Weekly Hot Project Updates: rsETH Recovery Implementation Plan Released, PumpFun Burn and Buyback PUMP, Ondo Introduces Stock Token Proxy Voting Feature, etc. (0426–0502)

1. DeFi United Releases Technical Implementation Plan for KelpDAO rsETH Recovery link

The DeFi Alliance DeFi United has published a technical implementation plan for the recovery of rsETH supported by KelpDAO, in response to the cross-chain bridge security incident on April 18 that caused 116,500 rsETH to be unexpectedly released from the Ethereum side adapter. The plan mainly includes two parts: first, using the obtained ETH funds to gradually exchange for rsETH and transfer into the affected staking contracts to restore rsETH collateral support; second, through governance proposals temporarily adjusting the rsETH oracle price, executing controlled liquidations of attacker positions on Aave and Compound, and redeeming recovered rsETH for ETH to fill market gaps. During this process, WETH and rsETH markets across multiple chains will remain frozen until the security risk is eliminated and normal operations are restored.

LayerZero Labs commits to providing over 10,000 ETH to the industry recovery plan led by Aave, including a donation of 5,000 ETH and an additional 5,000 ETH to boost Aave market liquidity, further enhancing GHO liquidity; this initiative is part of industry recovery measures surrounding the rsETH incident. LayerZero also states it will continue collaborating with Aave and other DeFi projects on the integration of OFT in lending markets.

Compound has initiated a proposal to support the rsETH recovery plan coordinated by DeFi United with 1,900–3,000 ETH (approximately $4.37 million to $6.9 million), contingent on meeting certain conditions. The specific amount will be determined by the execution team based on the final recovery plan, participant circumstances, and market conditions. About 1,857 ETH may be recovered through attacker position liquidation; if not recovered, it does not constitute actual funding. Funds will only be executed when rsETH is fully collateralized, the recovery plan is clear, and full disclosure of information is provided.

2. Arbitrum DAO Proposal to Release 30,765 ETH for rsETH Recovery link

The Arbitrum DAO governance proposal shows that Aave Labs, KelpDAO, LayerZero, EtherFi, Compound, and others have submitted a constitutional-level proposal to approve the release of 30,765.67 ETH previously frozen by the Arbitrum Security Council for rsETH recovery efforts, to cover collateral shortfalls and restore collateral backing. The proposal states that the frozen funds, originating from attacker-related addresses on April 21, 2026, currently have a shortfall of about 76,127 rsETH. The funds will be transferred to a multi-signature Gnosis Safe address to cover losses and compensate affected users. The proposal is still in governance process, with an estimated duration of about 49 days, involving no new treasury expenditure. The current voting approval rate is 100%, with voting ending at 2:54 AM Beijing time on May 8.

3. Polymarket Plans to Bring Main Trading Platform to the US After CFTC Approval link

Prediction market platform Polymarket is in discussions with U.S. Commodity Futures Trading Commission (CFTC) officials, planning to lift trading restrictions for U.S. users and push its main platform back into the U.S. market. If approved, this could significantly accelerate the development of prediction markets in the U.S. Polymarket previously exited the U.S. market after reaching a settlement with the CFTC in 2022 and banned U.S. users from accessing its international platform. Currently, the company is exploring integrating its blockchain main platform with a licensed U.S. platform, or possibly operating solely through on-chain trading. Approval remains uncertain and depends on a formal vote by the CFTC.

Polymarket’s monthly expenses in April reached a record high of $43.36 million, doubling from the previous month, with an annualized cost of about $520 million. Of this, Polymarket Global accounted for $37.81 million, and Polymarket US for $5.55 million. Notably, the two markets together dominate over 97% of on-chain prediction market fees.

4. PumpFun Burns About $370 Million in PUMP Tokens, Plans to Use 50% of Revenue for Buybacks and Burns Over the Next Year link

PumpFun announced that it has burned all previously repurchased PUMP tokens, approximately $370 million, accounting for about 36% of circulating supply, in response to market questions about the purpose and sustainability of buybacks. It also declared that over the next year, 50% of its revenue will be used for algorithmic buybacks and burns to reduce circulating supply and increase mechanism certainty. This move is an adjustment following about nine months of high revenue operations, addressing market trust concerns.

5. BNB Chain Announces Tokenized Stock Platform xStocks Officially Launched link

BNB Chain announced that its tokenized stock platform xStocks is now officially live, initially offering over 50 tokenized U.S. stocks and ETFs, including Apple, Tesla, Nvidia, and S&P 500 ETF, with plans to add over 100 more assets in the coming weeks. Users can trade directly on PancakeSwap and CowSwap with a minimum threshold of $10. The platform also states that these tokenized stocks can be used as collateral for loans and integrated into structured yield strategies.

6. Ondo Introduces Proxy Voting for Tokenized Stocks link

Ondo Finance announced a partnership with Broadridge to introduce proxy voting and company disclosure document access for over 250 tokenized stocks and ETFs on its platform. Users can log in via crypto wallets to Broadridge’s ProxyVote system, view corporate filings, and submit voting preferences. Ondo states that its tokens and underlying stocks are structurally separate, meaning token holders do not directly hold shareholder rights, but the platform will consider user voting preferences to vote on the underlying stocks they represent, enhancing transparency and trust. Currently, Ondo’s Global Markets platform offers tokenized stocks and ETFs exceeding $700 million in assets, targeting non-U.S. investors.

7. ether.fi Will Discontinue Support for Multi-Chain weETH Cross-Chain Bridges by End of June link

ether.fi announced that to strengthen cross-chain infrastructure security, it will gradually shut down support for weETH cross-chain bridges on chains including Scroll, Swell, Bera, zkSync, Mode, Blast, Morph, and Sonic, focusing security resources on more active and deeply integrated chains. The official states that weETH cross-chain functionality on these chains will be terminated by the end of June; users holding weETH on these chains must bridge back to Ethereum or migrate to supported chains before the deadline.

8. World Liberty Financial Sells an Additional 5.9 Billion Tokens, 80% of Investors’ Holdings Remain Locked link

Donald Trump family-related crypto project World Liberty Financial, after raising over $550 million in two funding rounds, further sold about 5.9 billion WLFI tokens (allocated from founders, team, and partners) to qualified private investors, with a transaction scale reaching hundreds of millions of dollars. Most funds flow into entities related to the founders. Meanwhile, about 80% of early investors’ holdings remain locked, with proposals to extend the lock-up period to at least two years and implement phased unlocking.

9. Carrot Announces Closure, Remaining Funds Withdrawal Deadline Set for May 14 link

Solana-based DeFi protocol Carrot announced that due to the Drift vulnerability incident, its operations are severely impacted, and Carrot will shut down. The deadline for withdrawing remaining funds (Boost, Turbo, and CRT) is set for May 14. Afterward, the system will be de-leveraged, with all leverage reduced to zero, to free liquidity for CRT redemption. Carrot states that user deposits remain under user control, and any recovery work related to Drift will proceed as previously described, though no specific timeline is provided.

10. ZetaChain GatewayEVM Contract Attacked, Cross-Chain Transactions Suspended link

ZetaChain announced that its GatewayEVM contract was attacked, affecting only the internal team wallet. The attack vector has been blocked, and there is no further risk of funds, with user funds unaffected. As a precaution, cross-chain transactions are paused, and the incident is under investigation. A detailed post-incident report will be released later.

SlowMist released an initial analysis of the GatewayZEVM attack, stating that the core vulnerability lies in the call function of the GatewayZEVM contract, which lacks access control and input validation, allowing any user to craft malicious cross-chain calls executed by relayers on the target chain.