US Banking Regulators Unveil Framework for Payment Stablecoins
A critical hurdle has been overcome in US stablecoin regulation: Draft rules of implementation under the Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act) have been released by the two main banking regulators. The FDIC and OCC have opened for public comment Notices of Proposed Rulemaking (NPRMs) outlining the application, licensing, and supervision processes for banks to issue payment stablecoins.
What Happened?
1. FDIC Draft
The Federal Deposit Insurance Corporation (FDIC) Board of Directors approved a draft rule implementing the application provisions of the GENIUS Act.
The rule allows insured deposit institutions to issue payment stablecoins through an affiliate.
State banks and savings associations under FDIC supervision must apply to the FDIC to have their affiliates approved as “authorized payment stablecoin issuers” in order to conduct this activity.
The draft regulates that applications will be evaluated according to legal factors under Section 5 of the law, finalized within specific timeframes, and an appeals mechanism will be established for rejected applications. The review period is 60 days following its publication in the Federal Register.
2. OCC Draft
The Office of the Currency Conduct Authority (OCC) has proposed a comprehensive regulatory framework for national banks, federal savings associations, and federal branches.
The draft, announced in OCC Bulletin 2026-3, covers “authorized payment stablecoin issuers” (PPSI – approved affiliates of banks), federally qualified issuers, state-qualified issuers, and foreign payment stablecoin issuers (FPSI) under OCC jurisdiction.
The rule aims to establish a licensing, supervision, and enforcement framework. The OCC is soliciting public comment on over 200 questions concerning permitted activities, reserve assets, the licensing process, and capital. The comment period is again 60 days.
Scope of the Drafts
Who is affected: National banks and their subsidiaries, federal savings associations, federal branches, and state banks under FDIC supervision. Also, foreign and state-qualified issuers within the OCC's jurisdiction.
What is regulated: Application and approval process, evaluation criteria, timelines, right to appeal. On the OCC side: Licensing, supervision, reserve asset structure, and capital requirements.
What is excluded: Anti-money laundering (AML) and sanctions compliance obligations are not covered in these drafts; separate regulations are expected for these topics.
What's Next?
Both drafts will enter a 60-day public comment period after being published in the Federal Register. Regulators will evaluate the comments received and shape the final rules. Once the process is complete, a clear legal procedure will be established in the US for the first time for the issuance of payment stablecoins through bank subsidiaries.
This step puts the GENIUS Act's claim to "drive innovation" into action: it opens a predictable application path for banks while regulators link reserve quality, consumer protection, and financial stability to the supervisory framework.
#GENIUSImplementationRulesDraftReleased

#DriftProtocolHacked
One of the Biggest DeFi Security Crises of 2026
The year 2026 began with a critical turning point for the decentralized finance (DeFi) ecosystem. Drift Protocol, a leading Solana-based perpetual futures platform, was shaken by a large-scale cyberattack on April 1, 2026, resulting in the theft of approximately $280–286 million worth of digital assets.
This event was not only the biggest DeFi hack of the year but also one of the most serious security breaches ever recorded in the Solana ecosystem.
Technical Anatomy of the Attack
According to initial analyses, the attack resulted from a privilege escalation at the admin level rather than a classic smart contract vulnerability.
The attacker gained access to Drift Protocol's administrator keys or multisig privileges.
Alternative analyses suggest the attack was carried out by exploiting Solana's "durable nonce" mechanism.
Using this method, the attacker manipulated the system by triggering pre-approved transactions with a delay.
This situation once again reveals that the most critical vulnerability in DeFi security is still the human factor and operational processes.
Scale and Impact of the Attack
Total assets stolen: ~$280M – $286M
Largest single transaction: ~$155M worth of JLP tokens
Drift's TVL: $550M → dropped below $250M
Post-attack:
Platform operations halted
Many Solana DeFi protocols temporarily suspended operations
Market confidence suffered a serious blow in the short term
Movement of Funds and Cross-Chain Flow
The attacker employed a complex strategy to quickly make the funds difficult to track:
Stolen assets were converted to USDC on Solana
Then transferred to the Ethereum network via cross-chain bridges
A large portion was converted to ETH
It was determined that the attacker accumulated 130,000+ ETH (~$260M) during this process
This action was not only a hack but also a forced liquidity rotation in the market. It created an event that even affected Ethereum's price dynamics.
Claims of North Korean Connection
According to blockchain analytics firms, the attack's traces show similarities to previous operations:
Attack methodology
Fund laundering techniques
Cross-chain movement pattern
These indicators suggest the attack may be linked to North Korean-linked Lazarus-like groups.
If confirmed, this event would be one of North Korea's largest crypto operations in 2026.
Controversy and Ecosystem Response
One of the biggest debates after the event was about centralized structures and stablecoin issuers:
Blockchain researcher ZachXBT claimed Circle failed to freeze 230M USDC.
This raised the question of "is centralized intervention possible/necessary?" The question was raised again.
Security experts also emphasized that the event was a "wake-up call," drawing particular attention to the following:
Key management
Multisig security
Human-based attack vectors
Strategic Implications
This hack clearly revealed several critical realities for the DeFi world:
1. Smart contract security is no longer sufficient.
The attack came from the governance layer, not directly from the code.
2. The human factor is the weakest link.
Social engineering and operational manipulation remain the biggest risks.
3. Cross-chain structures amplify risks.
Cross-chain bridges make fund tracking difficult after an attack.
4. "Centralized reflexes" are inevitable in DeFi.
Issues such as fund freezing, intervention, and crisis management are back on the agenda.
Conclusion
The #DriftProtocolHacked event is not only a significant financial loss; it is also a breaking point that tests the limits of DeFi's security architecture.
This attack clearly demonstrates that the industry needs to shift from a purely code-based security approach to a multi-layered one that includes governance, human factors, and cross-chain risk management.