The Week Institutional Crypto Grew Up — and Got Mugged

The bot this week

It's real now — well, real on paper. The book went live 116 days ago (on paper, $10,000 start) and has been rebalancing daily straight into one of the ugliest weeks crypto has had in months.

Equity	$10,689.76
Return since launch	+6.90%
vs. holding BTC	+17.57%
Max drawdown	−4.56%
Funding (annualized)	+4.44%
Net positioning	net long ($2,581.62)

The book is +6.90% since it went live, currently positioned net long.

Same window, holding BTC would have returned +17.57%. The book is beating buy-and-hold by roughly −10.67% — almost entirely by being net long into a falling tape, not by calling the top.

How it's positioned

The book runs short perps against long spot on each asset — a defensive, low-net-exposure stance the trend filter flipped into as momentum rolled over. Drawdown so far is a trivial −4.56%, and the funding leg is even paying a small carry (+4.44% annualized).

The honest caveat

This is 116 days of paper, not a track record. A green first week proves nothing — the backtest already told us the edge is risk reduction, not outperformance: out-of-sample, fixed parameters, it returned about the same as buy-and-hold (Sharpe 0.93 vs 0.62) with roughly a third of the drawdown. A calm week and a violent one are both just single data points. Real capital goes in around July; until then, every number here is paper and public.

Bitget's $352M Hole and What It Tells You About Hot Wallet Risk

The numbers first, because they keep shifting. Bitget confirmed a breach affecting hot wallets across multiple blockchains. The Block reported $387.5M; Cointelegraph and Decrypt landed between $350M and $352M. The exchange says private keys were not compromised — which raises the obvious question of how an unauthorized wallet drained hot and cold reserves in under an hour without touching keys. No satisfying answer has been offered. Withdrawals were suspended. Bitget says losses will be covered by its User Protection Fund.

The attribution angle is pointed. CEO Gracy Chen said a preliminary investigation traced IP addresses to VPN patterns associated with North Korean hacking groups — the same fingerprint seen in the Bybit breach earlier this year. That connection is unconfirmed, but it fits a pattern: DPRK-linked actors have extracted billions from centralized exchanges by targeting operational infrastructure rather than on-chain protocol flaws. If you can drain a wallet without compromising the private key, you're operating above the key layer — session hijacking, insider access, or compromised signing infrastructure are the working hypotheses.

What this means for the sector: centralized exchanges with large hot wallet balances remain the softest targets in crypto. The Bitget breach follows Bybit's $1.5B loss earlier this year, and the playbook looks nearly identical — speed (sub-hour), multi-chain, cold wallet labeled funds swept. The User Protection Fund claim deserves scrutiny: no figure for the fund's current size was provided, and users are being asked to trust a number they cannot verify against a loss that is still being tallied.

The broader irony is timing. This week also saw the Fed propose formal capital and reserve requirements for stablecoin issuers under the GENIUS Act, and the CFTC issue updated guidance for authorized crypto entities. Regulators are trying to build a framework for institutional crypto. Meanwhile, the industry keeps demonstrating that its operational security hasn't caught up with its asset base.

The Fed Writes the Stablecoin Rulebook

The Federal Reserve opened two proposals for public comment under the GENIUS Act framework. The requirements: issuers supervised by the Fed must back tokens fully with safe assets, meet standardized capital thresholds, and honor redemptions within a two-day window. A new application process will govern banks seeking to issue stablecoins directly. The proposals also mandate new reserve disclosures — the market has wanted this for years, mostly because it would expose anyone running a fractional reserve in costume.

Read this alongside the US government's separate framing — covered this week — that stablecoins are a tool for extending dollar dominance and propping up Treasury demand abroad. The Fed's rules and the geopolitical strategy are two faces of the same play: formalize the dollar's onchain wrapper before another currency gets there first. The two-day redemption window is tighter than most TradFi settlement rails. That's deliberate — it makes stablecoins structurally safer than money market funds while keeping them slower than pure crypto.

LayerZero Lawsuit: $292M and a Paper Trail

KelpDAO's developer Evercrest filed suit against LayerZero and CEO Bryan Pellegrino over the April 18 rsETH exploit that cost $292M. The core allegation is specific: LayerZero approved the single-verifier bridge configuration in writing, multiple times, before the exploit. Then warned a different developer about the same vulnerability. Pellegrino has dismissed the lawsuit as meritless.

If the paper trail holds up, this is a different kind of bridge liability case. Most exploit litigation turns on whether the attacker is findable. This one is about whether the infrastructure provider knew the configuration was dangerous and signed off anyway. The single-verifier setup is a known risk — it collapses a multi-party security model to a single point of failure. Whether LayerZero's written approvals constitute legal endorsement is for the courts. But the optics are brutal: you told us it was fine, it wasn't, and you knew.

Tokenization's Big Week: ARK, Ondo, BlackRock, Aave

ARK Invest is bringing its $1.3B ARK Venture Fund onchain via Securitize on Ethereum. The fund holds positions in OpenAI, Anthropic, and Stripe — assets that have never been liquid and are now wrapped for onchain transfer. This is the most significant tokenization of private venture exposure to date by a named manager.

Separately, Ondo launched three onchain portfolio tokens built around model portfolio strategies developed by BlackRock. Aave V4 on Base added Apple, Nvidia, Tesla, and four other tokenized stocks as USDC loan collateral — non-US users only. And Ethena expanded USDe's backing to include Binance bStocks and equity perpetuals, adding equity basis trades to what was previously a crypto-native delta-neutral strategy. These moves are not incremental. The underlying asset class being tokenized has expanded from Treasuries to equities to private funds in roughly six months. The rails are being built faster than the regulations that will eventually govern them.

Bitcoin: Steady at $84K While Yields Hit 2007 Levels

Bitcoin held near $83,927 as 10-year Treasury yields hit a 19-year high — the kind of macro backdrop that historically sends risk assets lower. Instead, BTC absorbed it. IBIT options implied volatility sat near the bottom of its 12-month range, per Saxo Bank's analysis — the market is not pricing in a sharp move either direction. US spot Bitcoin ETFs pulled in $191M on Thursday, slowing for a third consecutive session but keeping the six-day streak's total at $2.8B. Year-to-date net flows: $787M.

JPMorgan flagged that Bitcoin crossing $85,000 — their estimated production cost — could reduce miner selling pressure. BTC is close but hasn't held above that level. SOL outperformed this week at +5.0%, likely benefiting from the Solana Foundation's institutional hiring push: former Binance global CMO Rachel Conlan joins as chief strategy officer, and former Polygon Labs exec Jamal Raees takes GM of payments. Both hires signal the Foundation is positioning Solana for institutional payments and stablecoin infrastructure — not just DeFi volume.

What to Watch

• BTC $85,000 production cost level: JPMorgan says a sustained hold above it eases miner sell pressure — watch for follow-through or rejection.
• Fed stablecoin comment period: Industry response to the two-day redemption and capital requirements will shape whether GENIUS Act implementation is collaborative or adversarial.
• Bitget withdrawal resumption: When withdrawals reopen and what the User Protection Fund balance actually is — those two data points will tell you whether this is contained or not.
• LayerZero lawsuit discovery: Whether Evercrest's written-approval evidence surfaces publicly; if it does, every bridge operator's approval paper trail becomes a liability exhibit.