Bitcoin (BTC) continues to trade in a tight range around $77,000 in morning U.S. action on Wednesday. The major stock indices are posting small gains after three consecutive negative sessions.

Minutes from the Fed’s last policy meeting are due to be released at 2:00 pm ET. That April meeting was notable as it was the last to be headed by Jerome Powell, with Kevin Warsh due to be sworn in as Fed chair on Friday.

The meeting was also important for having four dissents — one from Stephen Miran, who wanted the central bank to trim rates, and three from board members who urged the Fed to drop any language suggesting an easing bias.

In the weeks since, bond markets globally have taken a major tumble as unexpected economic strength has combined with resurgent inflation to force a major reassessment from rate traders.

Nvidia (NVDA) reports its quarterly results after the close on Wednesday. A large stock price move in the tech bellwether is likely to lead to a sizable move in the Nasdaq. Traders accustomed to crypto’s correlation with that index will be keeping a close eye.

Singapore’s central bank, MAS, has revoked Bsquared Technology Pte Ltd’s Major Payment Institution Licence, removing the firm’s authority to provide digital payment token services under Singapore’s Payments Services Act 2019. The suspension follows an on-site inspection that uncovered weaknesses in governance and control frameworks, including risk management practices, conflict-of-interest policies, and outsourcing oversight.

The regulator also noted that Bsquared provided false or misleading information at multiple points during the license process and the subsequent review. Bsquared, which operates under the name BSQ, received the green light to offer digital payment token services roughly 16 months ago.

MAS has directed Bsquared to obtain a closure certificate from its auditors confirming that all customer funds have been returned to their rightful recipients. Bsquared informed MAS that it held no outstanding customer assets. In its statement, MAS stressed that it takes a serious view of the breaches and indicated it is reviewing the responsibilities of key BSQ officers.

Key takeaways

• MAS revoked Bsquared’s Major Payment Institution Licence after an on-site assessment revealed deficiencies in risk management, conflict-of-interest controls, and outsourcing compliance.
• The regulator criticized Bsquared for supplying false or misleading information during the application and inspection processes.
• The firm must secure a closure certificate from its auditors to demonstrate that all customer funds have been returned; Bsquared claimed no outstanding customer assets.
• Enforcement actions of this nature remain relatively rare in Singapore, where MAS has granted 37 digital payment token licenses to date; past actions include the rejection of AmazingTech’s Tokenize Xchange license and a subsequent probe by the Commercial Affairs Department.
• The case underscores heightened regulatory expectations for digital payment token providers and may influence licensing dynamics, governance standards, and audit requirements across the sector.

Regulatory framework and enforcement signals

The decision reflectsMAS’s ongoing emphasis on robust governance and risk controls for digital payment token services. Under the Payments Services Act 2019, MAS requires licensees to maintain sound risk management, clear conflict-of-interest policies, and proper oversight of outsourcing arrangements. The on-site findings in Bsquared’s case point to a broader enforcement trajectory in which governance failures, misrepresentation, and weak controls can lead to licence termination rather than penalties alone.

MAS’s stance also signals increased scrutiny of the personnel responsible for licensee governance. The authority stated it is reviewing the responsibilities of BSQ’s key officers, a step that could have implications for individual accountability within crypto firms seeking or retaining licences in Singapore.

Within this regulatory environment, the sector has seen relatively few revocations compared with license approvals. To date, MAS has granted 37 digital payment token licenses, and revocation actions remain uncommon. The regulator’s recent actions build on a pattern of careful, standards-based oversight rather than rapid, broad-based sanctions.

Historical context matters here. Last year, MAS rejected AmazingTech’s application to operate Tokenize Xchange, and the Commercial Affairs Department subsequently opened a probe into the company. These developments illustrate a vigilant, multi-agency approach to licensing and enforcement in Singapore’s crypto infrastructure landscape.

Singapore’s broader push into digital asset infrastructure

Singapore continues to position itself as a regional hub for digital assets and crypto infrastructure, hosting regional offices for major players and hosting flagship projects that connect traditional finance with tokenized assets. The regulatory environment in Singapore emphasizes prudent risk management, customer fund protection, and clear accountability for licensed entities as part of broader financial supervisory objectives.

Contextually, Singapore’s regulatory posture sits alongside ongoing global developments in crypto policy. In the European Union, MiCA is advancing a comprehensive framework for crypto assets and service providers, while U.S. authorities—across the SEC, CFTC, and DOJ—continue enforcement and policy evolution in related areas. The Bsquared case thus feeds into a global narrative prioritizing licensing discipline, AML/KYC rigor, and robust governance as prerequisites for institutional participation in crypto markets.

As Singapore strengthens its digital asset infrastructure, institutions and banks operating in or with the city-state may face heightened due diligence and compliance expectations. Initiatives such as banks enabling direct minting and redemption of stablecoins for institutional clients on blockchain rails illustrate the sector’s drive toward regulated, cross-border interoperability—but also underline the importance of clear custodial, settlement, and fund-tracing standards.

According to Cointelegraph, the MAS action against Bsquared reinforces the central bank’s position that licenced entities must meet rigorous governance and disclosure standards to maintain public trust and financial stability within Singapore’s payment and digital asset ecosystems.

Closing perspective

The Bsquared revocation demonstrates Singapore’s willingness to impose stringent consequences for governance and disclosure deficiencies in the digital asset space. For license applicants and existing providers, the case highlights the critical importance of robust risk management, transparent reporting, and strict adherence to outsourcing policies and fund custody requirements. As regulatory scrutiny intensifies, market participants should anticipate tighter officer accountability, more granular due-diligence by upstream partners, and a continuing emphasis on preserving customer fund integrity as a precondition for ongoing participation in Singapore’s crypto infrastructure ecosystem.

CoinDesk Indices presents its daily market update, highlighting the performance of leaders and laggards in the CoinDesk 20 Index.

The CoinDesk 20 is currently trading at 2064.22, up 0.7% (+14.51) since 4 p.m. ET on Tuesday.

Fifteen of the 20 assets are trading higher.

Leaders: UNI (+3.7%) and TAO (+2.1%).

Laggards: XLM (-0.6%) and BCH (-0.6%).

The CoinDesk 20 is a broad-based index traded on multiple platforms in several regions globally.

Online code repository firm GitHub says a recent breach of its internal data stemmed from a staff member downloading a “poisoned” VS Code extension.

The Microsoft-owned firm first disclosed in the early hours of this morning that it was investigating unauthorized access to its internal repositories.

Since then, GitHub has shared that the breach has only affected internal GitHub repositories. 

It added, “The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.”

The breach involves a malicious VS Code extension downloaded from Microsoft’s VS Code extension marketplace. VS Code stands for Visual Studio Code, and the marketplace offers various tools and applications for code editors to download. 

Read more: Binance says GitHub data leak could cause ‘severe financial harm’

The hacking group claiming to have breached GitHub’s repositories is TeamPCP, which has been linked to the Mini Shai Halud supply chain attack that impacted OpenAI, as well as a number of other supply chain attacks targeting developer software. 

The group is selling the roughly-4,000 private repositories on the Breached hacking forum for no less than $50,000 while stressing that it will not accept any “low ball offers.”

It said, “This is not a ransom, we do not care about extorting GitHub.” The data on its end will supposedly be “shred” after the sale, and if it can’t find a buyer, TeamPCP said it will leak the data for free. 

GitHub says it has removed ‘malicious extension’

GitHub claims it “removed the malicious extension version, isolated the endpoint, and begun incident response immediately.”

“Critical secrets were rotated yesterday and overnight with the highest-impact credentials prioritized first,” the firm said, adding that it will continue to monitor the situation. 

The reception to the incident hasn’t been forgiving. Users noted longstanding complaints against former Microsoft and GitHub executives that have asked for solutions to malware-ridden downloads within the VS Code extension marketplace.

This complaint was levied against GitHub’s former CEO two years ago. 

Read more: Microsoft could stall Bitcoin development via GitHub

Former Binance CEO Changpeng Zhao warned, “If you have API keys in your code, even private repos, now is the time to double check and change them…”

CEO of coding firm Treehouse, Ryan Carson, similarly warned, “If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets.”

Crypto security expert Taylor Monahan added to Zhao’s statement, and said that you should get your API keys “out of your repos.”

“Your biggest risk is not this. It’s your own devs getting hit by one of these wormy motherfucking supply chains and leaking all those secrets,” Monahan said.

Second GitHub leak in days

Software firm Grafana also claimed earlier this week that it witnessed unauthorised access to its GitHub repositories.

It claims the attackers “downloaded our codebase,” before issuing “a ransom demand under threat of data disclosure.”

Read more: Stealthy crypto miners loot altcoins with GitHub trial accounts

In this case, Grafana claims the breach also stemmed from the supply chain attack associated with the Mini Shai-Hulud campaign.

It said, “We performed analysis and quickly rotated a significant number of GitHub workflow tokens, but a missed token led to the attackers gaining access to our GitHub repositories. A subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in fact, been compromised.”

In 2024, leaked passwords and site code stemming from Binance were viewable on GitHub for months before they were eventually taken down. 

The exchange said the leaks were capable of causing “severe financial harm,” and that the upload of its data was never authorized. 

Protos has reached out to GitHub for comment and will update this piece should we hear anything back. 

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

LayerZero Labs has released its incident report on the KelpDAO bridge attack, saying about $292 million in rsETH was stolen after attackers poisoned RPC infrastructure used by its verification network and forcing policy changes around single-signer configurations.

LayerZero Labs has published a detailed account of the KelpDAO exploit, confirming that attackers stole roughly 116,500 rsETH, worth about $292 million, by compromising downstream infrastructure tied to the verification layer used in KelpDAO’s cross-chain configuration.

The company said the incident was limited to KelpDAO’s rsETH setup because the application relied on a 1-of-1 DVN configuration with LayerZero Labs as the sole verifier, a design LayerZero said directly contradicted its standing recommendation that applications use diversified multi-DVN setups with redundancy.

In its statement, LayerZero said there was “zero contagion to any other cross-chain assets or applications,” arguing that the protocol’s modular security architecture contained the blast radius even as a single application-level configuration failed.

How the attack worked

According to LayerZero’s report, the April 18, 2026 attack targeted the RPC infrastructure relied on by the LayerZero Labs DVN rather than exploiting the LayerZero protocol, key management, or the DVN software itself.

The company said the attackers gained access to the list of RPCs used by the DVN, compromised two nodes running on separate clusters, replaced binaries on op-geth nodes, and then used malicious payloads to feed forged transaction data to the verifier while returning truthful data to other endpoints, including internal monitoring services.

To complete the exploit, the attackers also launched DDoS attacks on uncompromised RPC endpoints, which triggered failover toward the poisoned nodes and allowed the LayerZero Labs DVN to confirm transactions that had never actually occurred.

Outside forensic work broadly matches that description. Chainalysis said the attackers linked to North Korea’s Lazarus Group, specifically TraderTraitor, did not exploit a smart contract bug but instead forged a cross-chain message by poisoning internal RPC nodes and overwhelming external ones in a single-point-of-failure verification setup.

Security changes

LayerZero said the immediate response included deprecating and replacing all affected RPC nodes, restoring the LayerZero Labs DVN to operation and contacting law enforcement agencies while working with industry partners and Seal911 to trace the stolen funds.

More importantly, the company is changing how it handles risky configurations. In the statement, LayerZero said its DVN “will not sign or attest messages from any applications that utilize a 1/1 configuration,” a direct policy shift aimed at preventing a repeat of the KelpDAO failure mode.

The company is also reaching out to projects still using 1/1 configurations to migrate them to multi-DVN models with redundancy, effectively admitting that configuration flexibility without enforced safety rails was too permissive in practice.

The attribution picture has also hardened. Chainalysis linked the exploit to North Korea’s Lazarus Group and specifically TraderTraitor, while Nexus Mutual said the forged message drained $292 million from KelpDAO’s bridge in under 46 minutes, making it one of 2026’s biggest DeFi losses.

The result is a familiar but brutal lesson for cross-chain infrastructure: the smart contracts can survive intact and the protocol can still fail in practice if the off-chain trust layer is weak enough. LayerZero is now trying to prove that the right takeaway from a $292 million bridge theft is not that modular security failed, but that letting anyone run a single-signer setup was the real mistake.

Bitcoin is roughly 40% off its October 2025 peak, but a long-range valuation framework suggests the pullback could be retraced as the market moves through a new cycle. The Bitcoin Decay Channel, a logarithmic model that tracks BTC’s secular uptrend while accounting for incremental gains each cycle, points to a broad end-of-year range—and potentially higher into 2027—despite near-term volatility.

Key takeaways:

• Bitcoin Decay Channel projects a conservative year-end range of $90,000–$255,000, with a 2027 band extending to $128,000–$308,000.
• On-chain signals, notably the HODL Waves indicator, imply a possible bottom around $65,900–$70,500 if selling pressure persists.
• BTC’s rebound in 2024 appears to have touched the lower edge of the Decay Channel, a region historically associated with long-term support.
• Analysts’ forecasts vary: Bernstein has emphasized a longer adoption cycle with a target near $150,000 for 2026 and a potential $200,000 peak in 2027, while other forecasters point to near-term milestones such as $126,000 this year and higher targets in the following years.

Decay Channel: a long-range compass for BTC valuation

The Bitcoin Decay Channel is a logarithmic framework that seeks to chart BTC’s extended uptrend while incorporating gradual gains across cycles. Historically, Bitcoin’s major tops in 2013, 2017 and 2021 formed near the model’s upper valuation band, while bear-market lows have repeatedly pressed back toward its lower support zone. The model has served as a reference point for traders seeking to understand where BTC might find底 in prolonged downturns and where renewed upside momentum could begin.

Bitcoin’s most recent rebound began near the lower boundary of the Decay Channel in March–April, a zone the model has traditionally treated as long-run support. That alignment keeps alive a bullish framing for the current cycle, according to observer Sminston, who highlighted the model’s plausible end-year range: “Bitcoin Decay Channel gives a pretty reasonable range—conservative case—of $90k–$255k, by the end of this year. $128k–$308k for end of ’27.”

To put that into perspective, Sminston has contrasted the gap between present prices and later targets with historical context: “For comparison, Bitcoin was $43k in December 2023.” The Decay Channel’s structure thus anchors expectations not only on where BTC could go if the cycle resumes, but also on where it might have already spent time in the current weak phase.

The model’s framing resonates with a broader narrative in the market: several independent forecasts align with the idea that BTC could participate in a fresh all-time high within the next couple of years as institutional demand, ETFs, and corporate treasury activity continue to evolve. This longer horizon is a recurring theme among strategic analysts who view the current pullback as part of a larger secular expansion rather than a purely cyclical retreat.

Bearish patterns and on-chain signals

Despite the optimistic scenario implied by the Decay Channel, a cluster of technical and on-chain indicators warns that downside risk remains material in the near term. A classic bear flag formation has traders watching for a potential breakdown that could push BTC toward the lower end of recent trading ranges. In raw terms, a breakdown of this setup could see BTC testing sub-$56,000 levels, representing a decline of roughly 30% from present price levels.

On-chain data, however, presents a more nuanced picture. The HODL Waves metric—tracking how long bitcoins sit in wallets without movement—has been cited as suggesting a stronger long-term holder base could stabilize the market and support a higher bottom. In a recent briefing, CryptoQuant analyst Sunny Mom noted that the ongoing accumulation by long-term holders could favor a higher, slower bottom this cycle, with $70,500 as a critical level to hold. The implication is that even as price drifts downward, a robust base of entrenched holders might cap further downside and lay groundwork for a renewed ascent.

These signals complicate the straightforward bearish view. While the bear flag remains a credible risk in the near term, the interplay between chart patterns and on-chain activity underscores a market that could drift within a broad range before a decisive move higher or lower materializes. Investors will be watching whether the lower-support zone identified by the Decay Channel—plus the stabilizing effect of a strengthening holder cohort—can anchor prices in the mid-to-high five-figure territory or whether a breach triggers a more extended correction.

What comes next for BTC price trajectories

Forecasts about BTC’s path in the medium term reflect a mix of valuation frameworks and strategic bets about institutional involvement. In coverage that preceded this edition, Bernstein analysts maintained a $150,000 target for 2026, while also laying out a $200,000 peak further out in 2027, tied to a lengthier cycle of institutional adoption driven by exchange-traded products and expanding corporate holdings. The pacing of this adoption curve remains a central question for the market, with the belief that larger institutions will progressively allocate to BTC as regulatory clarity improves and as more capital-bearing products become available.

Other prominent voices offer a different, though compatible, flavor of the story. Arthur Hayes, co-founder of BitMEX, has argued for BTC’s upside as macro and geopolitical catalysts fuel demand for scarce digital assets, citing paths toward a $126,000 level within the current year on the back of new liquidity drivers and demand from AI-related infrastructure. While these calls are not uniform, they reflect a shared conviction that BTC’s price action could be shaped by macro liquidity, regulatory developments, and the appeal of BTC as a non-sovereign store of value in uncertain times.

Taken together, the picture is one of a market in which multiple horizons coexist: a near-term range-bound regime driven by chart patterns and on-chain dynamics, alongside a longer-term trajectory that envisions fresh highs once institutional demand finds more durable footing. The Decay Channel’s ranges—$90,000 to $255,000 by year-end, extending to $128,000 to $308,000 in 2027—offer a framework for risk-aware participants to balance potential upside with the possibility of further volatility in the months ahead. The central task for traders and investors is to interrogate the underlying drivers: will the current weak phase resolve into renewed accumulation, or will a deeper consolidation re-assert itself before a new leg higher begins?

As the market navigates this juncture, traders should monitor both the technical backdrop and the on-chain substrate. A durable hold above the $65,900–$70,500 zone, reinforced by rising long-term holder activity, could tilt the odds toward a more constructive second half of the year. Conversely, a decisive break below the lower boundary of the Decay Channel or a fresh wave of macro shocks could reassert downside pressure in the near term.

In short, Bitcoin’s path remains contingent on how quickly institutional demand solidifies, how macro forces unfold, and whether the balance of active and dormant supply can sustain a credible bottom. The coming weeks will reveal which of the competing narratives dominates—and whether BTC can indeed align with the longer-term targets suggested by the Decay Channel and the diverse set of forecasts that accompany it.

Looking ahead, readers should watch for changes in on-chain behavior—especially shifts in HODL Waves and wallet activity—as well as any regulatory developments that could unlock or constrain financially meaningful products. The interaction of these factors will be decisive in determining whether Bitcoin stays within its current corridor or breaks toward the higher targets favored by some models and institutions alike.