Bicrypto 6.5.7

20 July 2026

ECOSYSTEMTRADINGSTOP-ORDERSCONDITIONAL-ORDERSMATCHING-ENGINESCYLLAORDERSWALLETSHUMMINGBOTAPI-KEYSKYCFEATURESLICENSEEXTENSIONSROUTINGI18NMIDDLEWARESECURITYBUG-FIXES

Core v6.5.7

Release Date: July 20, 2026 Tags: ECOSYSTEM, TRADING, STOP-ORDERS, CONDITIONAL-ORDERS, MATCHING-ENGINE, SCYLLA, ORDERS, WALLETS, HUMMINGBOT, API-KEYS, KYC, FEATURES, LICENSE, EXTENSIONS, ROUTING, I18N, MIDDLEWARE, SECURITY, BUG-FIXES

Overview

Version 6.5.7 brings stop orders to ecosystem (in-house DEX) markets — stop-limit and stop-market, on both sides of the book — and does it in a way that keeps them completely out of the matching engine until the moment they fire.

It also fixes the 404 after activating an extension license, closes the middleware defect behind it, and follows through with a site-wide navigation audit: every internal link in the frontend was validated against the real route tree, five broken destinations were repaired, and the entire class of locale-less hard navigations was eliminated.

Update Instructions

The usual pnpm updator.

Added

Stop orders on ecosystem markets

What's new

Ecosystem markets now support stop-limit and stop-market orders, for both buy and sell, covering both protective stop-losses and breakout/target entries. You place them exactly like any other order from the Pro trade panel: choose Stop-Limit or Stop-Market, set a trigger (stop) price — and, for stop-limit, a limit price — and submit. The order shows up in your Open Orders with a clear trigger-price badge, updates live, and can be cancelled at any time before it fires.

When the market's last-traded price reaches your trigger, the stop activates into a real order — a limit order at your limit price for stop-limit, or an immediate market order for stop-market — which then matches and settles through the normal flow. The trigger direction is inferred automatically from where your stop price sits relative to the current price, so both "sell if it falls to X" (stop-loss) and "sell if it rises to X" (take-profit) work without any extra toggle.

How it works

Untriggered stops rest in a dedicated store, separate from the live order book, that the matching engine never queries. This is the key design decision: because the matcher only ever reads live limit/market orders, a resting stop cannot reach it and therefore cannot stall it — the failure mode that made a naive approach dangerous is removed structurally, not patched around.

A small stop-order monitor runs alongside the matching engine and watches each market's price. It checks resting stops immediately after every trade updates a price (so triggers are near-instant) and also sweeps periodically as a safety net (so a price move that doesn't come from a user trade still fires stops). When a trigger is crossed, the stop is converted into a real order through the exact same placement code a normal order uses — the same validation, fee, cost and matching logic — so a triggered stop behaves identically to an order you placed by hand at that instant.

Funds are reserved at placement

The moment you place a stop, the funds it needs are held — the same hold used by a normal resting order — so the order is guaranteed to have the balance to execute when it triggers. Cancelling a stop (individually or via "cancel all") releases the hold back to your available balance; triggering it hands the hold to the real order it becomes. The reservation is deliberately locked before the stop ever becomes visible or cancellable, so there is never a window where a resting stop exists without its funds secured.

Built to be safe with money

The reservation is held strictly before the order becomes discoverable, closing a race where a simultaneous "cancel all" could act on a not-yet-funded stop, and a stop that has already produced a live order can never be mislabelled as failed by a follow-up bookkeeping hiccup. Cancel and trigger are serialized against each other so exactly one of them ever acts on a given stop, and every release of held funds is idempotent — it can only ever return what was actually held, never create balance. A restart reloads resting stops and still fires them.

Changed

Hummingbot: create API keys without KYC Level 2

Creating a Hummingbot API key no longer requires the account to have reached KYC Level 2. The key-creation endpoint previously gated on that level; that gate has been removed, so any authenticated user can generate a Hummingbot key and secret. All other protections on the endpoint are unchanged — the per-user key cap, IP restrictions, scope validation, and the one-time-only display of the signing secret all still apply, and key management still requires a real session (an API key cannot be used to mint more keys).

Fixed

License activation no longer 404s

What was happening

Activating an extension license could dump you on a 404 page instead of the product you just unlocked. The redirect after activation navigated to a URL without the language prefix (e.g. /admin/system/extension instead of /en/admin/system/extension). Normally the router middleware quietly adds the prefix — but the auth middleware returned early whenever it had just refreshed an expired access token, skipping the locale redirect entirely. Since access tokens expire after minutes, anyone who spent a moment on the activation form hit this window, and the bare URL fell through to a hard 404. The same early return also skipped the admin permission check for that request.

What changed

Fixed the auth middleware short-circuiting the chain. A freshly refreshed token is carried on whatever response ends the request — redirects included — so the locale redirect and the admin permission check now run on every request, refreshed token or not.
Fixed the post-activation redirects on the license page, which are now locale-aware, so you land directly on the right page with your current language intact, with no dependence on middleware rescue.
Fixed the ?return= parameter on the license page accepting external destinations — it now only accepts internal paths, closing an open-redirect hole where a crafted link could bounce an admin to an external site after activation.
Added a post-activation destination for the Forex & Multi-Asset Trading extension, so activating it takes you to its admin dashboard instead of the generic extensions list. Its eleven admin pages were also registered for route permissions, so granular (non-Super-Admin) roles can be granted access to them.

The license bug prompted a full audit of every internal navigation in the frontend — 1,710 links, buttons, and redirects validated against the actual route tree (dynamic segments included).

Broken destinations repaired

Five navigations pointed at pages that do not exist and 404'd on every click; three more had been caught earlier in the same investigation:

Blog author approval, "Create your first post" → now goes to the author post editor (/blog/author/manage/new).
KYC level builder error screen, "Return to levels" → now goes to /admin/crm/kyc/level.
Page editor's mobile-app section note, "Admin Settings" → now goes to /admin/system/settings.
User footer, "AI Investment" → now goes to /investment (the AI Investment extension's user-facing hub), with a guard so the footer never shows two links to the same page.
Admin menu, the "Binary Options" parent entry → now targets /admin/finance/binary/market instead of a non-page.
Binary trade header's Deposit button → now goes to /finance/deposit (previous target didn't exist).
KYC application help card → "Contact Support" and "View FAQ" now go to the real /contact and /faq pages.

Locale-less navigations eliminated

Seventeen places performed full-page navigations to bare paths, bypassing the app's locale routing — the exact mechanism behind the license 404, and even when rescued, they could silently flip the page language. All of them now carry the current language prefix. This covers the mailwizard campaign editor, AI market-maker config, ecommerce checkout, transfers, fiat deposits, the market/futures/ecosystem trade buttons, both error boundaries, the NFT footer, affiliate conditions, the ecosystem token wizard, and the page-builder button element. Deliberate hard reloads (used to bust caches after state changes) keep their reload behaviour — they just carry the language prefix now.