Odaily Planet Daily reports that Wasabi Protocol released a security incident update, stating that attackers exploited a configuration vulnerability in its AWS infrastructure's Spring Boot Actuator to steal private keys controlling EVM smart contracts and steal approximately $4.8 million in user funds and $900,000 in protocol vault funds. The attack chain originated from a public server used for analysis, whose Actuator heap dump was not properly password protected. This allowed attackers to obtain credentials from another server and ultimately gain control of the smart contract's private keys. This incident only affected EVM deployments, including some vaults on Ethereum, Base, Blast, and Berachain. Solana deployments and the Prop AMM were unaffected. Wasabi Protocol stated that it has not yet provided a final compensation plan for users, but "compensating all affected users" remains the team's top priority. Future updates on the investigation's progress will be released on the Discord community.

According to Huoxun Finance, the Estonian Financial Supervisory and Disposal Authority (MICA) has issued an investor warning to BB Trade Estonia OÜ, the operator of the Zondacrypto exchange, alleging that it failed to publish a white paper for the "TeamPL" token listed on its platform, as required by the EU's Crypto Asset Markets Regulation (CIMR), thus violating MiCA's regulations regarding transparency and investor disclosure obligations. This warning, coupled with previously reported withdrawal difficulties and cross-border investigations, has further intensified the compliance pressure on the exchange.

According to Huoxun Finance, the Rwandan House of Parliament passed a virtual asset regulation bill on May 5th, aiming to regulate cryptocurrency trading, protect investors, and maintain the stability of the financial system. The bill stipulates that individuals operating virtual asset businesses without authorization will face 3 to 5 years imprisonment and fines of 30 million to 50 million Rwandan francs, while companies can be fined up to 100 million Rwandan francs. The Capital Markets Authority will serve as the main regulatory body, working in conjunction with the National Bank of Rwanda for enforcement. The bill is pending presidential signature and will take effect after publication in the Official Gazette. Detailed implementing rules will be formulated separately after the law comes into effect.

Odaily Planet Daily reports that Polymarket has announced the latest progress on its feature updates, including the introduction of latency spam mitigation measures to ensure order placement and cancellation, fixing the "insufficient balance/authorization" error, and addressing another core issue affecting limit orders, which is expected to be resolved in the coming days. Furthermore, Polymarket stated that it has identified and banned multiple clusters of "ghost-fill" accounts, all of which were created before the deposit wallet system went live. Accounts exhibiting "ghost-fill" behavior will be identified and banned, and the deposit wallet system will prevent violating accounts from creating new accounts in bulk. More updates will be released in the coming week to resolve previous legacy issues.

According to data from RootData, a Web3 asset data platform, Caldera (ERA) will unlock approximately 18.08 million tokens worth about $2.72 million at 3 PM Beijing time on May 17.