Welcome to The Protocol, CoinDesk’s weekly wrap of the most important stories in cryptocurrency tech development. I’m Margaux Nijkerk, a reporter at CoinDesk.
In this issue:
Quantum threat to Bitcoin is real, but manageable, according to Wall Street broker Bernstein
How North Korea’s 6-month long secret espionage program has crypto community rethinking security
‘Don’t waste time with crypto’: Here is what Solana Foundation’s cryptic message really means
Crypto’s ‘AWS’ Alchemy unveils tool to make AI payment systems talk to each other
EXPLOITS TO ESPIONAGE: DRIFT HACK REVEALS MORE COMPLEX OPERATIONS: When Drift disclosed the details behind its $270 million exploit, the most unsettling part wasn’t the scale of the loss — it was how it happened. According to the team behind the protocol, the attack wasn’t a smart contract bug or a clever piece of code manipulation. It was a six-month campaign involving fake identities, in-person meetings across multiple countries and carefully cultivated trust. The attackers, allegedly from North Korea, didn’t just find a vulnerability in the system. They became part of it. This new threat is now forcing a broader reckoning across decentralized finance. For years, the industry has treated security as a technical problem, something that could be solved with audits, formal verification and better code. But the Drift incident suggests something far more complex: that the real vulnerabilities may lie outside the codebase altogether. Alexander Urbelis, chief information security officer (CISO) at ENS Labs, argues the framing itself is already outdated. “We need to stop calling these ‘hacks’ and start calling them what they are: intelligence operations,” Urbelis told CoinDesk. “The people who showed up at conferences, who met Drift contributors in person across multiple countries, who deposited a million dollars of their own money to build credibility: that’s tradecraft. It’s the kind of thing you’d expect from a case officer, not a hacker.” If that characterization holds, then Drift represents a new playbook: one where attackers behave less like opportunistic hackers and more like patient operators embedding themselves socially before making a move onchain. — Margaux Nijkerk Read more.
SOLANA FOUNDATION NEW AD ‘DONT WASTE TIME ON CRYPTO’: The Solana Foundation is taking a deliberately contrarian approach to crypto marketing in San Francisco, rolling out a billboard campaign that reads: “Don’t waste time with crypto.” At first glance, the message may seem a bit confusing as a crypto foundation is saying not to waste time with crypto. But according to the Solana Foundation, it is a bullish bet on the future of crypto that intersects with agentic AI. Essentially, what this means is that rather than wasting your time executing transactions with crypto, which might be cumbersome and time-consuming, let your AI agents do the hard work. The ad directs passersby to the x402 account on X, a nod to a growing push within the Solana ecosystem to position blockchain not as a consumer-facing product, but as invisible infrastructure for the next phase of the internet. — Margaux Nijkerk Read more.
NEW ALCHEMY AI TOOL: Alchemy, a cryptocurrency infrastructure provider used by many blockchains and firms in the space, has released a new tool, AgentPay , that lets different AI payment systems, from companies like Coinbase, Stripe, Visa, Mastercard, and Circle, work together. The new tool addresses the problem that agentic payment systems currently coming online aren’t “interoperable,” or in other words, don’t talk to one another, meaning a merchant that wants AI agents as customers has to build a separate integration for every protocol. “That’s not sustainable, and it’s only going to get more fragmented as more systems launch,” said Alchemy CTO Guillaume Poncin in an email. “AgentPay fixes that. A merchant registers their existing API with us, we give them a new endpoint, and any agent on any supported protocol can pay them through it.” Alchemy is widely seen as the “AWS of Web3,” as it provides the infrastructure, developer tools, and node services needed to build blockchain applications. AgentPay promises one integration for every protocol, citing the likes of x402, MPP, A2P or L402. “We sit in the middle as the translation layer, where AgentPay routes instructions, and Alchemy never touches the funds,” Poncin said. — Ian Allison Read more.
In Other News
Adam Back has denied claims that he is Satoshi Nakamoto after a New York Times story argued that the British cryptographer is the strongest candidate yet for Bitcoin’s pseudonymous creator. In a post on X after the article was published, Back said his long record in cryptography, privacy tools and electronic cash research explains why reporters keep finding links between his work and Bitcoin’s design. “I’m not satoshi,” Back wrote. He said he had been “early in laser focus on the positive societal implications of cryptography, online privacy and electronic cash,” and that his work from about 1992 onward, including discussions on the cypherpunks mailing list, led to Hashcash and other ideas later echoed in Bitcoin. Back, said NYT reporter John Carreyrou, had found “many interesting bitcoin analogs in early attempts to create a decentralized ecash,” adding that early researchers explored concepts such as peer-to-peer systems, proof-of-work, and routing models that looked like prototypes for Bitcoin. — Helene Braun Read more.
Wall Street investment bank JPMorgan (JPM) said the pace of capital flowing into digital assets slowed markedly in the first quarter of 2026, with total inflows estimated at around $11 billion. That implies an annualized run rate of roughly $44 billion, about one-third of the pace seen in 2025, according to the report published last week. “Investor flows, either retail or institutional, have been small or even negative YTD with the bulk of the digital asset flow in Q1’26 stemming from Strategy’s (MSTR) bitcoin purchases and concentrated crypto VC funding,” wrote analysts led by Nikolaos Panigirtzoglou. Crypto markets had a volatile and broadly negative first quarter, with prices and market value retreating sharply amid a risk-off backdrop. Total crypto market capitalization fell roughly 20% over the period, while bitcoin dropped around 23% and ether (ETH) declined more than 30%, marking one of the weakest first-quarter performances in years. The selloff was driven by macroeconomic and geopolitical pressures, triggering liquidations and a broad pullback in risk assets, with altcoins hit even harder. — Will Canny Read more.
Regulatory and Policy
Polymarket removed a betting market tied to the rescue of U.S. service members in Iran, after intense backlash and criticism from lawmakers this weekend. The market allowed users to wager on when the U.S. would confirm the rescue of two airmen after an F-15E fighter jet was shot down over Iran. The crew members have since been rescued. Rep. Seth Moulton, a Democrat from Massachusetts, criticized the listing in a post on X, calling it “disgusting” and arguing it reduced a military rescue effort to a financial trade. Moulton has taken a hard line on prediction markets, recently banning his staff from using platforms such as Polymarket and Kalshi over concerns that financial incentives could influence policy decisions. A Polymarket spokesperson said the listing did not meet its integrity standards and the contract was removed shortly after it appeared. The company added that it is reviewing how the market passed internal safeguards. — Francesco Rodrigues Read more.
The U.S. Federal Deposit Insurance Corp. formally proposed its approach to stablecoin issuers as one of the federal financial regulators required to write and oversee rules under last year’s Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act. The FDIC’s proposal —meant to align closely with what its sister banking agency, the Office of the Comptroller of the Currency, proposed in February — will be open for a 60-day public comment period on the lengthy list of 144 questions posed Tuesday by the agency. The FDIC’s job is to police U.S. depository institutions, and under the GENIUS Act, its role is to regulate such institutions issuing stablecoins from their subsidiaries. To that end, it posed capital, liquidity and custody standards for those firms, though the details won’t be set in stone until the rule is finalized — not likely to occur until the agency spends further months reviewing input and writing the final language. This is the second GENIUS Act proposal from the banking agency after its December pitch on the issuer application process. As expected under the law, stablecoins won’t enjoy the deposit insurance that the banks maintain on traditional banking accounts, according to the proposal. — Jesse Hamilton Read more.
Most crypto privacy models weaken as blockchain data grows. Encryption-based models like Zcash strengthen. CoinDesk Research maps the five privacy approaches and examines the widening gap.
Why it matters:
As blockchain adoption scales, the metadata available to machine learning models scales with it. Obfuscation-based privacy approaches are structurally degrading as a result. This report provides a comprehensive comparison of all five major crypto privacy architectures and a framework for evaluating which models remain durable as AI capabilities improve.
The broker said advances in quantum computing are accelerating the timeline for crypto risk, but argued Bitcoin faces a multi-year upgrade cycle, not an existential crisis.
What to know:
Bernstein warned quantum computing is a growing threat to Bitcoin’s cryptography, with timelines moving closer than previously expected.
The risk is concentrated in older wallets, while core network functions like mining remain largely secure.
Bitcoin and crypto have a three to five year window to transition to post-quantum security through…
