A ‘Jekyll and Hyde’ Tactic

A newly uncovered class of malicious decentralized finance ( DeFi) liquidity pools is targeting the core infrastructure that cryptocurrency traders rely on to find the best prices, according to new research published July 16 by DeFi infrastructure firm Enso.

The company is calling the deceptive setups “toxic pools.” Unlike typical cryptocurrency hacks that drain funds directly from smart contracts, these pools are engineered to systematically trick transaction simulations. They return attractive, highly competitive price quotes when a crypto wallet or decentralized exchange ( DEX) aggregator runs a simulation, but they alter their behavior the moment the transaction is actually executed on the blockchain.

The result is a subtle, systemic drain: traders receive significantly worse execution prices than they were quoted, or their transactions fail, burning network fees in the process.

“Our investigation leads us to believe this is not simply another isolated smart contract exploit,” said Milos Costantini, co-founder and chief product officer at Enso. “The industry has spent years optimizing price discovery. Our findings suggest the next challenge is verifying execution integrity.”

According to Enso’s report, toxic pools exploit the off-chain “dry-run” simulations that wallets use to preview trades. The malicious contracts detect when they are running in a read-only simulation environment and return an artificially optimized price. Once the transaction is actually broadcast on-chain, the pool alters its mathematical logic to execute the trade at a degraded rate.

To remain hidden from security systems, these pools alternate between honest and malicious states, rendering static code scanners and historical reputation filters ineffective. This bait-and-switch design degrades the user experience and drains user funds through failed transactions. In one case study, a manipulated Curve pool triggered more than 37,000 reverted trades, forcing users to burn nearly $30,000 in gas fees.

Attackers are also exploiting next-generation, modular exchange architectures. On Polygon, a malicious “hook” — a smart contract plugin used in platforms like Uniswap v4 — lured routing systems with fake rates before triggering a 99.1% transaction failure rate.

Findings From On-Chain Forensic Analysis

The research, which spanned roughly two months of on-chain forensic analysis, combined historical archive- node data, transaction trace analysis and smart contract inspections. Enso engineers, with support from contacts at major DeFi protocols Curve Finance and Oku, identified active toxic pools operating across both the Ethereum and Polygon blockchains.

In one documented case study on Ethereum, a manipulated Curve pool processed more than 129,000 swaps. While the pool appeared to be the optimal route, it delivered worse execution than quoted, leading to approximately $225,000 in overstated quotes.

Furthermore, Enso’s team identified multiple blockchain oracle contracts deployed by the same operator to support additional pools, indicating the tactic is likely more widespread than the two documented cases and could represent an emerging template for on-chain extraction.

The findings present a direct challenge to the user-facing layer of the DeFi ecosystem. Popular wallets, consumer-facing interfaces and aggregators depend heavily on automated simulations to guarantee the “best path” for a user’s trade.

Enso’s report highlights that if routing infrastructure cannot distinguish between a legitimate quote and a manipulated one, front-ends will continue to steer users toward these traps. This creates potential legal and financial liability risks for wallet providers and interface operators who promise “best execution” but routinely deliver toxic routes.

In response to the threat, Enso announced it has updated its execution-protection product, Enso Shield, to include dedicated toxic-pool detection. The security tool is designed to bypass standard simulation methods by analyzing live on-chain context, monitoring quote history and using transaction traces to spot execution discrepancies.

Rather than blaming individual decentralized exchanges, Enso has called on the wider cryptocurrency industry to conduct further research into the manipulation of transaction simulations.

“If transaction simulations can be manipulated while real execution tells a different story,” Costantini said, “we need better ways to verify what users actually receive.”

July 16, 2026, 5:00 AM HST

Strict Enforcement and Steep Penalties

Cryptocurrency exchange Luno has launched a formal challenge against a proposed overhaul of South Africa’s foreign exchange laws, arguing that the National Treasury’s plan to bring digital assets under an apartheid-era capital flow regime is unconstitutional because it bypasses Parliament. The challenge was detailed in Luno’s formal submission to the National Treasury on the Draft Capital Flow Management Regulations.

The draft rules, jointly published by the Treasury and the South African Reserve Bank for public comment, aim to modernize the country’s exchange controls. However, Luno warns that the proposal contains highly restrictive measures that threaten fundamental property and privacy rights.

As previously reported by Bitcoin.com News, the draft regulations seek to replace South Africa’s 1961 Exchange Control Regulations with a risk-based system focused on monitoring cross-border transactions and combating illicit financial flows. Violations could carry penalties of up to five years in prison, a fine of $53,000 (1 million South African rand), or both.

In its submission, Luno raised serious alarms over three specific enforcement provisions: asset seizure without court orders, forced liquidations and business-ending sanctions. Marius Reitz, Luno’s general manager for Africa, argued that changes of this magnitude must not be enacted via ministerial regulation.

“By proceeding through ministerial regulation, the executive branch effectively bypasses the democratic process for changes that will affect the fundamental property and privacy rights of millions of South Africans,” Reitz said. “They should, in our view, have been enacted as a new Act passed through Parliament.”

Luno further charged that the National Treasury is contradicting the central bank’s own policy roadmap, which identifies stablecoins as potential future money capable of facilitating low-cost, borderless payments. Yet, Luno argues, the Treasury’s draft regulations treat all digital assets as identical, bringing bitcoin, stablecoins and tokenized real-world assets under the same restrictive capital flow framework.

“By attempting to capture every digital asset regardless of utility or economic function, Treasury risks unintentionally stifling South Africa’s broader blockchain technology sector,” Luno stated.

Proposed Solutions for Industry Growth

The exchange warned that the proposed reporting requirements for transactions above an unspecified threshold would create an “unmanageable administrative burden” for platforms and the state alike, given that large transaction volumes are processed within seconds.

“Our experience demonstrates that overly restrictive regulation simply pushes digital asset activity underground or offshore, beyond the reach of domestic regulators and tax authorities,” the company added.

Meanwhile, the crypto exchange’s submission also shared several key recommendations to resolve some of the friction points. First, Luno calls for the enactment of the final crypto capital flow framework through an Act of Parliament rather than executive regulation. It also recommends the designation of crypto assets bought and held on South African-licensed exchanges as onshore assets.

Luno wants regulations to distinguish between digital asset classes based on economic function while dropping the proposed forced-sale and warrantless asset seizure mechanisms. Non-resident international trading firms must also be allowed to continue operating in the South African market under appropriate registration to preserve market liquidity.

“South Africa needs a regulatory framework that protects the integrity of the digital asset system without stifling the innovation, investment and economic growth that the digital asset sector is uniquely positioned to deliver,” Reitz said.