meaning most XRP holders from the past year are currently experiencing losses. Meanwhile, a researcher at VanEck has advised MARA shareholders to vote against the re-election of a current board member, arguing that the board is too limited in scope for a company of MARA’s size.

More exploits: Denaria, Aethir, RaveDAO, VDOR

Things remained turbulent in the crypto security world this week. A vulnerability on Linea led to a $165,000 loss for Denaria, forcing them to temporarily restrict user access. Aethir lost $400,000 through a compromised adapter, with the stolen funds moved to the TRON network. The RaveDAO token saw a huge, but ultimately unsustainable, 250% price increase after a large deposit, raising suspicions of a pump-and-dump scheme. Finally, VDOR, a memecoin on Solana that briefly gained attention from Middle East ceasefire news, plummeted 93% in an apparent rugpull.

StarkWare is proactively addressing the potential threat of quantum computing to Bitcoin. They’re developing solutions using STARK-based proofs to make Bitcoin quantum-resistant. While many have discussed the risks of quantum computing this year, it’s encouraging to see StarkWare move from simply raising concerns to actively building a solution.

Top Headlines of the week

Below are the major headlines, giving an overview of what happened in the crypto market this week.

Strategy’s 4,871 BTC Buy: Michael Saylor’s Strategy restarted its bitcoin accumulation program with a fresh 4,871 BTC purchase, pushing the company closer to its publicly stated goal of holding one million BTC on its balance sheet.
Bitmine Hits 4.8M ETH: Bitmine continued stacking ether, crossing 4.8 million ETH in its corporate treasury and cementing its status as the largest publicly disclosed ETH holder among treasury companies.
Russia’s Crypto Backdoor Through Africa: A Crypto Times investigation detailed how Russia is using crypto rails and stablecoin routes through African jurisdictions to move value around Western sanctions, adding a new geopolitical layer to the stablecoin conversation.
MARA Governance Pushback: VanEck’s head of digital asset research publicly urged MARA shareholders to reject the reelection of a long-serving director, calling the board “too small and insular” for a company of MARA’s scale.
India Reopens Old Crypto Tax Years: The Income Tax Department started issuing Section 148A notices to crypto investors for assessment year 2022-23, signaling fresh scrutiny of old crypto transactions even before a formal regulatory framework is in place.
XRP Holders Deep in Red: XRP’s 365-day MVRV ratio dropped to its lowest reading since the FTX collapse, meaning the average XRP buyer over the past year is now sitting on an unrealised loss.
CME Adds AVAX and SUI Futures: CME Group expanded its crypto derivatives suite with AVAX and SUI futures, opening regulated institutional exposure to two of the more actively traded alt-L1s beyond BTC, ETH, SOL, and XRP.
Oil Perps Dethrone BTC on Hyperliquid: Oil perpetuals briefly overtook bitcoin as the most traded market on Hyperliquid, as 24/7 commodity perps picked up serious volume inside crypto-native venues.
VDOR Memecoin Rugpull: A Solana memecoin called VDOR, which had been loosely riding Middle East ceasefire headlines, crashed 93% in what looks like a textbook rugpull.
Canary Files PEPE ETF: Canary Capital filed an S-1 with the SEC for a spot PEPE ETF, pushing the meme coin ETF race forward even as PEPE itself dropped 5% on the filing.
Denaria Exploit: Denaria suffered a $165K exploit on Linea and paused user access shortly after the drain, pulling its frontend offline while the team investigated.
Aethir Adapter Hack: An Aethir adapter was drained for roughly $400K, with the stolen funds quickly bridged over to TRON, following a familiar laundering pattern seen in smaller DeFi exploits.
RaveDAO Suspicious Spike: The RaveDAO token spiked 250% after a suspicious on-chain deposit, triggering pump-and-dump concerns before a sharp reversal wiped out most of the move.
StarkWare’s Quantum Fix: StarkWare announced it is working on making Bitcoin quantum-resistant using STARK-based proof systems, shifting the quantum debate from warning posts to actual engineering.
CZ Memoir vs Star Xu: CZ’s memoir dropped with the revelation that Binance’s early $3 million investment in Terra had grown to $1.6 billion before Luna collapsed, and it also sparked a fresh public feud with OKX founder Star Xu over their old competitive flashpoints.
DPRK Server Data Leak: ZachXBT published a detailed breakdown of leaked server data from the North Korean crypto network, giving the clearest public look yet at how DPRK-linked teams organise, launder, and move stolen funds across protocols.

Buzz of the week

This week, the contrast between growing institutional interest in crypto and ongoing issues with its governance really stood out. We’re seeing major moves like Morgan Stanley launching a bitcoin ETF on the NYSE, Circle rapidly creating USDC on Solana, and the CME adding futures for AVAX and SUI. Plus, both the Treasury and SEC are publicly supporting the CLARITY Act, and Strategy is reinvesting in bitcoin. Currently, crypto has more support from established financial institutions than ever before.

Recent developments in the crypto world include confirmation that the largest DeFi hack of 2026 was carried out by North Korean intelligence. Circle is explaining its actions following the hack, and a DeFi project supported by Donald Trump is facing accusations from its initial major investor of secretly including a way to block certain users. Meanwhile, Bhutan is reducing its holdings of bitcoin, and three additional crypto protocols were hacked within just one week.

We’re seeing the same issues we warned about last week, but they’re becoming more pronounced. The trend towards centralization isn’t letting up, and the underlying security and governance problems are getting worse. Even if the CLARITY Act becomes law, it won’t address the biggest vulnerabilities – things like social engineering attacks, hidden permissions within smart contracts, and the power stablecoin companies have to intervene. These issues will continue to be the main sources of risk in this market cycle.

That is the wrap for this week. See you next Sunday.

2026-04-12 21:25