Declared dead, but not gone
Easter is about pausing, loss, and what unexpectedly returns. This edition: the $285M Drift hack, selling pressure from BTC treasury companies, and the growing quantum risk to bitcoin.
Contribution by Peter
Monday morning. For most people, today would normally mark the start of another busy work week. But Easter pulls everyone out of that routine. A hearty breakfast with the family, a cup of coffee at your parents' place, or drinks with friends. A moment to pause; with a bit of luck in the sunshine, which fills my view as I write this.
During Easter, there's a good chance that conversations, somewhere in the background, are colored by that bigger story. An old story that everyone knows, but which — apart from in breathless TV specials — is rarely told in full. About loss, about doubt, about something that, against all expectations, comes back anyway.
There's something in the Easter story that everyone recognizes. The feeling that something can be gone, yet it still won't fully let go of you. You encounter that idea in more places than you'd expect.
Not just in traditions, but also in how people look at the world. At money, for instance. Or at technology. Things that initially carry great expectations, only to crash and burn. 'Told you so,' people say. It was nothing. And then, a few years later, there it is again. Apparently it wasn't as easy to kill as everyone thought. As if it keeps existing somewhere beneath the surface in standby mode, waiting until attention returns.
Perhaps we need to see whether something can disappear before we believe it can endure.
Decentralized technologies, like bitcoin, seem to have to go through this cycle over and over again, perhaps each time for a new group of people. Either way, they prove resilient and deliver plenty of material every week for a well-filled newsletter.
This week's topics:
- $285 million hack of DeFi protocol Drift
- BTC Treasury Companies forced to sell
- Quantum threat to bitcoin draws closer
1️⃣ $285 million hack of DeFi protocol Drift
Contribution by Erik
On April 1, 2026, Drift Protocol, the largest decentralized derivatives exchange on Solana, was largely drained in a matter of hours. It wasn't a software bug or stolen private keys, but an ingenious piece of social engineering, presumably by a North Korean team. They exploited two vulnerabilities: Drift's human governance layer and a Solana feature called durable nonces.
Drift was the first to assure us this was no April Fools' joke: "We're observing unusual activity on the protocol." By that point, the hackers were already siphoning off millions at a rapid pace.
Weak point 1: Drift's Security Council
How did the hack happen? Like virtually every major DeFi protocol, Drift has a human "backdoor" — in this case with the somewhat ironic name Security Council. It's a small committee with emergency powers, designed to intervene quickly in case of bugs or exploits without waiting for a DAO vote. At Drift, this council has five members, of which only two need to sign: a 2-of-5 multisig. For comparison: Polygon requires six of eight signatures, Arbitrum nine of twelve.
Because the hackers managed to deceive two of the five members, they gained full admin access to the protocol. That deception was likely a six-month process. It started last fall, when Drift team members were approached at a conference by employees of a trading firm. These were not North Koreans, by the way. To build credibility, the firm actually deployed real capital.
Trader Edge
Weak point 2: signatures that never expire
Normally, a Solana transaction expires after ninety seconds. So-called durable nonces keep a transaction valid indefinitely. This feature allowed the attackers to store signatures for weeks and choose the perfect moment. That moment came in late March, after Drift migrated the Security Council to a configuration without a timelock. A timelock is normally a mandatory waiting period between approval and execution, designed to intercept suspicious transactions. By removing it, the attacker could execute their pre-signed transactions immediately.
The two Security Council members were asked to sign something that looked like a routine update. Drift co-founder Cindy Leow stated that the signers believed they were approving innocuous protocol updates, while the transactions actually contained hidden admin permissions, including changes to withdrawal limits.
Once those fatal signatures were in place, the last line of defense was gone. No more withdrawal limits, and the protocol now accepted a token fabricated by the hackers (CVT) as collateral without any double-check. Against the fabricated value of this collateral ($780 million), the attackers were able to extract $285 million in USDC and other crypto.
A familiar pattern
The hack fits the picture painted by a Chainalysis report. We wrote about this in our January 19 edition: the frontline of crypto crime is shifting. Where the news five years ago was dominated by technical hacks, 2025 was the year of identity fraud. This latest hack — the largest of 2026 so far — confirms that trend once again.
2️⃣ BTC Treasury Companies forced to sell
Contribution by Erik
Last July, bitcoin treasury company Genius Group announced it wanted to accumulate 10,000 BTC. That lofty ambition came to an end last week: the company sold its last 84 BTC to pay off debts. It's one example of the small wave of selling by these types of companies that's currently underway. Still, the selling pressure on the market remains modest — especially since BTC whale Strategy continues to buy.
James Van Straten
It was a defining development of 2024 and 2025: companies putting BTC on their balance sheet and branding themselves as Bitcoin Treasury Companies. Over 150 publicly traded companies now hold BTC. The days when these companies were lining up to join are over. The market no longer rewards the strategy the way it did in the early days of this trend. Around 40 percent of companies holding BTC on their balance sheet now trade at a share price below the value of their BTC holdings.
This means they can no longer issue shares to buy more BTC. The flywheel of rising share prices and growing BTC holdings is now spinning in reverse. And in some cases, debts need to be repaid, forcing BTC sales at a loss.
Here's a table of the largest sellers in Q1 2026:
Nakamoto Holdings, the company of well-known bitcoiner David Bailey, is also selling out of necessity. The company sold 284 BTC in March for $20 million, roughly 5 percent of their stack. Nakamoto has a $210 million loan outstanding with Kraken at 8 percent interest, with the bulk of its bitcoin locked up as collateral. The stock has fallen 99 percent from its May 2025 peak.
The miners: from bitcoin to AI
As the table shows, miners are also among the sellers. For miners, selling BTC is of course less unusual.
And now that margins are under pressure, some major miners are using their accumulated reserves to fund a strategic pivot toward AI and high-performance computing.
Marathon, the largest publicly traded miner, sold over 15,000 BTC in March. The proceeds were used to buy back $1 billion in convertible notes at a 9 percent discount. The CEO justified the sale as a deliberate balance sheet restructuring that "enhances financial flexibility and strategic optionality," while the company also pivots toward AI infrastructure.
The dashboard below from Bitcoin Magazine puts the news in perspective.
The chart shows that most major holders aren't selling, and in some cases are still accumulating. But it's hardly encouraging. According to CryptoQuant, companies excluding Strategy bought just 1,000 BTC combined in March 2026.
According to Bitcoin Mining Stock, total holdings of treasury companies grew by approximately 68,526 BTC in Q1 2026. That is almost entirely thanks to Strategy. Without Strategy, the rest of the ecosystem has essentially stopped buying — or is actively selling.
3️⃣ Quantum threat to bitcoin draws closer
Contribution by Peter
Google has dropped a bombshell. In a new paper, the company claims that breaking the cryptography behind bitcoin requires far less quantum computing power than previously assumed. Fewer than 500,000 so-called qubits would be needed, rather than the millions previously estimated. And in theory, it could be done in nine minutes.
That's a factor of twenty more efficient than previous estimates. It shifts the scenario from "someday" to a timeline that's uncomfortably close.
The vulnerability lies in the way bitcoin ownership is proven. When you make a transaction, you reveal your public key. Today, that's safe because classical computers can't do anything with it. But a quantum computer could derive the corresponding private key from that public key — in theory, even before a broadcast transaction is processed. Meaning the balance could simply be taken over.
According to Google, roughly 6.9 million bitcoin are in addresses whose public keys are already exposed. That represents a substantial portion of the network — including old addresses from the early days, for which manual migration is presumably no longer possible.
The researchers point to 2029 as the tipping point. By then at the latest, measures must be in place against the risks quantum computers introduce. Governments around the world are already on similar timelines. The NSA, for instance, wants all systems to be quantum-resistant by 2030. For bitcoin, that's a relatively short horizon. Major upgrades that affect the entire ecosystem take years of discussion, development, and implementation.
Reactions within the bitcoin community are mixed. There are those sounding the alarm to drive action, like venture capitalist Nic Carter. There are those who say there's nothing to worry about, while quietly having twenty people working on it, like bitcoin veteran Adam Back. He sees it as his job as a quantum realist to keep the quantum hypers in check.
The most telling reaction to the news comes from outside the bitcoin community. Scott Aaronson, a renowned American computer scientist specializing in quantum computing, calls the news a 'bombshell.' He doesn't know how much sooner bitcoin is at risk, and he doesn't know in what year that risk becomes concrete. But:
In any case, these results provide an even stronger impetus for people to upgrade now to quantum-resistant cryptography. They—meaning you, if relevant—should really get on that!
Google isn't talking about an imminent threat, but is making an urgent call to action. The most concrete response within the bitcoin community right now is BIP-360, a proposal by developer Ethan Heilman for a new type of bitcoin address called P2MR — Pay-to-Merkle-Root. The idea is that you never have to reveal your public key, not even when sending a transaction. That renders a quantum attack pointless. A few weeks ago, this proposal came to life on one of bitcoin's testnets.
Ethereum, equally vulnerable to the developments described by Google, is taking a different approach. Multiple teams are working on a concrete path toward a quantum-resistant network. A website has been set up for the outside world to track progress.
Ethereum Foundation — Post-Quantum Team
As a bitcoiner, there's nothing you need to do right now other than stick to best practices, such as avoiding address reuse and keeping your hardware firmware up to date. The exact path forward for bitcoin hasn't been charted yet, but that's likely to change in the coming months. The tug of war between quantum hypers and quantum realists is far from over.
🍟 Snacks
To wrap up, some quick bites:
- EDX Markets has applied for a U.S. banking license. The exchange wants to offer custody, settlement, and trading under one regulated roof — but separated, as in traditional markets. EDX primarily serves institutional clients and was founded with backing from Citadel, Fidelity, and Charles Schwab. The application fits a broader trend of American crypto firms moving ever closer to the traditional banking system.
- Franklin Templeton launches new division, Franklin Crypto. The asset management giant, with $1.7 trillion under management, announced the initiative following its acquisition of 250 Digital, a spinoff of crypto fund CoinFund. The deal was partly settled with BENJI tokens, digital shares in its own on-chain money market fund. Operations are set to begin in Q2 2026, led by Chris Perkins (ex-Citi) and Seth Ginns (ex-CoinFund) as CIO.
- Infrastructure for AI agents gets its own foundation. The Linux Foundation has established the x402 Foundation. The foundation takes stewardship of the x402 protocol, a payment protocol for AI agents, and has more than twenty major companies as participants. Daily transaction volume on x402 is just $28,000, of which according to Artemis half is artificial. In March, Stripe launched a competing protocol, backed by OpenAI and Anthropic.
- Tether aims to raise fresh capital at a $500 billion valuation. Investors have two weeks to commit, or the round may be postponed. Tether doesn't need the money to survive — the company made over $10 billion in profit last year and dominates the stablecoin market. The fundraise appears primarily aimed at expanding into new sectors. The skepticism centers on the valuation, which exceeds that of virtually every bank in the world, without a public listing or clear exit path.
- Charles Schwab will make bitcoin and ether directly tradeable for clients. By the first half of 2026, investors should be able to buy crypto within the same environment as their stocks and bonds. With nearly $12 trillion in client assets, Schwab can reach a large group of investors currently dependent on external platforms. The company says it's responding to increased demand for crypto among investors.
- The market for tokenized assets continues to grow, reaching $27.6 billion. It's one of the few segments still seeing inflows. U.S. Treasuries are particularly popular in this market, followed by commodities and credit products. Tokenized equities are also gaining ground. While the total size remains modest, trading volume has grown significantly, pointing to active usage. The market is still heavily concentrated among a handful of providers.
- The U.S. federal government is suing multiple states to protect prediction markets. According to Washington, states cannot treat platforms like Polymarket and Kalshi as gambling operations. These platforms offer contracts on the outcomes of events. States view that as gambling, but the federal regulator considers it a financial market. The case comes down to jurisdiction: who sets the rules for this new category — the states or the federal government?
Thank you for reading!
To stay informed about the latest market developments and insights, follow our team members on X:
- Bart Mol (@Bart_Mol)
- Peter Slagter (@pesla)
- Bert Slagter (@bslagter)
- Mike Lelieveld (@mlelieveld)
We appreciate your continued support and look forward to bringing you more comprehensive analysis in our next edition.
Until then!