Institutional investors have increasingly gained exposure to bitcoin BTC$79,512.22 and other major tokens through ETFs and centralized exchanges.

However, they have largely stayed away from decentralized exchanges (DEXes) offering perpetual (perp) futures tied to crypto and tradfi assets, panelists said at Consensus Miami, citing security risks and a mismatch between DeFi’s permissionless design and institutional identity and compliance requirements.

The session titled “Perp DEX Explosion: Bullish Volumes & Bear Market Resilience” featured Wizard of SoHo, a veteran trader and family office manager; Michaël van de Poppe, founder and CIO of MN Fund & MN Capital; and Michael Anderson of Canary Labs. Jason Atkins, chief commercial officer at liquidity provider Auros, moderated the discussion.

The discussion focused on perpetual-focused decentralized exchanges and what it would take for them to attract institutional capital and scale up.

Wizard of SoHo said that institutions are unlikely to move onto perp DEXs easily due to recurring security/exploit risks highlighted by the recent multi-million-dollar hack of Drift, and that the next major competitive battleground for all perp DEXs will be whether any of them can safely onboard institutional capital.

“How do you convince the big institutional players to go on the perp devs? I think that’s going to be the biggest challenge, especially given the exploit on Drift. And, you know, we’ve had a lot of exploits lately,” he said.

Canary Labs’ Anderson struck a cautious tone on decentralized finance, saying he is reluctant to use it despite having explored parts of the ecosystem.

“I’m scared to use DeFi right now,” he said. “It does feel like a bit of a minefield, and you’re just waiting for the next headline each day.”

Anderson added that while activity has picked up in some areas, particularly from Asia amid tighter KYC enforcement on centralized exchanges, the overall environment still feels risky.

“Right now, it feels slightly dangerous on the product side,” he said.

Anderson argued that the risk perception makes it difficult to see large institutional players adopting decentralized exchanges at scale, especially compared with centralized platforms.

“I think it’s gonna be very difficult for some of the larger firms to use it on the institutional level, versus some of the centralized exchanges,” he said.

Anderson also pointed to product innovation gaps as another constraint, noting that centralized exchanges are increasingly integrating trading tools, such as bots, into futures markets. In contrast, decentralized exchanges have yet to match that pace of development.

KYC, or know-your-customer verification, is another key point of divergence. DeFi is built around open, permissionless participation, where users can interact without formal identity checks or traditional onboarding requirements.

Institutions, by contrast, operate under strict regulatory obligations and must meet full KYC and compliance standards, which makes that permissionless model difficult to adopt at scale.

“Crypto wants to be more non-KYC,” he said, “but to bring on institutional [players] you need to have some form of KYC at the larger size.”

The discussion also broadened into adjacent themes shaping market structure, including the rise of AI-driven trading tools and Hyperliquid’s dominance.

Michaël van de Poppe said AI agents are effectively an evolution of algorithmic trading, rather than a fundamentally new concept.

“To be honest, I think that AI agents are just the next level algorithmic trading anyways, so it’s just a little different execution,” he said. Responding to a moderator’s point about reduced human control in automated systems, he acknowledged the shift in oversight but argued the direction is inevitable.

“Yeah, there are some risks, but I think that at the end of the day, we are not going to be trading ourselves anymore. Nothing will be manual,” he said. “AI agents will be doing it for us, and they are probably better.”

van de Poppe added that the technology is still early and highly dependent on how it is deployed.

“If you start using those AI protocols or LLMs and you’re not putting in the right context or framework, it’s going to build a bad trader for you,” he said. “So if you are not a good trader, then it’s not going to build anything for you.”

Bitcoin (BTC) reserves on major crypto exchanges have dropped to their lowest level since 2023, with nearly 100,000 BTC withdrawn from Binance, OKX and Gemini in less than three months.

The outflows coincided with stronger demand from accumulator addresses, as the cohorts’ holdings have increased by 60.5% over the past two weeks. 

Bitcoin exchange reserves fall to two-year low

Crypto analyst Amr Taha noted that Bitcoin reserves on Binance, OKX and Gemini have declined sharply since February. Binance recorded the largest drawdown, with reserves dropping to nearly 620,000 BTC on May 7, down from roughly 670,000 BTC on Feb. 21. The decline pushed Binance’s holdings below levels last seen in December 2023.

OKX followed the same trend. Its Bitcoin reserve fell to around 102,000 BTC this week, from nearly 132,000 BTC on March 2. Gemini also posted steady outflows, sliding to 95,000 BTC from 114,800 BTC in early February.

BTC multi-exchange reserves. Source: CryptoQuant

Combined, the three exchanges recorded an outflow of nearly 100,000 BTC, valued at over $8 billion at current prices. 

Taha noted that a synchronized decline across multiple exchanges carries more weight than isolated outflows from a single exchange. Fewer coins on trading platforms can amplify the price reaction when strong spot demand returns.

The move coincides with a shrinking OTC balance. Lower OTC balances can reduce the amount of Bitcoin available for large private transactions outside exchanges. 

The latest 30-day OTC balance change showed a net decline of 24,940 BTC, while the same metric had risen to nearly 25,300 BTC on Feb. 8 after Bitcoin’s drop toward $60,000. The reversal shows that OTC supply inflows have slowed significantly since the February sell-off. 

Bitcoin total OTC desk balance. Source: CryptoQuant

Related: Bitcoin Bollinger Bands push key breakout as creator acts on positive signal

“Accumulator” demand rises as Binance buyers turn positive 

Long-term participants increased their Bitcoin accumulation during the latest recovery phase. CryptoQuant data shows demand from accumulator addresses climbed to 264,000 BTC on May 6, up from 164,440 BTC on April 23. The same metric fell to nearly 100,000 BTC on March 15, after peaking above 205,000 BTC on Feb. 5.

Bitcoin demand from accumulator addresses. Source: CryptoQuant

The increase in accumulation coincided with Bitcoin’s recovery toward $82,800, indicating stronger buying activity by long-term holders during the recent price advance. 

Derivatives activity also strengthened during the recent rally. Binance’s seven-day net taker volume moved from approximately -$1 billion (seller-dominated) in late March to +$2.63 billion (buyer-dominated) on Thursday.

Binance’s seven-day net taker volume for BTC. Source: CryptoQuant

Related: VanEck’s Sigel sees Bitcoin reaching $1M within five years

This article is produced in accordance with Cointelegraph’s Editorial Policy and is intended for informational purposes only. It does not constitute investment advice or recommendations. All investments and trades carry risk; readers are encouraged to conduct independent research.

Aptos Foundation and Aptos Labs have committed $50 million to Aptos development, with a particular focus on AI agent infrastructure and research, including support for two products it shipped last year to meet rising demand for onchain AI agent activity. 

Those products include Decibel, an AI-powered onchain order book and perpetuals exchange that launched on the Aptos mainnet in February, and Shelby, a decentralized storage protocol that seeks to support the workloads of AI agents, the Aptos Foundation said on Thursday.

“Autonomous agents are already transacting onchain at frequencies no human can match, routing to whatever venue is fastest, most consistent, and least gameable,” it said.

Aptos joins a growing number of crypto protocols seeking opportunities in supporting the agentic AI economy. Aptos said there is a need to build infrastructure that offers sub-second finality and systems that “run 24/7 with no human to escalate to.”

AI agents can act as personal assistants for people, both at home and in the workplace, completing everyday tasks on their behalf, whether it be booking a flight, making a shopping purchase or executing a high-level trade onchain.

The Aptos ecosystem’s “full stack” plan for markets and machines. Aptos Network

Last month, Coinbase CEO Brian Armstrong predicted there will be “more AI agents transacting online than humans very soon,” echoing comments from Circle CEO Jeremy Allaire in January that “literally billions of AI agents” will be transacting onchain in three to five years.

The World Economic Forum is expecting a boom too, having predicted in January that AI agents could become a $236 billion market by 2034, a 43-fold rise from its $5.4 billion market size in 2024.

AI agents use blue-chip stablecoins to transact

On Wednesday, Amazon Web Services said it integrated Coinbase’s x402 payments protocol into Amazon Bedrock AgentCore to allow AI agents to make USDC (USDC) payments and access services through AWS-managed payment controls. 

A week earlier, crypto wallet startup Oobit launched a Visa-supported virtual card for AI agents to make online purchases in USDt (USDT) on behalf of businesses. 

The foundation said the Aptos (APT) token would play a central role in the ecosystem’s AI agent economy by being burned in transactions, required to access advanced AI agent features, and staked to improve performance. 

Related: How AI agents can reshape arbitrage in prediction markets 

The foundation said the $50 million would also be used to develop other aspects of the “Aptos stack,” which also includes integrations with neobanks, institutional platforms and wallet providers.

Aptos said it also plans to work on building encrypted mempools and offer confidential perps trading, among other things.

Aptos rolled out privacy-focused coin last month

Meanwhile, Aptos launched a privacy-focused coin — Confidential APT — on Aptos mainnet on April 24 as part of an effort to fix a long-standing trade-off between protecting user privacy and preserving transparency for compliance. 

Aptos Labs founding engineer Sherry Xiao, told Cointelegraph that Confidential APT could help businesses hide the salaries of employees who are paid onchain, as well as conceal treasury movements, settlement flows and trading strategies that competitors could otherwise see. 

Magazine: Guide to the top and emerging global crypto hubs — Mid-2026 

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Crypto risk management and infrastructure provider Chaos Labs said its Chaos Oracle Network, which provides data feeds to blockchain applications, was not compromised after a hacking attempt over the weekend by a potential “nation-state.”

Chaos Labs founder Omer Goldberg said in an X post Thursday that the company identified an attack over the weekend, possibly by a “nation state,” and immediately moved to a full lockdown. 

“The surface area was strictly contained to operational wallets we use for routine onchain operations. At no point was the Chaos Oracle Network breached or compromised.”

“Chaos Oracles run in a fully isolated environment with nodes distributed globally, protected by layered security and cryptographic controls,” Goldberg said.

“The authorities and cyber professionals working with us have characterized the activity as consistent with nation-state attacks,” he added. “The investigation continues, and we will share more as it allows.”

State-backed hacker groups, particularly those from North Korea, have been seen as a persistent threat to the crypto space.

North Korea-affiliated actors have been accused of stealing at least $578 million across several major incidents in April and have been linked to many of the industry’s largest hacks. North Korea recently rejected claims linking it to global cybercrime, calling the allegations unfounded.

Goldberg said that Chaos Labs has rotated all keys since the attempted attack and said there hasn’t been any further suspicious activity. 

Source: Omer Goldberg

Recent industry exploits prompted “highest severity” response

The April Kelp DAO hack has been one of the year’s largest security incidents, causing broader ecosystem contagion and impacting the interconnected crypto lending market.

Drift Protocol, a decentralized cryptocurrency exchange, and at least a dozen other crypto entities were hacked in the same month. 

Goldberg said against the backdrop of recent exploits, Chaos Labs triggered its “highest-severity incident response” after detecting the attempted hack.

“We allocate a substantial share of our operating budget to cyber defense, alerting, and detection,” he added.

Several crypto firms shift to Chainlink

Borrowing platform Tydro said it is migrating to the Chainlink oracle platform following the attack on Chaos Labs, adding to the list of crypto firms that have switched providers in recent weeks.

Related: Chaos Labs taps out as Aave’s risk provider, decision ‘not made in haste’

DeFi protocol Kelp DAO is migrating its restaking token rsETH to the Chainlink oracle platform following the April exploit. It continues to blame the attack on LayerZero’s cross-chain infrastructure, which LayerZero has disputed. 

Decentralized finance platform Solv Protocol has also flagged plans to migrate its cross-chain infrastructure from LayerZero to Chainlink in “light of recent industry events.”

Magazine: Guide to the top and emerging global crypto hubs — Mid-2026 

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Coinbase shares fell after the U.S. crypto exchange posted a $394.1 million net loss for Q1 2026. 

The result marked its second straight quarterly loss and reversed a $65.6 million profit from the same period last year.

Google Finance showed COIN closing at $192.96, down 2.53%, before falling another 4.70% to $183.90 after hours. The move followed a revenue miss and a wider loss than analysts expected. The stock has also traded lower in 2026.

Trading slowdown hits revenue

Coinbase reported total revenue of $1.41 billion, down from $2.03 billion a year earlier. Its 10-Q showed transaction revenue fell to $755.8 million from $1.26 billion, while subscription and services revenue fell to $583.5 million from $674.6 million.

The company linked the weaker trading backdrop to softer market conditions. CFO Alesia Haas said “Macro conditions were genuinely tough,” adding that total crypto market cap and total crypto trading volume both fell more than 20% quarter over quarter.

Additionally, trading volume dropped to $202 billion from $401 billion a year earlier. Coinbase said the decline came as global crypto spot trading volume fell 44% during the period, leaving the exchange more exposed to lower user activity.

Consumer transaction revenue fell 48% to $566.9 million. Institutional transaction revenue rose 37% to $135.7 million, helped by derivatives trading and the Deribit acquisition. However, that growth did not offset the broader decline in spot-related revenue. Bitcoin accounted for 40% of spot transaction revenue in Q1.

Coinbase leans on wider products

Coinbase used the update to point investors toward products beyond spot trading. Its release said crypto trading volume market share reached 8.6%, while retail derivatives annualized revenue topped $200 million. It also said prediction markets reached more than $100 million in annualized revenue in March.

Chief executive Brian Armstrong said the company saw growth in derivatives, USDC, and Base activity. The message matched his wider plan to make Coinbase a broader venue for crypto, tokenized assets, derivatives, and event contracts.

Related crypto.news coverage said Coinbase had already framed its Q4 loss around a wider push into derivatives, stablecoins, and new markets. Crypto.news also reported on Coinbase’s prediction markets strategy, calling it part of an “everything exchange” plan.

Another related crypto.news update covered Agentic.market, where AI agents use USDC through x402 payments. For investors, the Q1 report showed two different stories. Trading revenue fell sharply, but Coinbase kept building products that may reduce its exposure to spot market cycles. 

The near-term pressure remains clear, while the wider strategy now faces a harder test in a weaker crypto market and tougher investor mood after two straight quarterly losses and a sharp share-price reaction.

• Bitcoin retreated amid clashes in the Strait of Hormuz and rising oil prices.
• Analysts argue that a limited appetite for full‑scale escalation caps downside risk.
• Bulls aim for a rebound toward $82,000, but bears could target a breakdown below $78,000.

Bitcoin dropped to around $79,200 in early trading on Friday as fresh military skirmishes in the Strait of Hormuz rattled global risk assets.

The crypto bellwether was witnessing a sharp intraday pullback after a brief run above $80,000, with the latest price swing highlighting prevailing weakness amid potential geopolitical shocks.

However, despite this outlook, is a classic “bear trap” in play?

Iran ceasefire cracks dent Bitcoin momentum

Bitcoin rallied above $82,500 on Monday, igniting further bullish sentiment across the broader cryptocurrency market.

However, BTC has reversed as selling pressure resurfaced, dropping to support near $79,200.

The downturn coincides with fresh clashes in the Strait of Hormuz after Iran accused the United States of striking an oil tanker, prompting retaliatory strikes by the Islamic Revolutionary Guard Corps (IRGC) against US warships.

The US says it responded with counterstrikes.

Energy markets reacted swiftly, with Brent crude pushing back above $100 per barrel as local skirmishes reignited fears of supply disruption in the world’s key oil chokepoint.

According to SosoValue, the flare‑up has injected fresh anxiety into the so‑called “14‑point deal” narrative, a diplomatic framework aimed at stabilizing the region.

However, the platform notes that President Donald Trump’s insistence that the ceasefire remains in place, and Washington’s framing of its actions as “self‑defense,” point to a lack of appetite for full‑scale escalation.

“If both sides publicly signal restraint, the damage to global risk appetite remains localized,” SosoValue observed on X.

Bitcoin price forecast: a bear trap or deeper retreat?

According to analysts, a scenario that sees the current macro fallout contained could set the stage for a bullish reversal.

Santiment has noted a wave of profit‑driven holder capitulation in recent days, which it says hints at a potential sharp rebound amid thinning liquidity.

“Capitulation is one of the key ingredients to the beginning of bull runs, and wallets can drop out during both a price fall (out of fear of losing more) or on a price rise (expecting prices to not go any higher),” the firm posted.

Meanwhile, veteran market technician John Bollinger recently flagged Bitcoin’s trend model as flipping positive. BTC has retreated from the upper Bollinger Bands line, but the BBTrend indicator remains bullish.

This suggests a short‑squeeze could materialize if prices hold support levels.

Bulls will also need to reclaim upward momentum on strong volume, largely helped by limited escalation in the Gulf, contained oil‑price spikes, and the crypto‑friendly CLARITY Act.

Key resistance levels could be around $85,000-$90,000. However, if downside risks continue, bears could eye a deeper correction toward the $60,000 support zone.

Bitcoin hovered around $79,615 on Friday morning.

Chaos Labs, a crypto risk management and infrastructure provider, says its Chaos Oracle Network—used to feed data to blockchain applications—emerged from a weekend hacking attempt without a breach. Founder Omer Goldberg disclosed that the incident was detected promptly and that the surface area was confined to operational wallets used for routine on-chain operations. He emphasized that the Chaos Oracle Network remained secure, operating in a fully isolated environment with globally distributed nodes protected by layered security and cryptographic controls.

In a Thursday X post, Goldberg said authorities and cyber professionals view the activity as consistent with nation-state attacks, though the investigation is ongoing and updates will be shared as allowed. He also noted that Chaos Labs rotated all keys in response and has not observed any further suspicious activity since the initial incident.

While the claim of a possible nation-state attribution remains contested within broader cyber security discourse, the event occurs against a backdrop of heightened concerns over the security of cross-chain infrastructure and oracle providers. North Korea-linked actors have been linked to several large-scale exploits in recent months, though Pyongyang has denied involvement in global cybercrime. The April incident landscape, including the high-profile Kelp DAO breach, has intensified scrutiny on the sector’s risk controls and incident response protocols.

Goldberg stressed that Chaos Labs’ incident response was decisive and proportionate, stating that the company has rotated keys and that there has been no recurrence of suspicious activity. He added that the organization remains committed to robust cyber defense, noteing that a substantial portion of operating budgets is devoted to alerting, detection, and defense in an increasingly hostile threat environment.

Key takeaways

• The Chaos Oracle Network was not breached; the surface area was limited to routine operational wallets, with keys rotated and no subsequent suspicious activity detected.
• The incident prompted a full lockdown and a “highest-severity” incident response, underscoring the sector’s emphasis on rapid containment and cyber resilience.
• Authorities have described the activity as potentially consistent with nation-state tactics, though investigations continue and attribution remains under review.
• Across the industry, firms are reassessing oracle security and moving toward more trusted infrastructure, highlighted by a wave of migrations to Chainlink.

Chaos Labs’ response and the evolving oracle security landscape

Chaos Labs framed the weekend event as a test of the resilience of its data feeds and risk-management stack. Goldberg’s account of the incident centers on containment and rapid isolation: the compromised surface was confined to operational wallets used for routine on-chain operations, and the Chaos Oracle Network itself remained untouched. The firm rotated all keys in response, and Goldberg said there has been no follow-on anomalous activity since the initial response.

The company also highlighted the defensive posture underpinning its operations. “Chaos Oracles run in a fully isolated environment with nodes distributed globally, protected by layered security and cryptographic controls,” Goldberg wrote. The emphasis on segmentation and cryptographic safeguards reflects a broader industry push to harden critical infrastructure as the DeFi ecosystem expands and becomes more interconnected with cross-chain services.

In the broader context, security incidents in 2024 have driven heightened vigilance across the space. The April Kelp DAO breach, which coincided with a string of other exploits, sent waves through DeFi and highlighted the fragility of cross-chain and oracle architectures. Such events have intensified the debate about where trust should reside in any data feed—from the providers that curate data to the networks that transport and verify it across chains.

Despite the fog of attribution, the incident has already contributed to a shift in how protocols evaluate oracles and cross-chain infrastructure. The attack environment has reinforced the view among developers and investors that a multi-sourced, heavily audited oracle framework can act as a critical line of defense against cascading risks in DeFi and beyond.

Chainlink migration wave and what it signals for the sector

The Chaos Labs event has added momentum to a broader migration trend toward Chainlink’s oracle platform. Several projects have signaled or initiated moves to Chainlink in response to security concerns around other providers’ infrastructures. Notably, Tydro, a borrowing platform, announced plans to migrate to Chainlink after the Chaos Labs incident, joining a growing cohort of projects seeking more trusted oracle security amid a period of industry-wide scrutiny.

In related moves, Kelp DAO has migrated its restaking token rsETH to the Chainlink Oracle platform, continuing to fault LayerZero’s cross-chain infrastructure in connection with the April exploits. LayerZero has disputed the attribution, but the migration underscores a preference for proven, auditable cross-chain connectivity in a volatile security environment. Separately, Solv Protocol has publicly flagged plans to migrate its cross-chain infrastructure from LayerZero to Chainlink, citing recent industry events as a driver for re-evaluating security and reliability in interoperability.

Taken together, the shifts point to a broader industry emphasis on oracle reliability and secure cross-chain messaging as the backbone of DeFi’s ongoing growth. Chainlink’s established track record in providing decentralized, tamper-resistant data feeds appears to be a factor driving these migrations, even as other players continue to innovate and compete in the space. The exact timelines for these migrations vary by project, but the trend is clear: builders are prioritizing security posture and resilience in the face of an increasingly sophisticated threat landscape.

For investors and developers alike, the episode reinforces a core takeaway: the infrastructure that underpins DeFi—especially data feeds and cross-chain messaging—has become a strategic battleground. While attribution remains a puzzle in many high-profile exploits, the practical impact is tangible: protocols are increasingly choosing platforms with transparent security practices, verifiable audits, and robust incident response protocols as a core element of their risk management strategy.

North Korean-linked actors have been repeatedly associated with major crypto hacks, and the sector continues to monitor whether these patterns will intensify or shift as security practices improve. The opposing narrative—denials from the North Korean side—highlights the ongoing geopolitical tension surrounding cybercrime and the crypto industry. As investigators continue to piece together recent incidents, the market will likely watch how oracle providers differentiate themselves on security and reliability in the months ahead.

With Chaos Labs’ investigation still in progress, the industry will be watching how quickly and transparently new details emerge, and whether additional firms will accelerate their migrations to Chainlink or other trusted infrastructures. The evolving story underscores a broader shift toward stronger, more auditable cross-chain connectivity in a space that increasingly depends on dependable data feeds to sustain growth and user trust.

Source: Omer Goldberg, Chaos Labs (via X post); ongoing industry reporting surrounding the Kelp DAO and other exploits. For additional context on related incidents and reactions across the sector, see ongoing industry reports and coverage from Crypto outlets.