skip to content

Weekly Top Stories - 6/6

Weekly Top Stories 06-06-25 - Thumbnail

This week in the newsletter, we break down the Ethereum Foundation’s new treasury policy, draw lessons from a crypto kidnapping spree, and check in on the trend of launching crypto (not just bitcoin) treasury companies.

Ethereum Foundation Balances Budget

In a detailed blog post, the Ethereum Foundation (EF) outlined its treasury composition and introduced a more principled strategy for managing its assets going forward. The thrust of the treasury policy is to refocus the EF on its core objectives of enabling “applications that run exactly as programmed without any possibility of downtime, censorship, fraud, or third-party interference.

OUR TAKE:

After years of sporadic ETH sales with minimal transparency, this move signals a clear shift from reactive sales to intentional budgeting. The Foundation holds over 94,000 ETH and more than $130 million in fiat-denominated assets. While that’s a strong position by any standard, the most notable aspect of the announcement is how the EF plans to manage it going forward. For years, the EF has come under fire for surprise ETH sales that often coincided with local market tops. While these sales were arguably prudent from a budgeting perspective, they were never well-communicated, and they repeatedly undermined confidence among ETH holders and traders. The new, transparent approach signals an awareness that optics and consistency matter just as much as raw balance sheet health.

Perhaps even more interesting is the EF’s new posture toward Ethereum’s DeFi ecosystem. For the first time, the foundation has outlined clear, public criteria for when and how it will engage with decentralized finance protocols. Rather than chasing high-yield opportunities or playing liquidity games, the EF will restrict itself to protocols that align with its cypherpunk and “Defipunk” values, focusing on robust documentation, open-source code, credible security audits, sustainable governance models, predictable risk profiles, and maximized trustlessness. This is not degen yield farming; it’s a move toward responsible, accretive capital deployment.

The timing of this announcement is no coincidence. The EF has been facing heightened scrutiny, not just over its market behavior, but also its role in Ethereum’s evolution. Recent governance shifts, roadmap volatility, and community frustration over price performance have put the foundation in the spotlight. This treasury update is, in many ways, a recalibration, a bid to reestablish credibility and remind the community that the EF is playing the long game.

Ultimately, this is a welcome and overdue maturation for the EF. Ethereum has already become critical infrastructure for the decentralized web; it’s only right that the blockchain’s core institution acts accordingly. But it’s also a reminder that financial responsibility alone isn’t enough. The Ethereum Foundation will need to do more than manage its treasury well; it will need to actively rebuild its relationship with the builders, users, and protocols that bring Ethereum to life.

This week’s treasury policy update is a signal that the EF understands the gravity of its role. A foundation that burns through capital chasing yield or mismanages risk doesn’t get to fund long-term research. It doesn’t get to support neutral infrastructure. It doesn’t get to be credible when it asks the world to adopt public goods over profit-seeking alternatives. Ethereum doesn’t need its foundation to act like a VC fund or a hedge fund. It needs it to last. Treasury conservatism may not excite the market, but it’s what ensures that five, 10, or 20 years from now, the EF will still be around to ask hard questions, fund deep research, and advocate for protocol integrity.

Stability isn’t a retreat from ambition. It’s what makes ambition possible. – Thad Pinakiewicz

Kidnapping Spree Underscores Crypto’s Operational Risks

A suspected mastermind behind a string of such crimes in France was detained in Morocco on Wednesday. Among other alleged plots, Badiss Mohamed Amide Bajjou is suspected to have been involved in the unsuccessful attempt (in broad daylight) last month to kidnap a French crypto CEO’s pregnant daughter, French media outlets reported. Passersby saved her, but others weren’t so lucky. Kidnappers allegedly severed the finger of a co-founder of hardware wallet maker Ledger, whom police later rescued.

Baijou’s detainment followed the charging in the U.S. last month of two crypto investors with the kidnapping and alleged torture of an Italian man for the passwords to his Bitcoin wallet. On May 6, the Italian crypto investor, Michael Valentino Teofrasto Carturan, traveled to New York City, allegedly lured by former business associate John Woeltz under the pretense of returning previously stolen bitcoin. Upon arrival at a luxury townhouse in Manhattan's SoHo neighborhood, Carturan was allegedly kidnapped by Woeltz and his accomplice William Duplessie. The assailants aimed to extract the password to Carturan's Bitcoin wallet, which was believed to contain substantial funds.

Over a harrowing 17-day period, Carturan was allegedly subjected to abuse, including electric shocks, beatings, threats with weapons, and psychological torment, according to multiple news sources and corroborated by Voidzilla. The captors also allegedly forced him to ingest drugs and threatened his family. Carturan managed to escape on May 23, seeking help from a nearby traffic officer. Subsequent police searches uncovered disturbing evidence, including weapons, drugs, and photographs documenting the abuse.

Woeltz, known in some circles as the "Crypto King of Kentucky," was arrested on May 23 and is scheduled for arraignment on June 11. Duplessie surrendered to authorities on May 27. Both face multiple charges, including kidnapping, assault, and unlawful imprisonment. A third individual, Beatrice Folchi, was also arrested but has not been charged pending further investigation.

Global Crypto Extortions by Year and Country

OUR TAKE:

Cryptocurrency is a bearer asset. Like cash, gold bars, or jewelry, once it’s gone, it’s gone. Despite the traceability of funds on public blockchains, heists have long plagued the crypto industry. Normally, these thefts take place in cyberspace, as smart contract exploits or attempts by state-sponsored hackers and other bad actors to hack exchanges' hot wallets. Getting robbed online is bad enough, but over the years, we have seen the rise of “wrench attacks” globally, where attackers resort to kidnapping, torture, and physical attacks to extract crypto assets. This growing attack vector leaves crypto holders not only at financial risk but also in physical danger and underscores the importance of operational security.

For individuals, the primary defense against such attacks is discretion: limiting your online footprint through obfuscation and minimizing identifiable signals. Using pseudonyms, maintaining separate digital identities, and avoiding unnecessary exposure on social media can significantly reduce a crypto holder’s personal attack surface. Refraining from sharing wallet addresses, publicly discussing crypto holdings, or posting real-time travel updates further helps investors keep a low profile and stay out of the spotlight.

Beyond operational discretion, technological protections like multi-signature (multi-sig) wallets and multi-party computation (MPC) offer additional layers of defense. While both involve distributing control over a wallet across multiple parties or devices, multi-sig relies on on-chain coordination, whereas MPC achieves similar outcomes through cryptographic key splitting off-chain. By requiring multiple parties or devices to authorize a transaction, multi-sig and MPC setups can render a single point of attack ineffective, especially when keys are geographically distributed or held by trusted entities. In a coercive scenario, even if one key is compromised, the funds remain secure.

Similarly, the rise of crypto insurance offers financial recourse in the event of loss due to theft, physical coercion, or even smart contract vulnerabilities. Typically, insurance against physical attacks costs 0.55% - 2% of the assets protected, while coverage for cyberattacks and hacks can run 3% to 4%.

While still a nascent market, institutional-grade policies are emerging that can cover both hot and cold storage scenarios, helping individuals and firms alike hedge against existential risks. Insurance is not a replacement for security hygiene, but in a landscape where threats are growing, it adds a much-needed safety net.

The builder community should treat physical attack vectors as core to crypto UX design, not as edge cases. From multi-sig coordination tools to duress password triggers, travel modes, kill switches, and emergency social recovery flows, user interfaces must evolve beyond transaction throughput and yield optimization to actively support personal safety in adversarial environments. – Christopher Rosa

The Treasury Trend

The crypto treasury meta continues to scale beyond bitcoin. This week, two companies, both publicly traded, said they would buy XRP to hold in their treasuries, and a third said it was acquiring ETH for the same purpose. Bitcoin treasury companies have been a common theme through much of the year, with Strategy (formerly Microstrategy) sitting at the helm. VivoPower and Nasdaq-listed Webus announced intentions to start XRP treasuries of $100 million and $300 million, respectively, and SharpLink announced a $425 million ETH treasury. Including these groups, Galaxy Research has identified 28 crypto treasury companies: 20 focused on BTC, four on SOL, two on ETH, and two on XRP.

Crypto Treasury Companies Table

OUR TAKE:

Expect to see the crypto treasury meta continue given the momentum of existing companies, and the market’s seemingly strong appetite to fund them in considerable size and across multiple assets.

Skepticism continues to mount as more and more crypto treasury companies come online. The primary concern rests on a funding source that fuels a portion of the buys: debt. Some companies are relying on borrowed funds, largely zero-coupon and low-interest convertible notes, to purchase treasury assets. Upon maturity, these notes can be converted, at investors’ discretion, into equity in the company so long as the notes are in the money (i.e., when the company’s share price exceeds the conversion price, making conversion to equity economically favorable). However, if the maturity date comes and the notes are out of the money, then additional capital is required to cover the liability – this is where concerns about the treasury company playbook stem from. Separately, albeit less frequently highlighted, is the risk that these companies may lack sufficient cash on hand to service the interest on their debt. In either event, treasury companies have four main options. They can:

  1. Sell their crypto stashes to shore up cash, possibly hurting asset prices, a move that can affect other treasury companies holding the same asset

  2. Issue new debt to cover the old liability, effectively refinancing the debt

  3. Issue new equity to cover the liability, which is similar in nature to how they fund treasury asset purchases through equity financing today

  4. Go into default if the value of their crypto stashes doesn’t fully cover the liability

The path each company takes in the worst-case scenario will depend on specific circumstances and market conditions at the time of maturity; for example, treasury companies can only refinance when market conditions allow.

On the opposite side of the treasury funding barbell are equity sales, where the treasury company issues stock to fund asset purchases. The equity sales that are used to supplement asset purchases are less of a concern in the big picture because under this method, there are no obligations for companies to default on, and no liability is created to fund asset purchases.

In our recent report surveying the crypto leverage landscape, we examined the magnitude and maturity timeline of the debt issued by some bitcoin treasury companies. Based on what we found, we don’t think there is an imminent threat today as much of the market believes, because most of the debt matures between June 2027 and September 2028 (pictured below). Concern about the debt-driven strategies of treasury companies is not unreasonable given the industry’s history with leverage, but at this time, we do not see significant risk from the approach. This may not always remain the case, however, as the debt comes due and more companies adopt the strategy, possibly taking riskier approaches and issuing debt with tighter maturity timelines. Even in a worst-case scenario, these companies will have a range of traditional finance options to engineer their way out that may not end in the sale of treasury assets. Zack Pokorny

22) Maturities of Bitcoin Treasury Company Debt Used to Buy Bitcoin (Notional Amt)

Charts of the Week

The monthly decentralized exchange (DEX) to centralized exchange (CEX) volume ratio reached a fresh all-time high of 31.1% in May. The “launchpad” meta that swept onchain markets provided an asymmetric opportunity for DeFi venues to generate revenue that centralized exchanges could not capture. These launchpads, such as Believe, are similar in nature to Pump.fun, allowing users to create new projects and launch tokens around them that users can trade.

Monthly Dex to Cex Volume Ratio

However, total monthly DEX volumes were well off the all-time high set in January. The $470.4 billion of dex volume generated during May was 22.2% (or $134.4 billion) below the January high. Onchain activity through January marked the top of memecoin mania, which was largely propelled by the launch of TRUMP.

Total Monthly Dex Volume

Other News

You are leaving Galaxy.com

You are leaving the Galaxy website and being directed to an external third-party website that we think might be of interest to you. Third-party websites are not under the control of Galaxy, and Galaxy is not responsible for the accuracy or completeness of the contents or the proper operation of any linked site. Please note the security and privacy policies on third-party websites differ from Galaxy policies, please read third-party privacy and security policies closely. If you do not wish to continue to the third-party site, click “Cancel”. The inclusion of any linked website does not imply Galaxy’s endorsement or adoption of the statements therein and is only provided for your convenience.