Online code repository firm GitHub says a recent breach of its internal data stemmed from a staff member downloading a “poisoned” VS Code extension.

The Microsoft-owned firm first disclosed in the early hours of this morning that it was investigating unauthorized access to its internal repositories.

Since then, GitHub has shared that the breach has only affected internal GitHub repositories. 

It added, “The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.”

The breach involves a malicious VS Code extension downloaded from Microsoft’s VS Code extension marketplace. VS Code stands for Visual Studio Code, and the marketplace offers various tools and applications for code editors to download. 

Read more: Binance says GitHub data leak could cause ‘severe financial harm’

The hacking group claiming to have breached GitHub’s repositories is TeamPCP, which has been linked to the Mini Shai Halud supply chain attack that impacted OpenAI, as well as a number of other supply chain attacks targeting developer software. 

The group is selling the roughly-4,000 private repositories on the Breached hacking forum for no less than $50,000 while stressing that it will not accept any “low ball offers.”

It said, “This is not a ransom, we do not care about extorting GitHub.” The data on its end will supposedly be “shred” after the sale, and if it can’t find a buyer, TeamPCP said it will leak the data for free. 

GitHub says it has removed ‘malicious extension’

GitHub claims it “removed the malicious extension version, isolated the endpoint, and begun incident response immediately.”

“Critical secrets were rotated yesterday and overnight with the highest-impact credentials prioritized first,” the firm said, adding that it will continue to monitor the situation. 

The reception to the incident hasn’t been forgiving. Users noted longstanding complaints against former Microsoft and GitHub executives that have asked for solutions to malware-ridden downloads within the VS Code extension marketplace.

This complaint was levied against GitHub’s former CEO two years ago. 

Read more: Microsoft could stall Bitcoin development via GitHub

Former Binance CEO Changpeng Zhao warned, “If you have API keys in your code, even private repos, now is the time to double check and change them…”

CEO of coding firm Treehouse, Ryan Carson, similarly warned, “If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets.”

Crypto security expert Taylor Monahan added to Zhao’s statement, and said that you should get your API keys “out of your repos.”

“Your biggest risk is not this. It’s your own devs getting hit by one of these wormy motherfucking supply chains and leaking all those secrets,” Monahan said.

Second GitHub leak in days

Software firm Grafana also claimed earlier this week that it witnessed unauthorised access to its GitHub repositories.

It claims the attackers “downloaded our codebase,” before issuing “a ransom demand under threat of data disclosure.”

Read more: Stealthy crypto miners loot altcoins with GitHub trial accounts

In this case, Grafana claims the breach also stemmed from the supply chain attack associated with the Mini Shai-Hulud campaign.

It said, “We performed analysis and quickly rotated a significant number of GitHub workflow tokens, but a missed token led to the attackers gaining access to our GitHub repositories. A subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in fact, been compromised.”

In 2024, leaked passwords and site code stemming from Binance were viewable on GitHub for months before they were eventually taken down. 

The exchange said the leaks were capable of causing “severe financial harm,” and that the upload of its data was never authorized. 

Protos has reached out to GitHub for comment and will update this piece should we hear anything back. 

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

LayerZero Labs has released its incident report on the KelpDAO bridge attack, saying about $292 million in rsETH was stolen after attackers poisoned RPC infrastructure used by its verification network and forcing policy changes around single-signer configurations.

LayerZero Labs has published a detailed account of the KelpDAO exploit, confirming that attackers stole roughly 116,500 rsETH, worth about $292 million, by compromising downstream infrastructure tied to the verification layer used in KelpDAO’s cross-chain configuration.

The company said the incident was limited to KelpDAO’s rsETH setup because the application relied on a 1-of-1 DVN configuration with LayerZero Labs as the sole verifier, a design LayerZero said directly contradicted its standing recommendation that applications use diversified multi-DVN setups with redundancy.

In its statement, LayerZero said there was “zero contagion to any other cross-chain assets or applications,” arguing that the protocol’s modular security architecture contained the blast radius even as a single application-level configuration failed.

How the attack worked

According to LayerZero’s report, the April 18, 2026 attack targeted the RPC infrastructure relied on by the LayerZero Labs DVN rather than exploiting the LayerZero protocol, key management, or the DVN software itself.

The company said the attackers gained access to the list of RPCs used by the DVN, compromised two nodes running on separate clusters, replaced binaries on op-geth nodes, and then used malicious payloads to feed forged transaction data to the verifier while returning truthful data to other endpoints, including internal monitoring services.

To complete the exploit, the attackers also launched DDoS attacks on uncompromised RPC endpoints, which triggered failover toward the poisoned nodes and allowed the LayerZero Labs DVN to confirm transactions that had never actually occurred.

Outside forensic work broadly matches that description. Chainalysis said the attackers linked to North Korea’s Lazarus Group, specifically TraderTraitor, did not exploit a smart contract bug but instead forged a cross-chain message by poisoning internal RPC nodes and overwhelming external ones in a single-point-of-failure verification setup.

Security changes

LayerZero said the immediate response included deprecating and replacing all affected RPC nodes, restoring the LayerZero Labs DVN to operation and contacting law enforcement agencies while working with industry partners and Seal911 to trace the stolen funds.

More importantly, the company is changing how it handles risky configurations. In the statement, LayerZero said its DVN “will not sign or attest messages from any applications that utilize a 1/1 configuration,” a direct policy shift aimed at preventing a repeat of the KelpDAO failure mode.

The company is also reaching out to projects still using 1/1 configurations to migrate them to multi-DVN models with redundancy, effectively admitting that configuration flexibility without enforced safety rails was too permissive in practice.

The attribution picture has also hardened. Chainalysis linked the exploit to North Korea’s Lazarus Group and specifically TraderTraitor, while Nexus Mutual said the forged message drained $292 million from KelpDAO’s bridge in under 46 minutes, making it one of 2026’s biggest DeFi losses.

The result is a familiar but brutal lesson for cross-chain infrastructure: the smart contracts can survive intact and the protocol can still fail in practice if the off-chain trust layer is weak enough. LayerZero is now trying to prove that the right takeaway from a $292 million bridge theft is not that modular security failed, but that letting anyone run a single-signer setup was the real mistake.

Bitcoin is roughly 40% off its October 2025 peak, but a long-range valuation framework suggests the pullback could be retraced as the market moves through a new cycle. The Bitcoin Decay Channel, a logarithmic model that tracks BTC’s secular uptrend while accounting for incremental gains each cycle, points to a broad end-of-year range—and potentially higher into 2027—despite near-term volatility.

Key takeaways:

• Bitcoin Decay Channel projects a conservative year-end range of $90,000–$255,000, with a 2027 band extending to $128,000–$308,000.
• On-chain signals, notably the HODL Waves indicator, imply a possible bottom around $65,900–$70,500 if selling pressure persists.
• BTC’s rebound in 2024 appears to have touched the lower edge of the Decay Channel, a region historically associated with long-term support.
• Analysts’ forecasts vary: Bernstein has emphasized a longer adoption cycle with a target near $150,000 for 2026 and a potential $200,000 peak in 2027, while other forecasters point to near-term milestones such as $126,000 this year and higher targets in the following years.

Decay Channel: a long-range compass for BTC valuation

The Bitcoin Decay Channel is a logarithmic framework that seeks to chart BTC’s extended uptrend while incorporating gradual gains across cycles. Historically, Bitcoin’s major tops in 2013, 2017 and 2021 formed near the model’s upper valuation band, while bear-market lows have repeatedly pressed back toward its lower support zone. The model has served as a reference point for traders seeking to understand where BTC might find底 in prolonged downturns and where renewed upside momentum could begin.

Bitcoin’s most recent rebound began near the lower boundary of the Decay Channel in March–April, a zone the model has traditionally treated as long-run support. That alignment keeps alive a bullish framing for the current cycle, according to observer Sminston, who highlighted the model’s plausible end-year range: “Bitcoin Decay Channel gives a pretty reasonable range—conservative case—of $90k–$255k, by the end of this year. $128k–$308k for end of ’27.”

To put that into perspective, Sminston has contrasted the gap between present prices and later targets with historical context: “For comparison, Bitcoin was $43k in December 2023.” The Decay Channel’s structure thus anchors expectations not only on where BTC could go if the cycle resumes, but also on where it might have already spent time in the current weak phase.

The model’s framing resonates with a broader narrative in the market: several independent forecasts align with the idea that BTC could participate in a fresh all-time high within the next couple of years as institutional demand, ETFs, and corporate treasury activity continue to evolve. This longer horizon is a recurring theme among strategic analysts who view the current pullback as part of a larger secular expansion rather than a purely cyclical retreat.

Bearish patterns and on-chain signals

Despite the optimistic scenario implied by the Decay Channel, a cluster of technical and on-chain indicators warns that downside risk remains material in the near term. A classic bear flag formation has traders watching for a potential breakdown that could push BTC toward the lower end of recent trading ranges. In raw terms, a breakdown of this setup could see BTC testing sub-$56,000 levels, representing a decline of roughly 30% from present price levels.

On-chain data, however, presents a more nuanced picture. The HODL Waves metric—tracking how long bitcoins sit in wallets without movement—has been cited as suggesting a stronger long-term holder base could stabilize the market and support a higher bottom. In a recent briefing, CryptoQuant analyst Sunny Mom noted that the ongoing accumulation by long-term holders could favor a higher, slower bottom this cycle, with $70,500 as a critical level to hold. The implication is that even as price drifts downward, a robust base of entrenched holders might cap further downside and lay groundwork for a renewed ascent.

These signals complicate the straightforward bearish view. While the bear flag remains a credible risk in the near term, the interplay between chart patterns and on-chain activity underscores a market that could drift within a broad range before a decisive move higher or lower materializes. Investors will be watching whether the lower-support zone identified by the Decay Channel—plus the stabilizing effect of a strengthening holder cohort—can anchor prices in the mid-to-high five-figure territory or whether a breach triggers a more extended correction.

What comes next for BTC price trajectories

Forecasts about BTC’s path in the medium term reflect a mix of valuation frameworks and strategic bets about institutional involvement. In coverage that preceded this edition, Bernstein analysts maintained a $150,000 target for 2026, while also laying out a $200,000 peak further out in 2027, tied to a lengthier cycle of institutional adoption driven by exchange-traded products and expanding corporate holdings. The pacing of this adoption curve remains a central question for the market, with the belief that larger institutions will progressively allocate to BTC as regulatory clarity improves and as more capital-bearing products become available.

Other prominent voices offer a different, though compatible, flavor of the story. Arthur Hayes, co-founder of BitMEX, has argued for BTC’s upside as macro and geopolitical catalysts fuel demand for scarce digital assets, citing paths toward a $126,000 level within the current year on the back of new liquidity drivers and demand from AI-related infrastructure. While these calls are not uniform, they reflect a shared conviction that BTC’s price action could be shaped by macro liquidity, regulatory developments, and the appeal of BTC as a non-sovereign store of value in uncertain times.

Taken together, the picture is one of a market in which multiple horizons coexist: a near-term range-bound regime driven by chart patterns and on-chain dynamics, alongside a longer-term trajectory that envisions fresh highs once institutional demand finds more durable footing. The Decay Channel’s ranges—$90,000 to $255,000 by year-end, extending to $128,000 to $308,000 in 2027—offer a framework for risk-aware participants to balance potential upside with the possibility of further volatility in the months ahead. The central task for traders and investors is to interrogate the underlying drivers: will the current weak phase resolve into renewed accumulation, or will a deeper consolidation re-assert itself before a new leg higher begins?

As the market navigates this juncture, traders should monitor both the technical backdrop and the on-chain substrate. A durable hold above the $65,900–$70,500 zone, reinforced by rising long-term holder activity, could tilt the odds toward a more constructive second half of the year. Conversely, a decisive break below the lower boundary of the Decay Channel or a fresh wave of macro shocks could reassert downside pressure in the near term.

In short, Bitcoin’s path remains contingent on how quickly institutional demand solidifies, how macro forces unfold, and whether the balance of active and dormant supply can sustain a credible bottom. The coming weeks will reveal which of the competing narratives dominates—and whether BTC can indeed align with the longer-term targets suggested by the Decay Channel and the diverse set of forecasts that accompany it.

Looking ahead, readers should watch for changes in on-chain behavior—especially shifts in HODL Waves and wallet activity—as well as any regulatory developments that could unlock or constrain financially meaningful products. The interaction of these factors will be decisive in determining whether Bitcoin stays within its current corridor or breaks toward the higher targets favored by some models and institutions alike.

• Algorand (ALGO) jumped 5% after Robinhood listed it for US users.
• Algorand’s price has stayed between $0.1092 and $0.1173 with no breakout.
• Weekly trend is still down 6.8% despite the short-term rally.

Algorand has recorded a sharp burst of activity following its addition to Robinhood’s crypto trading platform, including availability for users in New York.

At the time of writing, Algorand’s ALGO coin was trading near $0.1149, showing a 24-hour gain of about 5%.

Robinhood listing triggers short-term momentum

The listing on Robinhood marks a notable distribution shift for Algorand.

$ALGO is now available to trade on Robinhood Crypto, including NY. pic.twitter.com/HBqM2MZ9zA

— Robinhood (@RobinhoodApp) May 19, 2026

The listing on Robinhood gives access to a large base of retail users, and historically, new listings on major retail brokerages tend to attract immediate trading interest.

In this case, the move was preceded by a wave of market commentary highlighting the possibility of Robinhood adding ALGO.

During that period, Algorand recorded intraday gains in the range of 5% to over 7%, depending on the timeframe used across different market trackers.

Once the listing was confirmed, trading activity increased further, with daily volume reaching approximately $58.9 million according to data from Coingecko.

This spike in activity coincided with heightened attention from retail traders reacting to the expanded accessibility of the token.

Price structure still shows resistance to a sustained breakout

Even with the Robinhood-driven rally, Algorand continues to trade well below its long-term highs.

The token remains down roughly 96.8% from its all-time peak of $3.56, recorded in June 2019.

This long-term drawdown highlights how far the asset has moved away from its earlier cycle valuations.

Over the past seven days, ALGO is still down around 6.8%, indicating that the recent move has not fully reversed earlier weakness.

On a monthly basis, however, the token is up approximately 12.1%, showing that the asset has been recovering in bursts rather than maintaining a steady trend.

More recently, price behaviour has been shaped by a narrow trading band.

The 24-hour range between $0.1092 and $0.1173 aligns closely with the observed rally, suggesting that most of the move occurred within established short-term volatility limits rather than breaking out of a broader range structure.

A key technical observation is that while momentum improved after the listing, there has been no sustained push beyond recent resistance levels near the $0.117–$0.122 zone, where price has repeatedly stalled in prior short-term rallies.

This indicates that buyers have not yet gained full control of trend direction.

Market reaction points to a liquidity-driven move rather than a trend shift

The current market setup shows characteristics of a liquidity-driven reaction rather than a structural reversal.

The combination of a confirmed Robinhood listing and rapid price expansion fits a pattern commonly seen when assets gain new retail access.

Trading volume near $59 million in 24 hours reflects increased participation, but the lack of follow-through beyond the immediate price spike suggests that the move is still largely sentiment-driven.

The fact that ALGO has remained negative over the past week reinforces the idea that recent gains are offsetting prior declines rather than establishing a new upward trend.

Outlook: bounce or reversal still unresolved

The expansion of availability on Robinhood, including access for New York users, increases the potential pool of participants.

This type of distribution event typically has two phases: an initial reaction driven by attention and a second phase where sustained demand either develops or fades.

With the token still trading far below historical highs and showing negative weekly performance, the recent move sits within a corrective recovery phase rather than a confirmed breakout structure.

Whether this develops into a trend reversal will depend on whether trading activity continues beyond the initial listing impact or fades back into the prior range.

The European Commission has opened a public consultation on the functioning of the EU’s MiCA regime, with feedback due by Aug. 31, 2026, in a move that will shape how crypto rules are applied across the bloc.

The European Commission said on May 20 that it had launched a consultation to gather feedback from stakeholders and the wider public on how MiCA is working in practice, marking a new phase in the EU’s attempt to turn its landmark crypto law from statute into an enforceable and adaptable operating framework.

The consultation matters because MiCA is no longer theoretical. The regime established a harmonized EU framework for crypto-assets and related services, covering crypto-assets, asset-referenced tokens, e-money tokens, their issuers and crypto-asset service providers, and the Commission now wants to know where the rulebook is working and where it is already showing strain.

The Commission said the exercise includes both a public consultation for individuals and a targeted consultation aimed at more technical and legal questions for market participants and institutional stakeholders, meaning the review is designed not just as a political box-ticking exercise but as a practical audit of the regime’s first real-world effects.

Implementation phase

According to the European Commission, all feedback gathered through the consultation will be used to inform its future policy work on digital assets, making the process one of the clearest early signals that Brussels is already thinking beyond first-generation MiCA implementation.

That matters for any firm operating in Europe because the framework already applies across the bloc. As the French regulator AMF notes, MiCA entered into force on June 29, 2023, with rules for stablecoins taking effect on June 30, 2024, and the wider regime applying from Dec. 30, 2024.

The substance of the regime is broad. ESMA says MiCA introduces uniform EU market rules for crypto-assets not already covered by existing financial services law, with key provisions covering transparency, disclosure, authorization and supervision.

Industry impact

For exchanges, wallet providers, token issuers and stablecoin firms, this consultation is effectively an invitation to try to shape the next round of European crypto supervision before it hardens into precedent. Industry participants, consumer groups, civil society and public authorities are all being asked to weigh in on how the rules should function in practice and where gaps remain.

That broader review has been signaled for weeks. At Paris Blockchain Week, EU financial services official Peter Kerstens said the Commission would launch a public consultation on MiCA with “no taboos,” according to KuCoin, raising the prospect that issues such as DeFi, tokenized assets and cross-border supervision could become part of the next policy cycle.

The outcome will matter well beyond Brussels procedure. For crypto firms trying to operate across all 27 member states, the consultation will help determine whether MiCA remains a static compliance burden or evolves into a more usable framework for licensing, disclosure, stablecoin issuance and cross-border service provision throughout the European Union.

South Carolina Governor Henry McMaster signed Senate Bill 163 into law on Tuesday, advancing one of the most crypto-friendly state-level frameworks in the country.

The bill, which previously passed the Senate 38-1 and the House 110-1, bans state agencies from accepting central bank digital currencies (CBDCs), protects the rights of crypto users and miners, and clears regulatory hurdles for businesses operating in the space.

On CBDCs, the law bars any state agency or political subdivision from accepting, requiring payment in, or participating in Federal Reserve-led digital currency trials, including any pilot programs run by federal agencies.

It also protects crypto self-custody rights, preventing governments from restricting the use of hardware and self-hosted wallets while barring higher taxes on crypto transactions than comparable payments made in US dollars.

Related: Senate Crypto Bill Might Pass as Late as August: NYDIG

South Carolina protects Bitcoin miners

The bill gives Bitcoin miners operating in industrial zones specific protections. Local governments cannot impose restrictions on mining businesses that do not apply to other industrial operations in the same area, and cannot set mining-specific noise limits beyond what general pollution rules already require.

“A political subdivision shall not change the zoning of a digital asset mining business without going through the proper notice and comment. A digital asset mining business may appeal a change in zoning to the proper court of jurisdiction,” the bill reads.

Source: South Carolina State House

The law also exempts several activities from money transmitter licensing requirements, including mining, node operation, blockchain software development and crypto-to-crypto trading. Mining-as-a-service and staking-as-a-service providers are excluded from securities classification.

Related: Polish lawmakers back revised crypto bill after repeated vetoes

More states pass crypto-friendly bills

South Carolina joins a growing list of states staking out pro-crypto positions. Kentucky passed the Bitcoin Rights bill in March last year, guaranteeing self-custody rights and shielding mining operations from discriminatory local rules.

Oklahoma, Arkansas, Florida, Mississippi, Montana, North Dakota, Louisiana and Arizona are among the states that have passed similar pieces of crypto legislation in recent years.

Magazine: Will the CLARITY Act be good — or bad — for DeFi?

Market analysts say Bitcoin (BTC) is showing “momentum exhaustion” after its 8% drop from multi-month highs above $82,000, with bulls expected to defend key crucial support levels. 

Key takeaways:

• Bitcoin momentum weakens after rejection above the $82,000 level.
• Analysts warn BTC could fall to $65,000 if support at $74,000-$76,000 fails.

Bitcoin’s price momentum is “weakening”

Private wealth manager Swissblock stated that Bitcoin’s momentum is fading following failure to “sustain expansion” above $82,000. 

Swissblock said that Bitcoin’s positive momentum has been losing “force with every bounce,” contributing to the latest drop to $76,000. 

Related: Bitcoin price stays under $77K as US bond yields near 20-year highs

Bitcoin is now trading at $77,200, with the true market mean and the short-term holder cost basis around $78,000 now acting as immediate resistance.

“Bitcoin is losing its capacity to regenerate strong positive momentum internally,” the wealth manager said, adding:

“Momentum exhaustion is not the breakdown itself. It is the process that usually comes before it.”

Bitcoin performance impulse. Source: Swissblock

Echoing this observation, analyst Axel Adler Jr pointed out that Bitcoin’s slow impulse performance indicator has “turned negative for the first time since April,” adding:

“Momentum is fading exactly as macro pressure is rising. Without Slow back above zero, every rally is unconfirmed.”

Bitcoin impulse performance. Source: CryptoQuant

Bitcoin’s price momentum indicator has also decreased significantly, falling by 29% over the last week to 47.1 from 66.7, indicating a “shift from strong upward to weakening momentum,” Glassnode said in its latest Market Pulse report, adding:

“Bitcoin’s market structure is beginning to soften as momentum, spot demand, and speculative positioning weaken across the market.”

Bitcoin price momentum. Source: Glassnode

Key Bitcoin support levels to watch

As Cointelegraph reported, Bitcoin’s upside hinges on bulls keeping the price above the $74,000-$75,000 zone, as it has repeatedly served as key support over the last two years. 

This is where the key moving averages are found, including the 50-day exponential moving average (EMA), 100-day EMA and the 50-day simple moving average (SMA), as shown in the chart below.

This reinforces the importance of this demand zone and the fact that BTC/USD has not yet dipped below, “may be the most bullish thing” for Bitcoin, trading resource Material Indicators said in a recent X post.

BTC/USD daily chart. Source: Cointelegraph/TradingView

The second area of interest lies between $72,000 (100-day SMA) and the psychological level at $70,000. 

If this level is lost, BTC price could drop to $65,000 or later revisit the macro low below $60,000, reached on Feb. 6.

Analyst Daan Crypto Trades Bitcoin said that if the support at $75,000-$76,000 is lost, the BTC/USD pair would retest the $72,000 “level pretty quickly.”

BTC/USD daily chart. Source: X/Daan Crypto Trades

Zooming out, trader CryptoAmsterdam said it would be “good” if the BTC/USD pair held support at $74,000-$76,000 (the orange area on the three-day chart below) with other areas of defense around $72,000. 

The analyst sets downside targets at $60,000 and $50,000 in case these support levels are breached. 

BTC/USD three-day chart. Source: X/CryptoAmsterdam

As Cointelegraph reported, a key support level for the bulls was the 50-day SMA at $75,600, which, if lost, could see the BTC/USDT pair sink to $65,000.