Singapore’s central bank, MAS, has revoked Bsquared Technology Pte Ltd’s Major Payment Institution Licence, removing the firm’s authority to provide digital payment token services under Singapore’s Payments Services Act 2019. The suspension follows an on-site inspection that uncovered weaknesses in governance and control frameworks, including risk management practices, conflict-of-interest policies, and outsourcing oversight.

The regulator also noted that Bsquared provided false or misleading information at multiple points during the license process and the subsequent review. Bsquared, which operates under the name BSQ, received the green light to offer digital payment token services roughly 16 months ago.

MAS has directed Bsquared to obtain a closure certificate from its auditors confirming that all customer funds have been returned to their rightful recipients. Bsquared informed MAS that it held no outstanding customer assets. In its statement, MAS stressed that it takes a serious view of the breaches and indicated it is reviewing the responsibilities of key BSQ officers.

Key takeaways

• MAS revoked Bsquared’s Major Payment Institution Licence after an on-site assessment revealed deficiencies in risk management, conflict-of-interest controls, and outsourcing compliance.
• The regulator criticized Bsquared for supplying false or misleading information during the application and inspection processes.
• The firm must secure a closure certificate from its auditors to demonstrate that all customer funds have been returned; Bsquared claimed no outstanding customer assets.
• Enforcement actions of this nature remain relatively rare in Singapore, where MAS has granted 37 digital payment token licenses to date; past actions include the rejection of AmazingTech’s Tokenize Xchange license and a subsequent probe by the Commercial Affairs Department.
• The case underscores heightened regulatory expectations for digital payment token providers and may influence licensing dynamics, governance standards, and audit requirements across the sector.

Regulatory framework and enforcement signals

The decision reflectsMAS’s ongoing emphasis on robust governance and risk controls for digital payment token services. Under the Payments Services Act 2019, MAS requires licensees to maintain sound risk management, clear conflict-of-interest policies, and proper oversight of outsourcing arrangements. The on-site findings in Bsquared’s case point to a broader enforcement trajectory in which governance failures, misrepresentation, and weak controls can lead to licence termination rather than penalties alone.

MAS’s stance also signals increased scrutiny of the personnel responsible for licensee governance. The authority stated it is reviewing the responsibilities of BSQ’s key officers, a step that could have implications for individual accountability within crypto firms seeking or retaining licences in Singapore.

Within this regulatory environment, the sector has seen relatively few revocations compared with license approvals. To date, MAS has granted 37 digital payment token licenses, and revocation actions remain uncommon. The regulator’s recent actions build on a pattern of careful, standards-based oversight rather than rapid, broad-based sanctions.

Historical context matters here. Last year, MAS rejected AmazingTech’s application to operate Tokenize Xchange, and the Commercial Affairs Department subsequently opened a probe into the company. These developments illustrate a vigilant, multi-agency approach to licensing and enforcement in Singapore’s crypto infrastructure landscape.

Singapore’s broader push into digital asset infrastructure

Singapore continues to position itself as a regional hub for digital assets and crypto infrastructure, hosting regional offices for major players and hosting flagship projects that connect traditional finance with tokenized assets. The regulatory environment in Singapore emphasizes prudent risk management, customer fund protection, and clear accountability for licensed entities as part of broader financial supervisory objectives.

Contextually, Singapore’s regulatory posture sits alongside ongoing global developments in crypto policy. In the European Union, MiCA is advancing a comprehensive framework for crypto assets and service providers, while U.S. authorities—across the SEC, CFTC, and DOJ—continue enforcement and policy evolution in related areas. The Bsquared case thus feeds into a global narrative prioritizing licensing discipline, AML/KYC rigor, and robust governance as prerequisites for institutional participation in crypto markets.

As Singapore strengthens its digital asset infrastructure, institutions and banks operating in or with the city-state may face heightened due diligence and compliance expectations. Initiatives such as banks enabling direct minting and redemption of stablecoins for institutional clients on blockchain rails illustrate the sector’s drive toward regulated, cross-border interoperability—but also underline the importance of clear custodial, settlement, and fund-tracing standards.

According to Cointelegraph, the MAS action against Bsquared reinforces the central bank’s position that licenced entities must meet rigorous governance and disclosure standards to maintain public trust and financial stability within Singapore’s payment and digital asset ecosystems.

Closing perspective

The Bsquared revocation demonstrates Singapore’s willingness to impose stringent consequences for governance and disclosure deficiencies in the digital asset space. For license applicants and existing providers, the case highlights the critical importance of robust risk management, transparent reporting, and strict adherence to outsourcing policies and fund custody requirements. As regulatory scrutiny intensifies, market participants should anticipate tighter officer accountability, more granular due-diligence by upstream partners, and a continuing emphasis on preserving customer fund integrity as a precondition for ongoing participation in Singapore’s crypto infrastructure ecosystem.

CoinDesk Indices presents its daily market update, highlighting the performance of leaders and laggards in the CoinDesk 20 Index.

The CoinDesk 20 is currently trading at 2064.22, up 0.7% (+14.51) since 4 p.m. ET on Tuesday.

Fifteen of the 20 assets are trading higher.

Leaders: UNI (+3.7%) and TAO (+2.1%).

Laggards: XLM (-0.6%) and BCH (-0.6%).

The CoinDesk 20 is a broad-based index traded on multiple platforms in several regions globally.

Online code repository firm GitHub says a recent breach of its internal data stemmed from a staff member downloading a “poisoned” VS Code extension.

The Microsoft-owned firm first disclosed in the early hours of this morning that it was investigating unauthorized access to its internal repositories.

Since then, GitHub has shared that the breach has only affected internal GitHub repositories. 

It added, “The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.”

The breach involves a malicious VS Code extension downloaded from Microsoft’s VS Code extension marketplace. VS Code stands for Visual Studio Code, and the marketplace offers various tools and applications for code editors to download. 

Read more: Binance says GitHub data leak could cause ‘severe financial harm’

The hacking group claiming to have breached GitHub’s repositories is TeamPCP, which has been linked to the Mini Shai Halud supply chain attack that impacted OpenAI, as well as a number of other supply chain attacks targeting developer software. 

The group is selling the roughly-4,000 private repositories on the Breached hacking forum for no less than $50,000 while stressing that it will not accept any “low ball offers.”

It said, “This is not a ransom, we do not care about extorting GitHub.” The data on its end will supposedly be “shred” after the sale, and if it can’t find a buyer, TeamPCP said it will leak the data for free. 

GitHub says it has removed ‘malicious extension’

GitHub claims it “removed the malicious extension version, isolated the endpoint, and begun incident response immediately.”

“Critical secrets were rotated yesterday and overnight with the highest-impact credentials prioritized first,” the firm said, adding that it will continue to monitor the situation. 

The reception to the incident hasn’t been forgiving. Users noted longstanding complaints against former Microsoft and GitHub executives that have asked for solutions to malware-ridden downloads within the VS Code extension marketplace.

This complaint was levied against GitHub’s former CEO two years ago. 

Read more: Microsoft could stall Bitcoin development via GitHub

Former Binance CEO Changpeng Zhao warned, “If you have API keys in your code, even private repos, now is the time to double check and change them…”

CEO of coding firm Treehouse, Ryan Carson, similarly warned, “If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets.”

Crypto security expert Taylor Monahan added to Zhao’s statement, and said that you should get your API keys “out of your repos.”

“Your biggest risk is not this. It’s your own devs getting hit by one of these wormy motherfucking supply chains and leaking all those secrets,” Monahan said.

Second GitHub leak in days

Software firm Grafana also claimed earlier this week that it witnessed unauthorised access to its GitHub repositories.

It claims the attackers “downloaded our codebase,” before issuing “a ransom demand under threat of data disclosure.”

Read more: Stealthy crypto miners loot altcoins with GitHub trial accounts

In this case, Grafana claims the breach also stemmed from the supply chain attack associated with the Mini Shai-Hulud campaign.

It said, “We performed analysis and quickly rotated a significant number of GitHub workflow tokens, but a missed token led to the attackers gaining access to our GitHub repositories. A subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in fact, been compromised.”

In 2024, leaked passwords and site code stemming from Binance were viewable on GitHub for months before they were eventually taken down. 

The exchange said the leaks were capable of causing “severe financial harm,” and that the upload of its data was never authorized. 

Protos has reached out to GitHub for comment and will update this piece should we hear anything back. 

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

LayerZero Labs has released its incident report on the KelpDAO bridge attack, saying about $292 million in rsETH was stolen after attackers poisoned RPC infrastructure used by its verification network and forcing policy changes around single-signer configurations.

LayerZero Labs has published a detailed account of the KelpDAO exploit, confirming that attackers stole roughly 116,500 rsETH, worth about $292 million, by compromising downstream infrastructure tied to the verification layer used in KelpDAO’s cross-chain configuration.

The company said the incident was limited to KelpDAO’s rsETH setup because the application relied on a 1-of-1 DVN configuration with LayerZero Labs as the sole verifier, a design LayerZero said directly contradicted its standing recommendation that applications use diversified multi-DVN setups with redundancy.

In its statement, LayerZero said there was “zero contagion to any other cross-chain assets or applications,” arguing that the protocol’s modular security architecture contained the blast radius even as a single application-level configuration failed.

How the attack worked

According to LayerZero’s report, the April 18, 2026 attack targeted the RPC infrastructure relied on by the LayerZero Labs DVN rather than exploiting the LayerZero protocol, key management, or the DVN software itself.

The company said the attackers gained access to the list of RPCs used by the DVN, compromised two nodes running on separate clusters, replaced binaries on op-geth nodes, and then used malicious payloads to feed forged transaction data to the verifier while returning truthful data to other endpoints, including internal monitoring services.

To complete the exploit, the attackers also launched DDoS attacks on uncompromised RPC endpoints, which triggered failover toward the poisoned nodes and allowed the LayerZero Labs DVN to confirm transactions that had never actually occurred.

Outside forensic work broadly matches that description. Chainalysis said the attackers linked to North Korea’s Lazarus Group, specifically TraderTraitor, did not exploit a smart contract bug but instead forged a cross-chain message by poisoning internal RPC nodes and overwhelming external ones in a single-point-of-failure verification setup.

Security changes

LayerZero said the immediate response included deprecating and replacing all affected RPC nodes, restoring the LayerZero Labs DVN to operation and contacting law enforcement agencies while working with industry partners and Seal911 to trace the stolen funds.

More importantly, the company is changing how it handles risky configurations. In the statement, LayerZero said its DVN “will not sign or attest messages from any applications that utilize a 1/1 configuration,” a direct policy shift aimed at preventing a repeat of the KelpDAO failure mode.

The company is also reaching out to projects still using 1/1 configurations to migrate them to multi-DVN models with redundancy, effectively admitting that configuration flexibility without enforced safety rails was too permissive in practice.

The attribution picture has also hardened. Chainalysis linked the exploit to North Korea’s Lazarus Group and specifically TraderTraitor, while Nexus Mutual said the forged message drained $292 million from KelpDAO’s bridge in under 46 minutes, making it one of 2026’s biggest DeFi losses.

The result is a familiar but brutal lesson for cross-chain infrastructure: the smart contracts can survive intact and the protocol can still fail in practice if the off-chain trust layer is weak enough. LayerZero is now trying to prove that the right takeaway from a $292 million bridge theft is not that modular security failed, but that letting anyone run a single-signer setup was the real mistake.

Bitcoin is roughly 40% off its October 2025 peak, but a long-range valuation framework suggests the pullback could be retraced as the market moves through a new cycle. The Bitcoin Decay Channel, a logarithmic model that tracks BTC’s secular uptrend while accounting for incremental gains each cycle, points to a broad end-of-year range—and potentially higher into 2027—despite near-term volatility.

Key takeaways:

• Bitcoin Decay Channel projects a conservative year-end range of $90,000–$255,000, with a 2027 band extending to $128,000–$308,000.
• On-chain signals, notably the HODL Waves indicator, imply a possible bottom around $65,900–$70,500 if selling pressure persists.
• BTC’s rebound in 2024 appears to have touched the lower edge of the Decay Channel, a region historically associated with long-term support.
• Analysts’ forecasts vary: Bernstein has emphasized a longer adoption cycle with a target near $150,000 for 2026 and a potential $200,000 peak in 2027, while other forecasters point to near-term milestones such as $126,000 this year and higher targets in the following years.

Decay Channel: a long-range compass for BTC valuation

The Bitcoin Decay Channel is a logarithmic framework that seeks to chart BTC’s extended uptrend while incorporating gradual gains across cycles. Historically, Bitcoin’s major tops in 2013, 2017 and 2021 formed near the model’s upper valuation band, while bear-market lows have repeatedly pressed back toward its lower support zone. The model has served as a reference point for traders seeking to understand where BTC might find底 in prolonged downturns and where renewed upside momentum could begin.

Bitcoin’s most recent rebound began near the lower boundary of the Decay Channel in March–April, a zone the model has traditionally treated as long-run support. That alignment keeps alive a bullish framing for the current cycle, according to observer Sminston, who highlighted the model’s plausible end-year range: “Bitcoin Decay Channel gives a pretty reasonable range—conservative case—of $90k–$255k, by the end of this year. $128k–$308k for end of ’27.”

To put that into perspective, Sminston has contrasted the gap between present prices and later targets with historical context: “For comparison, Bitcoin was $43k in December 2023.” The Decay Channel’s structure thus anchors expectations not only on where BTC could go if the cycle resumes, but also on where it might have already spent time in the current weak phase.

The model’s framing resonates with a broader narrative in the market: several independent forecasts align with the idea that BTC could participate in a fresh all-time high within the next couple of years as institutional demand, ETFs, and corporate treasury activity continue to evolve. This longer horizon is a recurring theme among strategic analysts who view the current pullback as part of a larger secular expansion rather than a purely cyclical retreat.

Bearish patterns and on-chain signals

Despite the optimistic scenario implied by the Decay Channel, a cluster of technical and on-chain indicators warns that downside risk remains material in the near term. A classic bear flag formation has traders watching for a potential breakdown that could push BTC toward the lower end of recent trading ranges. In raw terms, a breakdown of this setup could see BTC testing sub-$56,000 levels, representing a decline of roughly 30% from present price levels.

On-chain data, however, presents a more nuanced picture. The HODL Waves metric—tracking how long bitcoins sit in wallets without movement—has been cited as suggesting a stronger long-term holder base could stabilize the market and support a higher bottom. In a recent briefing, CryptoQuant analyst Sunny Mom noted that the ongoing accumulation by long-term holders could favor a higher, slower bottom this cycle, with $70,500 as a critical level to hold. The implication is that even as price drifts downward, a robust base of entrenched holders might cap further downside and lay groundwork for a renewed ascent.

These signals complicate the straightforward bearish view. While the bear flag remains a credible risk in the near term, the interplay between chart patterns and on-chain activity underscores a market that could drift within a broad range before a decisive move higher or lower materializes. Investors will be watching whether the lower-support zone identified by the Decay Channel—plus the stabilizing effect of a strengthening holder cohort—can anchor prices in the mid-to-high five-figure territory or whether a breach triggers a more extended correction.

What comes next for BTC price trajectories

Forecasts about BTC’s path in the medium term reflect a mix of valuation frameworks and strategic bets about institutional involvement. In coverage that preceded this edition, Bernstein analysts maintained a $150,000 target for 2026, while also laying out a $200,000 peak further out in 2027, tied to a lengthier cycle of institutional adoption driven by exchange-traded products and expanding corporate holdings. The pacing of this adoption curve remains a central question for the market, with the belief that larger institutions will progressively allocate to BTC as regulatory clarity improves and as more capital-bearing products become available.

Other prominent voices offer a different, though compatible, flavor of the story. Arthur Hayes, co-founder of BitMEX, has argued for BTC’s upside as macro and geopolitical catalysts fuel demand for scarce digital assets, citing paths toward a $126,000 level within the current year on the back of new liquidity drivers and demand from AI-related infrastructure. While these calls are not uniform, they reflect a shared conviction that BTC’s price action could be shaped by macro liquidity, regulatory developments, and the appeal of BTC as a non-sovereign store of value in uncertain times.

Taken together, the picture is one of a market in which multiple horizons coexist: a near-term range-bound regime driven by chart patterns and on-chain dynamics, alongside a longer-term trajectory that envisions fresh highs once institutional demand finds more durable footing. The Decay Channel’s ranges—$90,000 to $255,000 by year-end, extending to $128,000 to $308,000 in 2027—offer a framework for risk-aware participants to balance potential upside with the possibility of further volatility in the months ahead. The central task for traders and investors is to interrogate the underlying drivers: will the current weak phase resolve into renewed accumulation, or will a deeper consolidation re-assert itself before a new leg higher begins?

As the market navigates this juncture, traders should monitor both the technical backdrop and the on-chain substrate. A durable hold above the $65,900–$70,500 zone, reinforced by rising long-term holder activity, could tilt the odds toward a more constructive second half of the year. Conversely, a decisive break below the lower boundary of the Decay Channel or a fresh wave of macro shocks could reassert downside pressure in the near term.

In short, Bitcoin’s path remains contingent on how quickly institutional demand solidifies, how macro forces unfold, and whether the balance of active and dormant supply can sustain a credible bottom. The coming weeks will reveal which of the competing narratives dominates—and whether BTC can indeed align with the longer-term targets suggested by the Decay Channel and the diverse set of forecasts that accompany it.

Looking ahead, readers should watch for changes in on-chain behavior—especially shifts in HODL Waves and wallet activity—as well as any regulatory developments that could unlock or constrain financially meaningful products. The interaction of these factors will be decisive in determining whether Bitcoin stays within its current corridor or breaks toward the higher targets favored by some models and institutions alike.

• Algorand (ALGO) jumped 5% after Robinhood listed it for US users.
• Algorand’s price has stayed between $0.1092 and $0.1173 with no breakout.
• Weekly trend is still down 6.8% despite the short-term rally.

Algorand has recorded a sharp burst of activity following its addition to Robinhood’s crypto trading platform, including availability for users in New York.

At the time of writing, Algorand’s ALGO coin was trading near $0.1149, showing a 24-hour gain of about 5%.

Robinhood listing triggers short-term momentum

The listing on Robinhood marks a notable distribution shift for Algorand.

$ALGO is now available to trade on Robinhood Crypto, including NY. pic.twitter.com/HBqM2MZ9zA

— Robinhood (@RobinhoodApp) May 19, 2026

The listing on Robinhood gives access to a large base of retail users, and historically, new listings on major retail brokerages tend to attract immediate trading interest.

In this case, the move was preceded by a wave of market commentary highlighting the possibility of Robinhood adding ALGO.

During that period, Algorand recorded intraday gains in the range of 5% to over 7%, depending on the timeframe used across different market trackers.

Once the listing was confirmed, trading activity increased further, with daily volume reaching approximately $58.9 million according to data from Coingecko.

This spike in activity coincided with heightened attention from retail traders reacting to the expanded accessibility of the token.

Price structure still shows resistance to a sustained breakout

Even with the Robinhood-driven rally, Algorand continues to trade well below its long-term highs.

The token remains down roughly 96.8% from its all-time peak of $3.56, recorded in June 2019.

This long-term drawdown highlights how far the asset has moved away from its earlier cycle valuations.

Over the past seven days, ALGO is still down around 6.8%, indicating that the recent move has not fully reversed earlier weakness.

On a monthly basis, however, the token is up approximately 12.1%, showing that the asset has been recovering in bursts rather than maintaining a steady trend.

More recently, price behaviour has been shaped by a narrow trading band.

The 24-hour range between $0.1092 and $0.1173 aligns closely with the observed rally, suggesting that most of the move occurred within established short-term volatility limits rather than breaking out of a broader range structure.

A key technical observation is that while momentum improved after the listing, there has been no sustained push beyond recent resistance levels near the $0.117–$0.122 zone, where price has repeatedly stalled in prior short-term rallies.

This indicates that buyers have not yet gained full control of trend direction.

Market reaction points to a liquidity-driven move rather than a trend shift

The current market setup shows characteristics of a liquidity-driven reaction rather than a structural reversal.

The combination of a confirmed Robinhood listing and rapid price expansion fits a pattern commonly seen when assets gain new retail access.

Trading volume near $59 million in 24 hours reflects increased participation, but the lack of follow-through beyond the immediate price spike suggests that the move is still largely sentiment-driven.

The fact that ALGO has remained negative over the past week reinforces the idea that recent gains are offsetting prior declines rather than establishing a new upward trend.

Outlook: bounce or reversal still unresolved

The expansion of availability on Robinhood, including access for New York users, increases the potential pool of participants.

This type of distribution event typically has two phases: an initial reaction driven by attention and a second phase where sustained demand either develops or fades.

With the token still trading far below historical highs and showing negative weekly performance, the recent move sits within a corrective recovery phase rather than a confirmed breakout structure.

Whether this develops into a trend reversal will depend on whether trading activity continues beyond the initial listing impact or fades back into the prior range.

The European Commission has opened a public consultation on the functioning of the EU’s MiCA regime, with feedback due by Aug. 31, 2026, in a move that will shape how crypto rules are applied across the bloc.

The European Commission said on May 20 that it had launched a consultation to gather feedback from stakeholders and the wider public on how MiCA is working in practice, marking a new phase in the EU’s attempt to turn its landmark crypto law from statute into an enforceable and adaptable operating framework.

The consultation matters because MiCA is no longer theoretical. The regime established a harmonized EU framework for crypto-assets and related services, covering crypto-assets, asset-referenced tokens, e-money tokens, their issuers and crypto-asset service providers, and the Commission now wants to know where the rulebook is working and where it is already showing strain.

The Commission said the exercise includes both a public consultation for individuals and a targeted consultation aimed at more technical and legal questions for market participants and institutional stakeholders, meaning the review is designed not just as a political box-ticking exercise but as a practical audit of the regime’s first real-world effects.

Implementation phase

According to the European Commission, all feedback gathered through the consultation will be used to inform its future policy work on digital assets, making the process one of the clearest early signals that Brussels is already thinking beyond first-generation MiCA implementation.

That matters for any firm operating in Europe because the framework already applies across the bloc. As the French regulator AMF notes, MiCA entered into force on June 29, 2023, with rules for stablecoins taking effect on June 30, 2024, and the wider regime applying from Dec. 30, 2024.

The substance of the regime is broad. ESMA says MiCA introduces uniform EU market rules for crypto-assets not already covered by existing financial services law, with key provisions covering transparency, disclosure, authorization and supervision.

Industry impact

For exchanges, wallet providers, token issuers and stablecoin firms, this consultation is effectively an invitation to try to shape the next round of European crypto supervision before it hardens into precedent. Industry participants, consumer groups, civil society and public authorities are all being asked to weigh in on how the rules should function in practice and where gaps remain.

That broader review has been signaled for weeks. At Paris Blockchain Week, EU financial services official Peter Kerstens said the Commission would launch a public consultation on MiCA with “no taboos,” according to KuCoin, raising the prospect that issues such as DeFi, tokenized assets and cross-border supervision could become part of the next policy cycle.

The outcome will matter well beyond Brussels procedure. For crypto firms trying to operate across all 27 member states, the consultation will help determine whether MiCA remains a static compliance burden or evolves into a more usable framework for licensing, disclosure, stablecoin issuance and cross-border service provision throughout the European Union.