Weekly Top Stories 07/17/26

Welcome to Galaxy Research's Weekly Top Stories. Subscribe to get this newsletter delivered to your inbox every Friday morning.

In this week's edition,, Lucas Tcheyan analyzes the shake-up at Coinbase’s Base; Thad Pinakiewicz unpacks New York’s statewide moratorium on data center construction; and Zack Pokorny explains how perps exchange Ostium got hacked for nearly $24 million.

Got feedback on this newsletter? Email [email protected]. We’d love to hear from you.

Coinbase Capitulates on Creator Coins in Base Team Shakeup

On Wednesday, Base creator Jesse Pollak said he's stepping back from leading Coinbase's Base app to focus on the chain itself, handing the app to Jordan Fish (better known as Cobie) and recommitting Base to three priorities: trading, payments, and AI agents.

In a long and candid post on X, Pollak called the first quarter of 2026 "a punch in the face" and admitted that half of the two-part bet he'd spent the last two years working on had failed. He'd wagered that builders and onchain-native social experiences would drive crypto's next wave of adoption. Builders delivered, through stablecoins, prediction markets, and perpetuals. Social didn't. Farcaster, Zora, miniapps, and creator coins, in his words, "disintegrated completely." The focus on social left Base behind where it counted. Its native apps in perps (Avantis) and prediction markets (Limitless) trail competitors that have scaled, and Base is also lagging on the tokenization and payments tooling enterprises actually wanted.

Pollak’s post followed one from Coinbase CEO Brian Armstrong two days earlier. On Monday, Armstrong conceded to a critic on X that content coins "didn't work" and that it was "time to turn the page," while pushing back on the idea that AI agents are just the next hype cycle. Base, he said, has consistently prioritized trading, payments, and agents "in that order," with most engineering resources going to trading.

Cobie (short for “crypto Cobain”) joined Coinbase last year through its roughly $375 million purchase of his fundraising platform Echo. Pollak framed the handoff as returning the app to Coinbase while he focuses all of his efforts on building Base into "the blockchain for global finance."

OUR TAKE

It’s hard to imagine the timing of this announcement – two weeks after the debut of Robinhood Chain (see our prior coverage) – was a coincidence. Robinhood Chain's early "success," if you can call memecoin volume success, only sharpens the criticism of Base. Coinbase now has a direct competitor (with significant retail distribution) shipping a nearly identical product, and it gave up whatever early lead it had by pouring development into exactly the wrong things, social and content coins most of all.

Social trading isn't the problem. We've argued the opposite, that other forms of it are some of the fastest-growing verticals in crypto. Look no further than social trading app FOMO's recently announced $550 million valuation. The idea that flopped was narrower and weirder: that the content itself should be the asset, that posting something should mint a coin. That model scattered attention across thousands of tokens backed by nothing, mostly producing short bursts (sometimes minutes) of frantic trading that never held and burned users who had no idea what they were doing. Jesse Pollak himself launched a “creator coin” ($JESSE) in November 2025 that debuted at $6.5m market cap and fell as much as 94%.

Beyond burning users, the experiment pulled attention and resources away from the growth areas where competitors are getting real traction. Base today accounts for less than 0.1% of total perpetual futures open interest across all chains and has no prediction market with meaningful traction. (To be fair, Robinhood Chain looks just as fallow here, but it only just launched). The problem is that the areas driving most of crypto's growth right now – perpetuals, prediction markets, and tokenization – are also the most competitive, and every chain is throwing everything at them. Base gave up a big lead, and its advantage now is its own distribution and not much else. Even on equity tokenization, there’s a real argument to be made that Base would not qualify for the exemptions in the pending CLARITY Act: if the chain doesn’t become more decentralized, it could be classified as a Non-Decentralized Finance Trading Protocol under Sec. 301 of the bill. If that happens, Base likely could not play host to the anticipated growth of regulated U.S. tokenized securities without running afoul of securities registration requirements.

None of which means it's all been a failure. Coinbase's Morpho integration for lending has been a real success, with close to $3 billion in borrow originations. Its small but growing onchain AI ecosystem is one of the better ones in crypto, with projects including Venice driving usage through private inference and new forms of inference tokenization (see our recent coverage here). The team finally owning the mistake is the first step toward righting the ship to drive more success stories like these.

The outstanding question for exchange-backed chains is how they drive growth for the corporation. Binance Smart Chain is the biggest success story here, but it also was a first mover, has an integrated token (whether Coinbase ever launches a token is a big outstanding question), and operates under very different regulatory constraints. From our perspective, the best approach for these teams is to seed their ecosystems with the centralized exchange distribution they already have, rather than renting mercenary capital that leaves the moment the incentives dry up. The thesis, for now, is the DeFi “mullet.” Get people using the chain without really knowing they are (Coinbase/business in the front, DeFi/party in the back). Once they're locked into the ecosystem, that user base pulls in builders who use the permissionless chain to ship new products that drive the next leg of growth. Who knows? Maybe one of those might even turn out to be content coins (don’t hold your breath).

If nothing else, at least Cobie's running the Base app now. -Lucas Tcheyan

N.Y. Data Center Freeze Tests State’s Leverage With Developers

New York, the state building one of the country’s most advanced academic AI supercomputers and long happy to hand server farms tax breaks, this week became the first U.S. state to freeze construction of data centers.

The pause matters less than the terms attached to it. What's new is the deal you get for building in the Empire State after the moratorium expires: no tax breaks, and a bill for the grid strain and the community that data centers move into. It's the first serious attempt to make data center developers pay their own way, and the rest of the country is watching to see whether it works.

On July 14, Gov. Kathy Hochul signed EO No. 62, which imposed a statewide moratorium on new data centers of 50 megawatts (MW) and up, freezing permits while the state studies what these things do to the grid, the water, and the neighbors. Her pitch is that the data center buildout and AI transition amount to a generational economic upheaval, and she won't let AI's power bill get expensed to New Yorkers who already pay some of the highest rates in the nation.

New York is not alone in taking action around data center development; states across the nation are rethinking the tax breaks and abatements they hand out to attract investment. For a decade, states competed to land data centers with incentives; by 2026 that had flipped to gatekeeping. Roughly 14 states have floated moratoriums. Maine's legislature passed one but its governor vetoed it. Ohio activists pushed a 25 MW ban toward the ballot but fell short of the signatures and are now aiming for 2027. In Texas (home to Galaxy Digital’s Helios campus) developers are also facing headwinds and some have resorted to suing jurisdictions over data center moratoriums. But New York is the first to make a statewide-freeze stick.

The legislature in Albany had already passed a moratorium of its own, the Responsible Data Center Development Act, which cleared both chambers on June 4. Hochul never signed it. She left the bill on the shelf and signed her own executive order about six weeks later. The two instruments are not the same. If the bill were to become law, it would have been durable and bind future governors, while an executive order is fast and revocable, and this one leans on environmental-review law to justify the freeze.

There is little difference in substance between the bill and the EO. The legislature’s moratorium would have kicked in at 20 MW, the EO’s only at 50. That 30-megawatt gap sounds like it should matter, but it barely does. Per cleanview.co's data, only one planned project sits in the 20-to-50 MW band: the 30 MW ORNY1 expansion from 1547 Critical Systems Realty in Orangeburg, less than 1% of the planned data center capacity. The threshold everyone treated as the real dividing line separates the two approaches by a single building. That is why Gonzalez, the bill's sponsor, could call the order "similar to our bill," and be right. On the substance of what gets frozen, the two are effectively the same.

The pause stops a material amount of data center buildout. Data centers are queued for more than 12 gigawatts, over a third of everything New York consumes, in a state that already pays the fourth-highest power prices in the country and has watched rates climb nearly 68% since 2019.

Under Hochul’s EO, once construction is allowed to resume, there will be no abatements (she is pushing to repeal the sales-tax exemption), plus a required Community Investment Framework (final version due from the state in September) that sets a negotiating floor near $1 million per megawatt of demand and adds prevailing-wage and local-hiring commitments on top of good-neighbor terms for noise and light. A 250 MW hyperscaler would open talks owing a quarter-billion, money that can go toward infrastructure, housing, childcare, broadband, and schools. The logic tracks the economics: if you can't get lasting jobs out of the development, extract lasting capital investments for the community.

The push didn't start in Albany. It started locally, with residents and environmental-justice groups who spent years fighting individual projects, and it turned out to cross party lines: a June Siena poll found New Yorkers backing a moratorium 46% vs. 21% opposed, with majorities among both Democrats and Republicans. Their argument leaned heavily on what had already happened elsewhere. In Virginia's data-center alley, wholesale power prices ran up as much as 267%, and one county's schools were told to dim the lights.

Massachusetts did a version of this with casinos a decade ago: it capped the licenses and made each operator sign a binding host-community agreement with mitigation payments. Gambling or GPUs, the social mechanism is old and familiar: the public names an externality, and its representatives address it through targeted legislation. Not the state breaking the market; representative government doing what it says on the tin.

OUR TAKE

This isn’t the nail in the coffin for data centers in New York. There is a way out, and it's the part worth watching to see if any developers get clever with their applications. Hochul's EO carves out an exemption for facilities primarily used for research, such as quantum or biomedical work, along with education, medical care, and the state's own Empire AI.

So, does a research exemption quietly make New York a good place to build the right kind of compute? It's not hard to imagine a frontier lab structuring a "research" facility that does no inference but focuses on AI alignment research. That's the recurring problem with regulations and definitions: the categories become the thing everyone optimizes toward, and "primarily used for research" is squishy enough to end up meaning whatever regulators decide it means.

New York is betting that hyperscalers need the state more than it needs them, and perhaps that other states will follow its suit. The next year will settle it. If compute is desperate enough for power, developers will pay the price, and other statehouses will copy the invoice. If it isn't, the money will reroute to friendlier jurisdictions, and states like New York will find out they wrote rules for an industry that had already left. – Thad Pinakiewicz

Ostium Left an Opening for Exploiters and $24m Went Out the Door

Thieves made off with an estimated $23.75 million worth of the USDC stablecoin Wednesday after exploiting Ostium, a platform for synthetic trading of stocks, commodities, forex, and crypto onchain.

The exploit was carried out over a sequence of eight transactions in which funds left Ostium’s OLP vault:

• Transaction 1 totaling 898 USDC

• Transaction 2 totaling 11.86 million USDC

• Transaction 3 totaling 13,480 USDC

• Transaction 4 totaling 13,480 USDC

• Transaction 5 totaling 4.49 million USDC

• Transaction 6 totaling 3.59 million USDC

• Transaction 7 totaling 2.7 million USDC

• Transaction 8 totaling 1.08 million USDC

All eight transactions paid out to the same wallet, 0x321Df1...8bfD9. The largest single payout transaction was executed in a single atomic batch that looped through open-and-close cycles. Every transaction routed through the same contract pair (Ostium: Trading → Ostium: Private PriceUpKeep).

Ostium, which runs on Arbitrum, lets users trade leveraged synthetic positions on forex, commodities, indices, stocks, and crypto. All activity is settled onchain in USDC. Users trade synthetic perpetual contracts that track the prices of underlying assets, and there is no delivery of the underlying or fixed expiries on user trades. The Ostium Liquidity Pool (OLP) is the vault side of all this. Liquidity providers deposit USDC and receive OLP tokens representing their pro-rata share of the pool, which is used to back perpetual positions and to provide liquidity for trader profit and loss (PnL) settlement.

The issue arises from how Ostium's oracle system authorizes price data. The verifier takes a price report, derives the signer from the signature, and checks that the signer is on an authorized list. It simply validates the signer's identity, not whether the price itself is accurate. An attacker who held both an authorized oracle-signer key and a registered PriceUpKeep forwarder (the keeper role responsible for fulfilling pending orders) used that combination to submit a future-dated, correctly signed price report and then repeatedly opened and closed positions against it. This allowed them to appear to generate trading profits from the view of the system without any real market exposure. Both the signer and forwarder roles are meant to be granted only by Ostium governance/timelock and are not supposed to be self-assignable; the exploit worked because the attacker obtained legitimate credentials for each, not because of a flaw in Ostium’s trading logic itself.

OUR TAKE

The Ostium incident is one of a number of major application exploits that have happened this year, including at Drift and KelpDAO’s rsETH. A common theme has been that smart contracts and the logic they contain have held up, and the main targets for exploiters have been operational infrastructure and human trust (the compromised signer credentials in Ostium's case, the socially engineered pre-signed admin takeover in Drift's case, and the poisoned RPC infrastructure behind KelpDAO's rsETH bridge).

After each of these high-profile exploits, some have called for safeguards around user funds on applications, such as throttled withdrawals, to disincentivize nefarious actors and limit the loss of funds in the event an exploit occurs. These proposals should be resisted.

Throttling withdrawals introduces censorship risk directly at the application layer. The moment a protocol can unilaterally delay or cap what a user can deposit or withdraw, self-custody becomes conditional instead of absolute. In this case, the app, not the user, decides when funds are accessible and how they can be used. It also collapses the distinction between the exploiter and the average user in the sense that a safeguard designed to slow down an attacker necessarily applies to everyone using the app at that moment. By design, apps would start treating ordinary users as suspects, with no way to distinguish intent in real time.

The slippery slope risk compounds this. Once a protocol builds in the technical capability to throttle or freeze deposits and withdrawals, that capability becomes precedent. Regulators can point to it as evidence that these applications already have the tool to comply with freeze orders, KYC gating, or other requirements and should therefore be required too. A safeguard built to stop attackers can become a hook that pulls a protocol toward obligations they would otherwise be incapable of meeting.

Moreover, innocent market actors will become incentivized to route around the frictions introduced by such measures. In this case, risk can become displaced rather than contained. Users locked behind a throttle will look for a way to exit their economic exposure anyway, which typically means a tradeable claim on the delayed deposit emerges to fill the gap (such as a receipt token, an IOU, a wrapped stand-in for "your funds, pending release"). That claim becomes a new dependency with its own risk surface at both the market level (a peg that can break, a discount that widens under panic) and the technical level (a new contract, a new oracle, a new thing that can be exploited independently of the application it's supposed to represent). The safeguard meant to contain one point of failure ends up compounding the very fragility it was built to prevent.

None of this means protocols shouldn’t harden the parts of the stack that actually failed here (e.g. signer key management, verifier redundancy, admin timelocks, social-engineering awareness). But the fix for weaknesses in operational infrastructure and human trust is hardening those things, not adding new discretionary controls over user funds that undermine the core value proposition of the thing being protected. - Zack Pokorny

In Other News

• 🏦 DTCC launches RWA tokenization trial run with JPMorgan, BlackRock, Goldman

• 👔 PayPal said to receive $53b buyout offer from Stripe, PE firm Advent, Dorsey’s Block

• 🏰 Citadel Securities invests $400m in Crypto.com at $20b valuation

• 🧊 Tether freezes $131m of USDT in Tron wallets sanctioned by OFAC for Iran ties

• 😵‍💫 CFTC orders Kalshi to fulfill trades it already voided under state court order

• 👂 Trump’s teleprompter operator allegedly made $100k trading mention markets

• 🦘 Jump Trading doubles prediction markets team to about 20, will keep hiring

• ✈️ Kalshi cancels plan to let traders bet on flight cancellation rates

• 🏢 Data center builder Cleanspark scores $6.6b+ lease in Georgia (tenant unnamed)

• 🐻 Bond manager Hoisington, long bullish on U.S. Treasuries, turns bearish

Charts of the Week: Bitcoin’s Great Awakenings

As bitcoin’s price rallied in 2024 and 2025, a significant amount of long-dormant BTC (held in the same address for a year or more) moved onchain – these two years rivaled only by the 2017 bull run. Although onchain coin movements do not necessarily equate to moving coins to an exchange to sell, nonetheless most bitcoiners tend to buy and “hodl” their coins, and the heuristic has proven its usefulness over time. As with any asset class, when BTC rises significantly, long-term holders find themselves deeply in profit. Thus, substantial movements of dormant coins are often a leading indicator of upward price momentum stalls or even tops. It appears, though, that this “great distribution” from 2024 and 2025 is mostly done, and 2026 is on pace to see less than half the volume of “awakened” coins as last year.

Looking at the same data by month, the clusters of old coins that came out of hibernation during the 2017, 2021, and 2024-2025 rallies really stand out.

Follow @glxyresearch on X for more insights.