Digital Asset Risk & Governance
The Drift Protocol Hack and the Infrastructure That Would Have Stopped It: What State-Level DeFi Attacks Mean for Institutional Fund Governance
The USD 285 million theft from Drift Protocol on April 1, 2026 was not a code vulnerability. It was an intelligence operation. What followed in twelve minutes of execution was six months of patient infiltration, credential building, and social engineering at a level of sophistication that the DeFi sector was not architected to resist. The governance gap that enabled it has a name: the absence of institutional structure.
By David Lloyd, Chief Executive Officer & Founder, CV5 Capital
CV5 Capital | April 2026 | Digital Asset Risk
The New Face of Crypto Theft
On the first day of April 2026, Drift Protocol, the largest decentralised perpetual futures exchange on the Solana blockchain, lost approximately USD 285 million in user assets. The attack took roughly twelve minutes to execute. The preparation took six months. The attackers did not find a bug in the code. They did not crack a private key or reverse-engineer a smart contract. Instead, they built a fictitious identity as a quantitative trading firm, attended major industry conferences across multiple countries, deposited more than one million dollars of their own capital to establish operational credibility, engaged Drift contributors in months of technically fluent conversations about trading strategies and vault integrations, and ultimately obtained two multisig approvals for pre-signed transactions that they then used to seize administrative control of the protocol and drain its vaults.
This attack was attributed with medium-to-high confidence to UNC4736, a North Korean state-affiliated group also known as AppleJeus or Citrine Sleet. The same group is assessed to have carried out the October 2024 exploitation of Radiant Capital, which resulted in losses of approximately USD 53 million through a materially identical methodology: a team member was socially engineered by an individual posing as a trusted contractor, allowing the attackers to insert themselves into critical authorisation workflows and drain lending pools across two blockchains. Before that came the February 2025 exploitation of a major centralised exchange through blind signing manipulation of hardware wallet interfaces, resulting in losses of approximately USD 1.46 billion in a single transaction: the largest theft of any kind in the history of the digital asset industry at the time.
The pattern across all three attacks is not technical. It is operational and human. The vector is the same: exploit the trust model, compromise the authorisation layer, and drain the vault before the protocol can respond. What these attacks expose is not a failure of blockchain technology. It is a failure of institutional infrastructure. And that is a problem that the regulated fund model is specifically designed to solve.
A Timeline of State-Level Attacks on DeFi
To understand what the Drift attack means for institutional allocators, it is necessary to see it in the context of a deliberate, escalating campaign that has been running for nearly a decade. North Korean state-affiliated groups have stolen an estimated USD 6 billion from the digital asset industry since 2017. The methods have evolved systematically, from exchange hacks to bridge exploits to social engineering at the operational level of protocols and custodians. The dollar amounts have grown in proportion with the sophistication of the attacks.
March 2022
Ronin Network — USD 624 million
Attackers compromised the private keys of five out of nine validator nodes by socially engineering team members. The theft was not discovered for six days. At the time it was the largest DeFi exploit in history. The attack vector was the human layer controlling the validator set, not the bridge code itself.
July 2024
WazirX Exchange — USD 235 million
Attackers manipulated the Safe multisig wallet interface to mask a malicious transaction as a legitimate one. Multisig signers approved what appeared to be a routine operation. The smart contract logic of the wallet was silently altered, transferring control to the attackers. Funds were moved and laundered across chains within hours.
October 2024
Radiant Capital — USD 53 million
A Radiant team member was approached by an individual posing as a trusted contractor. A file shared in that interaction deployed malware on the team member's device. The attackers gained access to the device's signing capabilities and used them to obtain multisig approvals for malicious transactions, draining lending pools across BNB Chain and Arbitrum. Investigators subsequently linked this operation to UNC4736.
February 2025
Major Centralised Exchange — USD 1.46 billion
Attackers compromised the development environment of a third-party custody interface provider. The malicious code modified the transaction signing interface so that signers saw a legitimate transaction while approving a malicious one. A 2-of-3 multisig cold wallet was drained in minutes. Attributed to the Lazarus Group by multiple intelligence firms and the FBI. The largest theft of any kind in history at time of execution.
April 2026
Drift Protocol — USD 285 million
Six-month social engineering operation by UNC4736, presenting as a quantitative trading firm. Attackers attended conferences across multiple countries, deposited their own capital, and engaged contributors at a technical level. Two attack vectors are assessed: exploitation of a known vulnerability in developer code editing software that permitted silent arbitrary code execution, and distribution of a malicious wallet application via a trusted channel. Two of five Security Council multisig members were manipulated into pre-signing durable nonce transactions. A fabricated token was listed as legitimate collateral. The entire protocol was drained in approximately twelve minutes on April 1, 2026, the second-largest theft in Solana history.
The cumulative loss across these five incidents alone exceeds USD 2.6 billion. Each attack involved the human authorisation layer as the primary vulnerability. Each involved multisig governance as the target. Each demonstrated that increasing the required number of signers does not prevent exploitation if the social engineering operation is sophisticated enough to compromise multiple signers simultaneously or sequentially. The attack surface is not the code. It is the people, processes, devices, and governance frameworks surrounding the code.
"The Drift attack was not a hack in any conventional sense. It was an intelligence operation with a budget, a timeline, an organisational structure, and a six-month cultivation phase. The question every institutional allocator should now be asking is not whether a similar operation could target the fund they are evaluating. It is whether the governance framework of that fund was designed to resist it if it did."
— David Lloyd, Chief Executive Officer & Founder, CV5 Capital
Why Multisig Governance Is Not Institutional Governance
The DeFi sector has long treated the multisig wallet as its primary governance and security mechanism. The logic is straightforward: if multiple parties must approve any transaction, compromising a single party is insufficient to drain a vault. The Drift, WazirX, Radiant, and Ronin attacks all demonstrate that this logic is correct as far as it goes, and that it does not go nearly far enough when the adversary is a state-level actor with the resources to compromise multiple parties simultaneously through a structured intelligence operation.
Multisig governance is a technical control. It addresses the question of how many signatures are required to authorise a transaction. It does not address who the signers are, how they are vetted, what devices they use, what processes govern how they review and approve transactions, what training they have received in identifying social engineering attempts, what controls exist over their professional and personal devices, what monitoring exists to detect unusual activity in the authorisation workflow, or what governance framework oversees the entire process and holds all parties accountable to documented standards.
These are the questions that institutional governance answers. They are questions that a CIMA-regulated digital asset fund platform is required to answer, document, and demonstrate to an independent regulator before it can accept a single dollar of investor capital. They are questions that an unregulated DeFi protocol is not required to answer at all, which is precisely why the attacks described above were possible.
The Drift Security Council operated as a five-member multisig with a 2-of-5 threshold. On paper, this means any single member can be compromised without consequence. In practice, UNC4736 compromised two members simultaneously using separate attack vectors: the VSCode code editor vulnerability and the malicious TestFlight wallet application. The 2-of-5 threshold was exactly the threshold the attackers needed. They met it. The protocol had no additional governance layer, no independent oversight function, no transaction review process, and no escalation procedure that could have caught a durable nonce transaction being used to seize administrative control of the entire Security Council before it executed.
The Drift Hack Through the Lens of a Regulated Fund
The most useful exercise for any institutional allocator evaluating a digital asset fund strategy is to ask: what would have happened if the Drift attackers had targeted a regulated fund structure instead of an unregulated protocol? The answer is instructive, not because a regulated fund is immune to sophisticated attack, but because the institutional governance architecture creates a series of independent barriers that a six-month social engineering operation would need to overcome sequentially and simultaneously, rather than a single human authorisation layer that can be bypassed once two members of a five-person committee have been compromised.
Counterparty Onboarding and Know-Your-Client Obligations
The first point at which a regulated fund structure would have diverged from the Drift scenario is at the point of counterparty onboarding. UNC4736 presented itself as a quantitative trading firm seeking to integrate with Drift as a vault operator. Drift's onboarding process required the group to fill out a form with strategy details. No formal counterparty due diligence process, no registered entity verification, no source of funds investigation, and no ongoing monitoring relationship were in place.
A CIMA-regulated fund operating under the Anti-Money Laundering Regulations of the Cayman Islands is required to conduct comprehensive know-your-client and counterparty due diligence on all investors, counterparties, and service providers before commencing any business relationship. This process requires verification of legal entity registration, ultimate beneficial ownership, source of funds, source of wealth, and the nature of the business relationship. A group presenting itself as a quantitative trading firm with "verifiable professional backgrounds" and "employment histories" would face documented verification requirements against independent authoritative sources, not a form submission and a Telegram group. UNC4736's front organisation, however sophisticated, would need to fabricate an entirely parallel corporate existence with genuine regulatory filings, audited accounts, and verifiable custodial relationships to pass institutional counterparty due diligence. The operational cost and exposure risk of that exercise changes the attack calculus significantly.
Segregation of Duties and the Four-Eyes Principle
The Drift attack succeeded in part because the same individuals responsible for protocol development and community engagement were also the multisig signers with administrative control over the protocol's vaults. This absence of segregation between operational functions and control functions is fundamental to why the social engineering operation was able to convert a working relationship into a signing authority.
Regulated fund governance requires documented segregation of duties between those who manage a fund's investments, those who authorise significant transactions, those who provide independent oversight, and those who administer and report on fund assets. An independent fund administrator is responsible for NAV calculation, investor recordkeeping, and transaction processing. Independent directors are responsible for oversight, governance, and the approval of material operational changes. The investment manager is responsible for investment decisions within agreed mandates. Each function is separated by contract, by regulatory requirement, and by the accountability that each party owes to CIMA, to auditors, and to investors.
In this structure, no single individual or small group of individuals holds both the authority to initiate transactions and the authority to approve and execute them without independent review. A pre-signed durable nonce transaction that would seize administrative control of a fund's entire custody structure would require approval from an independent board of directors, notification to the fund administrator, and potentially notification to CIMA before it could be executed legitimately. The ability to execute such a transaction in twelve minutes, without any independent party being in a position to flag or halt it, is an operational characteristic of unregulated DeFi governance, not institutional fund governance.
Device Security, Operational Controls, and Cybersecurity Policy
One of the two primary attack vectors in the Drift hack was the exploitation of a known vulnerability in widely used developer code editing software. A team member cloned a repository provided by the attackers, which silently executed arbitrary code through the editor's workspace opening function. This vulnerability had been documented in the security community for several months before the attack. The team member who triggered it was operating a personal or work device with no independent control over which software was installed, which repositories could be cloned, or what network traffic the device was permitted to generate.
A regulated fund platform is required to maintain documented cybersecurity policies and procedures as part of its compliance with CIMA's Rules and Statements of Guidance on Internal Controls and Corporate Governance. These policies must address device management, software installation controls, network segmentation, patch and vulnerability management, and incident response procedures. Signing devices used for any material transaction authorisation must be subject to documented controls that are independent of the individuals using them.
In an institutional governance framework, the known VSCode vulnerability exploited in the Drift attack would fall within the scope of the platform's vulnerability management programme. Patch cadence requirements, software allow-listing policies, and device monitoring would be documented components of the cybersecurity programme approved by the board and reviewed at least annually. A device used to authorise transactions on behalf of a regulated fund would not be a general-purpose development machine that can silently execute arbitrary code upon opening a shared repository.
Transaction Review, Escalation, and the Role of Independent Directors
The mechanism by which the Drift attackers defeated the multisig was the use of durable nonces, a legitimate Solana feature that allows transactions to be pre-signed and held in a valid state for an extended period before execution. Two members of the Security Council pre-signed transactions they had been led to believe were routine operations. Those pre-signed transactions sat dormant for more than a week before being simultaneously executed on April 1, at which point they took approximately twelve minutes to drain USD 285 million from the protocol.
The critical failure is not that two people were deceived. It is that the governance framework provided no mechanism for a pre-signed transaction to be reviewed, flagged, or cancelled once it was discovered to be malicious, and no independent party whose function was to ask questions that the operational team had been socially engineered not to ask.
Regulated fund governance places independent directors in a formal oversight role with documented responsibilities that include reviewing and approving material operational changes, overseeing the fund's risk management framework, and acting as a check on the actions of the investment manager and service providers. An independent director reviewing a proposed administrative action that would restructure the fund's Security Council governance with zero timelock would be required to ask what the action was, why it was necessary, and whether it had been reviewed by legal counsel and the administrator. The nature of their independence from the operational team is precisely what prevents them from being included in the same social engineering operation targeting the operational team.
The independent directors of a regulated fund are not participants in the day-to-day workflow of protocol development. They were not in the Telegram group. They were not at the conferences. They did not receive the malicious repository link or the malicious TestFlight application. Their role is to provide governance oversight that is structurally separated from operational involvement, which is exactly the kind of separation that a six-month social engineering operation targeting operational contributors cannot easily replicate.
Wallet Management: Custody Architecture and the Limits of Self-Custody
Drift Protocol held its users' assets in vaults controlled by its own multisig governance structure. The protocol was, in effect, its own custodian. This is a common model in DeFi and it is one of the most significant sources of concentrated operational risk in the digital asset industry. When the governance of the custodian and the governance of the protocol are the same, compromising the protocol's operational team is sufficient to access the assets. There is no independent custody layer, no segregated asset structure, and no independent party responsible for safeguarding assets who is not also a party to the operational relationships being exploited.
Regulated digital asset fund structures are required by CIMA's Rule on Segregation of Assets to appoint an independent service provider to ensure safekeeping of the fund's portfolio, with the portfolio segregated and accounted for separately from any assets of any service provider. The fund's assets are not controlled by the same governance structure that controls the fund's operational decisions. A regulated digital asset custodian holds assets under a documented custody agreement with independent controls, transaction authorisation requirements that are separate from the fund manager's internal processes, and its own cybersecurity and operational resilience frameworks that are subject to independent audit and regulatory oversight.
In practical terms, this means that draining a regulated fund's custody would require compromising not only the fund manager's transaction authorisation process but also the independent custodian's transaction review and approval controls, the administrator's NAV reconciliation process, and the board's oversight function, all simultaneously and without any of those independent parties raising an alert. This is materially more difficult than compromising two members of a five-person multisig whose devices are connected to an active development environment.
The wallet management framework for a regulated digital asset fund also addresses the specific vulnerabilities demonstrated in the Drift attack. Documented policies must specify which devices are permitted to generate or approve transaction signatures, what network controls those devices operate under, what the review and escalation process is for any transaction above defined thresholds, and what the procedure is for cancelling a pending transaction if concerns are raised. Pre-signed transactions of the kind used in the durable nonce attack would need to be captured within the fund's documented transaction authorisation framework, which would require them to be reviewed and approved through a formal process rather than obtained through social engineering of the operational team.
The Regulatory Framework as an Active Risk Mitigant
CIMA registration under the Mutual Funds Act is not a box-ticking exercise. It is a regulatory relationship that requires ongoing compliance with documented governance, internal control, and reporting standards that are subject to examination, inspection, and enforcement. The CIMA Rules on Corporate Governance, Internal Controls, and Segregation of Assets that came into full effect in October 2023 represent a comprehensive framework for institutional governance that goes significantly beyond what any DeFi protocol is required to implement.
The corporate governance rule requires registered funds to maintain an independent governing body, implement documented risk management and internal control systems, ensure reliable financial reporting, and maintain appropriate communication with CIMA. The internal controls rule requires effective control environments including segregation of duties, access controls, authorisation and verification procedures, and processes for monitoring activities and correcting deficiencies. These are not aspirational standards. They are regulatory obligations that are enforced through periodic examination and that carry consequences for non-compliance including fines, director removal, and fund cancellation.
An unregulated DeFi protocol operates under no analogous framework. Its governance is whatever the team decides it should be. Its internal controls are whatever the developers implement. Its authorisation procedures are whatever the multisig configuration provides. Its incident response is whatever the team can coordinate in the hours after an attack. The regulatory framework that applies to a CIMA-registered fund creates a mandatory baseline of operational and governance standards that must exist and must be demonstrable before any investor capital is accepted.
Critically, the regulatory relationship also creates accountability that extends to the individual directors. CIMA-registered directors operate under the Director Registration and Licensing Act, which requires them to meet ongoing fit and proper standards and imposes personal accountability for governance failures within regulated entities. A director who approved a material administrative transaction without adequate review of its implications, or who failed to question an unusual operational change, would face scrutiny not only from investors but from the regulator. This personal accountability is a material incentive for governance behaviour that the multisig model does not replicate.
Internal Controls as Infrastructure, Not Documentation
One of the most important lessons of the Drift attack, and of the broader pattern of state-level attacks on DeFi infrastructure, is that security is not a property of the code. It is a property of the operating environment around the code. The VSCode vulnerability that served as one of Drift's attack vectors was a known issue that had been flagged by the security community for several months. The attack on the third-party wallet interface used in the 2025 centralised exchange hack compromised a supply chain dependency, not the exchange's own systems. The social engineering that preceded both the Radiant Capital and Drift attacks exploited the absence of formal counterparty verification and contributor vetting processes.
These are all failures of internal controls in the broadest sense: the policies, procedures, technical configurations, and human practices that govern how an organisation operates, who is permitted to do what, how material actions are authorised and reviewed, and what monitoring exists to detect anomalies before they become catastrophic. Internal controls are not a compliance artefact. They are operational infrastructure, and when they are absent or inadequate, the technical security of the code is irrelevant because the attack goes around it.
A regulated fund's internal control framework addresses the specific failure modes demonstrated in these attacks. Software and device management policies determine what an authorised device can have installed and what network connections it can make. Counterparty vetting procedures determine who can enter into a working relationship with the fund and on what basis. Transaction authorisation procedures determine who can initiate, review, and approve a material transaction and what documentation is required at each stage. Incident response procedures determine what happens in the first hour, the first day, and the first week after a security event is detected. None of these frameworks eliminate risk. All of them make the specific attack vectors demonstrated in the Drift, Radiant, and 2025 exchange hacks materially more difficult to execute.
Device Management Policy
Documented controls over which devices may be used for transaction authorisation, what software may be installed, and what network access is permitted. The VSCode vulnerability exploited in Drift would fall within patch and vulnerability management requirements.
Counterparty Due Diligence
Formal KYC and AML screening of all counterparties before any working relationship commences. A fictitious quantitative trading firm would face legal entity verification, UBO screening, and source of funds requirements that a form submission cannot satisfy.
Transaction Authorisation Framework
Documented approval chains, threshold levels, independent review requirements, and escalation procedures for material transactions. Pre-signed transactions of the kind used in the durable nonce attack cannot be executed without passing through a review process that includes independent parties.
Segregation of Duties
Operational functions separated from control functions. The individuals socially engineered in the Drift attack were both contributors to the protocol and members of its security governance. Institutional governance separates these roles structurally.
Independent Custody
Assets held by an independent custodian under documented controls that are not accessible through the fund manager's operational workflow. Draining assets requires compromising both the fund manager's authorisation process and the custodian's independent controls.
Incident Response Procedures
Documented escalation paths, stakeholder notification requirements, and asset freeze procedures that are tested and ready before an incident occurs, rather than coordinated on an emergency basis after USD 285 million has already been moved to Tornado Cash.
The Comparison: Unregulated Protocol versus Regulated Fund
The governance comparison between an unregulated DeFi protocol and a regulated institutional fund is not an abstract one when viewed through the specific attack methodology employed against Drift. The following comparison maps each stage of the attack against the governance controls that would have applied in a regulated fund context.
- Counterparty onboarding via form submission and Telegram; no independent entity verification required
- Multisig signers drawn from operational team with no structural separation between contributors and governance authorities
- No device management controls; signers use personal and development machines with no monitoring
- No independent review of pre-signed transactions; signers trusted to understand what they are approving
- No independent custody layer; protocol controls its own vaults with no segregation from governance
- No mandatory cybersecurity policy; vulnerability management informal and dependent on team awareness
- No independent board oversight; governance concentrated in the Security Council multisig
- No regulatory relationship; no external accountability for governance failures
- Incident response improvised in real time after USD 285 million has been drained and bridged
- Full AML and KYC counterparty due diligence required before any business relationship; legal entity verification, UBO screening, source of funds documentation
- Segregation of duties between operational team, transaction authorisation, and independent governance oversight mandated by CIMA rules
- Documented device management and cybersecurity policies; authorised signing devices subject to controls independent of the operational team
- Transaction authorisation framework with independent review requirements and escalation procedures for material or unusual transactions
- Independent custodian holding fund assets under documented controls with separate authorisation requirements not accessible through the investment manager's workflow
- Documented cybersecurity policy approved by the board, including vulnerability management, patch cadence, and incident response procedures
- Independent board of directors with personal accountability under CIMA's Director Registration and Licensing Act; not embedded in operational relationships being targeted
- CIMA regulatory relationship with ongoing examination, inspection, and enforcement; governance failures carry regulatory consequences
- Documented incident response plan tested before incident occurs; stakeholder notification and asset protection procedures ready to execute immediately
The governance architecture of a regulated fund does not guarantee that a sufficiently resourced state actor cannot mount a successful attack. What it guarantees is that the attack methodology employed against Drift, which relied on the absence of any independent governance layer, the concentration of signing authority in an operationally embedded team, and the complete absence of any mandatory counterparty verification or device control framework, would not be sufficient. The attacker would face a materially more complex target requiring simultaneous compromise of multiple independent parties who are structurally separated from each other and from the operational relationships being exploited.
What This Means for Institutional Allocators
The Drift attack is, in an important sense, a gift to the institutional allocator community. It is an extraordinarily well-documented illustration of exactly which governance failures enable catastrophic losses in the digital asset space, provided in real time by a transparent team that engaged Mandiant and published a detailed forensic account. Every institutional allocator evaluating a digital asset fund strategy should read the Drift postmortem as a governance due diligence checklist and then ask their managers, point by point, how each failure mode has been addressed in the fund's operating framework.
The questions that the Drift attack makes mandatory for any credible operational due diligence exercise are not complex. They are straightforward governance questions that a regulated fund structure is required to have already answered: Who controls the authorisation of material transactions, and how are they separated from the team that initiates them? What is the counterparty verification process for any new operational or trading relationship? What device controls exist for individuals with signing authority? Is there an independent custody arrangement that is structurally separated from the fund manager's governance? Is there a documented incident response plan and has it been tested? Who are the independent directors, what is their specific accountability, and are they materially separated from the operational relationships that could be socially engineered?
For allocators who have previously treated digital asset governance as a secondary consideration relative to strategy and performance, the progression from the Ronin bridge hack in 2022 through the 2025 centralised exchange hack to the Drift Protocol attack in 2026 makes the case that governance is not a secondary consideration. It is the primary risk management question in the digital asset fund context, because the attack surface that sophisticated adversaries are exploiting is governance itself.
"The digital asset industry has spent years building better code. The most sophisticated adversaries in the world have spent the same years building better social engineering operations. The asymmetry of this contest is resolved not by better code but by institutional governance architecture that places independent, structurally separated parties in a position where the social engineering of any one individual or small group is insufficient to authorise a material action. That is what regulated fund structures provide, and it is what the Drift attack has made unmistakably necessary."
— David Lloyd, Chief Executive Officer & Founder, CV5 Capital
The CV5 Capital Governance Framework
CV5 Capital is a CIMA-regulated digital asset fund platform based in the Cayman Islands, operating the CV5 Digital SPC umbrella structure for digital asset and multi-asset fund strategies. Every fund operating within the CV5 Digital SPC platform launches within a governance architecture that addresses the specific failure modes demonstrated in the Drift, Radiant, and comparable attacks.
The governance framework applies from the first day of a fund's operation and does not depend on the investment manager building it themselves. Independent directors exercise formal oversight of the fund's governance and material operational decisions without being embedded in the investment manager's operational workflow. Fund assets are administered by an independent administrator responsible for NAV calculation, investor recordkeeping, and transaction processing under a documented service agreement. Custody arrangements are structured to provide asset segregation independent of the investment manager's authorisation process. AML and counterparty due diligence obligations apply to all investor and counterparty relationships from the point of first contact.
The platform's cybersecurity policies, internal controls framework, and incident response procedures are documented, board-approved, and aligned with CIMA's Rules on Internal Controls for Regulated Entities. These documents exist before a fund launches its first trade, not as responses to events that have already occurred. Platform managers and directors are personally accountable for governance standards under CIMA's Director Registration and Licensing Act, creating the individual-level incentives for governance behaviour that the multisig model fundamentally lacks.
For managers considering the launch of a digital asset fund strategy, and for allocators evaluating the governance of existing fund structures, the events of April 2026 make the case for institutional governance architecture with a clarity that no amount of prospectus language could provide. The Drift attack is a demonstration of what happens when the governance model is insufficient for the adversary it faces. The regulated fund model is what happens when governance is taken seriously from the beginning.
Further information about CV5 Capital's governance framework and digital asset fund platform is available at cv5capital.io/digital-asset-fund-platform, or by contacting the team directly at info@cv5capital.io.
This article is published for informational and educational purposes only and does not constitute legal, regulatory, investment, or financial advice. The views expressed are those of the author and reflect his personal analysis of publicly available information regarding the incidents described. Figures relating to financial losses in connection with the events discussed are based on publicly reported estimates and may not reflect final confirmed amounts. CV5 Capital makes no representation as to the completeness or accuracy of third-party reported figures. CV5 Capital is registered with the Cayman Islands Monetary Authority (CIMA Registration No. 1990085, LEI: 9845004EMS63A8938362).
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)