The tell: On a day the price tape turned green, the damage moved to the code. Three unrelated failures - a cross-chain key-generation flaw, a DeFi flash-loan drain, and a DAO governance takeover - hit three different layers of the stack in a single session, a reminder that the risk on a rally day migrated from the chart to the infrastructure.
Layer one: the wallet
A critical randomness flaw dubbed "Ill Bloom" exposed more than 2,114 wallet seeds across Bitcoin, Ethereum, Solana and other chains, draining over $5 million since it went live on May 27 [1]. Because the defect sits in key generation rather than any single application, it is chain-agnostic - the security firm that surfaced it released a scanning tool so holders can check whether an address was derived from weak entropy [1].
Layer two: the protocol
DeFi yield protocol SummerFi was drained of roughly $6 million in a flash-loan attack, flagged by monitoring firm Blockaid as an exploit still in progress as the funds moved [2][3]. The traced transactions carried ERC-20, DAI and HEX balances out of the protocol [3].
Layer three: governance
BonkDAO lost about $20 million from its treasury when an attacker turned the DAO's own governance process against it, confirmed by the project's official account [4]. It is the most pointed of the three: the failure was not a leaked key or a mispriced pool but the voting machinery meant to protect the treasury.
The backdrop: the rule-writers leaned in
The enforcement side moved the same day. The U.S. SEC under Chairman Paul Atkins signaled a shift away from "regulation by enforcement" toward cases framed around investor protection and market integrity [5]. In Asia, South Korea's Supreme Court proposed procedures for seizing and liquidating digital assets during litigation [6], while the country's media watchdog opened a review of whether a major prediction-market platform runs afoul of local gambling law [7]. The throughline: as the attack surface widened across the stack, the official response widened with it.
The read: three distinct failure modes - key generation, protocol logic, and on-chain governance - surfaced on the same green candle. None shares a root cause, which is precisely the point: the day's real volatility was in the code, not the price.
