- Buy Crypto
- Markets
- Futures
- Spot
- Copy Trade
Earn- More
SlowMist: Web3 Phishing Technique Analysis
Original Article Title: "SlowMist: Web3 Phishing Tactics Analysis"
Original Source: SlowMist Security Team
Lately, SlowMist was invited to participate in the Ethereum Web3 Security BootCamp organized by DeFiHackLabs. As a speaker, SlowMist's Head of Security Audit, Thinking, delved into the malicious ways and covert methods of phishing hackers across eight chapters titled "Fake, Bait, Lure, Attack, Conceal, Skill, Distinguish, Defend," combining practical examples to lead students to a deep understanding of phishing attacks and proposing relevant preventive measures. Phishing is one of the heavily targeted areas in the industry. Understanding the enemy is necessary to defend effectively. This article will extract key content from the sharing session to help users understand the current state of phishing attacks and effectively mitigate the threat of phishing attacks.
Why Phishing Happens
In the Web3 world, phishing attacks have become one of the major security threats. Let's first look at why users fall victim to phishing. In fact, even users with high security awareness sometimes feel the saying "if you walk by the river often, you will eventually get your shoes wet" applies to them. After all, maintaining the highest level of vigilance at all times is difficult. Attackers analyze factors such as recent hot projects, community activity, and user base to select highly visible targets, disguise them carefully, and then lure users using airdrops, high returns, and other baits. These attack methods are usually accompanied by social engineering. Attackers are adept at exploiting user psychology to achieve their fraudulent goals:
· Enticement: Airdrop whitelist qualification, mining rewards, private key of wealth, etc.
· Curiosity / Greed: Fearless exit strategy for a rug pull, can't miss the potential 100x coin, don't miss out at 10 PM tonight, meeting link https://us04-zoom[.]us/ (malicious); $PENGU airdrop whitelist must not be missed, https://vote-pengu[.]com/ (malicious).
· Fear: Urgent alert: XX project has been hacked, please use revake[.]cash (malicious) to revoke authorization and prevent fund loss.
· Efficient Tools: Airdrop farming tools, AI quantitative tools, one-click mining fleeceware, etc.
Attackers invest time in creating and deploying baits simply because it is profitable. Through the above means, attackers can easily obtain users' sensitive information/permissions, thereby stealing user assets:
· MNEMONIC / Private Key Theft: Deceiving users into inputting their mnemonic phrase or private key.
· Deceiving User to Sign with Wallet: Authorization signature, transaction signature, etc.
· Account Password Theft: Telegram, Gmail, X, Discord, etc.
· Social App Permission Theft: X, Discord, etc.
· Inducing Installation of Malicious Programs: Fake wallet apps, fake social apps, fake conference apps, etc.
Phishing Techniques
Next, let's take a look at some common phishing techniques:
Account Theft / Impersonation
Recently, there has been a surge in incidents where Web3 projects' / KOLs' X accounts were hacked. After hijacking the account, attackers often promote fake tokens or construct similar domain names in the "good news" they release to deceive users into clicking. Of course, there are cases where the domain is legitimate because the attacker may have taken over the project's domain. Once the victim clicks on the phishing link, performs a signature, or downloads malicious software, their assets will be stolen.
In addition to stealing accounts, attackers on X often use impersonated accounts to comment in the comments section of legitimate accounts to deceive users. The SlowMist Security Team has conducted targeted analysis and statistics: about 80% of well-known projects have the comments section of their tweets occupied by scam phishing accounts. Attackers use automated bots to follow the activities of well-known projects. After a project releases a tweet, the phishing group's bots will automatically leave a comment in the comments section to ensure they occupy the first comment position for high visibility. Since the post the user is viewing is sent by a real project and the disguised phishing group account and the project account are highly similar, as long as the user is not vigilant enough and clicks on the high-imposter account's phishing link under the guise of an airdrop or similar pretext, and then authorizes or signs, they will lose their assets.
Attackers will also impersonate administrators to post fake news, especially on platforms like Discord where this phenomenon is more common. Discord supports user-customized nicknames and usernames, so attackers will change their profile picture and nickname to match those of an administrator, then post phishing information in the channel or private message users. If users do not click on the account profile to view the username, it is difficult to detect the issue. Furthermore, although Discord usernames cannot be duplicated, attackers can use names that are highly similar to the administrator's username, such as adding an underscore or a period in the username, making it difficult for users to distinguish between real and fake accounts.
Invite Phishing
Attackers often establish contact with victims on social platforms, recommend "high-quality" projects or invite users to meetings, guide victims to visit malicious phishing sites, or download malicious applications. In the past, users have been hacked after downloading a fake Zoom app. Attackers use domains like "app[.]us4zoom[.]us" to disguise themselves as legitimate Zoom meeting links, with the page closely resembling the actual Zoom interface. When users click the "Start Meeting" button, they trigger the download of a malicious installation package instead of launching the local Zoom client or downloading Zoom's official client. As the malicious program prompts users to enter their passwords at runtime, and subsequent malicious scripts collect browser plugin wallet data and KeyChain data (potentially including various passwords saved on the computer), attackers collect this data to attempt decryption and obtain sensitive information such as the user's wallet mnemonic phrase/private key, leading to asset theft.
Search Engine Ranking Manipulation
Search engine ranking results can be boosted through ad promotion, leading to phishing sites potentially ranking higher than the genuine official websites. In cases where users are unaware of the official website's URL, it's challenging to differentiate a phishing site solely based on the site's appearance. Phishing sites can customize the URL displayed in Google Ads promotions, where the URL shown in the Sponsored section may be identical to the official URL, but when users click the ad's URL, they are redirected to the attacker's constructed phishing site. Because phishing sites created by attackers closely resemble genuine official sites, it's challenging to distinguish between them, making it inadvisable for users to directly search for official websites using search engines as they are likely to land on a phishing site.
TG Advertisement Scam
Recently, there has been a significant increase in users falling victim to fake TG Bots. Multiple users reported encountering a new bot at the top of the channel while using a trading bot, assuming it was an official new release and proceeding to import private keys to link wallets, only to be hacked. Attackers utilize Telegram to precisely target advertisements in official channels, enticing users to click. This form of phishing is highly covert because the ad appears in an official channel, leading users to instinctively believe it is an official robot release. Lacking vigilance, if users click the phishing bot and upload private keys to link, they risk being hacked.
In addition, we recently disclosed a new type of scam, the Telegram Fake Safeguard scam, where many users were stolen from because they ran malicious code following the attacker's tutorial.
App Store
Not all software on the app stores (Google Play, Chrome Store, App Store, APKCombo, etc.) are genuine. Often, the stores cannot fully review the software. Some attackers lure users into downloading fraudulent apps through methods like buying keyword rankings. Dear readers, please pay attention to verification. Before downloading, make sure to check the app developer information to ensure it matches the officially announced developer identity. You can also refer to app ratings, download counts, and other information.
Phishing Email
Email phishing is the most classic trick, known for being "simple and unadorned." Attackers use phishing templates and combine them with Evilngins reverse proxy to create emails like the one in the image below: when users click on "VIEW THE DOCUMENT," they will be redirected to a fake DocuSign interface (now unable to open). Subsequently, if a user clicks on Google Login on that interface, they will be redirected to a reverse-proxied Google login window. Once the user enters their account, password, and 2FA on that window, the account will be taken over by the attacker.
The phishing email in the image above is obviously not well-crafted because the sender's email address is not disguised. Let's see how the attacker in the image below disguises their identity: the attacker's email address differs from the official address by just a small dot. Attackers can use DNSTwist to find special characters supported by Gmail to make their email address look legitimate. If you don't look closely, you might think it's just a dirty computer screen.
Browser Feature Exploitation
See SlowMist's article: Revealing how malicious browser bookmarks can steal your Discord Token.
Defense Challenge
The tactics used by attackers are constantly evolving, generally moving towards a more sophisticated and standardized direction. In our previous analysis, we found that attackers are not only able to create web pages highly similar to those of well-known projects and take over the project's domain, but there are also cases where an entire project is fictitious. These fake projects not only have many (purchased) fans on social media but also have GitHub repositories, posing a greater challenge for users to identify phishing threats. Additionally, attackers' adept use of anonymous tools has made tracing their tracks more difficult and complex. To conceal their identities, attackers often use VPNs, Tor, or even control compromised hosts to carry out malicious activities.
With an anonymous identity established, attackers, to build a phishing network, also need to purchase basic service infrastructure, such as Namecheap, with support for cryptocurrency payments. Some services only require an email for registration, without the need for KYC verification, allowing attackers to avoid being traced.
Once the aforementioned preparations are in place, attackers can launch phishing attacks. After profiting, the funds are further obfuscated using services like Wasabi, Tornado, etc., to confuse the fund's path. To enhance anonymity, funds may also be converted into highly anonymous cryptocurrencies such as Monero.
To avoid leaving samples and evidence, attackers will cover their tracks by deleting related domain resolutions, malicious programs, GitHub repositories, platform accounts, etc. This often results in security personnel encountering situations where phishing websites cannot be accessed or malicious programs cannot be downloaded, increasing the difficulty of analysis and tracking.
Defense Strategy
Users can identify phishing threats based on the characteristics in the above image and learn basic methods to verify information authenticity. They can also use some defense tools to enhance phishing defense capabilities:
· Phishing Risk Blocking Plugins: Tools like Scam Sniffer can detect risks from multiple dimensions. When users open suspicious phishing pages, the tool will promptly display a risk warning.
· Secure Wallets with High Interaction Security: Such as Rabby's Watch-only wallet (no private key required), phishing website identification, see-and-sign, high-risk signature identification, history record Scam identification, etc.
· Internationally Recognized Antivirus Software: Such as AVG, Bitdefender, Kaspersky, etc.
· Hardware Wallet: A hardware wallet provides an offline way to store private keys. When interacting with a hardware wallet and DApp, the private key is not exposed online, effectively reducing the risk of asset theft.
Final Thoughts
In the blockchain dark forest, phishing attacks are omnipresent. Cultivation lies in the arising of every thought—being mindful of one's intentions to avoid unconsciously falling into a mental state. When navigating the blockchain dark forest, the most fundamental practice is to cultivate a habit of maintaining zero trust and continuous verification. It is recommended that everyone deeply read and gradually master the "Blockchain Dark Forest Survival Manual."
Due to space constraints, this article only introduces the main contents of the sharing session. The nearly seventy-page PPT is now publicly available.
You may also like
a16z Leads $18M Seed Round for Catena Labs, Crypto Industry Bets on Stablecoin AI Payment
Pharos, deeply integrated with AntChain, is about to launch. How can we get involved?
$COIN Joins S&P 500, but Coinbase Isn't Celebrating
On May 13, S&P Dow Jones Indices announced that Coinbase would officially replace Discover Financial Services in the S&P 500 on May 19. While other companies like Block and MicroStrategy, closely tied to Bitcoin, were already part of the S&P 500, Coinbase became the first cryptocurrency exchange whose primary business is in the index. This also signifies that cryptocurrency is gradually moving from the fringes to the mainstream in the U.S.
On the day of the announcement, Coinbase's stock price surged by 23%, surpassing the $250 mark. However, just 3 days later, Coinbase was hit by two consecutive events: a hack where employees were bribed to steal customer data and a demand for a $20 million ransom, and an investigation by the U.S. Securities and Exchange Commission (SEC) into the authenticity of its claim of having over 100 million "verified users" in its securities filings and marketing materials. These two events acted as mini-bombs, and at the time of writing, Coinbase's stock had already dropped by over 7.3%.
Coincidentally, Discover Financial Services, being replaced by Coinbase, can also be considered the "Coinbase" of the previous payment era. Discover is a U.S.-based digital banking and payment services company headquartered in Illinois, founded in 1960. Its payment network, Discover Network, is the fourth largest payment network apart from Visa, Mastercard, and American Express.
In April, after the approval of the acquisition of Discover by the sixth-largest U.S. bank, Capital One, this well-established digital banking company of over 60 years smoothly handed over its S&P 500 "seat" to this emerging cryptocurrency "bank." This unexpected coincidence also portrayed the handover between the new and old eras in Coinbase's entry into the S&P 500, resembling a relay race scene. However, this relay baton also brought Coinbase's accumulated "external troubles and internal strife" to a tipping point.
Over the past decade, cryptocurrency exchanges have been the most stable "profit machines." They play a role in providing liquidity to the entire industry and rely on trading fees to sustain their operations. However, with the comprehensive rollout of ETF products in the U.S. market, this profit model is facing unprecedented challenges. As the leader in the "American stack," with over 80% of its business coming from the U.S., Coinbase is most affected by this.
Starting from the approval of Bitcoin and Ethereum spot ETFs, traditional financial capital has significantly onboarded users and funds that originally belonged to exchanges in a more cost-effective, compliant, and transparent manner. The transaction fee revenue of cryptocurrency exchanges has started to decline, and this trend may further intensify in the coming months.
According to Coinbase's 2024 Q4 financial report, the platform's total trading revenue was $417 million, a 45% year-on-year decrease. The contribution of BTC and ETH's trading revenue dropped from 65% in the same period last year to less than 50%.
This decline is not a result of a decrease in market enthusiasm. In fact, since the approval of the Bitcoin ETF in January 2024, the inflow of BTC into the U.S. market has continued to reach new highs, with asset management giants like BlackRock and Fidelity rapidly expanding their management scale. Data shows that BlackRock's iShares Bitcoin ETF (IBIT) alone has surpassed $17 billion in assets under management. As of mid-May 2025, the cumulative net inflow of 11 major institutional Bitcoin spot ETFs on the market has exceeded $41.5 billion, with a total net asset value of $1214.69 billion, accounting for approximately 5.91% of the total Bitcoin market capitalization.
Institutional investors and some retail investors are shifting towards ETF products, partly due to compliance and tax considerations. On one hand, ETFs have much lower trading costs compared to cryptocurrency exchanges. While Coinbase's spot trading fee rate varies annually in a tiered manner but averages around 1.49%, for example, the management fee for IBIT ETF is only 0.25%, and the majority of ETF institution fees fluctuate around 0.15% to 0.25%.
In other words, the more rational users are, the more likely they are to move from exchanges to ETF products, especially for investors aiming for long-term holdings.
According to multiple sources, several institutions, including VanEck and Grayscale, have submitted applications to the SEC for a Solana (SOL) ETF, with some institutions also planning to submit an XRP ETF proposal. Once approved, this may trigger a new round of fund migration. According to a report submitted by Coinbase to the SEC, as of April, the platform's trading revenue from XRP and Solana accounted for 18% and 10%, nearly one-third of the platform's fee revenue.
However, the Bitcoin and Ethereum ETFs passed in 2024 also reduced the fees for these two tokens on Coinbase from 30% and 15% to 26% and 10%, respectively. If the SOL and XRP ETFs are approved, it will further undermine the core fee revenue of exchanges like Coinbase.
The expansion of ETF products is gradually weakening the financial intermediary status of cryptocurrency exchanges. From their original roles as matchmakers and clearers to now gradually becoming mere "on-ramps and off-ramps" for funds, exchanges are seeing their marginal value squeezed by ETFs.
On May 12, 2025, SEC Chairman Paul S. Atkins gave a keynote speech at the Tokenization and Cryptocurrency Working Group roundtable. The theme of his speech revolved around "It is a new day at the SEC," where he indicated that the SEC would not approach enforcement and regulation the same way as before but would instead pave the way for cryptocurrency assets in the U.S. market.
With signs of cryptocurrency compliance such as the SEC's "NEW DAY" declaration, an increasing number of traditional brokerages are attempting to enter the cryptocurrency industry. One of the most representative cases is the well-known U.S. brokerage Robinhood, which began expanding its crypto business in 2018. By the time of its IPO in 2021, Robinhood's crypto business revenue accounted for over 50% of the company, with a significant boost from the Dogecoin "moonshot" promoted by Musk.
In Q1 2025 earnings report, Robinhood showcased strong growth, especially in revenue from cryptocurrency and options trading. Fueled by Trump's Memecoin, cryptocurrency-related revenue reached $250 million, nearly doubling year-over-year. Consequently, Robinhood Gold subscription users reached 3.5 million, a 90% increase from the previous year, with the rapid growth of Robinhood Gold providing the company with a stable source of income.
Meanwhile, RobinHood is actively pursuing acquisitions in the cryptocurrency space. In 2024, it announced a $2 billion acquisition of the long-standing European cryptocurrency exchange Bitstamp. Additionally, Canada's largest cryptocurrency CEX, WonderFi, which recently went public on the Toronto Stock Exchange, also announced its integration with RobinHood Crypto. After obtaining virtual asset licenses in the UK, Canada, Singapore, and other markets, RobinHood has taken a proactive approach in the compliant cryptocurrency trading market.
Furthermore, an increasing number of brokerage firms are exploring the same path. Futu Securities, Tiger Brokers, and others are also dipping their toes into cryptocurrency trading, with some having applied for or obtained the VA license from the Hong Kong SFC. Although their user bases are currently small, traditional brokerages have a natural advantage in user trust, regulatory licenses, and low fee structures. This could pose a threat to native cryptocurrency platforms in the future.
In April 2025, security researchers discovered that some Coinbase user data was leaked on the dark web. While the platform initially responded by attributing it to a "technical misinformation," it still raised concerns among users regarding its security and privacy protection. Just two days before Dow Jones Indexes announced Coinbase's addition to the S&P 500 Index, on May 11, 2025, Coinbase received an email from an unknown threat actor claiming to have obtained customer account information and internal documents, demanding a $20 million ransom to keep the data private. Subsequent investigations confirmed the data breach.
Cybercriminals obtained the data by bribing overseas customer service agents and support staff, mainly in "non-U.S. regions such as India." These agents abused their access to Coinbase's internal customer support system and stole customer data. As early as February this year, blockchain detective ZachXBT revealed on X platform that between December 2024 and January 2025, Coinbase users lost over $65 million to social engineering scams, with the actual amount potentially higher.
Among the victims was a well-known figure, 67-year-old Ed Suman, an established artist in the art world for nearly two decades, having been involved in the creation of artworks such as Jeff Koons' "Balloon Dog" sculpture. Earlier this year, he fell victim to an impersonation scam involving fake Coinbase customer support, resulting in a loss of over $2 million in cryptocurrency. ZachXBT critiqued Coinbase for its inadequate handling of such scams, noting that other major exchanges have not faced similar issues and recommending Coinbase to enhance its security measures.
Amidst a series of ongoing social engineering incidents, although there has not been any impact on user assets at the technical level so far, it has raised concerns among many retail and institutional investors. Especially institutions holding massive assets on Coinbase. Just considering the U.S. BTC ETF institutions, as of mid-May 2025, they collectively hold nearly 840,000 BTC, and 75% of these are custodied by Coinbase. If we price BTC at $100,000, this amount reaches a staggering $63 billion, which is equivalent to the nominal GDP of two Iceland in the year 2024.
In addition, Coinbase Custody also serves over 300 institutional clients, including hedge funds, family offices, pension funds, and endowments. As of the Q1 2025 financial report, Coinbase's total assets under management (including institutional and retail clients) reached $404 billion. The specific amount of institutional custodied assets was not explicitly disclosed in the latest report, but it should still be over 50% based on the Q4 2024 report.
Once this security barrier is breached, not only could the rate of user attrition far exceed expectations, but more importantly, institutional trust in it would undermine the foundation of its business. Therefore, after a hacking event, Coinbase's stock price plummeted significantly.
Facing a decline in spot trading fee revenue, Coinbase is also accelerating its transformation, attempting to find growth opportunities in derivatives and emerging assets. Coinbase acquired a stake in the options platform Deribit at the end of 2024 and announced the official launch of perpetual contract products in 2025. This acquisition fills in Coinbase's gap in options trading and its relatively small global market share.
Deribit has a strong presence in non-U.S. markets, especially in Asia and Europe. The acquisition has enabled Coinbase to gain a dominant position in bitcoin and ethereum options trading on Deribit, accounting for approximately 80% of the global options trading volume, with daily trading volume remaining above $2 billion.
Meanwhile, 80-90% of Deribit's customer base consists of institutional investors, with their professionalism and liquidity in the Bitcoin and Ethereum options market highly favored by institutions. Coinbase's compliance advantage, coupled with its already robust institutional ecosystem, makes it even more suitable. By using institutions as an entry point, it can face the squeeze from giants like Binance and OKX in the derivatives market.
Facing a similar dilemma is Kraken, which is attempting to replicate Binance Futures' model in non-U.S. markets. Since the derivatives market relies more on professional users, fee rates are relatively higher and stickiness is stronger, making it a significant source of revenue for exchanges. In the first half of 2025, Kraken completed the acquisition of TradeStation Crypto and a futures exchange, aiming to build a complete derivatives trading ecosystem to hedge the risk of declining spot transaction fee income.
With the surge of Memecoin in 2024, Binance, OKX, and various CEX platforms began massively listing small-market-cap, highly volatile tokens to activate active trading users. Due to the wealth effect and trading activity of Memecoins, Coinbase was also forced to join the battle, successively listing popular tokens from the Solana ecosystem such as BOOK OF MEME and Dogwifhat. Although these coins are controversial, they are frequently traded, with fee rates several times higher than mainstream coins, serving as a "blood-boosting" method for spot trading.
However, due to its status as a publicly traded company, this practice is a riskier endeavor for Coinbase. Even in the current crypto-friendly environment, the SEC is still investigating whether tokens like SOL, ADA, and SAND constitute securities.
In addition to the forced transformation strategies carried out by the aforementioned CEXs, they are also starting to lay out RWAs and the most talked-about stablecoin payment fields, such as the PYUSD launched through a collaboration between Coinbase and Paypal, Coinbase's support for the Euro stablecoin EURC by Circle that complies with EU MiCA regulatory requirements, or the USD1 launched through a collaboration between Binance and WIFL. In the increasingly crowded trading field, many CEXs have shifted their focus from just the trading market to the application field.
The golden age of transaction fees has quietly ended, and the second half of the crypto exchange platform game has silently begun.
Key Market Insights for May 16th, how much did you miss out on?
MOG Coin Skyrockets as Elon Musk and Garry Tan Embrace "mog/acc" Identity
The End and Rebirth of NFTs: How the Meme Coin Craze Ended the PFP Era?
STARTUP's Price Surges 40x in 30 Minutes: How did he become the Emotion King of Believe?
Key Market Intelligence on May 14th, how much did you miss out on?
1.Binance Alpha Launches HIPPO, BLUE, and Other Tokens
2.Believe Ecosystem Tokens See General Rise, LAUNCHCOIN Surges Over 250% in 24 Hours
3.Tiger Securities Introduces Cryptocurrency Deposit and Withdrawal Service, Supports Mainstream Cryptocurrencies such as BTC and ETH
4.Current Bitcoin Rally Possibly Driven by Institutions, Retail Traders Yet to Join
5.Binance Wallet's New TGE Privasea AI Participation Requires a 198 Point Threshold, with a Point Consumption of 15
Source: Overheard on CT (tg: @overheardonct), Kaito
PUMP: Today's discussions about PUMP focus on its new creator revenue-sharing model: the platform will allocate 50% of PumpSwap revenue to token creators, sparking varied reactions from users. Some criticize the move as insufficient or even misleading, while others view it as a positive step the platform is taking to reward creators. Meanwhile, PUMP faces market pressure from emerging competitors like LetsBONKfun and Raydium, which are rapidly gaining market share. Users also express concerns about PUMP's sustainability and potential regulatory risks in the U.S., with discussions extending to the platform's impact on the entire memecoin ecosystem.
COINBASE: Today, Coinbase became the first crypto company to join the S&P 500 Index, replacing Discover Financial Services, sparking widespread industry attention. The entire crypto community views this milestone as a significant development, signaling that crypto assets are further integrating into the mainstream financial system. The news has sparked lively discussions on Twitter, with many users pointing out that this may attract more institutional investors to enter the Bitcoin and other cryptocurrency markets.
XRP: XRP became the focal point of today's crypto discussion, with its significant market movements and strategic advances drawing attention. XRP has surpassed USDT to become the third-largest cryptocurrency by market capitalization, sparking market excitement and discussions about its future potential. The surge in market capitalization and price is believed to be related to increasing institutional interest, deepening strategic partnerships, and its role in the crypto ecosystem. Additionally, XRP's integration into multiple financial systems and its potential as a macro asset class are also seen as key factors driving the current market sentiment.
DYDX: Today's discussions about DYDX mainly focused on the dYdX Yapper Leaderboard launched by KaitoAI. The leaderboard aims to identify the most active community participants, with a total of $150,000 in rewards to be distributed over the first three seasons. This initiative has sparked broad community participation, with many users discussing the potential rewards and the incentive effect on the DYDX ecosystem. Meanwhile, progress on the ethDYDX to dYdX native chain migration and historical airdrop events have also been topics of discussion.
1. "What Is 'ICM'? Holding Up the $4 Billion Market Cap Solana's New Narrative"
Overnight, the hottest narrative in the crypto space has become "Internet Capital Markets," with a host of crypto projects and founders, led by the Solana ecosystem's new Launchpad platform Believe, releasing this phrase. Together with "Believe in something," it has become the new slogan heralding the onset of a bull market. What exactly is the so-called "Internet Capital Market," will it become a short-lived hype phrase like the Base ecosystem's previous Content Coin, and what related targets are available for selection?2.《LaunchCoin Surges 20x in One Day, How Did Believe Create a $200M Market Cap Shiba Inu After Going to Zero?｜100x Retrospective》
LAUNCHCOIN broke through a $200 million market cap today, with the long-lost liquidity and such a high market cap "Memecoin" almost bringing half of the on-chain crypto community CT into the fray. The community is crazily discussing this token, with half of it being FOMO and the other half being FUD. This token, originally issued by Believe founder Ben Pasternak under his personal identity, transformed into a new platform token after a renaming. From once going to zero to a $200 million market cap, what happened in between?May 14 On-chain Fund Flow
Within 24 hours, GOONC's market cap soared to 70 million, could GOONC be the next billion-dollar dog on the Believe platform?
Bitcoin has broken $100,000, Ethereum has surpassed 2500, and is Solana's hot streak about to make a comeback?
The current market is in a state of macro euphoria, with GOONC riding the wave today, skyrocketing 10x in just a few hours, reaching a market cap of tens of millions of dollars, trading volume soaring past 50 million, and rumors swirling that the developer may be from OpenAI (unconfirmed but intriguing enough).
A ludicrous and absurd Solana meme that some actually buy into.
GOONC is a meme coin that has sprouted from the "gooning" subculture, offering no technological innovation or practical use, its sole function being speculation.
It takes inspiration from an NSFW term "gooning," which refers to a person being deeply immersed in certain content (you know what), eventually entering a nearly religious-like trance.
In Reddit (such as r/GOONED, r/GoonCaves) and some counterculture media outlets (such as MEL Magazine in 2020), "gooning" has gradually transitioned from an adult label to a meme-addicted, digital content and virtual self-indulgence synonym, arguably the epitome of Degen spirit.
GOONC is playing around with this concept, packaging the addictive nature, uselessness, and irony of gooning into a tradable financial product. The project team has made it clear: "We do not solve blockchain problems, we only trade absurdity." Blunt but oddly genuine.
GOONC launched on May 13, 2025, using the meme coin launch platform Believe App's LaunchCoin module on Solana. This tool is highly Degen: zero technical barriers, a few clicks to create a coin, perfect for projects like GOONC that can come up with ideas out of the blue.
The mastermind behind GOONC is also quite something and is the most talked-about, with KOL @basedalexandoor on X platform (alias "Pata van Goon") personally involved. His profile even caught the attention of Marc Andreessen, co-founder of a16z, making onlookers unable to resist speculating if GOONC has a hint of OpenAI lineage.
While this 'OpenAI Endorsement' is currently just community speculation, it is definitely a good card to play to fuel hype. Saying "we are pure speculation" on one hand, while tagging a few "AI + a16z" on the other.
GOONC took off as soon as it launched. After its launch on May 13, 2025, its market capitalization skyrocketed to $22 million within 4 hours, with a trading volume exceeding $25.6 million in 24 hours. According to platform data, the first day of trading saw an astonishing +41,100% surge, soaring from $0.0000001 to $0.02, becoming a "missed-the-boat" situation.
GOONC quickly formed an active trading community post-launch, with a lot of discussion and trading signals appearing on X platform (such as the 292x return signal provided by DeBot). Liquidity pools on exchanges like Raydium and Meteora grew rapidly, supporting high trading volumes and price increases.
The real climax occurred between May 13 and May 14, with the market cap rising to $5.5 million in the morning and directly surpassing $55 million in the afternoon. By the 14th, it briefly approached a $70 million market cap, with the trading volume soaring to $59 million. Some community members even posted screenshots claiming an increase of +85,000%, creating a new myth out of the ruins.
As of 1:30 pm on May 14, the price stabilized around $0.039, with a total market cap and FDV both around $39.6 million, and a 24-hour trading volume of $5.43 million. Active platforms include XT.COM, LBank, Meteora, and others.
Although there was a slight pullback from the peak ($0.07), the coin's popularity remains strong. For a coin that relies purely on "irony + community + X post" to thrive, this performance is already at a stellar level.
Currently, the background of the token's development team is not transparent, increasing the potential risk of a rug pull. Rugcheck.xyz warns that the creator of the GOONC contract may have permission to modify the contract (e.g., change fees or mint additional tokens), posing certain security risks.
Community members speculate that the meteoric rise of GOONC may be the "last hurrah".
After Surging 40%, Has Ethereum Price Peaked Upon Exiting the Craze?
Whether you are an insider or an outsider, these days you must be familiar with the news about Ethereum. The reason is simple, causing Ethereum enthusiasts to sigh with emotion and almost throwing off-guard those who defend Ethereum, Ethereum, with a "3-day surge of 40%," climbed to the top of the Douyin Hot List.
As we all know, Ethereum launched the Pectra upgrade on May 7th. This most significant network upgrade since early 2024 integrates the Prague execution layer hard fork and the Electra consensus layer upgrade, significantly improving Ethereum's performance through 11 improvement proposals. The account abstraction feature (EIP-7702) allows users to flexibly manage wallets through social media accounts or multi-signature schemes, reducing the user threshold, attracting more users and developers. The staking mechanism optimization increases the validator ETH cap from 32ETH to 2048ETH and introduces a flexible withdrawal method, making it easier for institutions and individuals to participate in network security, enhancing the market's confidence in Ethereum's long-term value.
At the same time, Pectra optimized the interaction efficiency of Layer 2 networks such as Arbitrum and Optimism, making transactions faster and cheaper, leading to a surge in on-chain activity. As a crucial step for Ethereum's transition from "2G" to "5G," the Pectra upgrade not only enhances network vitality but also "recharges confidence" in the market, directly driving the price increase.
Related Reading: "Ethereum Skyrockets 22% in One Day, E Enthusiasts Rejoice"
It's not just Ethereum itself, as Wall Street also brought important bullish news.
The world's largest asset management company, BlackRock, proposed to the SEC allowing Ethereum ETFs for staking. This proposal is expected to elevate Ethereum ETFs from a mere investment tool to a bond-like "interest-bearing asset," bringing investors both capital appreciation and passive income, igniting market optimism about Ethereum's future potential.
Specifically, BlackRock has proposed to amend its S-1 filing to allow investors to create and redeem ETF shares directly with Ethereum instead of the U.S. dollar (i.e., in-kind redemption). This move, combined with its $2.9 billion BUIDL Fund launched in March 2024, aims to deepen the integration of traditional finance with blockchain. The BUIDL Fund is a tokenized fund operating on the Ethereum network, investing in traditional assets such as U.S. Treasury bonds. This setup is highly attractive to institutional investors, as they can not only benefit from Ethereum's price appreciation but also earn stable cash flow through staking.
Robert Mitchnick, BlackRock's Head of Digital Assets, stated in a CNBC interview in March 2025 that the addition of staking functionality will significantly enhance the appeal of the Ethereum ETF. He admitted that when the Ethereum spot ETF was launched in July 2024 without staking functionality, the market demand was lackluster, and staking could be the key to reversing this trend.
Meanwhile, the SEC's shifting stance on cryptocurrency regulation has also fueled this upward trend. During the tenure of the previous SEC chairman, the regulatory approach was tough, and staking was strictly viewed through the Howey test as a potential unregistered security. Therefore, when approving the Ethereum spot ETF in May 2024, staking functionality was explicitly prohibited.
However, with Trump back in the White House and Paul Atkins taking over the SEC, there has been a noticeable relaxation in crypto regulation. Apart from BlackRock, ETF issuers such as Invesco Galaxy, VanEck, WisdomTree, and 21Shares have also submitted applications for similar staking and in-kind redemption.
Related reading: "New Chairman Takes Office, SEC Transforms into 'Crypto Daddy' Within 48 Hours"
If staking ETFs are approved, the benefits are likely to go beyond price appreciation. The introduction of staking functionality could redefine the role of crypto assets, making them more similar to traditional financial products that provide returns and value appreciation, thereby driving Ethereum closer to mainstream finance.
Currently, the SEC still needs to address several decisions related to crypto ETFs, including whether to approve ETFs for Solana, XRP, Litecoin, and even Dogecoin. With the calls for an "altcoin season" growing louder, Ethereum's strong performance may just be the beginning of a larger crypto market frenzy.
In addition, the Trump family-related DeFi project WLFI is also bullish on this wave of rise, with frequent on-chain activities. According to on-chain data analyst @ai_9684xtpa's monitoring, a WLFI-related address is currently borrowing coins to go long on ETH, borrowing 4 million U from Aave to buy 1590 ETH at an average price of $2515 per ETH.
For this epic surge of Ethereum after half a year of silence, the community has indeed gained more confidence and hope, which has also led to a revival of the entire altcoin market. However, amidst the joy, there are also voices of pessimism. Below is a summary conducted by BlockBeats based on community discussions.
The optimists point out that the current market structure is similar to the eve of the bull markets in 2016 and 2020, predicting a life-changing surge in the next 3-6 months, where some altcoins may even achieve astonishing single-day gains of up to 40%.
@liuwei16602825 stated that this surge signifies the return of the bull market as a sure thing. There is no need to worry about a pullback. The driving force behind the surge uses a high-cost isolated operation, fearing a drop more than any retail investor and will definitely do everything to support the price.
Related Reading: "Ethereum Leads the Surge Triggering the 'Altcoin Season' Speculation, How Do Traders View the Future Market?"
The bears mainly believe that this surge is different from the bull market of 2021, as the current market lacks the confidence of large-scale retail investors entering and holding positions for the long term, with funds rotating too quickly.
@market_beggar observed that a Bitfinex E/B whale has started to close positions and believes that if this whale maintains its high-speed position-closing operation for the next few days, it can be inferred that the whale no longer sees the upside potential of ETH, preparing to take profits and exit. The closing time will be a key focus going forward.
@FLS_OTC stated that there are still many uncertainties at the macro level, and the liquidity cannot support a major bull market. At this stage, it is a "last hurrah," not a complete reversal, and will continue to remain in a short position.
@off_thetarget believes that after ETH transitioned from POW to POS, it lost the "gold standard" of mining machine power cost support. The staking economic model led to a breakdown in value anchoring. Additionally, the L2 ecosystem (such as Starknet, zkSync, etc.) suffered from liquidity fragmentation, failing to establish an effective capital inflow mechanism, causing the collapse of the split disc pattern. Furthermore, the ETH community's excessive pursuit of technical narratives divorced from real-world needs resulted in a weak ecosystem growth. Therefore, he believes that ETH's intrinsic value system has crumbled, and the price is bound to plummet to the 800-1200 range, with a decisive short position at 1800.
@Airdrop_Guard, based on the core logic of the "High Probability Trading Strategy," where three sets of underlying logic different trading systems (such as volume depletion, price supply-demand, long/short position funding rate, etc.) simultaneously issue a short signal at the same point (2580), creating a high-probability trading opportunity. He emphasizes that these systems must be based on different algorithms and logics (rather than mere technical indicator overlays). The current ETH trend aligns with the short conditions in multiple independent dimensions of his trading system, hence the decision to short.
Overall, Bitcoin still maintains over 54% market dominance, and institutional funds' continued preference for it may limit the altcoin's upward potential. The market's future direction will depend on multiple factors, such as Bitcoin's price trend, global macroeconomic conditions, and whether funds can effectively rotate from Bitcoin to the altcoin sector.
Although Ethereum's recent leadership in the market has brought about optimistic sentiment, investors still need to remain rational as different sectors of altcoins are likely to show divergence in trends. Whether this round of Ethereum's rise will usher in a true altcoin frenzy may require more time and conducive conditions.
How to Get Rich in Crypto Without Relying on Luck? Financial Veteran Raoul Pal's Macro Insights and Investment Path
Stablecoins Driving Global B2B Payment Innovation: How to Break Through Workflow Bottlenecks and Unlock Trillion-Dollar Market Potential?
These startups are building cutting-edge AI models without the need for a data center
After CEX and Wallet, OKX enters the payment game
Binance Sparks "Delist Concept": Can CEX Still Produce the Next ALPACA?
On April 24, Binance announced that it would delist four tokens, including Alpaca Finance ($ALPACA), on May 2, and cease trading of these pairs' perpetual futures contracts at 00:00 on May 1, 2025, Beijing time. Fast forward to the last day of perpetual futures trading delisting, ALPACA surged on the liquidation heat map. Over the past 24 hours, a total of $52.21 million evaporated in ALPACA's contract trading, exceeding the sum of the token's liquidation volume over the past two years.
Historically, when a token is listed on Binance, many traders would buy the news instantly ("Buy the News"). As the Binance listing effect gradually waned, traders found another path, which is to short sell the tokens set to be delisted from Binance ("Sell the News"). This strategy often has a very high success rate. However, as traders followed this path, they encountered the Alpaca on their short-selling journey.
Every thrilling market manipulation game requires careful preparation. Before Binance's official announcement, on April 10, $ALPACA was ranked 7th in the preliminary list of the second batch of "Vote for Delisting" on Binance, causing its price to plummet almost by half. However, in the five days leading up to Binance's official announcement, from April 19 to April 23, trading volume suddenly surged.
The story traces back to the start of Binance's second round of "Vote for Delisting," where ALPACA was included in the delisting candidates list, ranked 7th among 17 projects. After the completion of Binance's delisting vote count, $ALPACA was included in the projects to be delisted. The market did not react significantly, price fluctuations were not substantial, but trading volumes expanded abnormally, suggesting the entry of "manipulative funds" into the community.
On April 24, Binance officially announced the delisting of the $ALPACA spot trading pair on May 2 and the settlement of the futures contracts on April 30. Following the announcement, the spot price of $ALPACA dropped from $0.0329 to $0.029, with a market cap of only about $5 million. However, what followed were two price "rollercoaster" moments; within an hour, the price surged from $0.029 to $0.0857, an increase of about 195%, only to rapidly drop back to $0.04 within 3 hours. Shorts were caught off guard, and the open interest of contracts surged rapidly, initiating the "long and short grinder" mode.
On April 25, Alpaca Finance officially announced that the trading volume in the past 24 hours had exceeded 1 billion tokens. The liquidity provider had suggested a "minting for stability" to be returned to the treasury after a decrease in trading volume. However, as public opinion began to ferment, opposition filled the community. Alpaca Finance deleted the previous tweet and posted a new one at 9 p.m. on the same night, announcing the cancellation of the minting due to community opposition.
On April 26, Binance amended the contract funding rate rules, shortening the maximum rate cap settlement period to hourly and setting it at up to ±2%. Some high-leverage accounts continued to hold short positions against the high rate and were liquidated. Millions of dollars disappeared within a few hours, with $13 million in short positions vanishing on a token with a market cap of less than $30 million.
With the establishment of this short-selling trend, the price skyrocketed nearly 12 times from a low of $0.029 to $0.3477 within 3 days. The contract's open interest surged significantly, especially with a notable increase in short positions, resembling a microcosm of the Wall Street battle of GME's retail investors. However, this time, the retail investors' opponents could continue to mint additional chips.
From April 26 to April 29, these days were relatively calm, with the price fluctuating around $0.2 to $0.34. On April 29, Binance announced another increase in the rate cap to ±4%. Theoretically, such a high rate would severely impact short positions. If the rate remains at -4%, the bears will face a 96% "cost of ruin" after holding a short position for 24 hours. However, miraculously, the price plummeted from $0.27 to $0.067.
On April 30, with the contract delisting and liquidation scheduled in the final 24 hours, the price continued to experience intense fluctuations. ALPACA's attention peaked, with its highest price reaching $1.2 at one point. From a week before the delisting announcement to the eve of the contract delisting, ALPACA's price surged 40 times, creating an independent market for the token delisted by Binance. The total liquidation volume across the network also reached $50 million, with $42 million in "bearish fuel" beneath the price surge.
After the first surge of ALPACA, Heyi, the co-founder of Binance, replied to a netizen asking, "Can the teacher who buys the shell guarantee breakeven?" This has also triggered endless speculation among community members.
KOL Tunbtc believes that Heyi's reply to this matter was the starting point of ALPACA's surge. "The large holders of Alpaca's native token, by transferring spot chips, operating rights, and distribution rights, have pledged allegiance to Binance's deep-water core interest circle, allowing it to fully harvest market liquidity before delisting, slaughtering opposing positions." Through a triple path of fees, contract liquidations, and spot volatility, they converted user attention into profits.
He also called on Binance to thoroughly investigate this matter, clarify which market maker is manipulating the candlestick patterns, as ALPACA saw an 18x surge within 24 hours with users liquidated of tens of millions of dollars, while previously GPS's 500% surge was promptly halted, and expressed his sentiment: "All of this is thought-provoking."
Wenze, the founder of Beta Capital, believes that bypassing the regular listing process, buying shells, renaming, and restarting has crossed Binance's bottom line of maintaining listing credibility and brand compliance. Binance sometimes has a high tolerance for market fluctuations, and the OM issuance only adjusts the collateralization ratio, with many projects only allowed for leveraged trading. However, once the project, such as these "shell projects," is identified, it is easily labeled for observation, triggering a vote for delisting, ultimately leading to delisting rather than using mild measures.
Renowned KOL Rui, "YeruiZhang," likened the ALPACA incident to "crazy revenge on an ex" and shared a piece of insider information, claiming that the original whale behind ALPACA was a team that controlled BSC's MEV for a period of time and expressed dissatisfaction with Binance's current management for some reason. The comments section is rampant with speculation that it is BSC's whale 48CLUB, and 48CLUB's Ian even personally appeared to eat "his own melon."
With the recent buzz around VOXEL's surge and the wealth effect and discussion surrounding ALPACA, more and more "delisting concepts" have emerged. This concept does not necessarily refer to tokens that have already been delisted but rather shares some common characteristics of delisted tokens.
Famous KOL Chuanmo recently shared on Twitter his logic for choosing concept tokens and listed several tokens, all of which experienced varying degrees of price increase after his recommendation.
His "Concept Delisting" strategy involves selecting low-cap tokens from Bybit and Binance, arranging them by market cap from lowest to highest, with almost 100% price increase for the tokens with the highest holdings/circulating market cap. He buys three tokens daily following this order with a fixed amount, and based on the holdings/circulating supply ratio, he removes tokens that no longer meet the criteria daily and continues to buy the new top three tokens.
Many community members have tested this strategy, with some creating helpful tools. The dreamer Disney "discountifu" has created a dashboard, and Vivek10 early bird "vivekw_eth" has developed a monitoring and alert system that can be directly pushed to WeChat with a copyable link, although it is currently deployed locally and not yet entirely stable.
However, when using tools created for free by community members, please be cautious. While there are many enthusiastic contributors in the community, there are also many uncertain factors in this dark forest.
In an increasingly insular market, retail investors not only have to contend with whales and other retail investors but also must bear many unstable elements. The recent ALPACA incident serves as a warning to us. Whether it's a primary or secondary listing on a top-tier exchange or the "Concept Delisting" approach, we need to make rational asset allocations amidst FOMO to protect our principal and reach the other shore.
The mention of all tokens above does not constitute financial investment advice "NFA".
RWA Evergreen Product Crisis: Why is the GLP Model Doomed to Collapse Under RWA Evergreen?
Science Equity Movement: DeSci's Trillion-Dollar Knowledge Economy Reconstruction Revolution
Sentient In-Depth Research Report: Secures $85 Million in Funding to Build a Decentralized AGI New Paradigm
a16z Leads $18M Seed Round for Catena Labs, Crypto Industry Bets on Stablecoin AI Payment
Pharos, deeply integrated with AntChain, is about to launch. How can we get involved?
$COIN Joins S&P 500, but Coinbase Isn't Celebrating
On May 13, S&P Dow Jones Indices announced that Coinbase would officially replace Discover Financial Services in the S&P 500 on May 19. While other companies like Block and MicroStrategy, closely tied to Bitcoin, were already part of the S&P 500, Coinbase became the first cryptocurrency exchange whose primary business is in the index. This also signifies that cryptocurrency is gradually moving from the fringes to the mainstream in the U.S.
On the day of the announcement, Coinbase's stock price surged by 23%, surpassing the $250 mark. However, just 3 days later, Coinbase was hit by two consecutive events: a hack where employees were bribed to steal customer data and a demand for a $20 million ransom, and an investigation by the U.S. Securities and Exchange Commission (SEC) into the authenticity of its claim of having over 100 million "verified users" in its securities filings and marketing materials. These two events acted as mini-bombs, and at the time of writing, Coinbase's stock had already dropped by over 7.3%.
Coincidentally, Discover Financial Services, being replaced by Coinbase, can also be considered the "Coinbase" of the previous payment era. Discover is a U.S.-based digital banking and payment services company headquartered in Illinois, founded in 1960. Its payment network, Discover Network, is the fourth largest payment network apart from Visa, Mastercard, and American Express.
In April, after the approval of the acquisition of Discover by the sixth-largest U.S. bank, Capital One, this well-established digital banking company of over 60 years smoothly handed over its S&P 500 "seat" to this emerging cryptocurrency "bank." This unexpected coincidence also portrayed the handover between the new and old eras in Coinbase's entry into the S&P 500, resembling a relay race scene. However, this relay baton also brought Coinbase's accumulated "external troubles and internal strife" to a tipping point.
Over the past decade, cryptocurrency exchanges have been the most stable "profit machines." They play a role in providing liquidity to the entire industry and rely on trading fees to sustain their operations. However, with the comprehensive rollout of ETF products in the U.S. market, this profit model is facing unprecedented challenges. As the leader in the "American stack," with over 80% of its business coming from the U.S., Coinbase is most affected by this.
Starting from the approval of Bitcoin and Ethereum spot ETFs, traditional financial capital has significantly onboarded users and funds that originally belonged to exchanges in a more cost-effective, compliant, and transparent manner. The transaction fee revenue of cryptocurrency exchanges has started to decline, and this trend may further intensify in the coming months.
According to Coinbase's 2024 Q4 financial report, the platform's total trading revenue was $417 million, a 45% year-on-year decrease. The contribution of BTC and ETH's trading revenue dropped from 65% in the same period last year to less than 50%.
This decline is not a result of a decrease in market enthusiasm. In fact, since the approval of the Bitcoin ETF in January 2024, the inflow of BTC into the U.S. market has continued to reach new highs, with asset management giants like BlackRock and Fidelity rapidly expanding their management scale. Data shows that BlackRock's iShares Bitcoin ETF (IBIT) alone has surpassed $17 billion in assets under management. As of mid-May 2025, the cumulative net inflow of 11 major institutional Bitcoin spot ETFs on the market has exceeded $41.5 billion, with a total net asset value of $1214.69 billion, accounting for approximately 5.91% of the total Bitcoin market capitalization.
Institutional investors and some retail investors are shifting towards ETF products, partly due to compliance and tax considerations. On one hand, ETFs have much lower trading costs compared to cryptocurrency exchanges. While Coinbase's spot trading fee rate varies annually in a tiered manner but averages around 1.49%, for example, the management fee for IBIT ETF is only 0.25%, and the majority of ETF institution fees fluctuate around 0.15% to 0.25%.
In other words, the more rational users are, the more likely they are to move from exchanges to ETF products, especially for investors aiming for long-term holdings.
According to multiple sources, several institutions, including VanEck and Grayscale, have submitted applications to the SEC for a Solana (SOL) ETF, with some institutions also planning to submit an XRP ETF proposal. Once approved, this may trigger a new round of fund migration. According to a report submitted by Coinbase to the SEC, as of April, the platform's trading revenue from XRP and Solana accounted for 18% and 10%, nearly one-third of the platform's fee revenue.
However, the Bitcoin and Ethereum ETFs passed in 2024 also reduced the fees for these two tokens on Coinbase from 30% and 15% to 26% and 10%, respectively. If the SOL and XRP ETFs are approved, it will further undermine the core fee revenue of exchanges like Coinbase.
The expansion of ETF products is gradually weakening the financial intermediary status of cryptocurrency exchanges. From their original roles as matchmakers and clearers to now gradually becoming mere "on-ramps and off-ramps" for funds, exchanges are seeing their marginal value squeezed by ETFs.
On May 12, 2025, SEC Chairman Paul S. Atkins gave a keynote speech at the Tokenization and Cryptocurrency Working Group roundtable. The theme of his speech revolved around "It is a new day at the SEC," where he indicated that the SEC would not approach enforcement and regulation the same way as before but would instead pave the way for cryptocurrency assets in the U.S. market.
With signs of cryptocurrency compliance such as the SEC's "NEW DAY" declaration, an increasing number of traditional brokerages are attempting to enter the cryptocurrency industry. One of the most representative cases is the well-known U.S. brokerage Robinhood, which began expanding its crypto business in 2018. By the time of its IPO in 2021, Robinhood's crypto business revenue accounted for over 50% of the company, with a significant boost from the Dogecoin "moonshot" promoted by Musk.
In Q1 2025 earnings report, Robinhood showcased strong growth, especially in revenue from cryptocurrency and options trading. Fueled by Trump's Memecoin, cryptocurrency-related revenue reached $250 million, nearly doubling year-over-year. Consequently, Robinhood Gold subscription users reached 3.5 million, a 90% increase from the previous year, with the rapid growth of Robinhood Gold providing the company with a stable source of income.
Meanwhile, RobinHood is actively pursuing acquisitions in the cryptocurrency space. In 2024, it announced a $2 billion acquisition of the long-standing European cryptocurrency exchange Bitstamp. Additionally, Canada's largest cryptocurrency CEX, WonderFi, which recently went public on the Toronto Stock Exchange, also announced its integration with RobinHood Crypto. After obtaining virtual asset licenses in the UK, Canada, Singapore, and other markets, RobinHood has taken a proactive approach in the compliant cryptocurrency trading market.
Furthermore, an increasing number of brokerage firms are exploring the same path. Futu Securities, Tiger Brokers, and others are also dipping their toes into cryptocurrency trading, with some having applied for or obtained the VA license from the Hong Kong SFC. Although their user bases are currently small, traditional brokerages have a natural advantage in user trust, regulatory licenses, and low fee structures. This could pose a threat to native cryptocurrency platforms in the future.
In April 2025, security researchers discovered that some Coinbase user data was leaked on the dark web. While the platform initially responded by attributing it to a "technical misinformation," it still raised concerns among users regarding its security and privacy protection. Just two days before Dow Jones Indexes announced Coinbase's addition to the S&P 500 Index, on May 11, 2025, Coinbase received an email from an unknown threat actor claiming to have obtained customer account information and internal documents, demanding a $20 million ransom to keep the data private. Subsequent investigations confirmed the data breach.
Cybercriminals obtained the data by bribing overseas customer service agents and support staff, mainly in "non-U.S. regions such as India." These agents abused their access to Coinbase's internal customer support system and stole customer data. As early as February this year, blockchain detective ZachXBT revealed on X platform that between December 2024 and January 2025, Coinbase users lost over $65 million to social engineering scams, with the actual amount potentially higher.
Among the victims was a well-known figure, 67-year-old Ed Suman, an established artist in the art world for nearly two decades, having been involved in the creation of artworks such as Jeff Koons' "Balloon Dog" sculpture. Earlier this year, he fell victim to an impersonation scam involving fake Coinbase customer support, resulting in a loss of over $2 million in cryptocurrency. ZachXBT critiqued Coinbase for its inadequate handling of such scams, noting that other major exchanges have not faced similar issues and recommending Coinbase to enhance its security measures.
Amidst a series of ongoing social engineering incidents, although there has not been any impact on user assets at the technical level so far, it has raised concerns among many retail and institutional investors. Especially institutions holding massive assets on Coinbase. Just considering the U.S. BTC ETF institutions, as of mid-May 2025, they collectively hold nearly 840,000 BTC, and 75% of these are custodied by Coinbase. If we price BTC at $100,000, this amount reaches a staggering $63 billion, which is equivalent to the nominal GDP of two Iceland in the year 2024.
In addition, Coinbase Custody also serves over 300 institutional clients, including hedge funds, family offices, pension funds, and endowments. As of the Q1 2025 financial report, Coinbase's total assets under management (including institutional and retail clients) reached $404 billion. The specific amount of institutional custodied assets was not explicitly disclosed in the latest report, but it should still be over 50% based on the Q4 2024 report.
Once this security barrier is breached, not only could the rate of user attrition far exceed expectations, but more importantly, institutional trust in it would undermine the foundation of its business. Therefore, after a hacking event, Coinbase's stock price plummeted significantly.
Facing a decline in spot trading fee revenue, Coinbase is also accelerating its transformation, attempting to find growth opportunities in derivatives and emerging assets. Coinbase acquired a stake in the options platform Deribit at the end of 2024 and announced the official launch of perpetual contract products in 2025. This acquisition fills in Coinbase's gap in options trading and its relatively small global market share.
Deribit has a strong presence in non-U.S. markets, especially in Asia and Europe. The acquisition has enabled Coinbase to gain a dominant position in bitcoin and ethereum options trading on Deribit, accounting for approximately 80% of the global options trading volume, with daily trading volume remaining above $2 billion.
Meanwhile, 80-90% of Deribit's customer base consists of institutional investors, with their professionalism and liquidity in the Bitcoin and Ethereum options market highly favored by institutions. Coinbase's compliance advantage, coupled with its already robust institutional ecosystem, makes it even more suitable. By using institutions as an entry point, it can face the squeeze from giants like Binance and OKX in the derivatives market.
Facing a similar dilemma is Kraken, which is attempting to replicate Binance Futures' model in non-U.S. markets. Since the derivatives market relies more on professional users, fee rates are relatively higher and stickiness is stronger, making it a significant source of revenue for exchanges. In the first half of 2025, Kraken completed the acquisition of TradeStation Crypto and a futures exchange, aiming to build a complete derivatives trading ecosystem to hedge the risk of declining spot transaction fee income.
With the surge of Memecoin in 2024, Binance, OKX, and various CEX platforms began massively listing small-market-cap, highly volatile tokens to activate active trading users. Due to the wealth effect and trading activity of Memecoins, Coinbase was also forced to join the battle, successively listing popular tokens from the Solana ecosystem such as BOOK OF MEME and Dogwifhat. Although these coins are controversial, they are frequently traded, with fee rates several times higher than mainstream coins, serving as a "blood-boosting" method for spot trading.
However, due to its status as a publicly traded company, this practice is a riskier endeavor for Coinbase. Even in the current crypto-friendly environment, the SEC is still investigating whether tokens like SOL, ADA, and SAND constitute securities.
In addition to the forced transformation strategies carried out by the aforementioned CEXs, they are also starting to lay out RWAs and the most talked-about stablecoin payment fields, such as the PYUSD launched through a collaboration between Coinbase and Paypal, Coinbase's support for the Euro stablecoin EURC by Circle that complies with EU MiCA regulatory requirements, or the USD1 launched through a collaboration between Binance and WIFL. In the increasingly crowded trading field, many CEXs have shifted their focus from just the trading market to the application field.
The golden age of transaction fees has quietly ended, and the second half of the crypto exchange platform game has silently begun.
App