Crypto Markets Navigate Regulatory Shifts Amid Institutional Rotation (2026-05-26)

South Africa advances crypto asset regulation, focusing on cross-border transactions rather than ownership restrictions

May 26th news, according to IOL reports, South Africa is moving towards clearer regulation of crypto assets, with a focus on cross-border transactions rather than ownership restrictions. The South African Treasury and the South African Reserve Bank issued a statement saying that the proposed rules are not intended to criminalize the holding of crypto assets or apply retroactively.

At the same time, the authorities have extended the public comment deadline to June 30, 2026, and plan to issue a draft handbook on the cross-border crypto asset framework, defining what constitutes a cross-border crypto transaction and stipulating the obligations of authorized crypto asset service providers. In recent years, South Africa has required crypto asset service providers to register with the Financial Sector Conduct Authority.

A Chainalysis report shows that South Africa remains one of the largest crypto markets in Africa.

[PANews]

OKX’s X Layer lets users build their own crypto markets

OKX’s Ethereum-compatible Layer 2 network X Layer has introduced Exchange OS, a protocol upgrade that lets developers, institutions, and ecosystem teams deploy their own trading venues. The system supports spot markets, perpetual markets, and outcome markets using infrastructure tied to OKX’s exchange stack.

The X Layer team said, “Exchange OS is designed to address one of the biggest structural limitations in onchain finance today: fragmented infrastructure.” The upgrade aims to place exchange functions such as matching, margining, liquidation, settlement, and risk controls closer to the protocol layer.

Exchange OS is designed to let venue operators choose their own assets, oracle systems, revenue models, market structures, and compliance settings. A regulated institution could build a KYC-enabled venue, while a Web3-native team could run a permissionless market on the same shared infrastructure (https://t.co/3PiIWU41j4).

X Layer said deployers will need to stake OKB in the X Layer Staking Contract before creating a venue. A previous report noted that OKB had become the only gas and native token for X Layer after OKX moved deeper into its X Layer migration plan.

The first venue built on Exchange OS will launch in June with 2026 World Cup Outcomes, a simulated outcome market deployed on the new infrastructure. The X Layer team said it wanted to build on the system before opening it more widely to other market creators. OKX’s Outcomes FAQ describes outcome trading as an event contract product where users buy Yes or No shares tied to real-world events. It also says current coverage focuses on World Cup-related events, while noting that FIFA-related references do not mean endorsement by FIFA.

The Exchange OS rollout follows several X Layer updates. In January, Uniswap launched on X Layer, giving users access to swaps, liquidity provision, and native markets such as xBTC, USDT, and USDG through its app, wallet, and API. In March, Aave launched on X Layer, allowing OKX Wallet users to lend, borrow, and earn yield directly on the network. That report said X Layer had about $25 million in total value locked at the time, showing that OKX was still working to grow on-chain activity.

OKX has also added payment infrastructure linked to X Layer. A recent report said OKX’s Payment SDK lets developers integrate one-time, batch, and pay-as-you-go transactions using X Layer with low or zero gas costs.

[crypto.news]

Stable launches StableEarn, expanding its business into treasury management.

PANews, May 26: Stable, a blockchain focused on USDT stablecoin payments, has launched StableEarn, expanding its business into treasury management and launching its first liquidity pool on Morpho. This product targets neobanks, fintech companies, payment processors, and individual users.

The pool is managed by Gauntlet, a crypto risk management firm, which allocates deposited assets across Morpho’s lending markets and manages credit limits and reallocations.

The first treasury is powered by products from Theo, an institutional real-world asset yield platform. Its strategies include thBILL—a tokenized U.S. Treasury exposure; thGOLD—a yield-generating gold token backed by loans to jewelers; and thUSD—a yield-generating stablecoin based on gold derivatives.

[Tech in Asia]

Canadian regulators have approved Robinhood’s acquisition of crypto services firm WonderFi

Canada’s investment regulatory organization has approved Robinhood’s acquisition of the crypto services company WonderFi. WonderFi’s products cover crypto trading, staking, and custody.

The deal was originally scheduled to close in the second half of last year, but both parties later extended the closing date to June 1, 2024, to give Robinhood more time to deploy its proprietary technology in Canada and obtain regulatory approval.

[Foresight News]

Latvian police dismantle SIM card fraud operation, seizing $290,000 worth of cryptocurrency

Europol and Latvia’s counter-terrorism unit recently raided an office in Latvia, dismantling a SIM card fraud operation. Authorities seized 1,200 SIM box devices and 40,000 active SIM cards capable of connecting simultaneously to 80 countries.

The group operated two websites—Gogetsms and Apisim—providing criminals with on-demand rental of overseas phone numbers for phishing, banking fraud, investment scams, extortion, and human trafficking.

This network has been linked to at least 3,200 fraud cases in Austria and Latvia, resulting in losses totaling $5.8 million. Police also confiscated four luxury vehicles, froze $470,000 in bank account funds, and seized $290,000 worth of cryptocurrency. Despite comprising only seven members, the group generated 49 million fake accounts through its services.

[Foresight News]

Two whales opened long positions on DOGE and LINK with a total position of $6.33M, and have placed orders to continue buying.

On May 26, according to Lookonchain monitoring, whales are going long on LINK and DOGE.

Address 0x3109 has opened long positions of 27.3800 million DOGE ($2.75 million) and 162,670 LINK ($1.53 million), and has placed orders to continue buying 33.4600 million DOGE ($3.31 million) and 515,120 LINK ($4.73 million).

Address 0x5687 has opened long positions of 10.2100 million DOGE ($1.03 million) and 108,430 LINK ($1.02 million), and has placed orders to continue buying 14.6600 million DOGE ($1.45 million) and 336,280 LINK ($3.09 million).

[PANews]

Scammers made at least $400,000.00 by placing fake Uniswap ads on Google

May 26th, scammers are using Google search to place malicious phishing ads impersonating Uniswap, resulting in at least $400,000.00 in losses. On-chain analyst b-block pointed out on X that fake Uniswap websites are stealing funds from multiple wallets.

Stacy Muur, founder of Web3 marketing agency Green Dots, said that Google has ignored the issue for years, with paid fake ads consistently ranking above genuine search results.

The security alliance SEAL reported a significant increase in phishing activity on Google search in March, with attackers bidding on or hacking into legitimate ad accounts to place ads impersonating crypto protocols. SEAL has intercepted over 356 malicious ad links, and the activity has been ongoing for over a year without slowing down.

[PANews]

Kraken redeemed $107 million worth of ETH from EigenCloud; the TVL of the re-staking sector has shrunk by over 64% from its peak.

According to crypto analyst Yu Jin @EmberCN, 11 hours ago Kraken redeemed 50,600 ETH from the restaking project EigenCloud (formerly EigenLayer), worth approximately $107 million.

Yu Jin noted that the total TVL of the restaking sector has declined from approximately $31 billion in August 2025 to roughly $11 billion currently; among this, EigenCloud—the sector’s leader—has seen its TVL fall from about $22 billion to $5.5 billion.

[Odaily]

Squid Distances Itself From $3.2 Million Hack of Lookalike Third-Party Contract

Cross-chain router Squid distanced itself from a third-party Gnosis Safe module, SquidRouterModule, after attackers drained about $3.2 million across Ethereum and Base. Blockchain security firms flagged the exploit that affected 86 Gnosis Safe accounts in roughly 2 hours.

Blockaid highlighted that the attacker swapped stolen tokens into Dai (DAI) through attacker-controlled Uniswap V3 pools. Separately, security firm PeckShield said the attacker was originally funded with 2.1 ETH from Tornado Cash. Moreover, the firm added that the exploiter’s wallet 0xA447…54859 contained the stolen assets.

Squid moved fast on X to separate its protocol from the exploited contract. The team said the “contract shares our name but is not our code.” It also stressed that none of its users were affected. On Basescan, the compromised contract carries the name “SquidRouterModule,” which sparked early confusion.

Squid said the team had no role in writing the contract or pushing it on-chain. It described the module as a third-party smart-wallet product that integrated with multiple protocols, including Squid. Squid’s actual router sits at 0xce16F69375520ab01377ce7B88f5BA8C48F8D666 and runs on a different design. That contract was not affected by the attack, and existing user balances, approvals, and platform integrations all remain safe.

The episode is one of several crypto exploits to hit protocols this month. DefiLlama tracked more than 20 exploits in May 2026.

Facet co-founder proposes including EIP-8182 in the Ethereum Hegota upgrade to introduce native private transfers

Facet co-founder proposes incorporating EIP-8182 into Ethereum’s Hegota upgrade to introduce native private transfer functionality for ETH and ERC-20 tokens.

The proposal adopts a UTXO architecture with zero-knowledge proofs and enhances anonymity protection via a unified privacy pool.

[Odaily]

Analysis: Bitcoin has entered a high-risk zone, and ETF fund outflows indicate institutional investors are exiting.

PANews reported on May 26 that crypto analytics platform Swissblock stated that Bitcoin is sliding into a high-risk environment due to continued institutional selling. Its Bitcoin Risk Index is currently at 33 points, placing it in the high-risk zone.

Swissblock pointed out that each time the risk index sends a signal that selling pressure structurally overwhelms the market, it is backed by institutional selling. Glassnode reported that since May 7, US Bitcoin ETFs have recorded net outflows almost every trading day, and the institutional selling signal for more than two consecutive weeks has continued to increase pressure on the supply side, without any demand offsetting it.

CoinEx Chief Analyst Jeff Ko said that spot ETFs have seen outflows of over $2.00B in the past two weeks, and institutional risk appetite is still in a marginally sensitive state.

[Cointelegraph]

OKX Releases Exchange OS: An Open Trading Infrastructure Based on X Layer

OKX officially released the Exchange OS whitepaper today. This is a set of open protocols built on X Layer that sinks capabilities such as matching, margin, clearing, settlement, and unified accounts to the protocol layer.

Anyone can independently deploy spot, perpetual contract, and prediction markets on Exchange OS without platform approval. User funds are托管 by the protocol contract, and no single entity can unilaterally call them; OKX’s self-operated market and external markets follow the same set of protocol rules.

In addition, Exchange OS also supports cross-market unified accounts, allowing users to participate in multiple types of markets with the same funds.

[Odaily]