TradFi races on-chain but bridges, ATMs, and ads still break trust

TradFi is moving into crypto’s core yield and credit rails at the same time the ecosystem’s outer layers — bridges, browser wallets, and physical ATMs — are demonstrating how fragile trust still is. Fidelity wants to stake up to 100% of its Ethereum ETF holdings and pay quarterly cash rewards [^claim_834], and Goldman Sachs is buying NEOS, a $2.25 billion deal that folds in a roughly $1 billion Bitcoin covered-call fund [^claim_835]. In the same week, an XRP bridge was drained of about US$200,000 because its software treated fake deposits as real, a flaw missed by multiple audits [^claim_833], and a Hyperliquid user lost about US$550,000 to a Google ad phishing scam [^claim_838]. The contrast is the story: institutional capital is formalizing crypto exposure faster than the industry is hardening its weakest links.

Cross-chain bridges remain a prime target. The XRP exploit is a validation logic error: the bridge software accepted a forged deposit as authentic, letting an attacker mint unbacked balances and withdraw XRP [^claim_833]. Multiple audits missed it, so bridge security isn’t an audit checklist problem; it’s a software-proof problem. Every interop protocol that relies on off-chain attestation of deposits faces the same class of risk, and the US$200,000 price tag is a leading indicator, not a ceiling.

For users, the attack surface is shifting toward the layers between them and the chain. A Google ad phishing campaign drained roughly US$550,000 from a Hyperliquid user [^claim_838] — an indication that the user-facing layer, not just protocol code, is a critical attack surface. For centralized and hybrid exchanges that host margin traders, this is a browser-security problem: transaction signing flows and ad-fraud detection now sit on the same criticality as matching engines.

Institutional staking and options are coming on-chain. Fidelity’s SEC filing would stake up to 100% of its Ethereum ETF and pay rewards as quarterly cash [^claim_834], effectively wrapping liquid staking in a regulated ETF product. If approved, that changes the LST market: a large, custody-grade staker competing with DeFi yield for ETH, and a new on-ramp for TradFi capital into Ethereum’s validator set. Goldman’s NEOS acquisition, which includes a Bitcoin covered-call fund of roughly US$1 billion within a US$30 billion ETF business [^claim_835], does the same for options: a regulated wrapper turning BTC yield into a tradable product, which in turn pressures venues like Deribit and decentralized options AMMs to deepen liquidity.

On-chain credit continues to scale. Figure nearly tripled its quarterly profits on US$4.3 billion of loan marketplace volume [^claim_837], proving that tokenized loan markets can generate real revenue. Ether.fi is pushing further into that territory, adding tokenized stocks, metals, and Aave-powered portfolio loans to its neobank-style suite [^claim_839]. The implication for DeFi: collateral design and risk management are moving beyond ether and stablecoins into the full RWA spectrum, and protocols that can compose these assets with lending markets will compete directly with neobanks.

Meanwhile, the regulatory environment for physical on-ramps is tightening. Hawaii will ban crypto ATMs starting in October, joining Minnesota, Tennessee, and Indiana [^claim_836]. Arizona has enacted a law that lets scam victims seek full reimbursement if they notify operators and law enforcement within 30 days [^claim_836]. Crypto ATMs have long been a retail on-ramp and a remittance channel; as states restrict them, more users will be pushed toward stablecoin apps, L2 payment rails, and KYC’d centralized exchanges. That shifts the compliance burden from ATM operators to digital infrastructure providers.

The week’s news doesn’t fit a single bull-or-bear narrative. It shows infrastructure catching up with capital: TradFi is putting ETH staking and BTC covered calls into regulated wrappers, while on-chain credit is turning into a real business. But the US$200,000 bridge drain and the US$550,000 phishing loss are reminders that the deepest liquidity doesn’t protect the weakest software, and the last mile of user trust is still the least-institutionalized part of the stack. Watch for the SEC’s decision on Fidelity’s staking filing, and for whether the next bridge exploit targets the same validation flaw rather than a novel cryptography break.