Bitcoin&#8217;s rise could trigger selective altcoin growth, reshaping market dynamics and emphasizing fundamentals over speculative hype. The post Bitcoin must break $110K before alt season begins, says Arthur Hayes appeared first on Crypto Briefing.

Bitcoin must break $110K before alt season begins, says Arthur Hayes

Bitcoin (BTC) starts a new week with a long-awaited breakout from a narrow 
trading range around $103,000. 
 * BTC price action grabs liquidity before reversing to its starting position, liquidating many an emotional trader on the way. A fakeout or a taste of things to come?
 * The May 18 daily and weekly close nonetheless became Bitcoin&#8217;s highest ever.
 * US trade deals remain high on the list of macro volatility triggers for risk asset traders this week.
 * Crypto&#8217;s correlation with stocks paints a mixed picture, adding to uncertainty over how macro developments will influence Bitcoin and altcoins going forward.
 * Bitcoin exchange volume delta becomes a key ingredient in assessing the staying power of BTC price breakouts, per analysis from CryptoQuant.
## A liquidity grab for the ages
Bitcoin price action delivered some &#8220;classic&#8221; moves around the May 18 weekly 
close.
A trip to new multimonth highs near $107,000 was followed by a 4% correction 
in a matter of hours, data from Cointelegraph Markets Pro and TradingView 
shows.
_BTC/USD 1-hour chart. Source: Cointelegraph/TradingView_
The spike took out a block of liquidity nestled close to all-time highs, with 
BTC/USD performing a liquidity &#8220;grab&#8221; designed to first squeeze out shorts and 
then trap late longs.
&#8220;Classic liquidity trap above the recent high and reversal downwards,&#8221; crypto 
trader, analyst and entrepreneur Michael van de Poppe responded on X.
&gt; &#8220;I think we&#8217;ll do the same at $100K before we&#8217;ll start breaking out above 
&gt; the ATHs. Those are the zones to accumulate your Bitcoin.&#8221;
_BTC/USDT 4-hour chart with RSI data. Source: Micha el van de Poppe/X_
Data from monitoring resource CoinGlass showed ask liquidity being replenished 
at $107,500, keeping the price from heading higher. The market then took out 
bid liquidity to $102,000.
Total crypto liquidations in the 24 hours to the time of writing were $673 
million.
_BTC liquidation heatmap. Source: CoinGlass_
Discussing the outlook for Bitcoin, trader CrypNuevo was among those arguing 
for caution instead of entering at any level in the current range above 
$100,000.
&#8220;From a risk management perspective, I don&#8217;t see it worth it to go long right 
now at market price,&#8221; he wrote in an X thread prior to the weekly close 
volatility.
&gt; &#8220;Yes, price could go up as the HTF trend suggests but as a trader I look for 
&gt; low risk entries. We&#8217;re currently at resistance. Clearing it would make a 
&gt; much more attractive entry.&#8221;
_BTC/USDT 1-week chart with 50EMA. Source: CrypNuevo/X_
CrypNuevo acknowledged that bullish signals on high timeframes remain and 
highlighted the retest of the 50-week exponential moving average (EMA) in 
April, which has historically led to new all-time highs.
This weekend, another prediction called for $116,000 to arrive in the coming 
days.
## 
Bitcoin scores highest weekly close in history
It may not have lasted long, but Bitcoin&#8217;s latest weekly close has become the 
highest ever recorded.
Coming in at around $106,500, the weekly candle also allowed for a new all- 
time high daily close.
_BTC/USD 1-week chart. Source: Cointelegraph/TradingView_
Despite the subsequent correction of nearly 4%, traders are keen to celebrate 
what they see as an underlying desire for the market to push higher.
&gt; Highest weekly close ever for Bitcoin. 
&gt; 
&gt; The trend is your friend! pic.twitter.com/p4td9Ab4R8 
&gt; 
&gt; &#8212; CryptoGoos (@crypto_goos) May 19, 2025
&#8220;Highest weekly close ever followed by a red start to the week? Yeah &#8211; get the 
low in early, this week likely ends in the green big time,&#8221; trader Jelle 
argued in an X analysis.
Fellow trader Chad noted that BTC/USD has also managed to close above a key 
Fibonacci extension level for two consecutive weeks &#8212; a first of its kind.
_BTC/USD 1-week chart with Fibonacci levels. Source: Chad/X_
Private wealth manager Swissblock Technologies saw one key ingredient to 
bullish continuation.
&#8220;Bitcoin flirted with $107K, grabbed liquidity above $104K-$106K but failed to 
hold,&#8221; it summarized in its latest X reaction.
&gt; &#8220;Back in the range, support holding, for now. Bulls have one job: defend 
&gt; this range.&#8221;
_BTC price data. Source: Swissblock Technologies/X_
CoinGlass showed that May is a highly varied month for BTC price action. 
Currently, its 10% gains sit in the middle of a wide range of historical 
outcomes, with under two weeks left until the monthly close.
_BTC/USD monthly returns (screenshot). Source: CoinGlass_
## US trade war rumbles on as Bitcoin ignores rate-cut odds
A lack of crucial macroeconomic data reports this week places the focus on the 
Federal Reserve and US trade deals.
In particular, markets will be looking for positive developments regarding 
trade ties between the US and its partners. Treasury Secretary Scott Bessent 
promised to enact new tariffs on those who do not negotiate in &#8220;good faith.&#8221;
News of a deal with China caused a snap reaction for stocks earlier this 
month, with traders feeling a sense of relief.
This may not be so evident as the week begins, thanks to the recent US credit 
downgrade by Moody&#8217;s, wiping 1% off stocks&#8217; futures prior to the first Wall 
Street open.
With the dollar again under pressure, trading resource The Kobeissi Letter 
suggested that Bitcoin and altcoins may still benefit in the current climate.
&#8220;Crypto is loving the Moody&#8217;s downgrade: Bitcoin is now 4% away from a new all 
time high and up over +40% since its April low,&#8221; it noted around the weekly 
close.
&gt; &#8220;As the US Dollar weakens and uncertainty rises, Bitcoin and Gold are 
&gt; thriving. Instability is Bitcoin&#8217;s best friend.&#8221;
_US dollar Index (DXY) 1-day chart. Source: Cointelegraph/TradingView_
Crypto is also increasingly resilient to hawkish cues from the Fed, which has 
given markets reason to believe that interest rate cuts will not come before 
September.
Data from CME Group&#8217;s FedWatch Tool shows the odds of a cut at the Fed&#8217;s 
upcoming June meeting at just 12%. Jobless claims on May 22 could shift those 
expectations if the result differs significantly from predictions.
_Fed target rate probabilities (screenshot). Source: CME Group_
Fed Chair Jerome Powell will deliver the annual Georgetown University Law 
Center Commencement Address on May 25, but it is unlikely to provide much 
policy insight.
## 
Crypto stocks correlation in flux
Diverging reactions to the Moody&#8217;s downgrade set the stage for a debate around 
crypto&#8217;s correlation with US stocks.
In its latest analysis, research firm Santiment could not draw a clear 
conclusion over the two asset classes&#8217; relationship, calling them &#8220;somewhat 
correlated.&#8221;
&#8220;With the 90-day tariff pause between the US &amp; China Monday, markets remain 
within striking distance of all-time highs,&#8221; it summarized on May 17, 
referring to the S&amp;P 500, Bitcoin and gold.
_Bitcoin vs. S &amp;P 500 vs. gold. Source: Santiment/X_
Separate findings from blockchain data provider RedStone Oracles drew a 
distinction between long- and short-term correlation.
While negative on a rolling seven-day basis, it told Cointelegraph, a 30-day 
perspective delivers a &#8220;valuable correlation&#8221; between Bitcoin and the S&amp;P 500.
_Bitcoin, S &amp;P 500, 30-day rolling correlation, 1-year chart. Source: Redstone 
Oracles_
Meanwhile, market participants have aired frustration at crypto&#8217;s 
susceptibility to the same volatility triggers impacting stocks.
&#8220;It was a lot more enjoyable when $BTC traded independently of stocks,&#8221; 
commentator IncomeSharks told X followers on May 19.
&gt; &#8220;It seems now it&#8217;s just a way for people to trade stock futures during the 
&gt; weekend and mirror what the $SPY is doing during the week.&#8221;
## Volume delta warns over &#8220;local market top&#8221;
Considering what it might take to launch Bitcoin back into price discovery, a 
new analysis looked at exchange order-book behavior.
_**Related:**__**Bitcoin hitting $220K &#8216;reasonable&#8217; in 2025, says gold-based 
forecast**_
Binance, in particular, was under the microscope as the exchange with the 
largest spot volumes. Volume delta, onchain analytics platform CryptoQuant 
said, is a key ingredient in sustained price moves.
&#8220;After the recent market correction, the spot net volume delta on Binance has 
turned positive again,&#8221; contributor Darkfost wrote in a &#8220;Quicktake&#8221; blog post 
on May 18.
&gt; &#8220;This signals that buying activity is picking up on spot markets, but more 
&gt; importantly, that selling pressure has significantly declined, even with BTC 
&gt; trading above $100 000. However, historically, when spot volumes on Binance 
&gt; rise too quickly and too sharply, it has often coincided with local market 
&gt; tops.&#8221;
_Bitcoin spot net volume delta. Source: CryptoQuant_
Volume delta measures the difference in buy and sell pressure across candles, 
helping assess the underlying strength of bid and ask sides.
CryptoQuant suggests that investors throwing caution to the wind around 
breakouts contributes to unsustainable price spikes, and monitoring volume 
delta helps avoid disadvantageous market entries.
&#8220;Rather than being a warning sign, rising spot volumes at this point would be 
encouraging for market strength,&#8221; Darkfost continued.
&gt; &#8220;Tracking spot volumes can provide valuable insights into investor behavior, 
&gt; especially on Binance, which handles the largest share of global trading.&#8221;
This article does not contain investment advice or recommendations. Every 
investment and trading move involves risk, and readers should conduct their 
own research when making a decision.

$107K fakeout or new all-time highs? 5 things to know in Bitcoin this week

## What is a crypto drainer?
_A crypto drainer is a malicious script designed to steal cryptocurrency from 
your wallet. Unlike regularphishing attacks that try to capture login 
credentials, a crypto drainer tricks you into connecting your wallets, such as 
MetaMask or Phantom, and unknowingly authorizing transactions that grant them 
access to your funds._
Disguised as a legitimate Web3 project, a crypto drainer is usually promoted 
via compromised social media accounts or Discord groups. Once you fall prey to 
the fraud, the drainer can instantly transfer assets from the wallet.
Crypto drainers may take various forms:
 * Malicious smart contracts that initiate unauthorized transfers. 
 * Fake NFTs or token systems that create deceptive exchanges or assets.
Crypto drainers are a growing threat in Web3, enabling quick, automated theft 
of crypto assets from unsuspecting users through deception. Common methods of 
crypto drainers include:
 * Phishing websites. 
 * Fake airdrops. 
 * Deceptive ads. 
 * Malicious smart contracts. 
 * Harmful browser extensions. 
 * Fake NFT marketplaces.
## Crypto drainers-as-a-service (DaaS), explained
_DaaS elevates the threat of crypto drainers by commercializing them. Just 
like software-as-a-service (SaaS) platforms, DaaS platforms sell ready-to- 
use malware kits to cybercriminals, often in exchange for a percentage of the 
stolen funds._
In the DaaS model, developers offer turnkey draining scripts, customizable 
phishing kits and even integration help in exchange for a share of the stolen 
funds. A DaaS offer might be bundled with social engineering support, 
anonymization services and regular updates, making them attractive even to 
low-skill scammers.
Types of crypto DaaS tools include:
 * **JavaScript-based drainers:** Malicious JavaScript is embedded into phishing websites that mimic legitimate decentralized apps (DApps). These scripts execute when you connect your wallet, silently triggering approval transactions that drain assets. 
 * **Token approval malware:** Tricks users into granting unlimited token access via malicious smart contracts. 
 * **Clipboard hijackers:** Hackers use clipboard hijackers to monitor and replace copied wallet addresses with those controlled by attackers. 
 * **Info-stealers:** They harvest browser data, wallet extensions and private keys. Some DaaS packages combine these with loader malware that drops additional payloads or updates the malicious code. 
 * **Modular drainer kits:** Segregated into modules, these drainers use obfuscation techniques to bypass browser-based security tools. 
_**Did you know?** According to Scam Sniffer, phishing campaigns using wallet 
drainers siphoned off over $295 million in NFTs and tokens from unsuspecting 
users in 2023._
## What crypto DaaS kits include
_Crypto DaaS kits are pre-built toolsets sold toscammers, enabling them to 
steal digital assets with minimal technical skill. These kits typically 
include phishing page templates, malicious smart contracts, wallet-draining 
scripts and more._
This is what crypto DaaS kits generally include:
 * **Pre-built drainer software:** Plug-and-play malware requiring minimal setup. 
 * **Phishing kits:** DaaS providers supply customizable phishing website templates that hackers can modify according to their plans. 
 * **Social engineering:** With DaaS, hackers find support for social engineering along with psychological tactics to trick users into connecting their wallets. 
 * **Operational security (OPSEC) tools:** To avoid detection, some DaaS vendors offer advanced operational security tools that mask user identity and hide digital footprints. 
 * **Integration assistance and/obfuscation:** These services help attackers deploy drainer scripts seamlessly and use obfuscation tools to evade tracking. 
 * **Regular updates:** Frequent improvements are designed to bypass wallet defenses and detection systems. 
 * **User-friendly dashboards:** Control panels that help attackers oversee operations and monitor drained funds. 
 * **Documentation and tutorials:** Step-by-step instructions enabling even beginners to execute scams efficiently. 
 * **Customer support:** Some DaaS operators provide real-time help through secure messaging apps like Telegram.
With DaaS kits available for as little as $100 to $500, or through 
subscription models, sophisticated crypto attacks are no longer limited to 
experienced hackers. Even the inexperienced can now access these scripts with 
a small budget, effectively democratizing this type of crime.
_**Did you know?** Advanced DaaS tools often update scripts to evade detection 
from browser extensions like WalletGuard and security alerts issued by 
MetaMask or Trust Wallet._
## Evolution of crypto drainers as prominent fraudulent activity
_The threat landscape of cryptocurrency fraud is constantly evolving. Emerging 
around 2021, crypto drainers have rapidly transformed the landscape. Their 
ability to stealthily siphon funds from users&#8217; wallets has made them a threat 
that demands vigilance._
Drainers specifically designed to target MetaMask began to emerge around 2021 
and were openly advertised on illicit online forums and marketplaces.
Here are some prominent drainers that have been around for some time:
 * **Chick Drainer:** It emerged in late 2023, targeting Solana (SOL) users through phishing campaigns. It operates using the CLINKSINK script, embedded in fake airdrop websites. 
 * **Rainbow Drainer:** The platform shares code similarities with Chick Drainer, suggesting potential reuse or collaboration among threat actors. 
 * **Angel Drainer:** Launched around August 2023, Angel Drainer is widely promoted on Telegram by threat groups like GhostSec. Affiliate scammers need to make an upfront payment between $5,000 and $10,000 and also pay a 20% commission on all stolen assets facilitated through its platform. 
 * **Rugging &#8216;s Drainer: **Compatible with several crypto platforms, this DaaS drainer offers comparatively low commission fees, typically ranging from 5% to 10% of the stolen proceeds. 
In the wake of the US Securities and Exchange Commission&#8217;s X account being 
compromised in January 2024, Chainalysis found a crypto drainer acting as the 
SEC. This led users to connect their wallets in an attempt to claim 
nonexistent airdropped tokens.
According to a Kaspersky Security Bulletin, dark web threads discussing crypto 
drainers rose sharply in 2024, jumping by 135% to 129 threads from 55 in 2022. 
These conversations encompass a wide range of topics, including buying and 
selling malicious software and forming distribution teams.
As the following chart demonstrates, crypto drainers have been stealing crypto 
at a faster quarterly growth rate than even ransomware.
## Red flags to identify a crypto DaaS attack
_Spotting a crypto wallet drainer attack early is crucial to minimizing 
potential losses and securing your assets. You must be careful, as a 
sophisticated drainer attack can sometimes evade standard alert mechanisms. 
You must remain vigilant even while relying on automated tools. _
Here are a few indicators that your wallet may be under threat:
 * **Unusual transactions:** A red flag of a drainer attack is finding transactions you didn&#8217;t authorize. These may include unexpected token transfers or withdrawals to unknown wallet addresses. Sometimes, attackers execute multiple small transfers to avoid detection, so you must monitor for repeated unusual transactions of low-value crypto. 
 * **Lost access to wallet:** If you cannot access your wallet or your funds are missing, it could mean an attacker has taken control. This often happens when the drainer changes private keys or recovery phrases, effectively locking you out. 
 * **Security alerts from wallet providers:** Your crypto wallet may issue security alerts for suspicious actions, like logins from new devices, failed access attempts or unauthorized transactions. These warnings indicate that someone may be trying to access your wallet or has already accessed it. 
 * **Fake project websites or DApps:** If you find a cloned or newly launched platform mimicking a real Web3 service and prompting wallet connections, it is a warning sign of a crypto drainer. It might also have urgent calls to action, urging users to immediately claim rewards, airdrops, or mint NFTs. The objective is to pressure victims into connecting wallets without verifying authenticity. 
 * **Unverified social media promotions:** Suspicious links shared via X, Discord, Telegram or Reddit, often unverified profiles, indicate a fraudulent attempt to drain money from a wallet. Fraudsters may also use compromised accounts to share malicious links. 
 * **Unaudited smart contracts:** Interacting with unfamiliar contracts without public audits or GitHub transparency can expose wallets to hidden drainer scripts. 
 * **Wallet prompts requesting broad permissions:** Sign-in or approval requests that ask for full token spending access or access to all assets, rather than specific transactions, are serious warning signs.
_**Did you know?** Just one popular drainer kit can be used by hundreds of 
affiliates. That means a single DaaS platform can be behind thousands of 
wallet thefts in a matter of days._
## How to protect your crypto wallet from DaaS attackers
_To protect your crypto wallet from DaaS attackers, adopting strong, proactive 
security practices is essential. Blockchain monitoring tools can help identify 
suspicious patterns linked to drainer activity, allowing you to respond 
quickly. _
Here are key strategies to help protect your digital assets:
 * **Use hardware wallets:** Hardware wallets, or cold wallets, store private keys offline, shielding them from online threats like malware and phishing. Keeping your keys in a physical device significantly lowers the risk of remote attacks and is ideal for securing long-term crypto holdings. 
 * **Enable 2FA (two-factor authentication):** Adding 2FA to your wallet means even if someone steals your password, they will need a second verification step. They need to put in a verification code sent to your phone to access the account, along with your password, making unauthorized access much harder. 
 * **Avoid phishing links:** Always verify URLs and avoid clicking on unsolicited messages claiming rewards or updates. Never input private keys or seed phrases on suspicious sites. When in doubt, manually enter the correct website address. 
 * **Secure your private keys and seed phrases:** Store your private keys and seed phrases offline in a safe, physical location. Never save these credentials on internet-connected devices, or hackers might get access to them, putting your wallet at risk. 
 * **Verify apps and browser extensions:** Take care to install software only from official sources. Research apps beforehand to avoid malicious or fake tools. 
 * **Monitor wallet activity regularly:** Check your wallet for unauthorized transactions or unusual patterns. Early detection can help stop further losses and improve recovery chances.
## What to do if you suffer from a crypto-drainer attack
_Swift action is essential if you suspect your crypto wallet has been 
compromised. Though fund recovery is rare, quick action can limit further 
losses._
Here are the steps you need to take if you suffer from a crypto DaaS attack:
 * **Secure your accounts:** Immediately change the password for your wallet and enable 2FA, if you still have access to it. Transfer any remaining funds to a secure, uncompromised wallet. 
 * **Notify your wallet provider or exchange:** Report the incident to your wallet provider or exchange. You could request them to monitor your account or freeze suspicious activity. Platforms may flag suspicious addresses or prevent further transfers. 
 * **File a report with authorities:** Contact local law enforcement or cybercrime units, as cryptocurrency theft is treated as a financial crime in most regions. 
 * **Seek professional assistance:** Cybersecurity firms specializing in blockchain forensics can analyze transactions and potentially trace the stolen funds. While full recovery is unlikely, especially if assets pass through mixers or bridges, expert help may aid investigations.

Crypto drainers as a service: What you need to know

Cryptocurrency exchange Bybit said it had involved team members, including an 
executive, to fix a glitch that affected a single user who could not go 
through an Apple-based know-your-client (KYC) system.
In a May 18 X post, the Bybit China Team said it received reports about users 
experiencing withdrawal restrictions on the Bybit platform due to a KYC 
verification anomaly when logging in with an Apple ID. The team claimed to 
have immediately responded and taken action involving multiple departments, 
including the firm&#8217;s chief operating officer, Helen Liu.
Other people involved in the operation were the heads of customer service, 
risk control, the Chinese-language division, product managers and the 
technical team. The exchange coordinated its actions with the user.
After an internal investigation, Bybit concluded this was a &#8220;unique case 
affecting an individual user, not a systemic issue.&#8221; The account&#8217;s KYC 
information was not tampered with and the funds in the account remained secure 
at all times.
Bybit had not answered Cointelegraph&#8217;s request for comment at the time of 
writing.
_**Related:**__**A decade-old debate is back as self-custody gets smarter**_
## The perks of media attention
Bybit claims to have taken large-scale and timely action, which involved a 
member of its executive team, all in response to an issue reported by a single 
user. Chinese-speaking X crypto influencer EnHeng claimed to be the reason for 
this.
In a separate post that Bybit&#8217;s X post answers to &#8212; EnHeng explained that in 
a group chat, he noticed &#8220;a girl mentioned a bug related to Bybit&#8217;s Apple ID.&#8221; 
He verified the issue and after confirming that it was real, flagged it to 
Bybit.
EnHeng said that the staff responded quickly and assisted the user in 
recovering access to about $100,000 worth of funds. They highlighted:
&gt; &#8220;This incident really made me feel the value of having influence.&#8221;
EnHeng said &#8220;in this market, retail investors often lack a voice and are 
vulnerable.&#8221; For this reason, he said, &#8220;When we have more resources and a 
bigger voice, we should use them to speak up for retail investors.&#8221;
_**Related:**__**Self-custody vs. centralized crypto cards: Freedom or 
convenience?**_
## Locked out of exchange
Being locked out of a cryptocurrency exchange account or some of its features 
is not excessively uncommon. Often, it is an emergency measure meant to 
prevent fund losses.
A recent example is Phemex crypto exchange halting withdrawals after being 
alerted to nearly $30 million worth of suspicious outflows that raised alarms 
among blockchain security firms in late January. Indian cryptocurrency 
exchange Mudrex temporarily halted crypto withdrawals during the same month, 
claiming compliance improvements were the reason.
Sometimes action is taken on the request of law enforcement. Last summer, a 
small set of Palestinian user accounts was frozen after Israeli authorities 
issued a seizure request. Also last summer, OKX warned it would terminate any 
account linked to crypto mixer Tornado Cash or sanctioned addresses, and 
several users said their log-ins were suddenly disabled.
Those incidents echo an old adage popular in the Bitcoin (BTC) community: Not 
your keys, not your coins. This statement is meant to remind Bitcoin &#8212; and 
now crypto &#8212; users that real control over assets comes only with control over 
the private keys that allow for signing transactions.
_**Magazine:**__**Danger signs for Bitcoin as retail abandons it to 
institutions: Sky Wee**_

Apple KYC glitch on Bybit draws swift executive response to recover $100K

Cryptocurrency exchange Coinbase is facing a class-action lawsuit in the U.S. 
state of Illinois, which claims that the company may have violated the state’s 
Biometric Information Privacy Act. A group of Coinbase customers has accused 
the platform of improperly collecting…

Coinbase sued in Illinois over biometric data practices tied to KYC checks

New revelations suggest that the arrest of Vladimir Smerkis, former Binance 
Russia chief and co-founder of crypto app Blum, may be linked to his 
involvement in earlier collapsed crypto ventures that left investors empty- 
handed. The Zamoskvoretsky District Court ordered Smerkis&#8217;s…