The week unfolded with four simultaneous vectors. The Lazarus group hacked Kelp DAO for $293 million, causing the largest quarterly collapse of DeFi TVL by 14%, losing $13.8 billion. Meanwhile, Japan, Pakistan, South Korea, and the EU made four independent regulatory moves, ranging from criminal liability to pilot programs with tokenized deposits. Deutsche Börse and Tether are investing in crypto as an infrastructure asset class. On the flip side, Iran and the sanctioned Grinex show the opposite end of the spectrum — the same technology is used as a workaround for sanctions. Lazarus has put DeFi back into a mode of existential stress testing. The North Korean Lazarus group hacked Kelp DAO on April 20 for $293 million via the LayerZero bridge, configured with 1/1 DVN instead of the recommended 2/2. The stolen 116,500 rsETH were used as collateral in Aave, Compound, and Euler to secure loans amounting to $236 million. DeFi’s total TVL plummeted from $99.5 billion to $85.7 billion, with Aave losing $8.9 billion (33.7%). DeFiLlama co-founder 0xngmi outlined three scenarios to cover the gap: an "18.5% haircut" creates $216 million in bad debt, writing off L2 holders of rsETH results in $341 million, and a pre-hack snapshot leaves $91 million in residual losses. On April 14, Polkadot Hyperbridge lost $1.2 billion nominally — the perpetrator issued 1 billion DOT, but due to low liquidity, only withdrew 108.2 ETH ($253,000). Regulators across four continents are simultaneously constructing the legal perimeter for crypto. The Japanese Cabinet on April 13 approved the reclassification of cryptocurrencies as financial instruments; the penalty for operating without registration increases from 3 to 10 years in prison, and fines rise from $18,800 to $62,800, effective FY2027. The Central Bank of Pakistan on April 16 lifted an eight-year ban on banks servicing licensed VASPs — banks will segregate client funds and fully vet each VASP, though engaging in crypto trading themselves remains prohibited. On April 16, South Korea announced a pilot for tokenized deposits in Sejong for Q4 2026: the government will conduct operational expenses via blockchain for targeted usage control; deposits remain bank liabilities rather than stablecoins. EU Commission advisor Peter Kerstens confirmed on April 16 that MiCA will be revised by June 30, 2027. Institutions are entering crypto not as traders, but as infrastructure investors. The trend is for large TradFi players to acquire stakes and build their settlement products without awaiting clarity. Deutsche Börse invested $200 million in Kraken's parent company on April 15, with a valuation of $13.3 billion — 33% lower than in November, but the exchange receives 1.5% of shares along with joint products for tokenization, clearing, and collateral management. The partnership follows their collaboration on xStocks for tokenized American stocks; Kraken CEO Arjun Sethi emphasized that the IPO remains on the agenda.