Sustainability of DeFi Security and STRC [FP Weekly 20]

1. Major News

[Crypto] Lido's Web3SOC Certification: A Signal for Standardized DeFi Due Diligence

What Happened?

Lido received Web3SOC certification from Cantina on May 6. This certification is a point-in-time assessment covering governance, financial resilience, security, legal, and compliance areas, and it stands as one of the early certification cases among liquid staking protocols. What matters most is not the certification itself, but the fact that, with over $21 billion worth of ETH staked through Lido, institutions now have a standardized due diligence reference they can use before integrating Lido.

Web3SOC is a framework designed to assess DeFi characteristics that existing standards such as SOC 2 or ISO 27001 do not fully cover. Traditional due diligence standards assume centralized organizations and internal controls, while DeFi combines elements such as on-chain governance, distributed operations, smart contracts, validator infrastructure, and key management. Until now, institutions had to rebuild their due diligence criteria for each protocol, and Web3SOC can be understood as an attempt to standardize and reduce that inefficiency.

With this certification, Lido has added another layer to its existing set of external assessment materials. Staking Rewards assesses the risks of staking assets such as stETH itself, while Credora evaluates protocol-level and market-level DeFi risks. Web3SOC, on the other hand, looks at whether Lido as an organization is mature enough in terms of operations, finance, security, and regulation to meet institutional due diligence standards. In other words, Lido now has external assessment materials across three layers: asset, protocol, and organization.

Researcher’s Comment

Lido’s Web3SOC certification is more meaningful as a signal of a broader trend than as a standalone announcement. It suggests that the infrastructure DeFi protocols need in order to onboard institutional capital is moving beyond the efforts of individual protocols and entering a stage where it is built on shared standards.

This trend is especially meaningful at a time when operational security incidents continue to occur. Across the DeFi ecosystem, large-scale asset losses are increasingly caused not only by smart contract bugs, but also by breaches at the organizational operations layer. In this context, the operational security control environment assessed through Lido’s Web3SOC certification can be viewed as one of the early examples directly responding to the attack vectors the crypto ecosystem currently faces. This case can serve as a representative reference point for other protocols as they improve their own operational maturity, giving it industry-level value beyond the certification of a single protocol.

The emergence of a standardized due diligence framework has two sides. On one hand, having referenceable due diligence materials can lower the barrier to institutional DeFi adoption. On the other hand, it may widen the gap between large protocols that have the resources and compliance infrastructure to respond quickly to these standards and smaller protocols that do not. This is similar to how a gap in institutional sales can emerge between SaaS companies that have SOC 2 certification and those that do not. In Lido’s case, this certification adds a formalized layer on top of its existing external assessment materials, making it one of the DeFi protocols with the most developed standard materials for institutional due diligence at this point. This shows the possibility that stETH could gain further momentum for integration through a wider range of institutional channels.

[Investment] Strategy Announces First Quarter 2026 Financial Results

What Happened?

In its first-quarter 2026 earnings release, Strategy described itself as “the world’s first and largest Bitcoin Treasury Company” and stated that it held 818,334 BTC as of May 3, 2026. This represented a 22% increase from the beginning of 2026. Over the same period, the company reported a BTC Yield of 9.4% and a BTC $ Gain of approximately $4.97 billion. Strategy treats increasing its Bitcoin holdings faster than the dilutive effect of share issuance as a key performance metric.

The most emphasized part of the announcement was the growth of its “Digital Credit” business centered on STRC. Strategy explained that it had raised a total of $5.58 billion through STRC in 2026, representing 189% growth year to date. CEO Phong Le said STRC showed strong demand, high liquidity, and low volatility even during a Bitcoin bear market.

The financial results themselves showed a large loss due to mark-to-market losses on Bitcoin. Strategy reported an operating loss of $14.47 billion for the first quarter of 2026, most of which came from $14.46 billion in unrealized losses on digital assets. Net loss was $12.54 billion, and diluted loss per share was $38.25, marking a significant expansion in losses from the same period a year earlier.

However, the legacy software business posted modest growth. First-quarter revenue was $124.3 million, up 11.9% year over year, while gross profit was $83.4 million and gross margin was 67.1%. The company said its combination of Bitcoin-centered capital management and enterprise analytics software provides the foundation for long-term value creation.

Strategy also highlighted its ability to meet preferred stock dividend obligations as an important source of credibility. Since launching its preferred stock products in early 2025, the company said it had made all 23 dividend payments on time, with cumulative dividends totaling approximately $693 million. STRC, in particular, grew to $8.5 billion in size within nine months of launch, and the company also proposed increasing STRC’s dividend payment frequency from once a month to twice a month.

Researcher’s Comment

STRC dividends do not come from interest or operating income naturally generated by Bitcoin. Since Bitcoin itself does not produce cash flow, STRC’s monthly dividends are ultimately paid out of dollar cash that Strategy secures. On the surface, STRC may look like a “Bitcoin-based yield product,” but in substance it is closer to a high-yield preferred stock backed by Strategy’s credit, the value of its Bitcoin holdings, and its access to capital markets.

So far, STRC appears to be working well based on the metrics. Strategy said it had raised roughly $5.6 billion through STRC since the beginning of the year, while average daily trading volume grew to around $375 million and volatility declined to about 3%. As long as STRC trades near its $100 par value, pays a dividend of around 11.5%, and continues to gain liquidity, there is clearly market demand for the product.

The key question, however, is where the dividends come from. Strategy is using a large portion of the proceeds from STRC issuance to buy Bitcoin. That means the dividend funding mainly comes from retained cash, additional common stock issuance, additional preferred stock issuance, cash flow from the legacy software business, and, if necessary, partial Bitcoin sales. In other words, it is more accurate to say that STRC dividends come from cash Strategy raises or unlocks through asset monetization, rather than from money generated by Bitcoin itself.

For this structure to remain sustainable, several conditions need to hold at the same time. Bitcoin needs to rise over the long term, MSTR must continue to trade at a premium to its net Bitcoin value, and investors must keep buying high-dividend preferred shares like STRC. If these conditions hold, Strategy can use capital raised through STRC to buy more Bitcoin, pay dividends, and still increase Bitcoin holdings per share. If Bitcoin weakens, MSTR’s premium contracts, and demand for new STRC issuance fades, the dividend becomes an increasingly burdensome fixed cost.

Therefore, STRC should not simply be viewed as a risky product, but rather as a highly sophisticated financial engineering product that works only under certain conditions. Strategy’s statement that it could strategically sell Bitcoin if necessary may signal dividend-paying capacity for STRC holders, but it also places pressure on the company’s original narrative of continuously accumulating Bitcoin. Ultimately, the sustainability of STRC does not depend on the 11.5% dividend rate itself. It depends on whether Strategy can continue to grow its net Bitcoin value and Bitcoin holdings per share even after absorbing the cost of that dividend.

Others

Crypto

• Western Union's USDPT is Now Live on Solana
• Securitize, Jump Trading Group, and Jupiter Launch Fully Onchain, Regulated Trading for Tokenized Equities
• DL News is closing
• MegaETH Kicks Off MEGA Buybacks

Institution

• Rain is now a Mastercard Principal Member
• Securitize has received approval from FINRA’s Continuing Membership Application (CMA) to significantly expand our broker-dealer activities
• Coinbase Cuts 14% Workforce to Go AI-Native
• MoonPay acquires Solana trading infrastructure platform in $100M all-stock deal
• SoFi is launching SoFiUSD on Solana
• U.S. Senate Banking Committee moves to advance “Clarity Act” crypto framework
• Kraken parent Payward applies for national OCC trust charter following Ripple, Coinbase

Tech

• Kelp DAO Switches to Chainlink to Tackle Security Issues Post-Bridge Attack

Investment

• Katie Haun raises $1B for new venture funds
• As crypto cools, a16z crypto raises a $2.2B fund
• Kalshi Raises $1B, Now Valued at $22B After Latest Funding Round
• Bitwise Announces Inaugural Tokenized Fund, the Bitwise Crypto Carry Fund, In Partnership with Superstate
• Coinbase loses nearly $400 million in Q1 as CEO seeks to reduce dependence on spot crypto trading
• SC Ventures named first external shareholder of GSR following strategic investment

Asia

• BNY expands crypto custody push in Abu Dhabi
• Bithumb eyes Vietnam expansion under new partnership with SSID
• South Korea’s largest crypto exchange Upbit launches Ethereum blockchain with Optimism Foundation support

2. Data Spotlight

What PYUSD Suggests for KRW Stablecoin Adoption (Link)

Can HIP-4 break the prediction market duopoly? (Link)

3. Four Pillars Weekly

: : [Institution/Report] What is Institutional-Grade Blockchain Privacy? (Link)

• For blockchain to become real financial infrastructure, privacy must be treated as a core requirement rather than an optional feature. On a public ledger, exposed balances, counterparties, settlement flows, and positions can lead not only to privacy leaks but also to front-running, market manipulation, and competitive intelligence leakage.
• Monero and Zcash showed that strong privacy can be implemented on public blockchains. However, their standalone-chain architectures, limited programmability, client-side computational burden, and relatively coarse selective disclosure mechanisms limited their ability to scale into institutional financial infrastructure.
• Tornado Cash, Railgun, and Privacy Pools attempted to bring privacy to EVM environments. Yet they still faced limitations such as the mixer model, client-side ZK proof bottlenecks, constrained DeFi integration, and insufficient audit paths for activity inside privacy pools.
• Institutional-grade privacy protocols require more than anonymity; they must be compatible with regulatory obligations. Businesses need the ability to monitor their own customers’ transactions, respond to authorized regulator requests, and address deletion or correction requests related to personal data.
• The Travel Rule and KYC mapping enable AML compliance, but they can also amplify privacy risks on public blockchains. If identity-to-wallet mappings leak, they can be combined with public ledger data to reconstruct users’ past and future onchain transaction histories.
• FHE and institutional private chains each offer meaningful advantages: encrypted computation on one side and compliance-friendly operating environments on the other. However, FHE still faces performance and address-exposure issues, while private chains involve trade-offs around operator trust, user control over funds, and separation from public-chain liquidity and composability.
• Privacy Boost combines ZK and TEE on top of public EVM chains to address privacy, performance, auditability, and self-custody together. This approach is especially relevant for stablecoins, RWAs, and fintech applications that require both regulatory compliance and public-chain composability.

: : [Investment/Report] 2026 Hyperliquid Q1 Report (Link)

• This report covers Hyperliquid's financial performance, ecosystem developments, and structural transformations through Q1 2026. Crypto's worst first quarter since the 2018 ICO crash, and the quarter Hyperliquid's "House of All Finance" thesis became undeniable. S&P Dow Jones licensed its benchmark to a Hyperliquid deployer. Four major asset managers filed HYPE ETFs. When the Iran strikes closed legacy commodity exchanges, Hyperliquid's 24/7 oil markets became the venue of record.
• When we published the 2025 Annual Report, we committed to a quarterly cadence that meets the disclosure standards institutional allocators expect. We believe a protocol generating nearly $150M in quarterly buybacks, growing market share against every major centralized exchange, and processing real-world commodity flow in real time deserves coverage that matches its scale.
• This report is a product of the Hyperliquid Research Collective (HRC), the independent research hub created by GLC Research and Four Pillars to reduce information asymmetry around Hyperliquid. With the continued support of Hyperion, Hyperliquid Strategies, B-Harvest, and HypurrCollective, we remain committed to producing accessible, high-quality research. We are grateful to our sponsors for making this work possible.
• The numbers in this report tell one part of the story. The structural shift underneath them tells the rest. Native crypto perpetuals declined while HIP-3 RWA volume tripled within the quarter. Forty thousand new users a day onboarded into entirely new asset classes. A team left $849M in vested entitlement on the table.

: : [Crypto/Issue] QFEX: Samsung Is a Global Megacap, but Trades Like a Junk Asset (Link)

• AI infrastructure bottlenecks have shifted from GPUs to memory, and Korea's Big 2 are being repriced as global assets. Samsung Electronics crossed $1 trillion in market cap, overtaking Berkshire Hathaway, while SK Hynix posted a Q1 2026 operating margin of 72%, ahead of Nvidia (65%), TSMC (58%), and Samsung (43%). The two companies, controlling more than 80% of the global HBM market, have begun to anchor pricing power in the AI cycle.
• Foreign capital is flowing in at a steep pace. Across just two trading sessions on May 4 and 6, foreign net buying on KOSPI exceeded KRW 6 trillion, and foreign ownership of KOSPI rose to 38.9%, a six-year high. With Korea's FSC laying the groundwork for an integrated foreign investor account framework, foreign investors are also gaining direct access to Korean equities through global brokerage channels for the first time.
• Inside IBKR, however, Korea's Big 2 do not receive the capital efficiency their global megacap status warrants. Official policy excludes Asian equities from Portfolio Margin; only rules-based (Reg T) margin applies. While US megacaps like Apple and Nvidia get portfolio-level hedge offsets, Samsung is treated as a far heavier collateral burden under foreign-equity rules. Even on the same AI supply chain pair trade, the capital efficiency gap between US-listed names and Korea's Big 2 widens substantially.
• Equity perpetual futures narrow this gap without requiring any change to incumbent infrastructure. They settle on index prices alone, bypassing issuer-country clearing systems, and bring foreign and US tickers into the same collateral framework through USDC settlement and 24-hour trading.
• QFEX allows traders to access AI infrastructure names like NVDA, AVGO, and CRWV alongside Korean assets like Samsung Electronics, SK Hynix, and EWY on a single collateral rail, with up to 10× leverage. The further AI trades move from index leaders down into the deeper infrastructure layer, the more clearly traditional brokerages reveal their constraints (ticker coverage, trading hours, foreign-equity margin penalties), and the stronger the structural case for QFEX's perpetual futures rail.

Comments

• Lido's Web3SOC Certification: A Signal for Standardized DeFi Due Diligence

4. Macro & Onchain Metrics

Some of the charts below are powered by CryptoQuant. For those interested in exploring the underlying data in greater detail, CryptoQuant provides access to a comprehensive suite of onchain and market analytics used by institutional participants.