Donovan Choy

This is a segment from the 0xResearch newsletter. To read full editions, <a href="https://blockworks.co/newsletter/0xresearch" target="_blank" rel="noreferrer noopener">subscribe</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Phantom wallet announced yesterday that it was integrating Hyperliquid perps right into its wallet interface.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Introducing: Phantom Perps 👻 ♾️ Go long or short in just a few taps. 100+ markets. Up to 40x leverage. All in your pocket. Powered by <a href="https://twitter.com/HyperliquidX?ref_src=twsrc%5Etfw">@HyperliquidX</a> <a href="https://t.co/YDKjUGBdEn">pic.twitter.com/YDKjUGBdEn</a>&mdash; Phantom (@phantom) <a href="https://twitter.com/phantom/status/1942628993636917311?ref_src=twsrc%5Etfw">July 8, 2025</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



This is <a href="https://x.com/hyperliquidbull/status/1942630523408351446">surprising</a>, mainly because Phantom is Solana’s marquee wallet and far ahead of competing wallets like Solflare or Backpack, with 15 million monthly active users (MAUs).



If Phantom wanted a cut of the perps market, I suppose one would’ve naively expected it to partner up first with a native Solana perps DEX like Drift or <a href="https://x.com/DefiSolar/status/1942657673994068081">Jupiter</a>.



But though Drift or Jupiter might be hometown favorites, Hyperliquid is where the money already is.



<figure class="wp-block-image"><img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcFE4l4Km4H4mpQpTG8JLhnqumZMyAFqEgNLpMaiAKAF0towGfMZANz_aUCNsS6FI74YF77MmZLj-O3C7wY6vq8uxf-plujUo1HLgHr7uG85vviI-iyDQgiyYoxiFVFNDBrA03dvg?key=D8S8VRimuiNq_D7bNzCT1w" alt=""/></figure>



Source: <a href="https://dune.com/uwusanauwu/perps">Dune</a>



So the wallet that onboarded millions to Solana is now shepherding flow to a rival venue, which doesn’t boost Solana fees or TVL at all.



Just this morning, Kraken and Backed announced that xStocks would also be launching on BNB Chain.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Welcome Kraken, Backed and xStocks to the <a href="https://twitter.com/BNBCHAIN?ref_src=twsrc%5Etfw">@BNBChain</a> ecosystem. 🤝<a href="https://t.co/gg2k8SEsgE">https://t.co/gg2k8SEsgE</a>&mdash; CZ 🔶 BNB (@cz_binance) <a href="https://twitter.com/cz_binance/status/1942933592541110398?ref_src=twsrc%5Etfw">July 9, 2025</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Soon, eligible Kraken customers will be able to deposit and withdraw those BEP-20 stock tokens straight from the exchange.



xStocks is Kraken and Backed’s tokenized stock product that debuted on Solana less than two weeks ago (I wrote about it <a href="https://blockworks.co/news/tokenized-stocks-good-bad">last week</a>).



Tokenized stocks may have been Solana-first, but they will be fiercely multichain. <a href="https://x.com/Bybit_Official/status/1939626244728840498">Bybit</a> is also integrating xStocks.



xStocks’ move to BNB Chain is no surprise, given Backed co-founder Adam Levi’s <a href="https://www.businesswire.com/news/home/20250522493630/en/Kraken-Partners-with-Backed-to-Launch-xStocks-on-Solana-Bringing-Tokenized-Equities-to-the-Masses">stated goal</a> for the product to “be a neutral, public good asset class” and eventually “expanding xStocks to other exchanges and chains.”



What investor mental model do these pieces of news affirm?



The Phantom x Hyperliquid news seems to simultaneously affirm both the <a href="https://blockworks.co/news/battle-for-wallet-supremacy">Fat Wallet</a> thesis and <a href="https://blockworks.co/news/crypto-infrastructure-bloat">Fat App</a> thesis.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">This Phantom x Hyperliquid integration is: • Bullish for Phantom (validation of fat wallet/super app thesis) • Bullish for Hyperliquid (validation of fat protocol thesis) • Bearish for Solana (they have no good perp dex, distribution moat is much smaller than perceived)&mdash; Uma Roy (@pumatheuma) <a href="https://twitter.com/pumatheuma/status/1942669033771536640?ref_src=twsrc%5Etfw">July 8, 2025</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Build a great wallet like Phantom, because wallets, not apps, own the users.



Or build a great app like Hyperliquid, because users follow the app, not the underlying chain.



But if you can, you should most definitely build a Fat Exchange like Robinhood or Kraken, because then you can take your users to whichever chain you want.



Kraken is a Fat Exchange, but it’s not quite as Fat as Robinhood’s 14 million MAUs.&nbsp;



That may explain Kraken’s decision to go multichain fast and cement its position on each respective blockchain.



There was never really a reason to believe that wallets, apps or CEXs would be loyal to any particular chain to begin with.



Time to totally disabuse that notion.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

0xResearch Newsletter

The winners and losers of Phantom’s Hyperliquid integration

Jack Kubinec

Jeff Albus

Howdy!



I’ve been reading a few of these ‘Love Is Blind’ exposés recently, which are always a little fascinating and a little terrifying.&nbsp;



In my own humble opinion, these lawsuits won’t make a meaningful dent in the show’s viewership. What will kill ‘Love Is Blind’ is the fact that the “social experiment” side of the show was settled like five seasons ago, and its storylines are growing increasingly bland.



I digress. As for Solana:



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<h2 class="wp-block-heading">Phantom may boost JitoSOL usage&nbsp;&nbsp;</h2>



Phantom and Jito — Solana’s most notable wallet app and its largest liquid staking provider — announced a partnership today.&nbsp;



Under the deal, users who are natively staking their solana on Phantom will have the option to convert their holdings to the JitoSOL liquid staking token (LST). On top of this, the companies say users will soon be “prompted” to convert unstaked SOL into JitoSOL within the Phantom wallet (I’m told this means in-app JitoSOL minting).



The significance of this is a matter of perspective.



On one hand, LSTs take immobile assets (staked SOL) and make them useful for DeFi applications — which leverages Solana’s base layer security to make the ecosystem more liquid. LSTs only <a href="https://dune.com/embeds/3756050/6316994">make</a> up 6% of all staked solana, so there’s a lot of potential for growth in this area.



But it’s worth noting that prior to the partnership, users could already purchase JitoSOL within Phantom if they wanted to. It takes two to three days to unstake solana, so the Jito-Phantom partnership is really just saving users a bit of hassle in doing something they could already do.



(Jito Foundation contributor Andrew Thurman pointed out that minting JitoSOL is more capital efficient than swapping SOL for JitoSOL, which is also worth noting.)&nbsp;



Looked at this way, Jito might be taking a bet that better education would lead to the adoption of JitoSOL. In other words, users who are staking their SOL might not understand that they can both earn yield and have a token via JitoSOL, and this partnership is akin to sending everyone a big push notification saying: “Hey, you’re leaving money on the table, just FYI!”



I ran this by Phantom’s head of growth, David Wu, who echoed the sentiment that the partnership is largely about education. He declined to comment on whether Jito had paid Phantom as part of the deal.&nbsp;



Jito appears to have convinced others in Solana DeFi that its bet will cash out. Kamino and MarginFi increased their JitoSOL loan-to-value (LTV) ratios — essentially making JitoSOL more valuable as collateral — while Drift raised its deposit cap for the asset.&nbsp;&nbsp;



Thurman said since SOL-JitoSOL is Solana DeFi’s most liquid LST pair, it should be seen as the most valuable LST for use as collateral.&nbsp;



As JitoSOL’s liquidity deepens, Thurman said he sees the LST becoming “the defacto collateral for Solana DeFi.”



— Jack Kubinec



<h2 class="wp-block-heading">Zero In</h2>



Here’s the market share of the four largest Solana LSTs over the past three months:



<figure class="wp-block-image"><img loading="lazy" decoding="async" width="800" height="575" src="https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png" alt="" class="wp-image-87365" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png?w=800 800w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png?w=768 768w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png?w=358 358w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png?w=363 363w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png?w=305 305w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-2.png?w=80 80w" sizes="auto, (max-width: 800px) 100vw, 800px" /></figure>



 



As you can see, JitoSOL and mSOL have seen their market dominance falter a bit in recent weeks, primarily driven by the relative growth of INF, a product offered by Sanctum. INF just recently passed bSOL, the LST offered by BlazeStake, to become the third-largest LST.



INF is a novel product whose “infinity pool” can be thought of as a basket of LSTs, offering holders exposure to the weighted average yield of tokens in the pool.



Its growth has also certainly been helped by Sanctum’s points-like program for its CLOUD token airdrop. The airdrop-farming window has ended on Sanctum for now, so it remains to be seen whether INF can continue to grab market share from incumbents.



— Jack Kubinec



<h2 class="wp-block-heading">The Pulse</h2>



It seems like it’s time to finally address the Iggy Azalea in the room: The decade-past-her-peak rapper’s memecoin is driving the online crypto conversation.



Ethereum co-founder Vitalik Buterin <a href="https://x.com/VitalikButerin/status/1798293391144366184">criticized</a> the trend of celebrity backed memecoins, emphasizing the speculative nature and lack of utility in these projects. He expressed his concerns on social media, <a href="https://x.com/VitalikButerin/status/1798290424622113230">stating</a> he was &#8220;feeling quite unhappy&#8221; about the <a href="https://blockworks.co/news/pump-dot-fun-caitlyn-jenner-memecoin">rise</a> of celebrity memecoins, comparing them unfavorably to earlier projects like the NFT based animated series &#8220;Stoner Cats,&#8221; which had a more <a href="https://x.com/stonercatstv/status/1606080857050976256">tangible</a> purpose.



In response, Azalea posted an image <a href="https://x.com/IGGYAZALEA/status/1798471807647068297">depicting</a> herself as a breastfeeding mother with Buterin as the baby, captioned &#8220;he was just hangry.&#8221; This led to a <a href="https://x.com/SCHIZO_FREQ/status/1798519802816082336">flood</a> <a href="https://x.com/chesterweb3/status/1798472282056343942">of</a> <a href="https://x.com/issguac/status/1798472243481383398">reactions</a> from the crypto community, with many users mocking Buterin and supporting Azalea&#8217;s retort. User @0xSweep <a href="https://x.com/0xSweep/status/1798477721233952858">commented</a>, &#8220;He gets all the girls,&#8221; while @kalvissh admitted, &#8220;This is not something I expected to see when I opened Twitter today.&#8221;



Buterin’s criticism and the subsequent social media reactions highlight the ongoing tension between calls for responsible blockchain development and the speculative fervor driving the memecoin craze. As regulatory bodies like the SEC <a href="https://x.com/IGGYAZALEA/status/1798621601371668935">monitor</a> these developments, the long-term viability and ethical <a href="https://x.com/poordart/status/1795727648414703880">considerations</a> of celebrity memecoins remain suspect.



Mother is up 96.9% over the last 24 hours. For my money though, I&#8217;d probably take the advice of the guy whose work makes the entire ecosystem possible in the first place. He just might know a bit more than some random pop singer trying to capitalize on the latest trend.



— Jeffrey Albus



<h2 class="wp-block-heading">One Good DM</h2>



A message from David Wu, head of growth at Phantom:



<figure class="wp-block-image"><img loading="lazy" decoding="async" width="564" height="480" src="https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-3.png" alt="" class="wp-image-87366" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-3.png?w=564 564w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-3.png?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-3.png?w=302 302w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-3.png?w=307 307w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-3.png?w=257 257w, https://blockworks-co.imgix.net/wp-content/uploads/2024/06/image-3.png?w=80 80w" sizes="auto, (max-width: 564px) 100vw, 564px" /></figure>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

liquid staking

Lightspeed Newsletter: Phantom may boost JitoSOL usage

James Cirrone

Crypto wallets are becoming an even bigger entry point for new users than centralized exchanges.&nbsp;



That’s according to Phantom co-Founder and CEO Brandon Millman who spoke Monday at the Permissionless conference in Austin, Texas.



And that’s why the phrase that anyone who’s been paying attention to crypto for half a minute has come across — “how do we onboard the next billion users” — is fundamentally flawed in Millman’s view.



“The space really needs to focus on…retention of users, and not actually trying to onboard all these net new users,” Millman said. “It doesn&#8217;t matter if you onboard a billion users if your retention is zero, because then you end up with no users.”



Having good security in place is the first step toward getting people to stick around. That’s because if they fall victim to a phishing scheme, it makes it dramatically less likely for them to persist in crypto.



However, the assembled panelists seemed eager to move away from seed phrases, a security measure that’s so rigid it can lock the end user out of their account.&nbsp;



Look no further than <a href="https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html">Stefan Thomas</a>, a programmer who has hundreds of millions of dollars worth of bitcoin trapped in a wallet to which he lost the password.



Braavos co-founder and CEO Motty Lavie went as far as to say that seed phrases are “almost the root of all evil.”



Braavos, a smart contract wallet, uses two-factor authentication, biometric authentication and a seed phrase, widening the ways users can access their assets. This, essentially, is a form of account abstraction, which can allow users to recover their funds in the event of losing their seed phrase.&nbsp;



A subsequent panel weighed the evolution of account abstraction and its benefits —&nbsp;chief among them being gasless payments.&nbsp;



Stackup co-founder and CEO John Rising described gas payments as a “huge barrier of entry that has now been knocked down by smart accounts” and paymasters.



“A paymaster is an entity that exists on-chain that can basically sponsor transactions for people. So if you have a marketplace, and you want creators to publish things to your marketplace, you can effectively pay for gas for that,” Rising said.



Still, even if account abstraction became the norm, panelists said crypto wallets would need to evolve to handle customer issues in a more standard manner.&nbsp;



As Lavie put it, people will inevitably make mistakes. They’ll click on links they shouldn’t click on and they’ll transfer funds they shouldn’t have transferred. 



Read more: <a href="https://blockworks.co/news/researcher-security-crypto-wallets">Researchers flag security concern for users of certain crypto wallets</a>



Millman and fellow panelist Jason Lau, OKX’s chief innovation officer, emphasized that providing customer support through standard, time-tested systems is the way to go.&nbsp;



“For some reason, crypto and Web3 don’t really take much inspiration from all of the customer support techniques that have been developed over many decades on Web2 and instead opt for sending people into a Discord channel,” Millman said.&nbsp;



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Brandon Millman

Wallet providers emphasize security as top hurdle to overcome

Sebastian Sinclair

Wallet service provider Phantom said Monday it has introduced a new feature allowing applications to authenticate users using a Solana address.



The introduction of Sign In With Solana (SIWS) is intended to improve the user experience and security by streamlining the traditional &#8220;connect&#8221; and &#8220;signMessage&#8221; flow into a single-click &#8220;signIn&#8221; method.



Traditionally, the connect function enables a user&#8217;s digital wallet to interact with an application, while “signMessage” allows the user to cryptographically verify their identity.



The message lacks human-readable information, which can sometimes lead to new and seasoned users agreeing to malicious prompts. 



Even in cases when connecting a wallet to trusted applications, unexpected pop-up signatures can often confuse or frighten new users, Phantom said in a <a href="https://phantom.app/learn/developers/sign-in-with-solana">statement</a>. This, in turn, can often be a major hurdle for new entrants, it said.



The one-click sign-in method, available as of Phantom version 23.11, allows Solana developers to prompt users to connect and sign a standardized authentication message and prove ownership of their addresses.



Designed as a drop-in replacement for the previous two-step authentication flow, the sign-in method also provides developers with a robust API for creating standardized authentication messages, Phantom said.



The responsibility for message construction shifts from applications to the wallet, allowing Phantom to scrutinize elements such as the site&#8217;s domain or the time of message issuance to ensure legitimacy.



It is unclear whether there could be fresh privacy concerns associated with the shift of responsibility in message construction. Blockworks has reached out to Phantom for comment.



In some instances, that construction may help slow or hinder the progress of malicious actors. That could help prevent instances like <a href="https://blockworks.co/news/solana-based-wallet-users-drained-in-suspected-exploit">last year’s breach</a>, when a coding error allowed hackers to easily find and use client passwords, leading to a breach in both Slope and Phantom wallets.



Private keys associated with the impacted wallets were either leaked or compromised, and these keys were then utilized to authorize fraudulent transactions, according to <a href="https://discover.luno.com/what-exactly-happened-in-the-slope-finance-hack/">reports</a> at the time.



The sign-in feature released on Monday makes authentication more consistent and allows Phantom to check for suspicious activity, its developers said.



Ethereum dapps similarly can facilitate a “sign in with Ethereum” feature using <a href="https://blockworks.co/tag/ethereum-name-service">Ethereum Name Service</a> (ENS), as part of a push for <a href="https://blockworks.co/news/what-is-decentralized-identity">decentralized identity services</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Phantom

Phantom materializes ‘sign in with Solana’ wallet authentication

Bessie Liu

<div id="highlights-block_62aa2d415a283" class="highlights">
 <ul>
 <li>The discovered vulnerability exposes browser wallet users’ secret recovery phrases</li>
 <li>Affected wallet providers were contacted, and the vulnerability was kept confidential until the security issues were remediated</li>
 </ul>
 
</div>



A number of popular browser-based crypto wallets are vulnerable to hacking under certain conditions, according to new research. 



Blockchain security firm Halborn found several instances where wallets including Brave, MetaMask and Phantom can be compromised under specific computer conditions — adding yet another wrinkle to traders still reeling from recent high-profile decentralized finance (DeFi) hacks.&nbsp;



The conditions can expose a crypto wallet user’s secret recovery phrase (a series of words generated that gives the owner access to their crypto), which can then be used to change their private key. All told, billions of dollars of digital assets are stored in software wallets.&nbsp;



Affected wallet providers were contacted and the vulnerability was kept under wraps until the security issues were remediated.



<h3 class="wp-block-heading">Who is affected? </h3>



Users who meet the following conditions may be at risk:



<ul class="wp-block-list"><li>Users who have unencrypted hard drives</li><li>Users who have previously imported their secret recovery phrase into a web extension on a device that is in the possession of someone else or have had their computer compromised</li><li>Users who have used the “show secret recovery phrase” checkbox to view their secret recovery phrase on-screen during the import process</li></ul>



Cryptocurrency wallets like the ones impacted by this vulnerability, such as Metamask, are a self-custody wallet — meaning users alone are responsible for safeguarding their private keys. 



“Exchanges like Coinbase or Binance usually hold custody of those keys on the behalf of their customers,” Steven Walbroehl, Halborn’s chief security officer and co-founder, told Blockworks.



“This impact is only for those that self-custody those assets, and it is the users&#8217; responsibility to take it seriously, upgrade the wallets to the patched version listed on the wallet developer&#8217;s websites, and to rotate their mnemonic phrase if they think it may be at risk,” Walbroehl said.&nbsp;



MetaMask has <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">asked</a> users to update their extension versions to 10.11.3 and later and to “take the time to enable full disk encryption on computers.”



Echoing Walbroehl, Dan Finlay, founder and group manager at MetaMask <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">wrote in a blog post</a> that users should “remember that it’s your responsibility to keep your computer secure. No wallet or software can keep itself safe if the system it runs on is compromised. Take time to learn how to avoid installing a virus on your computer.” 



Phantom, meanwhile, wrote in a <a href="https://phantom.app/blog/demonic-vulnerability" target="_blank" rel="noreferrer noopener">blog post</a> that to protect themselves on Web3, on top of general internet safety measures, users should diversify their wallets to minimize risk and use hardware wallets to store large amounts of assets and currencies.



“Other mitigations include storing the mnemonic phrase/key on a hardware-based wallet like Trezor or Ledger. These wallets still work with software wallets like Metamask when physically connected via a USB cable&#8230;but it protects the keys from attackers that may access your disk,” Walbroehl said.



Halborn has been rewarded $50,000. The wallet providers did not immediately return requests for comment.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Brave

Security Threat Exposed for Browser-based Crypto Wallets

Sam Reynolds

<div id="highlights-block_612e77f34b15b" class="highlights">
 <ul>
 <li>MetaMask says it has grown by 19x since July 2020</li>
 <li>Other non-custodial wallets like Phantom have also seen similar exponential growth as more users explore DeFi as an investment alternative</li>
 </ul>
 
</div>



As the total value locked in decentralized finance (DeFi) comes close to the <a href="https://defipulse.com/" target="_blank" rel="noreferrer noopener">$90 billion</a> mark, MetaMask, the most popular wallet used by traders in the DeFi ecosystem, has reported that it has passed the 10 million mark of monthly active users, up from just over 500,000 a year ago.&nbsp;



“MetaMask defined a new kind of cryptocurrency wallet, where users don&#8217;t just interact with currencies, but with decentralized applications, and we are constantly making these new kinds of applications more safe and accessible to a broader audience,” said Dan Finlay, MetaMask Co-Founder. “We&#8217;re letting users explore new ways of establishing trust on the internet.”



Part of the appeal of MetaMask is that it functions as a browser add-on, allowing integration with DeFi protocols and dApps on the web. Furthermore, with MetaMask, users are always in control of their assets. Their keys are always under their control on their PC, so a situation like what happened with QuadrigaCX — where the <a href="https://www.investmentexecutive.com/news/industry-news/not-your-keys-not-your-coins-lessons-from-quadrigacx-fraud/" target="_blank" rel="noreferrer noopener">founder absconded with the keys</a> and thus the assets of the exchange — can’t happen.&nbsp;



Given <a href="https://cms.blockworks.co/why-asia-is-becoming-the-natural-home-of-decentralized-finance/" target="_blank" rel="noreferrer noopener">DeFi’s appeal in Asia</a>, MetaMask reported that Asia is the number one region in terms of users’ growth, followed by Europe and North America. Within Asia, the Philippines, Vietnam, China, India, Indonesia and Thailand led for the number of downloads and active users. MetaMask’s growth story is shared by other wallets in the industry.



Speaking to Blockworks, the CEO of Phantom, a non-custodial wallet startup, said that their platform is about to break 100,000 MAUs. Since its launch four months ago it has already gotten to a point where there are already 1 million transactions a month though through the wallet. 



“There’s two predominant umbrellas: DeFi and NFTs, which have exploded over the past year and a half or so. There’s no sign of slowing down as long as people are discovering these apps and becoming comfortable with them,” Brandon Millman, CEO of Phantom, told Blockworks. “These applications are going to become more and more popular and there will be more of them and the wallet is a window into all of them.”



Millman believes that the only thing holding back further adoption of DeFi and NFTs are expensive gas fees — something that<a href="https://cms.blockworks.co/ethereums-role-in-a-multi-chain-future/" target="_blank" rel="noreferrer noopener"> many new blockchain protocols</a> are trying to solve.



“NFTs are just getting started&#8230;Even within the US there’s a huge number of people who don’t interact with them at all because they’re so expensive, but despite that, you&#8217;re still seeing a lot of growth,” he told Blockworks. “With the advent of blockchain tech that’s faster and cheaper, you’ll see more and more people buying NFTs and trading them. From a consumer perspective, it has a lot of room to grow from the NFT trader and publisher perspective.”



But non custodial wallets aren’t for everyone.



Some investors would not feel comfortable having their millions tied to a browser plugin. This isn’t a bad thing per se, rather it shows the strength of retail interest in DeFi.&nbsp;



Eric Ervin, CEO of Blockforce Capital, added that he’s seeing “incredible demand” from investors looking to get exposure to DeFi, so much so that his company has put together a fund with DeFi ecosystem Vesper Finance to give users that don’t want to install wallets and prefer to get exposure via a more traditional fund subscription, a chance to get exposure to DeFi.&nbsp;



“We believe this will act as an onramp to significant adoption from investors who have yet to approach – and benefit from – the decentralized ecosystem,&#8221; he said.



At this time, MetaMask doesn’t have a token like that Binance or FTX has, but is willing to explore one should there be a &#8220;compelling use case&#8221; for it. These tokens, like BNB or FTX, are utility tokens but are also used by investors as a proxy for a public listing.



Want more investor-focused content on digital assets?&nbsp;<a target="_blank" href="https://cms.blockworks.co/events/digital-asset-summit-2021-2/" rel="noreferrer noopener">Join us</a>&nbsp;September 13th and 14th for the Digital Asset Summit (DAS) in NYC. Use code ARTICLE for $75 off your ticket.&nbsp;<a target="_blank" href="https://cms.blockworks.co/events/digital-asset-summit-2021-2/" rel="noreferrer noopener">Buy it now</a>.