Riot Platforms posted $167.2 million in revenue for the first quarter of 2026, with its newly launched data center business contributing $33.2 million.

The data center revenue helped offset a decline in Riot’s core Bitcoin mining business, which fell to $111.9 million from $142.9 million in Q1 2025, driven by lower average Bitcoin prices and a 24% rise in the global network hash rate. Riot produced 1,473 Bitcoin during the quarter, down from 1,530 a year earlier, while the average cost to mine one coin increased to $44,629 from $43,808, according to an announcement.

“The first quarter of 2026 marks a definitive inflection point for Riot, as we officially transitioned into an active, revenue-generating data center operator,” CEO Jason Les said, adding that AMD’s decision to double its contracted capacity to 50 megawatts during the quarter validated the company’s ability to execute at institutional scale.

AMD had initially contracted 25 megawatts before exercising an option to expand, bringing total contracted capacity to 50 megawatts of critical IT infrastructure.

Related: CoreWeave shows how crypto-era infrastructure quietly became AI’s backbone

Riot holds $1.1 billion in Bitcoin

Riot ended the quarter holding 15,679 Bitcoin, valued at roughly $1.1 billion based on a March 31 price of $68,222, with 5,802 coins held as collateral. The company maintained $282.5 million in cash, of which $76.9 million is restricted. Riot also said it sold more than $250 million worth of Bitcoin during the quarter.

Meanwhile, engineering revenue, which covers infrastructure services, rose to $22.2 million from $13.9 million year-over-year, adding another layer of diversification to the company’s revenue mix.

Riot’s stock closed up 7.31% at $18.50 on Friday, surging on the earnings release. The stock slipped 0.57% in after-hours trading to $18.40.

Riot shares surge on earnings news. Source: Yahoo! Finance

Related: Bitcoin Miner Bitdeer Liquidates Entire BTC Treasury, Holdings Fall to Zero

Bitcoin miners shift to AI

Bitcoin miners are increasingly shifting toward AI infrastructure as tightening mining margins push the industry to seek more stable revenue streams. As Cointelegraph reported, Core Scientific is converting its Pecos, Texas site into a 1.5-gigawatt AI-focused data center campus, repurposing 300 megawatts of Bitcoin mining capacity and acquiring over 200 acres of land to support the buildout.

Among other miners, MARA Holdings has acquired a majority stake in French AI infrastructure firm Exaion, while Hive, Hut 8, TeraWulf and Iren are also converting mining facilities into data centers.

Magazine: Bitcoin will not hit $1M by 2030, says veteran trader Peter Brandt

Decentralized finance (DeFi) protocols are stepping in to freeze stolen funds while centralized issuers face criticism for holding back.

A recent intervention on Arbitrum saw attacker-linked assets frozen after a major exploit, while some stablecoin issuers, including Circle, have faced public backlash for slower or more limited responses in similar situations.

Connor Howe, CEO and co-founder of cross-chain infrastructure project Enso, said that crypto protocols are not that different from centralized platforms or banks if a small group of people can freeze funds.

“The differentiation from a bank compliance officer is less than DeFi idealists will ever admit,” Howe told Cointelegraph.

The debate isn’t the usual kerfuffle between decentralization and centralization, but about who gets to intervene and how quickly they can act. In practice, it can determine whether stolen funds are stopped or slip through.

Crypto community divided on Arbitrum’s decision to freeze stolen funds. Source: Joe Hall

The limits of decentralization in DeFi

To put it simply, the industry is split on whether protocols that call themselves decentralized should be able to freeze funds during exploits.

Protocols like THORChain said they cannot freeze funds by design, even during exploits. Security researchers have questioned that claim, pointing to past cases where intervention did happen.

THORChain founder’s defense against the security community. Source: JP Thorbjornsen

Related: Crypto projects shut down as token models fail under pressure

Bernardo Bilotta, CEO of stablecoin infrastructure platform Stables, said the function is necessary but must operate within clear constraints.

“Freeze capabilities need to be narrowly scoped, time-limited and governed by transparent criteria that existed before the breach occurred,” Bilotta told Cointelegraph. “A protocol shouldn’t be making up the rules while the house is on fire.”

Bilotta characterized choosing “philosophical purity” over user protection as “negligence.”

The recent $293 million Kelp DAO exploit brought those discussions back into the spotlight as Arbitrum froze some of the stolen funds linked to suspected North Korean hackers. Some in the industry said the decision cut against DeFi’s grain.

The Ethereum layer-2 network has a 12-member security council with the ability to carry out certain changes to the protocol. In emergency situations, it can do so through nine of the 12 in its multisig wallet.

Arbitrum security council members are voted on by the network’s decentralized autonomous organization. Source: Arbitrum

Howe said that transparency in how such security councils operate can still separate DeFi platforms from traditional finance or their centralized counterparts.

“That’s notably different from a TradFi institution that invokes discretionary powers buried in their terms of service and guarded by their legal team,” Howe said.

“There should be transparency in every protocol around who holds the keys, and the safeguards in place to prevent them from going rogue. If there’s no clear distinction, then it’s a vague claim of decentralization.”

Centralized issuers face different constraints

Centralized stablecoins are among the most-traded cryptocurrencies in the world. Tether’s USDt and Circle’s USDC are the largest, accounting for more than $266 billion in combined market capitalization.

Both issuers have the ability to freeze their stablecoins, but they approach that function differently.

While Tether freezes funds more quickly in most security breaches, Circle emphasizes legal process and jurisdiction before intervening, 

“Let me be clear about something that is frequently misunderstood: when Circle freezes USDC, it is not because we have decided, unilaterally or arbitrarily, that someone’s assets should be taken from them,” Dante Disparte, the company’s head of global policy, wrote in a recent blog post.

“Our ability to freeze funds is a compliance obligation — exercised only when we are legally compelled by an appropriate authority, through lawful process,” he continued.

Circle was pushed to explain its stance after the recent $280 million exploit on Solana-based Drift protocol, also attributed to North Korea.

Circle’s explanation did not cut it for security experts demanding answers. Source: ZachXBT

Related: Ethereum’s EEZ could pull other blockchains into its orbit

Bilotta said waiting for formal legal orders in cases with clear, onchain evidence of an exploit is a “failure of responsibility.”

Who decides what counts as “extreme”

Large-scale exploits, including those linked to North Korean actors, have pushed the industry into situations most would consider extreme, where hundreds of millions can be drained and laundered in real time.

Such cases raise the question of who defines what qualifies as “extreme” and when intervention is justified.

“This is the question the industry has been ducking the longest,” said Wish Wu, CEO of institution-focused layer-1 Pharos.

“In practice, ‘extreme’ is too often defined after the fact by whoever holds the keys, which is exactly the failure mode decentralization was meant to avoid,” he added.

Wu said the more credible approach is to define those conditions in advance and encode them into governance, even if that means accepting that some edge cases fall outside those rules.

“Can a small, identifiable group move user funds before users have a fair chance to exit?” Wu asked.

“If the answer is yes, then whatever the marketing says, the system is custodial in substance. If the answer is no, only then are we in an honest conversation about which governance and safety tradeoffs make sense for different use cases.”

Below that line, decentralization loses its substantive meaning, he added.

Magazine: AI-driven hacks could kill DeFi — unless projects act now

Solana-based decentralized finance yield protocol Carrot said Thursday that it is shutting down permanently, becoming one of the first DeFi protocols to fall due to contagion from the Drift Protocol exploit in early April. 

In an X post on Thursday, Carrot said the Drift exploit was “catastrophic” for the protocol and had left it financially unable to continue operating. The platform set a May 14 deadline for users to withdraw remaining funds. It said it will continue to help recovery efforts related to Drift and distribute assets once they become available.

“We are setting May 14th as the deadline to withdraw any remaining funds from Boost, Turbo, and CRT before we will then begin to deleverage the system. Your deposited funds are still yours, but all leverage will be reduced to zero, freeing up all liquidity for CRT redemption,” the protocol’s team said.

The Drift protocol exploit on April 1 was the second-largest in 2026. It was a highly coordinated attack that involved months of social engineering by a group of hackers who gained admin control and drained more than half the protocol’s total value locked. 

The contagion spread to several affiliated projects such as the yield protocol Gauntlet, the lending and borrowing platform PrimeFi and the crypto fund Elemental DeFi. 

Related: Insider trading backlash forces Polymarket to step up surveillance

Carrot was integrated with Drift’s infrastructure and used its pools to generate yield for its users. Its TVL collapsed after the Drift Protocol hack. 

According to data from DefiLlama, Carrot’s total value locked was around $28 million before the Drift hack, and is currently $1.99 million, marking a decrease of roughly 93%.

Carrot’s sharp TVL drop after the Drift hack. Source: DefiLlama

DefiLlama data also shows nearly $630 million worth of digital assets were stolen in April across 25 incidents, making it the month with the largest losses since February 2025, when $1.47 billion was stolen.

The $293 million hack on liquid staking protocol Kelp is the largest exploit of 2026 so far. The Drift hack is close behind at $285 million. Together, these two attacks account for more than 90% of all crypto stolen in April.

Magazine: AI-driven hacks could kill DeFi — unless projects act now