XRP-Linked Ripple Never Had Gag Order, Clarifies SEC Veteran; Binance Drops Major Uniswap and Bitcoin Pairs; Crypto Faces Shai-Hulud Malware Again - Morning Crypto Report
SEC veteran Marc Fagel clarifies that Ripple was never under a gag order, as the company opted for litigation over a settlement. Binance will delist eight low-liquidity trading pairs, and a new malware targeting Web3 developers has emerged.
Key points
Ripple was never under a gag order according to Marc Fagel
Binance will delist eight low-liquidity trading pairs
New Mini Shai-Hulud malware targets Web3 developers
Ripple Myth Debunked: SEC veteran Marc Fagel clarifies the recent "gag rule" repeal does not affect Ripple, as the company chose full litigation over a settlement and was never ordered to stay silent.
Binance Spot Pairs Delisting: Binance will remove eight low-liquidity trading pairs on May 22, 2026, including cross-pairs for BTC, ETH, and UNI, to optimize order book quality without affecting user balances.
Shai-Hulud Malware Waves: A new "Mini Shai-Hulud" worm is targeting Web3 developers by hijacking AI tools like Claude Code and VS Code to steal cloud credentials and API keys via compromised npm packages.
Crypto Market Outlook: Bitcoin stabilizes in the $76,800–$79,800 range as Kevin Warsh takes over as Federal Reserve Chairman this Friday amid rising inflation and upcoming FOMC minutes.
SEC veteran debunks regulatory myth around XRP
The repeal of the SEC's historic "gag rule" does not affect Ripple's freedom of speech in any way, because the company never lost it in the first place - that is the conclusion made by SEC veteran Marc Fagel.
The regulator's decision to abolish the 1972 rule that prohibited defendants from criticizing allegations after reaching settlements triggered excitement across the crypto community. However, the expert urges the market to separate the global reform from the actual status of the XRP case.
The key legal nuance behind this news is that for Ripple, the repeal became a loud but purely theoretical event. While other market participants are celebrating a victory over censorship, the Ripple case was built on an entirely different scenario from the beginning.
Note: The SEC and Ripple never settled, and Ripple never had any gag order prohibiting it from talking about the case. It’s been free to do so all along (and has done so). Nothing has changed for Ripple.
Q&A
Did Ripple ever have a gag order from the SEC?
No, Ripple was never under a gag order, as clarified by SEC veteran Marc Fagel.
What trading pairs is Binance delisting on May 22, 2026?
Binance is removing eight low-liquidity trading pairs, including BTC, ETH, and UNI cross-pairs.
What is the Mini Shai-Hulud malware targeting?
The Mini Shai-Hulud malware targets Web3 developers by hijacking AI tools to steal cloud credentials and API keys.
What is the current price range for Bitcoin?
Bitcoin is stabilizing in the $76,800 to $79,800 range amidst rising inflation.
Ethereum's Buterin: 'My Power Will Continue to Decrease'
Vitalik Buterin states his influence over Ethereum Foundation is shrinking intentionally.
U.Today··1 min read
News
Crypto and the Fed: State of Crypto
The Federal Reserve updated its proposal for a 'skinny' master account, enhancing crypto firms' access to payment systems. Concurrently, President Trump signed an executive order to integrate digital assets into existing payment networks.
Many mistakenly assumed the reform would finally untie Ripple executives' hands, but Fagel reminded the public that the company was never bound by any obligation to remain silent. The "gag rule" only applied to pretrial settlements under the "neither admit nor deny" formula. Ripple, however, chose full-scale litigation.
Brad Garlinghouse and Stuart Alderoty openly, aggressively, and publicly criticized the SEC for years, which would have been impossible if such a restriction had actually existed in their case.
What actually changed for the crypto industry
SEC Chairman Paul Atkins officially repealed Rule 202.5(e), acknowledging that it restricted freedom of speech. Companies and entrepreneurs that previously entered settlement agreements can now publicly challenge the SEC's position without risking the cancellation of those agreements.
The legal status of XRP and the final terms of the Ripple case, including penalties and the digital commodity status discussions, remain unchanged and are not affected by this reform.
Binance optimizes spot market: BTC and UNI pairs face removal
Crypto exchange Binance announced a scheduled delisting of eight spot trading pairs starting May 22, 2026, at 03:00 UTC. The official reason behind the decision is low liquidity and declining trading volume. Behind the announcement, however, is a technical cleanup of underused markets involving major assets such as Bitcoin (BTC), Uniswap (UNI), Ethereum (ETH), and Avalanche (AVAX).
Despite the mention of key industry tokens, the move concerns only the removal of specific trading pairs, not the delisting of the cryptocurrencies themselves. The following pairs are scheduled for removal:
BTC and ETH pairs: CHZ/BTC, IOTA/BTC, XLM/BTC, as well as AVAX/ETH and UNI/ETH.
Fiat and BNB pairs: UNI/FDUSD, XLM/FDUSD, and FET/BNB.
An interesting angle is that even for top-tier assets like Uniswap or Stellar, liquidity is now increasingly concentrated in primary pairs such as USDT, while cross-pairs against BTC or FDUSD are losing popularity among market participants. Binance is effectively removing "dead weight" to reduce system load and maintain order book quality.
The delisting of trading pairs does not affect user balances. Assets such as UNI, AVAX, or XLM remain fully available on Binance Spot through other, more liquid trading instruments.
"Shai-Hulud" in the code: NPM worm now hijacks AI assistants in Web3
The Web3 industry and JavaScript community are facing the fifth wave in the past eight months of the self-replicating Shai-Hulud worm spreading across development infrastructure. Analysts from SlowMist, who detected the threat through the MistEye monitoring system, report a critical compromise of widely used development infrastructure.
What makes this attack unique is how the virus has evolved as it now uses developers' AI assistants such as Claude Code and Codex as backdoors.
The current incident, codenamed "Mini Shai-Hulud", is unfolding right now. Attackers compromised the legitimate npm developer account atool (i@hust.cc). Using that account, they automatically published more than 600 malicious versions of various libraries.
Article image
List of artefacts infected by "Mini Shai-Hulud", Source:SlowMist
Unlike traditional token theft malware, the new Shai-Hulud variant has adapted to the realities of modern software development. Once inside a system, the worm silently modifies local development environment configuration files such as .claude/settings.json or .vscode/tasks.json. Every subsequent launch of an AI assistant like Claude Code or VS Code tasks automatically triggers a hidden Bun bootstrapper, which redeploys and executes the malicious code again, even if the developer attempts to clean the project.
At the same time, the worm extracts cloud credentials including AWS and Azure keys, API tokens, seed phrases from local environments, and CI/CD pipelines. The stolen data is encrypted and sent to attacker-controlled servers through the official GitHub API disguised as ordinary working commits, making the traffic effectively invisible to standard security systems.
SlowMist experts urge the industry to treat any system that used the affected packages as compromised. Recommended actions include:
Conduct an audit: Isolate projects using dependencies published by atool (i@hust.cc) and inspect preinstall scripts.
Reset credentials: Revoke and reissue all API tokens, SSH keys, and passwords accessible from the development environment.
Clean AI configurations: Inspect local AI agent settings for unauthorized hooks and malicious tasks.
Crypto market outlook: Bitcoin meets Kevin Warsh
Bitcoin is holding its ground amid Kevin Warsh's arrival at the Federal Reserve and shifting monetary expectations, while investors await key macroeconomic signals.
Key checkpoints:
Bitcoin price outlook: BTC is stabilizing in the $76,800–$79,800 range, finding local support despite broader pressure. Liquidity contraction signals a potential rise in Bitcoin dominance over altcoins in the next 12 months, according to Delphi Digital's LMOS index.
Macroeconomic triggers: The main focus this week is the FOMC minutes on May 20, which will reveal the Fed's stance after April CPI accelerated to 3.8%. Markets are adjusting to a 37.4% probability of a 25 bps rate hike by December, driven by rising oil prices and bond yields.
The Kevin Warsh factor: The new Federal Reserve chairman officially takes office this Friday. While Warsh has historically been open to financial innovation, accelerating inflation and the evolving economic environment are putting immediate pressure on his monetary discipline and the Fed's independence.
SEC institutional breakthrough: The U.S. SEC is preparing to publish an "innovation exemption" this week that would allow tokenized stock trading. The regulatory update would enable platforms to issue blockchain-based shares 24/7 without direct company consent, fueling the Real World Assets (RWA) sector.
