US-listed spot Bitcoin exchange-traded funds (ETFs) posted their longest outflow streak since launch, extending withdrawals as institutional demand for Bitcoin exposure weakened.

Spot Bitcoin ETFs recorded another $223 million in net outflows on Thursday, marking the record nine-day outflow streak since the funds launched in 2024, according to data from Farside Investors.

The latest streak surpassed the previous record eight-session outflow run recorded in February 2025, though its roughly $2.84 billion in cumulative withdrawals remains below the $3.2 billion lost during the earlier selloff.

US spot Bitcoin ETF outflows in May 2026 versus February 2025. Source: SoSoValue

The outflows suggest institutional demand for Bitcoin exposure is weakening through the ETF channel, and come as major corporate holders such as Strategy face renewed pressure even as some new altcoin products like Hyperliquid (HYPE) ETFs continue attracting investor interest.

BlackRock’s IBIT leads the outflows at $2 billion

BlackRock’s iShares Bitcoin Trust (IBIT), the largest US spot Bitcoin ETF by assets, accounted for a massive share of losses during the nine-session outflow streak.

The fund recorded roughly $2.04 billion in cumulative outflows between May 15 and Thursday. As Cointelegraph reported, a $527.8 million withdrawal on May 27 marked IBIT’s second-largest daily outflow on record, narrowly below the $528.3 million record posted on Jan. 30, 2025.

BTC holdings for all US spot Bitcoin ETFs as of market close on Wednesday. Source: Wallet Pilot

Despite the selling pressure, BlackRock’s Bitcoin ETF remains the dominant US spot Bitcoin fund by assets under management. IBIT held roughly 792,000 BTC as of market close on Wednesday, representing about 62% of all US spot Bitcoin ETF holdings, according to Wallet Pilot data.

HYPE ETFs buck the broader slowdown

While spot Bitcoin ETFs face sustained selling pressure, newly launched HYPE ETFs have continued attracting fresh capital from investors.

The products recorded steady inflows between May 12 and Thursday, with cumulative net inflows rising above $100 million, according to SoSoValue.

Daily flows in US-listed spot HYPE ETFs. Source: SoSoValue

Other altcoin funds such as spot XRP ETFs also recorded steady gains over the period, totaling roughly $120 million in net additions between May 4 and Thursday.

Related: Bitcoin’s major holders halt buys as demand slows: CryptoQuant

The divergence underscores a shift in crypto fund flows, with investors pulling back from Bitcoin and Ether ETFs while newer products tied to tokens such as Hyperliquid’s HYPE continue to attract inflows.

US spot Ether ETFs have also faced persistent selling pressure, logging 13 consecutive days of outflows between May 11 and Thursday, with cumulative losses of roughly $694 million.

Magazine: Big Questions: Do we really only need 2–5 cryptocurrencies?

The global rush to deploy autonomous AI agents across the internet, enterprise networks and consumer applications is creating a catastrophic security debt, according to the chief of blockchain security auditor Certik.

While corporations ambitiously market these tools as productivity miracles, the crude reality is that it can be a very, very risky thing to do. Unisolated, unvetted AI agents are a massive security disaster waiting to happen, Ronghui Gu, the co-founder and CEO of CertiK, told CoinDesk.

Gu warned that users are potentially exposing their most sensitive files, local credentials and money accounts to autonomous systems that can be easily manipulated, hijacked and openly scammed.

“Right now, agents are no longer just answering questions in a chat window,” Gu told CoinDesk on the heels of CertiK’s landmark deep-dive report into widespread agent infrastructure. “They are beginning to call external tools, read local files, trigger workflows, and interact with financial infrastructure. But if you do not isolate the execution environment and scan these tools first, you are handing a compromised identity broad internal access to your entire network.”

The fundamental flaw in the current AI agent boom is a mistaken trust model, according to Gu.

Charles Hoskinson, founder and CEO of Cardano’s Input Output, said that by 2035 they will become more relevant than humans on the internet. Coinbase CEO Brian Armstrong, recently said “very soon there are going to be more AI agents than humans making transactions” and Binance Founder Changpeng Zhao, predicted they “will make one million times more payments than humans.”

Ultimate inside threat

Gu said many popular, open-source AI applications are built under the assumption that because they run locally on a user’s computer or connect via standard chat apps like WhatsApp, they are safe from external threats.

The reality is entirely the opposite, he noted. The moment a user grants an AI agent permission to read local system storage, view execution histories or manage personal email and business database credentials, that agent becomes the ultimate inside threat.

CertiK’s recent analysis of early-state, rapidly growing agent structures uncovered a staggering accumulation of security vulnerabilities, including hundreds of critical security advisories, unpatched common vulnerabilities and exposures (CVEs) and other massive exposures of local credentials and session memories resulting from completely inconsistent boundary checks.

More alarming yet is how easily these autonomous systems can be completely redirected at the reasoning layer without a single line of malicious code ever being written, Gu emphasized.

Through basic “prompt injection” attacks, a bad actor can embed hidden natural language instructions inside a benign webpage, a PDF document, or an incoming email, he added.

When the unisolated AI agent reads that file to process a task for the user, it fails to separate trusted system commands from the untrusted external data, Gu explained. The agent then silently overwrites its original rules, obeys the malicious instruction, and can be forced to exfiltrate data or trigger unauthorized fund transfers.

Hyperfast exploits

Gu revealed that CertiK discovered hundreds of malicious skills, fake installers, and lookalike dependency packages sitting directly on open agent utility hubs. Because these malicious plug-ins use standard natural language to subtly influence the agent’s behavior and change its goals, they completely bypass legacy, signature-based antivirus software.

“The scam apps use natural language to influence behavior, making them totally resistant to traditional antivirus scans,” Gu explained. “And right now, it is even easier to scam the machine than it is to scam a human.”

In what Gu describes as a bizarre evolution of financial crime, CertiK’s telemetry has observed an explosion of onchain, automated scams that run for only 10 minutes or a few hours before completely vanishing.

These hyperfast, ephemeral exploits are specifically designed by hackers to target and scam other autonomous AI trading bots and automated agent systems, executing machine-on-machine financial drainage before any human even realizes a compromise has occurred.

Gu states that the software engineering industry must completely abandon its reliance on trust-based interactions and move immediately toward an isolated, “Zero Trust” architecture where every command and dependency is continuously verified.

This morning, the Commodity Futures Trading Commission (CFTC) took historic action to permit the listing of a true bitcoin perpetual contract by a CFTC-registered exchange. In doing so, the Commission charted a path for one of the most liquid segments of the crypto asset markets to exist within the U.S. regulatory framework. Having true perpetual contracts in the United States is a major step forward in delivering on President Trump’s goal of cementing America as the crypto capital of the world.

Unlike a traditional futures contract, which was designed for markets that close overnight and on weekends, a perpetual contract (also known as a “perpetual” or “perp”) is a type of derivative contract that has no fixed expiration date. Instead, counterparties periodically exchange a funding rate payment, similar to variation margin, that is designed to maintain relative price parity with the underlying asset’s spot price. In markets that operate 24/7, the lack of an expiration date allows market participants to maintain continuous price exposure without periodic expirations and the associated costs of rolling over contracts.

Perpetual contracts were first theorized in a discussion paper published in 1992 by Nobel-prize-winning economist Robert Shiller. Since then, perpetuals have become a foundational risk-management and price-discovery tool in the global crypto asset markets.

Yet, despite clear market demand and the CFTC’s statutory obligation to promote responsible innovation, the CFTC has – until now – failed to provide a workable pathway for crypto asset perpetuals to exist in a compliant manner in the United States.

As a result, perpetual trading activity has predictably occurred offshore. With liquidity fragmented across foreign platforms, American crypto asset firms were competitively disadvantaged, and U.S. market participants were effectively barred from accessing these markets.

Under my leadership, the CFTC has taken a different approach. One that is consistent with the CFTC’s mandate to promote responsible innovation and fair competition, and one rooted in the belief that responsible innovation requires regulatory clarity.

The Commission’s long-standing, principled oversight of the commodity derivatives market will now include a workable framework for true crypto asset perpetual contracts. This is a framework that can limit excessive leverage, volatility and systemic risk, rather than pushing those risks offshore to unregulated venues.

While today’s approval of the bitcoin perpetual may seem novel, history tells a different story.

For more than a century and a half, America’s commodity futures markets have functioned as a proving ground for innovation and evolved alongside technological progress. From agricultural futures in the nineteenth century, to electronic trading in the twentieth century and bitcoin futures under Trump 1.0, our markets have consistently adapted to new forms of commerce, risk transfer and capital formation. Crypto assets and blockchain-based financial infrastructure represent one of the many next chapters in that story.

In my view, the question was never whether crypto asset perpetual contracts would exist. Instead, the question was whether they would exist under American oversight, American standards and American rule of law.

For too long, bureaucratic regulators approached the new frontier of finance with the assumption that innovation itself represented a threat to the public interest. This decelerationist approach resulted in regulation by enforcement and forced American innovators to flee the U.S. and build beyond our borders.

Fortunately, thanks to the leadership of President Donald Trump, those days are behind us, and the U.S. is now the crypto capital of the world. Today’s action to onshore crypto asset perpetuals was the natural extension of this American achievement and reinforces U.S. leadership in digital financial technology.

Although the work is far from finished, today marks an important milestone.

For the first time, the world’s most sophisticated financial system has opened the door for crypto asset perpetuals to operate within its regulated framework. And while Congress has an important role to play in delivering long-term statutory clarity for crypto asset markets, the CFTC will continue advancing initiatives related to tokenized collateral, crypto asset market structure and prediction markets.

Innovation is coming onshore.

American crypto asset perpetuals are here, and the U.S. will continue to lead in this new frontier of finance.

Latest developments: Klein argued the Commodity Futures Trading Commission faces a dramatically larger mandate as lawmakers consider expanding its authority over digital assets. Klein recently joined Rebecca Rettig and Renato Mariotti on CoinDesk’s The Policy Protocol.

• Klein said the CFTC was originally created to oversee commodity futures markets and was not built for the scale of responsibilities envisioned under current crypto legislation.
• He warned that giving the agency new powers without additional staff, funding and expertise could create the appearance of regulation without meaningful oversight.
• Klein expressed concern that regulatory capacity has been weakened by personnel departures and structural changes at the agency.

What this means: The debate over the Clarity Act is increasingly becoming a debate over whether the CFTC can effectively police crypto markets.

• Klein said one lesson from the Dodd-Frank era is that assigning major responsibilities across multiple regulators can create delays and confusion.
• He argued that fragmented oversight risks repeating past regulatory failures if agencies lack the resources or will to enforce rules.
• Klein compared those risks to shortcomings he believes contributed to past financial crises.

The controversy: Klein sharply criticized allegations that political influence is affecting financial regulation.

• Referring to a New York Times report discussed during the interview, Klein said regulators should remain independent from political intervention.
• He argued that enforcement decisions should not be influenced by relationships with the White House or political figures.
• Klein described the current environment as unusually permissive toward financial misconduct and called for stronger accountability.

Reading between the lines: Klein sees a longer-term solution in closer coordination between U.S. market regulators.

• He said the U.S. is unusual in maintaining separate capital markets regulators through the SEC and CFTC.
• Klein argued that eventually merging the agencies would make sense, though he expressed skepticism that Congress is prepared to pursue that path.
• In the meantime, he praised reports that SEC and CFTC staff may share office space, saying physical proximity can improve collaboration more than formal agreements.

What comes next: Regulatory structure could become as important as the rules themselves.

• Klein said memorandums of understanding between agencies often fail to produce meaningful cooperation in practice.
• He argued that stronger coordination mechanisms and operational integration would better prepare regulators for overseeing crypto and prediction markets.

U.S. crypto firms can offer perpetual futures contracts, or “perps,” without running afoul of the U.S. Commodity Futures Trading Commission, according to the agency’s first approval allowing Kalshi to list and trade U.S. bitcoin perpetuals, the regulator said on Friday.

In a related action, the agency also issued key guidance that allowed Coinbase Financial Markets to put its U.S. clients into global options and perps, tapping the largest current markets.

The perp is a kind of derivative that allows the investor to speculate on future price movements in a crypto asset without putting an expiration date on that contract, allowing it to be held as long as the investor wants. With this first approval on a registered platform, the U.S. derivatives regulator with a long history overseeing traditional crypto futures now opens a U.S. path for the potentially lucrative and popular arena of crypto perps that have previously been pursued more in non-U.S. jurisdictions.

The CFTC announced Kalshi is approved for the first true bitcoin-referenced perp, BTCPERP, and the agency said the approval “requires, among other terms and conditions, that Kalshi list and maintain the BTCPERP Contract in compliance with all applicable provisions of the Commodity Exchange Act.” While Kalshi is best known in the public as a leading prediction markets platform, the registered exchange has been expanding its business footprint.

“This marks Kalshi’s evolution from prediction market leader to next-gen derivatives exchange,” said Tarek Mansour, CEO of Kalshi, in a post on the company’s website that called their event-contract business only the first chapter. “Onshore, safe and regulated perps will improve capital allocation and risk management for countless American businesses.”

In a letter sent to Coinbase on the same day, the CFTC said it would permit certain perpetual futures products that Coinbase intends to list through its CFM subsidiary. These perpetual futures will be routed through Coinbase Bermuda, so they’ll be treated as “foreign futures.” The no-action letter will allow CFM to post customers’ digital assets (including bitcoin, ether and stablecoins) as margin collateral for these products.

Paul Grewal, Coinbase chief legal officer, called it a “massive first for the industry” in a post on social media site X.

The CFTC announcements follow closely on the heels of President Donald Trump’s social-media post this week that cited perpetuals and argued that the previous administration’s regulators “nearly DESTROYED the American Crypto Industry by driving Bitcoin, Crypto Perpetuals, and INNOVATION offshore, but ‘TRUMP’ SAVED IT.”

Trump’s CFTC chairman, Mike Selig, argued that the contracts represent “a foundational risk management and price discovery tool in the global crypto asset markets.”

“Having true perpetual contracts in the United States is a major step forward in delivering on President Trump’s goal of cementing America as the crypto capital of the world,” Selig wrote in an opinion piece published Friday at CoinDesk. He said his agency is now providing “a workable framework for true crypto asset perpetual contracts.”

Perps, typically amplified with leverage, can be a way to cash in big on even minor price movements in assets such as bitcoin BTC$73,238.42 and Ethereum’s ether (ETH), but that also means they can go the other direction just as sharply, making them a volatile investment.

Selig had said in March that he has been trying to repair damage from the previous U.S. administration that “drove a lot of these firms and the liquidity offshore.” Some of the other crypto-native exchanges the agency oversees in the U.S. include Bitnomial (just acquired by Kraken) and Gemini, plus Kalshi’s prediction-market rival, Polymarket.

Selig wrote on Friday that his agency’s approach to perps would “limit excessive leverage, volatility and systemic risk.”

There are other dangers associated with perpetuals, too, as witnessed this week with the flash crash in the Hyperliquid SPACEX-USDH, a crypto perpetual contract for SpaceX’s market valuation, catching many investors off-guard and wiping out some $1.5 million in notional value within 30 minutes because of one outsized position that absorbed the market’s thin liquidity.

The CFTC’s new stance doesn’t yet carry the weight of a formal rule. The CFTC and its sister agency, the Securities and Exchange Commission, have been blazing a crypto policy trail with new statements, so-called no-action letters (like the one sent to Coinbase on Friday), approvals and guidance revealing their current stance on various aspects of the industry. But until the policies are set with formal rules or — even more durable — new laws, then they can be easily overturned by future agency leaders.

In March, the two agencies released highly consequential guidance that — for the first time — offered their definitions for classifying various crypto assets. The new taxonomy described a series of buckets the assets could be placed in that would establish how they’d be regulated and by whom, and it also set out standards for how a crypto security may eventually transition out of that classification as its project matures.

The SEC is also poised to release a wide-reaching new crypto policy meant to pave the way for the tokenization of securities by offering temporary exemptions from registration for digital asset innovations. The shift — a marquee project for SEC Chairman Paul Atkins — is planned as an interim measure to foster crypto activity while the industry awaits a more permanent law from Congress.

Read More: CFTC chief Selig to clear path for U.S. perpetual futures in coming weeks

UPDATE (May 29, 2026, 14:17 UTC): Adds identification of the approved firm, Kalshi, and the addition of no-action guidance involving Coinbase.
UPDATE (May 29, 2026, 14:30 UTC): Adds remarks from Kalshi.

UPDATE (May 29, 2026, 14:44 UTC): Adds detail and remarks from Coinbase.

The most recent of the floated Middle East peace deals appears to have more legs than the dozen or so previous ones. Stocks continue to gain, bond yields are easing, and oil has fallen back to close to a three-month low.

No bit of news, though, has been able to lift crypto prices.

Bitcoin (BTC) has fallen back to $72,500 in morning U.S. trade, down about 0.5% over the past 24 hours and lower by 5.5% over the past week. Other crypto majors are posting similar declines.

Bitcoin began May at about $77,000, so absent a sizable rally over the next 60 hours, BTC will be negative for the month, ending a two-month winning streak.

Bitcoin’s latest drawdown has done more than nudge its price lower. It coincided with a sharp reevaluation of its place in the global asset hierarchy, as BTC’s market capitalization slipped below the $1.5 trillion mark and its ranking within the world’s top assets fell to 13th. The move comes amid a broader rotation of capital into traditional safe havens and AI-driven equities, set against renewed geopolitical frictions and macro headwinds.

Bitcoin traded off a rally that had seen it hover around $83,000 earlier in May, with prices dropping toward the $72,000 area. That move shaved the market cap from roughly $1.66 trillion to about $1.45 trillion, underscoring how quickly asset leadership can shift in a risk-off environment. The retreat has BTC trailing several widely followed conglomerates and tech players, placing it behind heavyweights such as Saudi Aramco, Tesla, and Meta Platforms as investors reallocate capital.

The broader market backdrop features a notable rotation into traditional stores of value and AI-focused equities. A surge in precious metals has underscored demand for non-crypto hedges, while semiconductor and AI-related stocks have outperformed Bitcoin in 2026. In parallel, a number of major technology and memory-makers have crossed sizable valuation thresholds, signaling a market tilt toward cash-generative tech and high-growth AI exposure. Micron Technology, for one, has eclipsed the $1 trillion valuation amid the ongoing AI and chip-driven rally.

Analysts offered mixed readings on Bitcoin’s longer-term prospects. One observer warned that “things are starting to look scary” as BTC’s position in global rankings deteriorates. Others argued that the sell-off does not erode Bitcoin’s scarcity narrative or its longer-run upside potential. A third commentator framed the move as a potential bottom signal, though cautioned that confirmation would require more price action. These views illustrate a landscape where immediate price catalysts clash with longer-term structural arguments around BTC’s role in a diversified portfolio.

Key takeaways

• Bitcoin’s market capitalization fell to roughly $1.45 trillion, dropping BTC from the world’s top 10 assets to 13th place by market cap.
• Prices moved from about $83,000 in May to a low near $72,000, aligning with the market-cap reordering and a broader risk-off tone.
• There was a clear rotation into safe havens and AI equities, with gold and silver rallying and AI/semiconductor stocks outperforming Bitcoin in 2026.
• BTC’s realized price is approaching a bearish cross with the 365-day moving average, a configuration historically followed by meaningful drawdowns in prior cycles.
• Past episodes of a realized-price death cross coincided with sharp declines (notably in the mid-2022 bear market and the 2018 macro downturn), underscoring potential downside risk if the pattern completes.

Bitcoin’s market cap slips and the asset rebalancing

Bitcoin’s price decline from the high-70,000s to the low-70,000s level has not occurred in a vacuum. Its market capitalization collapsed from about $1.66 trillion to approximately $1.45 trillion, reflecting a broader reshuffling of capital away from crypto toward other asset classes. In the wake of the move, BTC fell out of the global top 10 assets by market cap, ranking 13th overall. The shift places BTC behind heavyweight corporates and tech giants, illustrating how quickly risk sentiment can tilt away from digital assets in favor of traditional equities and value-oriented plays.

The pullback comes amid a confluence of external pressures: ongoing geopolitical tensions, mixed macro signals, and a general risk-off mood that has benefitted traditional safe-havens and AI-led equities. The landscape is further complicated by strong performances in AI and semiconductor sectors, which have attracted fresh capital flows and, in some cases, overtaken BTC in market capitalization. The broader implication for investors is a reminder that BTC’s market position is not insulated from macro cycles and sector rotations, even as its scarcity and adoption narratives persist over the long horizon.

Safe havens rise as AI stocks take the lead

Beyond Bitcoin, the market narrative has been shifting in favor of assets perceived as safer havens or high-growth tech exposures. Gold, which had surged to extraordinary levels earlier in the year before retreating, remains a focal point for risk-off flows. The precious metal narrative has been supported by a broader rally in metals, with gold and silver reaching or approaching multi-year highs in different phases of the cycle. One study noted gold’s all-time rally in the context of a wider rotation into traditional assets, underscoring how macro uncertainty can drive money toward tangible stores of value.

Meanwhile, the AI and semiconductor rally has continued to reshape market leadership. Major chipmakers and AI hardware plays have climbed the capitalization ladder, at times surpassing Bitcoin. This dynamic is visible in metrics showing names like Taiwan Semiconductor Manufacturing Company (TSMC) and Broadcom outpacing BTC in market cap as AI-driven demand and semiconductor supply constraints push valuations higher. The momentum in AI-related equities reinforces a market where technology and computing infrastructure increasingly dictate relative asset strength, even as digital assets face episodic volatility.

In this tilt, market participants have pointed to the evolving demand dynamics around BTC. Some observers argued that the drop does not erase Bitcoin’s inherent scarcity, a long-run driver that could still anchor demand as the macro environment stabilizes. Others warned that, if the rotation persists, BTC could endure further mark-to-market pressure before a potential rebalancing takes hold.

Death cross on the realized price looms for Bitcoin

Analysts highlight a technical setup that could foreshadow further weakness: a pending death cross between Bitcoin’s realized price and its 365-day moving average. The realized price—an average of the cost basis of all coins in circulation—has historically acted as a magnet for BTC’s price, with a cross below the moving average signaling diminished momentum. The current configuration mirrors patterns seen in past bear markets, though the exact timing and magnitude of any follow-on moves remain uncertain.

The last time this bearish crossover materialized, BTC faced significant downside, including the mid-2022 bear market when prices collapsed from around $69,000 toward the realized-price level, culminating in a roughly 52% decline to $15,500. A similar 52% drawdown occurred during the 2018 macro downturn. At present, Bitcoin is trading about 35% above its realized price, roughly near $54,200. If the historical pattern repeats, a reversion toward the realized price could pull BTC into the low-$30,000s, though many analysts deem such a move unlikely in the near term.

“This must be a bottom signal.”

As market participants weigh these signals, observers emphasize that a cross does not guarantee a rebound or a crash—it simply increases the probability of a continued move in the direction signaled by the cross. The current setup adds a layer of caution for traders who are evaluating risk-reward in a market where macro factors and sector rotations are now a primary driver of asset performance.

In sum, Bitcoin’s latest price action has produced a visible shift in the asset’s relative standing within the global markets. The combination of a slipping market cap, a drop in ranking, and a looming realized-price death cross paints a picture of a market that remains highly sensitive to macro dynamics and sector rotations. For investors, the message is clear: BTC’s long-term narrative—scarcity, adoption, and network effects—continues to compete with a broader macro regime that favors AI-linked equities and traditional hedges in the near term. The coming weeks will be telling as macro data, geopolitical developments, and crypto-specific demand signals converge to decide whether BTC reclaims leadership or remains tethered to broader risk-off flows.

TLDR

• DxSale’s legacy liquidity locker on BNB Chain suffered a $7.3 million exploit.
• Attackers reportedly targeted more than 1,400 old liquidity pools linked to DxSale contracts.
• Investigators traced 2,958 BNB from the attacker address to two main wallets.
• Tahax reported that DxSale locker ownership moved through around 89 wallets before the attack.
• Eyeonchain reported older backdoor claims tied to unlocking old DxSale LP positions.

DxSale’s legacy liquidity locker on BNB Chain suffered a $7.3 million exploit across old liquidity positions. On-chain investigators reported that attackers targeted more than 1,400 liquidity pools linked to outdated locker contracts. The incident has raised fresh questions around contract ownership changes, old DeFi infrastructure, and possible insider-level access.

Attackers Drain Old DxSale Liquidity Pools

Blockchain security firm PeckShield and on-chain analyst Tahax reported the exploit on DxSale’s legacy locker contracts. The attackers drained assets from old liquidity provider positions that remained locked on BNB Chain. DxSale gained wide use during the early BNB Chain token boom. Many memecoin projects used the platform to lock LP tokens and assure token holders.

Several of those contracts dated back to the 2021 market cycle. Many positions stayed untouched for years, which left substantial liquidity inside older contract structures. Investigators traced the primary attacker address to several post-exploit transactions. The address moved 2,958 BNB, worth about $1.87 million, to two main wallets.

The funds then moved through routes linked to multiple Binance deposit addresses. Separate tracking also showed swaps and mixer-related activity, including AnySwap routes. Researchers reported that the attackers used custom contracts to drain liquidity in batches. They also manipulated unlock timestamps and reduced fees close to zero.

Ownership Transfers Raise Questions

Tahax reported that DxSale’s deployer moved ownership of the legacy locker contract in August 2025. That transfer happened about 269 days before the attack. The migration did not come with a public statement from DxSale, according to the investigation. Ownership then moved through around 89 fresh wallets before reaching a new address.

That final address received funding through Bybit and bridge activity shortly before the main drain. Researchers linked this funding pattern to the later attack flow. Tahax described the wallet movement as an attempt to hide the trail. “Each hop adds plausible deniability,” the investigator wrote in a post on X.

The exploit centered on an unverified locked contract with a permission issue. The attackers used that weakness to create new locks on already locked positions. Community researchers also pointed to older claims of internal access. In August 2025, a user reportedly shared screenshots of a Telegram service offering to unlock old DxSale LPs.

Backdoor Claims Add Pressure on DxSale

On-chain investigator Eyeonchain reported that the Telegram operator claimed links to the DxSale team. The person allegedly offered to unlock LPs from projects launched before late 2021. The operator reportedly asked for a 20% cut from recovered funds. The only stated condition involved access to the original wallet used during the DxSale launch.

Eyeonchain wrote that the latest exploit made the old claims appear more relevant. He also raised the possibility of insider-level knowledge behind the attack. DxSale had not issued an official public response across its social channels in the reports reviewed. The silence added attention to the ownership trail and contract design.

The incident follows other recent DeFi exploits across wallets, bridges, and staking platforms. StablR, SquidRouterModule, Kelp DAO, and Drift Protocol also faced large reported losses. Security researchers linked the DxSale incident to risks in older DeFi systems. They pointed to missing timelocks, weak ownership controls, and outdated monitoring around legacy contracts. Experts advised users with old DxSale LP positions to review their contracts on BscScan. They also urged projects to withdraw accessible funds and move remaining assets to audited locking tools.

Stellar’s native token, XLM, has rallied more than 50% this week, outperforming the broader crypto market, which has declined by nearly 5% in the same period.

Key takeaways:

• US financial giant DTCC announced it would integrate its tokenized securities platform with the Stellar Network.
• XLM rallied by over 50% after the announcement, but risks a sharp downside in the coming weeks.

DTCC partnership fuels XLM rally

XLM’s price surged after a major institutional partnership announcement by the Depository Trust & Clearing Corporation (DTCC), a US financial giant that clears and settles $10 trillion to $12 trillion in securities transactions daily.

In a Wednesday press release, the firm revealed plans to integrate its tokenized securities platform with the Stellar network, targeting a launch in the first half of 2027.

XLM/USD daily chart. Source: TradingView

The move builds on DTCC’s tokenized trades, launched in July 2026, based on its multi-chain strategy for tokenized asset issuance, reporting, corporate actions, and settlement.

XLM rallied 51.75% after the DTCC announcement and traded for as high as $0.224 on Friday, its highest level since January. Trading volumes rose sharply alongside the upside move, suggesting that many buyers stepped in.

Short squeeze helped fuel XLM price rally

A crowded short trade appears to have also amplified the XLM upside move. Since May 28, Stellar’s short liquidations have reached $12.41 million, compared with $6.82 million in long liquidations, according to CoinGlass.

Stellar total liquidations chart vs. XLM price. Source: CoinGlass

That means bearish traders suffered nearly 1.8 times more forced closures than bullish traders as XLM surged from around $0.15 to as high as $0.224.

XLM open interest nearly doubled during the same period, reaching $292.11 million on Friday. That shows traders added heavy leverage as the rally unfolded, instead of simply closing positions.

Stellar open interest vs. XLM price. Source: CoinGlass

At the same time, XLM’s OI-weighted funding rate dropped to around -0.0270%, its deepest level since April, even as the price climbed.

Stellar’s OI-weighted funding rate vs. XLM price. Source: CoinGlass

Negative funding means short traders paid long traders to keep their positions open, showing that bearish positioning remained crowded during the breakout.

When the price rises against heavily leveraged shorts, exchanges force bearish traders to buy back the token to close their trades. That forced buying adds fresh upward pressure, leading to a “short squeeze.”

XLM’s PayPal and Trump rallies raise sharp pullback risks

Stellar’s latest breakout mirrors earlier XLM rallies that ended with steep corrections.

In November 2024, XLM surged by roughly 640% after Donald Trump’s re-election as the US president. However, the rally quickly lost momentum, with XLM later dropping by about 68.6% from its local peak.

XLM/USD two-week chart. Source: TradingView

A similar pattern played out in July 2025, when PayPal’s stablecoin launch on Stellar and growing excitement around the Protocol 23 upgrade helped XLM rally by around 140%.

However, the upside was short-lived, with the XLM/USD pair later correcting by roughly 73.8%.

The risk now is that the DTCC-driven rally follows the same pattern.

XLM is running hard into long-term resistance

XLM’s latest rally has pushed the token into a major long-term resistance zone, raising the risk of a pullback or consolidation.

As of Friday, XLM was trading near the $0.198–$0.224 ceiling area, and a zone that also overlaps with three exponential moving averages (EMA), namely the 50-week EMA (red) near $0.2216, 100-week EMA (purple) near $0.2281 and 200-week EMA (blue) near $0.2083.

XLM/USD weekly price chart. Source: TradingView

Failure to break above the resistance confluence, which analyst MAGIC called “too strong for the first test,” risks sending the XLM price toward the $0.112–$0.136 area, down 30%–40% from current levels, by June or July.

The downside target area aligns with the lower trendline of XLM’s prevailing descending channel pattern.

Related: Altseason is dead, expect shorter cycles and ‘violent’ rotations: Crypto exec

Conversely, a decisive breakout above the resistance area raises the odds of XLM rallying toward the channel’s upper boundary near the $0.28–$0.30 range by June or July. That’s up roughly 40% from the current price levels.