ETH Foundation Reforms, Bybit Hack, and Meme Coins

“Critical Correction” and “Tactical Retreat”

For bitcoin, the week started at the $95,500 mark. However, on the night of Tuesday, 25 February, the rate of the first cryptocurrency broke through the $91,000 level, which had previously limited its decline. 

The cryptocurrency Fear & Greed Index collapsed from 49 to 25 points overnight, moving into extreme anxiety territory.

The price hit a local low around $78,000 by midweek.

On 2 March, amid Donald Trump’s announcement to include XRP, SOL and ADA in the US national cryptocurrency reserve, the price of bitcoin went up, although the asset was not mentioned.

At the time of writing, the digital gold is trading at ~$90,600 with a capitalisation of $1.75 trillion, down around 8.5% for the week.

Experts at Bitfinex exchange declared that the drop below $91,000 is a “tipping point” amid a three-month consolidation.

Analysts said the first cryptocurrency’s correlation with traditional financial markets is increasing. The decline in investor activity is supported by macroeconomic instability. 

Binance CEO Richard Teng called the crypto market correction a “tactical retreat.” In his opinion, the drawdown is short-term and will not last long;

“It is important to view this as a tactical retreat and not a reversal. This has happened before and the rebound was even stronger. That is why we should remain optimistic,” he wrote.

On 27 February, amid the ongoing market decline, the fear and greed index dropped to 10 points, corresponding to the zone of extreme panic. The last time such values were observed was in June 2022.

Matrixport analysts estimate that bitcoin’s current pullback will last until March or April before a rally to previous highs is attempted.

Specialists noted the strengthening of USD amid the US President’s threats to introduce duties against foreign trade partners, which reduces liquidity and puts pressure on risky assets.

In their opinion, the importance of macroeconomic factors for the pricing of the first cryptocurrency has increased amid the popularisation of digital gold trading by TradFi-investors via BTC-ETF.

According to a study by 10x Research, the majority of volume in ETFs (56%) is arbitrage-related. Traders profit from the difference between spot and futures quotes. 

In the current environment, funding rates and basis spreads are too low to justify holding positions and opening new ones, experts said.

Nexo platform analyst Ilya Kalchev considers that bitcoin quotes could collapse to the support level at $72,000.

According to him, now “the market is regrouping”. The rapid recovery of digital gold is in question due to a sharp deterioration in investor sentiment.

“A temporary pullback is possible while the market fills in the gaps after rapid growth. Bitcoin is more likely to form a stable support in the range of $72,000-80,000,” Kalchev noted.

The above level “could form the basis for a more sustained recovery, reducing the likelihood of a deep correction.”

According to analysts at IntoTheBlock, the rise in bitcoin network activity indicates a possible trend reversal.

As of 28 February, the number of active addresses had risen to 912,300 – the level of December 2024, when the price of digital gold was $105,000.

“Historically, bursts of onchain frenzy have often coincided with market peaks and lows associated with panicked sellers and enterprising buyers,” IntoTheBlock said.

Experts called it a sign of a “critical turning point”, although there are no direct guarantees of a change in dynamics;

Ethereum opened the week at $2800. On 28 February, the coin reached a local low near $2100, but by the weekend it stabilised near $2250;

At the time of writing, Ethereum is trading at $2270 with a market capitalisation of $272.54bn. The seven-day loss was about 18.3%.

CryptoRank noted the impact of Ethereum Foundation controversy and the effects of the meme-coin scandals on Solana on the exchange rates of the first cryptocurrency’s main competitors.

Among the top 10 assets by capitalization, all but XRP (+2.2%) and ADA (+9.7%) showed declines;

In seven days, the price of DOGE is down 10.7 per cent, BNB is down 5.6 per cent and SOL is down 5.5 per cent.

Reforms in Ethereum Foundation

On 28 February, Ethereum Foundation announced the creation of the Silviculture Society, an independent group that will make informal recommendations on key ecosystem development issues.

The main objective of the society is to uphold the fundamental principles of the project, such as open source, privacy, security and anti-censorship.

The Silviculture Society is made up of outside experts. Their advice will help the foundation make decisions while preserving the original ideals of the Ethereum network.

One of the society’s members is Matthew Green, a senior lecturer in the Department of Computer Science at Johns Hopkins University and one of the authors of the original Zerocash white paper.

On 1 March, EF announced the appointment of researcher Xiao-Wei Wang and Nethermind founder Tomasz Stanczak as co-executive directors. They will assume their duties on 17 March.

“If we play our cards right, today will be remembered as one of the most important turning points in Ethereum’s history,” commented core developer Tim Beyko on the appointment.

Amid a reputation crisis, leading Ethereum Foundation (EF) researchers, including Vitalik Buterin, Justin Drake and Dankrad Feist, answered questions about scaling, L1 revenue and security as part of the AMA session.

Developers, including Buterin, touched on improving the economics of the network, suggesting returning revenue from L2 and promoting so-called “native rollups.”

“The goal is Ethereum neutrality, not EF neutrality – often the two goals coincide, but sometimes they diverge. The big risks I see now are at the L2 and wallet level, as well as staking and custodial providers. EF has recently begun to act in the former two areas, pushing for the adoption of interoperability standards,” the network’s co-founder explained in response to a question about a potential “corporate takeover” of blockchain by an organisation.

Drake and Feist said the need to scale native “data availability” (DA) on L1 instead of alternatives like the restaking platform EigenLayer, which pose a “big threat.”

On 24 February at epoch 115,968, developers activated the Pectra hardfork in the Holesky testnet. As a result, the network stopped finalising slots.

According to Paritosh Jayanti of Ethereum Foundation, the upgrade “encountered a configuration issue on three core network clients.” The identified bug does not affect the core network in any way and is related to Holesky’s features, the developer clarified.

“The problem occurred because Holesky (and Sepolia) deposit contracts are on a different address from the core network. Why? I have no idea,” confirmed Ethereum teamleader Tim Beyko.

Activation of the Pectra hardfork on the Sepolia test network is tentatively scheduled for 5 March.

The Aftermath Of The Bybit Hack

By 24 February, cryptocurrency exchange Bybit had fully recovered Ethereum (~444,870 ETH) reserves stolen in the 21 February attack.

According to Lookonchain, the platform has raised 446,870 ETH (~$1.23bn) through loans, whale deposits and direct purchases since the hack. On 25 February, the exchange returned a 40,000 ETH  debt to Bitget;

According to Blockstream co-founder and cypherpunk Adam Back, the reason for Bybit’s hacking was “the faulty design of EVM.”

“The EVM could drop to zero and no one would care. The problem is that the Ethereum virtual machine hurts trust in the ecosystem, which unfairly reflects on bitcoin,” the expert said.

According to Beck, the Bybit incident has nothing to do with the security of hardware wallets, but is due to the difficulty of the EVM in correctly verifying the transaction.

Unlike the second most capitalised cryptocurrency, the bitcoin ecosystem is devoid of such vulnerabilities, he added.

According to the official preliminary incident report, the attack on Bybit realised through the Safe (Wallet) infrastructure rather than the systems of the trading platform itself.

According to an investigation by Sygnia analysts, the attacker injected malicious JavaScript code into Safe (Wallet) resources stored in the AWS S3 cloud.

The criminals’ script only activated on transactions associated with Bybit contract addresses and an unknown test address, indicating the targeted nature of the attack.

Two minutes after the asset theft, the hacker replaced the modified files with the original versions to cover their tracks.

Cached files with the modifications made on 19 February were found on the devices of the three signatories of the fake transaction. The code manipulated data at the time of approval, spoofing the recipient’s address. 

“The results of the forensic investigation of the hosts of the three signatories indicate that the root cause of the attack is malicious code originating from the Safe (Wallet) infrastructure. No evidence of compromise has been identified in the Bybit infrastructure. The investigation is ongoing to finalise the findings,” the report concludes.

Binance founder Changpeng Zhao (CZ) said the report “is vaguely written and leaves more questions than answers.”

According to CZ, the findings presented did not answer a number of important questions:

• What does “hacking into the developer’s machine” mean and how was it accomplished?
• How did this device gain access to a “Bybit managed account”?
• How did the hackers defrauded the Ledger verification stage of several signatories? 
• Was Bybit’s $1.46bn address the largest under Safe and why didn’t attackers target others?
• What lessons can other providers of multisig self-storage wallets and users learn?

Martin Koppelman, co-founder of the company behind Safe, Gnosis, provided CZ with some clarification. In general, he repeated the theses from the report regarding the attack vector and failed to explain the methods used to deceive the signatories;

According to Koppelman’s estimates, the Bybit vault was indeed one of the largest and apparently the first to suffer such an attack – which is why the hackers tried to cover their tracks.

The entrepreneur also spoke about the measures being developed to strengthen transaction security.

Regarding CZ’s third question, Ledger CTO Charles Guimet gave an answer. According to him, the hardware wallet provider provides a number of solutions for securing transactions, but it is difficult to integrate them into Safe due to technical peculiarities.

“To me, the most important takeaway from the Bybit hack is this: companies and financial institutions should use enterprise-grade storage solutions. Placing $1.46bn in a free Safe (Wallet) smart contract with a group of signatories designed for retail users should be a relic of the past,” said the programmer.

On 26 February, the Federal Bureau of Investigation (FBI) confirmed that hackers from the North Korean group TraderTraitor, also known in the industry as Lazarus Group, APT38, BlueNoroff and Stardust Chollima, were behind the attack on the Bybit exchange.

According to the bureau, the attackers are actively converting stolen assets into bitcoins and other digital currencies. The funds are dispersed to thousands of addresses on multiple blockchains. These cryptocurrencies are expected to be laundered and converted to fiat.

The Bybit team also succefdully blocked the meme token QinShihuang, allegedly linked to hackers who broke into the platform.

The launch of a meme coin called QinShihuang was first reported by onchain sleuth ZachXBT. He revealed that a Lazarus-linked wallet transferred 60 SOLs to another address before issuing 500,000 QinShihuang tokens. In three hours, trading volume reached $26 million.

SEC continues to Close Cases Against Cryptocurrency Companies

The US Securities and Exchange Commission (SEC) has stopped a number of investigations against cryptocurrency companies.

On 24 February, the Commission notified it was stopping a case against a division of online broker Robinhood.

“We have always respected the federal securities laws and have never allowed transactions to take place with them,” said Robinhood General Counsel Dan Gallagher.

He said the company is pleased with the SEC’s decision and sees a “return to the rule of law.”

On the back of the news, Robinhood shares rose 3% in pre-market trading. Since the beginning of the year, the company’s securities have added 30.83%.

On 25 February, Uniswap Labs’ Uniswap Labs team announced that the agency had concluded its investigation into the company and had no plans to bring charges.

“For DeFi this is a tremendous achievement. This result confirms that our technology is compliant with the law and our work has long-term value,” Uniswap representatives commented on the case closure.

On 27 February, ConsenSys CEO Joseph Lubin announced that the SEC has tentatively agreed to withdraw the lawsuit against the company.

The conclusion of the litigation still depends on final agency approval, he said, but key agreements have already been reached.

“Now we can fully focus on development. 2025 will be the best year yet for Ethereum and ConSensys. The transition to a more decentralised world is accelerating,” Lubin noted.

On the same day, the Commission closed the case against Coinbase’s platform. 

“It’s time for the Commission to correct its approach and develop policy on cryptocurrencies in a more transparent manner,” said Acting SEC Chairman Mark Ueda. 

Mem-coins Have “Cooled Off”

As part of the updated policy, the SEC also explained the status of meme-coins. According to the Commission’s experts, such assets are generally not securities and are closest to “collectible assets.”

Participants of the market of “funny coins” do not need to register with the agency. The SEC clarified that buyers and holders of such assets are not protected by securities laws. 

That said, meme-coin fraud can be the basis for prosecution by other regulators or law enforcement.

The regulator emphasised that this statement is not a guidance with legal force, but is intended to clarify the application of securities laws to cryptocurrencies.

Despite the SEC’s expression of a relatively friendly stance, interest in the segment has declined significantly.

As of 3 March, meme-coin trading volumes on non-custodial exchanges were approximately 10% of the 19 January peak.

Against the background of the rise and fall of LIBRA, the trading volume again demonstrated a local maximum, but then began to decline.

The slump in interest in meme-coins amid the market correction may be indicated by the decline in Pump.fun‘s “production capacity” – the “meme-token factory” struggled with a sharp decline in the number of tokens that reach listing on the decentralized Solana exchange Raydium. 

The GMCI Meme Index, which reflects the capitalisation of the largest “funny coins”, has fallen to September levels.

Since the beginning of the year, the value has decreased by 48%;

The graph below also illustrates the significant and almost synchronised decline in coin capitalisation on various themes since the peak reached in early December.

According to media reports, the US Justice Department has initiated an investigation into Argentine President Javier Milieu’s connection to the LIBRA promotion. Authorities are also looking into the roles of the project’s founders – Hayden Davis of Kelsier Ventures, Julian Pech of KIP Protocol and two Argentine entrepreneurs Mauricio Novelli and Manuel Terrones Godoy.

The investigation began with a report that indicated the involvement of the aforementioned individuals in LIBRA.

The case is also being reviewed by Argentine authorities, who are assessing the extent of Milei’s involvement in the project and looking into the possibility of offences of abuse of power, influence peddling and fraud.

Argentina’s president has ordered an internal investigation.

On 17 February, Bubblemaps linked LIBRA and US First Lady Melania Trump’s coin (MELANIA) to the same team. KIP Protoco denied involvement in the project.