Pump.fun Bets on Dubious Celebrity Trader to Reach the Mainstream

gm, Defiers!

These are the biggest stories in DeFi and crypto:

• Pump.fun ran a Kimchi coin ad 78 seconds after mint
• NSA urges PHP patching or offline systems
• Ledger adds Morpho loans against wrapped bitcoin
• PancakeSwap votes on an 88% LP fee share
• OCC finalizes GENIUS rule, drops yield presumption

Pump.fun wants customers who have never heard of a bonding curve. On Tuesday it signed Kimchi, a pseudonymous trader who claims about $40 million of profit on the TRUMP token, as a creative partner, and posted an ad for a Kimchi coin 78 seconds after the coin was minted. Co-founder Alon Cohen said the platform's next wave of users "does not come from CT."

The push makes sense, because the memecoin market no longer hands Pump.fun its users by default. Launchpads on Robinhood Chain cut its share of launchpad fees from 79% to 27% in two weeks this summer, and it climbed back above half by mid-August. Flap, a BNB Chain launchpad, passed it in daily revenue on Aug. 1. Fomo, a trading app with copy trading and Apple Pay signup, competes for the trade rather than the mint, and earned $19 million over the last 30 days against Pump.fun's $45.4 million. Pump.fun has answered by widening its app: callout rewards tied to followers' profits, coins priced in tokenized stocks, and this week pre-IPO tokens. A famous face is the next move.

The ads got a lot of backlash, but I think the message was right. People come to a memecoin launchpad for a shot at getting rich quickly, and an ad that says so is honest about what the product sells. The cars-and-watches version of success is cringe to me, but it will still work on the audience Pump.fun is chasing. A lot of the criticism was around promoting It is a stretch to think Pump.fun users show up for community or to make online friends.

Kimchi was the wrong way to deliver it, because almost nobody outside Pump.fun's corner of X knows who he is. A mainstream campaign needs a face that people already recognize. A pseudonymous account with an unverified $40 million claim, which Community Notes now flags, gives new users nothing to recognize, so the ad mostly reached people already on the platform.

The Defiant's breakdown of the onchain record covers the wallet that minted the coin, the fee routing and the liquidity behind it.

Read more below!

As of 20:10 UTC, Oct. 21. Price data by CoinGecko. Full list

WATCH

He Lost $14M to FTX. Now He's Putting Real Stocks on Solana | Armani Ferrante (Backpack)

Armani Ferrante of Backpack explains how he lost $14 million to FTX and why he is now putting real stocks on Solana. Today, Sunrise brought Backpack-issued tokenized META shares to Solana. Watch the full conversation.

TOKENS

A Wallet Three Hours Old Minted Kimchi's Coin and Routed Every Fee to One Address

Pump.fun advertised a Kimchi memecoin to its users on Tuesday night, and a wallet three hours old had minted the coin 78 seconds earlier. That wallet sent 750 million of the 1 billion tokens to an address Pump.fun's own profile page titles "Kimchi" and routed the coin's entire creator-fee stream there, which has paid out 164 SOL, about $17,800. The coin peaked near a $44 million market value and traded at $28.5 million on Wednesday against about $1.33 million of liquidity. Pump.fun has not addressed the launch timing or the criticism.

A Wallet Three Hours Old Minted Kimchi's Coin and Routed Every Fee to One Address

Onchain records show the Kimchi coin was minted by a three-hour-old wallet that routed its entire creator-fee stream to one address, 78 seconds before Pump.fun's ad.

thedefiant.io

Why this matters: Kimchi's 75% stake is worth about $21.5 million at the quoted price, but thin liquidity means it cannot sell near that price.

SECURITY

NSA Urges PHP Users to Patch or Take Systems Offline

PHP released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both score 9.2 on CVSS v4.0 and can let attackers run code on a server without logging in. The NSA advised organizations to take systems offline if they cannot update immediately, after Japan's prime minister urged operators to patch. SlowMist had told crypto platforms to prepare, and Sebastian Bürgel said exploits were circulating, though PHP, CERT-EU and SlowMist notices do not confirm active exploitation.

NSA Urges PHP Users to Patch or Take Systems Offline

NSA advises PHP users to take systems offline if immediate updating is not feasible, as PHP releases fixes for two critical vulnerabilities.

thedefiant.io

Why this matters: Crypto platforms and wallet providers that run PHP services face unauthenticated code execution on their web servers until they update, and PHP says only patching fully closes the risk.

DEFI

Ledger Adds Morpho Loans Against Wrapped Bitcoin

Ledger is rolling out Crypto Loan in its wallet app, letting eligible users borrow USDC or USDT against cbBTC or WBTC through Morpho on Ethereum, with Yield.xyz providing the integration. Collateral moves into Morpho smart contracts and can be liquidated if a loan becomes unhealthy. Separately, Dolomite added about $100 million of Concrete's BTCcx, backed one-to-one by Bitcoin held at BitGo, as collateral. Only Concrete can borrow against it, and a forced liquidation needs an offchain custody redemption.

Why this matters: Hardware signing protects how users authorize a loan. Liquidation rules and wrapped-Bitcoin custody risk stay in the contracts, and Dolomite's BTCcx adds an offchain settlement step.

DEFI

PancakeSwap Opens 'The Flip' Vote With CAKE Supply Condition

PancakeSwap opened a Snapshot vote on a revised "The Flip" proposal that would raise liquidity providers' share of v3 and Infinity swap fees to 88%, from 66–68% on most pools. Daily CAKE emissions would fall from 22,500 to 7,000 tokens, and the final switch depends on CAKE supply falling 20% from its April 2025 baseline. Supply is down 11.5% so far. Voting closes Oct. 24.

Why this matters: Liquidity providers would keep a larger fee share, while the dedicated v3 burn gives way to treasury buybacks with no stated commitment to burn the CAKE purchased.

REGULATION

OCC Finalizes GENIUS Act Rule, Drops Third-Party Yield Presumption

The OCC finalized its GENIUS Act stablecoin rule, dropping a proposed presumption against certain third-party yield arrangements while keeping the ban on issuers paying interest to holders. The rule takes effect Jan. 18, 2027. The OCC will judge yield arrangements case by case, declined to grandfather existing rewards programs and offers no safe harbor. Existing issuers get no automatic transition, though the OCC generally expects to grant waivers from prior approval.

Why this matters: Stablecoin rewards run through affiliates or partners now face case-by-case review with no safe harbor, so issuers get no clear line before the Jan. 18 start.

Other Stories Worth Your Time

SpaceX Share Unlock Looms Over Aave Collateral Proposal — about 1.3 billion SpaceX shares become eligible for sale Oct. 22 as Aave weighs Coinbase's tokenized SpaceX stock as collateral; LlamaRisk recommends a 55% collateral factor and a 37,000-token deposit cap.

eMudhra's Weak Certificate Keys Prompt Emergency Trust Updates — researchers recovered eight weak issuing keys, and unpatched software can still accept forged HTTPS certificates; also: Obol urged Ethereum mainnet operators to upgrade to Charon v1.11.2 after compromised certificate-authority keys, and Railway urged all users to rotate secrets after a security incident.

13 JPMD Lookalikes Emerge Amid JPMorgan’s Ethereum Launch — thirteen lookalike contracts appeared on Ethereum, which shows the limits of identifying tokens by ticker.

Polymarket US Sues Ohio to Block Sports-Contract Crackdown — the suit challenges Ohio's sports-gaming licensing rules and argues federal commodities law preempts enforcement.

FCA Proposes Guidance on When DeFi Interfaces Need UK Authorization — the draft separates technical access to DeFi from transaction intermediation; responses are due Nov. 18.

Tesla and SpaceX Explore Merger That Could Unite 30,221 Bitcoin — the combined holdings would rank sixth among CoinGecko's tracked public companies.

Polkadot Warns Fearless Wallet Users to Move Funds After Private-Key Leak — also: Eclair patched Lightning bugs that could let peers steal funds, and SideSwap reported about 600 L-BTC redemptions after reopening swaps.

Ondo Perps Adds 3x OpenAI Pre-IPO Contract — also: OpenStocks' BNB Chain tokens offer price exposure without ownership of private shares, and Sunrise brought Backpack's tokenized META to Solana.

Lido Lend Exit Plan Would Tap Borrower Collateral for Withdrawals — eligibility and settlement rules for the proposed Fallback Exits are still to come.

Pendle Daily Volume Hits $159 Million, Led by Ethereum — Oct. 20 trading was nearly seven times the prior seven-day median, per DefiLlama data.

OpenSea Opens Mobile App to All Users, Pays Referrers 25% of Fees — the app adds a cross-app trading feed and a 25-plus chain portfolio view.

NEAR Opens Vote to Cut Token Issuance to 1.6% — the House of Stake vote would lower issuance from 2.5% over time.

Doodles' DOOD Token Surges 212% to a $38 Million Market Cap — the NFT floor posted a smaller gain.

Standard Chartered Signs Deal to Take Full Ownership of Zodia Custody — also: Western Union picked Noah for Receiver Redirect payouts in USDPT, and Securitize will mint stablecoins directly with Anchorage.

Binance to Reprice bStocks Collateral While US Stock Markets Are Closed — repricing runs around the clock from Oct. 24 UTC; also: OKX combined euro and EURC liquidity in one spot order book and Evernorth's $132.2 million warrant registration went effective.

Blockchain Association Asks SEC to Double Crypto Startup Exemption to $10 Million — the comment letter also asks for a $150 million cap on larger offerings.

Polymarket US vs. Kalshi: What a 100-Contract Trade Costs — and Krak vs. PayPal vs. Cash App on fees, reach and bank withdrawals.

Trending on The Defiant