Key Insights: False Dawn

Open interest was flat on the week but the close disguises a violent intra-week swing. BTC OI edged +0.44%, while ETH fell -5.6%. The weekly numbers miss the April 18th event when Iran announced the Strait of Hormuz would reopen under a new ceasefire framework, upon which BTC OI spiked to $61.7B, a $5B increase in a single session, as leveraged longs piled in and shorts were forcibly covered, triggering $820M in liquidations, primarily on the short side. BTC touched $78,348 before Iran’s parliament rejected Trump’s nuclear deal claims within hours, collapsing the bid and unwinding the entire OI build by Saturday. Funding rates remained negative throughout. BTC has now posted negative funding for 46 consecutive days, the longest sustained negative streak since the FTX collapse in November 2022. The persistence of crowded short positioning against a price that has ground from the mid-$60ks to $77k+ creates significant short-squeeze potential, and Friday’s event previewed what that unwind looks like when a catalyst lands, even a false one.

Institutional flows accelerated for a second consecutive week, with Bitcoin ETFs recording +$996.5M in weekly inflows, with Ethereum adding +$276M, Solana +$35M, and Ripple +$55M, for a combined +$1.36B. This is ****nearly double last week’s +$700M and the strongest weekly total since January. BlackRock’s IBIT captured $871M of the BTC total, while Morgan Stanley’s MSBT, the first spot BTC ETF from a major US bank, launched April 8th at a category-low 0.14% fee, crossed $100M in its opening week. BTC ETF AUM now sits at $91B and ETH at $14B. The flow acceleration coincides with exchange reserves falling to 2.21M BTC, a seven-year low representing just 5.9% of circulating supply, and Strategy adding 13,927 BTC on the week, valued at north of $1B, as a result of its healthy STRC product. YTD crypto ETF flows have now turned positive at $2.3B after Q1’s persistent outflows.

Sector performance was uniformly positive, a shift from recent weeks of clear winners and losers. RWA and Memecoins co-led at +7.4%, with RWA continuing to benefit from structural institutional flows, with tokenised RWA AUM hitting $27.6B, BlackRock’s BUIDL crossing $1B in market cap, and Franklin Templeton partnering with Ondo to issue tokenised versions of five ETFs for 24/7 blockchain-native trading. Memecoins caught a specific catalyst in Canary Capital’s PEPE ETF filing, with PEPE surging +10% on April 17th alone. Staking gained +6.7%, led by Lido after approval of a second $20M LDO buyback programme. On the downside of a green board, DeFi’s +2.8% underperformed the field, weighed by the Kelp DAO exploit on April 19th, a $292M bridge hack via LayerZero that marked the largest DeFi exploit of 2026 and forced Aave, SparkLend, and Fluid to freeze rsETH markets.

Our Take: The April 18th Hormuz reversal is the most informative event of the week purely for what it previewed in the market. A single geopolitical headline generated $5B in OI, $820M in liquidations, and a $78K print within hours. The structural setup behind that move has not changed, and our desk notes that the last two instances of this funding regime, March 2020 and November 2022, resolved with violent upside moves within weeks. The April 22nd ceasefire expiry remains the proximate trigger, whereby if it extends, short-squeeze pressure should continue to build with institutional capital reinforcing the floor. If it lapses, the test is whether the $1.36B in fresh ETF positioning holds or joins the leverage unwind.

Stablecoin lending rates stabilised this week after several weeks of oscillation. USDC supply APY was essentially flat at -0.36% WoW across major venues, with utilisation holding steady near 0.80. USDT rose 5.05% WoW, with utilisation also expanding, reinforcing the pattern of borrowing demand concentrating in Tether-denominated markets rather than broadening across assets. The stabilisation in rates, rather than continued compression, is notable and aligns with our view from recent weeks that onchain lending markets are finding a floor defined by selective demand rather than broad-based borrowing.

Chain-level flows broke from the pattern that has defined recent weeks, with Arbitrum posting a dominant +$444.9M in net inflows, displacing Hyperliquid, which had led inflows for four consecutive weeks, as the primary destination for capital. The catalyst was Arbitrum’s high-visibility presence at ETHCC[9] in Cannes, where targeted activations around scaling and RWA infrastructure converged with the formal approval of ArbitrumDAO Procedures on April 2nd and continued momentum from its STEP tokenization program with Franklin Templeton, Spiko, and WisdomTree.

RWA AUM rose +3.97% WoW in aggregate, with Centrifuge leading at +9.62%, continuing to benefit from adoption of deSPXA on Base. deSPXA is the tokenised S&P 500 Index Fund licensed by S&P Dow Jones Indices and sub-advised by Janus Henderson, which is increasingly being integrated as collateral across Base DeFi protocols. Maple posted +7.47%, driven by steady institutional demand for its overcollateralised syrupUSDC and syrupUSDT lending vaults.

Our Take: Arbitrum’s ability to absorb nearly $450m in a single week suggests the market for onchain capital is widening beyond the derivatives-versus-payments binary we identified in recent weeks. A third lane of institutional infrastructure is emerging as the market shows flickers of recovery. Our desk is watching for whether Arbitrum can sustain these flows once the event-driven narrative fades, or whether capital rotates back to the structural winners.

This week’s chart tracks monthly DeFi exploit losses over the past six months, whereby the trajectory through Q1 told a reassuring story. After a $194M November, losses declined steadily through December ($76M), stabilised in January ($100M), and fell to a cycle low of $24M in February, with March only marginally higher at $41M. The combined Q1 total of $165M was comfortably below Q4 2025’s run rate. Then April happened, and with ten days still remaining in the month, losses have already reached $606M, more than the entire previous five months combined, and the worst single month for DeFi exploits since October 2022.

This month’s damage is concentrated in two mega-exploits, both attributed to North Korean state-linked actors. On April 1st, Drift Protocol on Solana was drained of $296M after DPRK-linked operatives spent six months infiltrating the team, social-engineering two of five Security Council multisig signers into pre-signing hidden authorisations via Solana’s durable nonces feature, then seizing admin control and executing 31 rapid withdrawals in 12 minutes. Then, more recently, on April 18th, KelpDAO’s rsETH bridge was exploited for $293M, roughly 18% of the rsETH circulating supply, through a configuration flaw in its LayerZero integration. This flaw was a 1-of-1 DVN setup that allowed attackers to forge a single verifier attestation and authorise fund release. Neither exploit was a smart contract bug, instead both were failures of operational security and infrastructure configuration.

The KelpDAO contagion was immediate and severe, with the attacker depositing stolen rsETH as collateral across Aave V3 and V4, borrowing over $236M in WETH and wstETH. Aave’s TVL fell $6.3B in 24 hours, from $26.4B to roughly $20B, and WETH pools hit 100% utilisation, with bad debt estimated at $177-200M. rsETH depegged approximately 42%, while wrapped rsETH stranded across 20+ Layer 2 chains as backing reserves was drained. AAVE fell 16%, while SparkLend, Fluid, and Upshift all froze rsETH markets within hours.

Our Take: We think the composition of, and type of, the exploits in April matters more than the size. Both exploits were operational, meaning smart contract audits, which the industry has spent years and billions improving, would have caught neither. The structural risk exposed here is the supply chain of trust that feeds into the protocol governance. Aave’s contracts worked exactly as designed, it was the collateral that failed. As LRT and restaked assets proliferate as DeFi lending primitives, the attack surface is no longer the protocol itself but the security assumptions of every external asset it accepts.

Join our Telegram Channel to get it delivered directly to your phone.