XRP (XRP) is flashing a familiar technical pattern that has historically preceded sharp short-term price rebounds.
XRP bulls still focus on $5 despite latest dip
XRP’s three-day chart shows a “hidden bullish divergence,” where the price forms higher lows while the relative strength index (RSI) posts lower lows. In technical analysis, most analysts perceive this pattern as a sign of weakening downside momentum.
Two such divergences appeared in XRP’s recent history.
The first formed in early 2022, leading to a 69% bounce before prices resumed their broader decline. The second emerged between late 2023 and early 2024, preceding a 49% rally that led to the price stabilizing.
XRP/USD three-day chart. Source: TradingView
Both examples show that XRP often saw quick rebounds after the hidden bullish divergence signal, but those rallies didn’t last long. In other words, this setup can spark short-term gains, but it does not necessarily mean a bullish reversal has begun.
XRP dropped 11.95% in the last 24 hours and was trading for as low as $2.229 on Tuesday.
“I’d be hoping to hold this range and spring back as the week goes on, but the bias is bearish in the moment,” said pseudonymous analyst Guy on the Earth, who spotted the hidden bullish divergence on the XRP charts.
He added:
“$2.20 is next support with the 2025 major support between $1.90 and $2 next up if we lose this range.”
The support area aligns with the lower trendline of XRP’s prevailing symmetrical triangle structure and its 1.0 Fibonacci retracement trendline, as shown below.
XRP/USDT weekly chart. Source: TradingView
The upside target for the symmetrical triangle is around $5 in the event of a breakout, representing a gain of about 115% from the current price levels.
This XRP structure reinforces the bounce setup presented by the hidden bullish divergence.
Over $695 million in XRP shorts at risk
Derivatives data shows a growing imbalance between long and short positions on XRP.
As of Tuesday, XRP’s cumulative short liquidation leverage exceeded $695 million, compared with just $32.1 million in long exposure, according to CoinGlass. It reflects a market heavily tilted toward short positions, signaling growing pessimism among traders.
Most of this short-side liquidity is concentrated between $2.60 and $3.50, suggesting that even a modest rebound toward this range could trigger a cascade of short liquidations, or a potential “short squeeze.”
Meanwhile, there’s little to no long-side liquidity below $2.16, signaling that the long flush has already occurred during the October correction.
The current setup implies that XRP’s downside risk may be limited in the near term, while upside volatility could intensify if price climbs into the short-heavy zone.
This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.
The onchain transactions of the exploiter behind the $116 million Balancer hack point to a sophisticated actor and extensive preparation that may have taken months to orchestrate without leaving a trace, according to new onchain analysis.
Blockchain data shows the attacker carefully funded their account using small 0.1 Ether (ETH) deposits from cryptocurrency mixer Tornado Cash to avoid detection.
Conor Grogan, director at Coinbase, said the exploiter had at least 100 ETH stored in Tornado Cash smart contracts, indicating possible links to previous hacks.
“Hacker seems experienced: 1. Seeded account via 100 ETH and 0.1 Tornado Cash deposits. No opsec leaks,” said Grogan in a Monday X post. “Since there were no recent 100 ETH Tornado deposits, likely that exploiter had funds there from previous exploits.”
Grogan noted that users rarely store such large sums in privacy mixers, further suggesting the attacker’s professionalism.
“Our team is working with leading security researchers to understand the issue and will share additional findings and a full post-mortem as soon as possible,” wrote Balancer in its latest X update on Monday.
Balancer exploit was most sophisticated attack of 2025: Cyvers
The Balancer exploit is one of the “most sophisticated attacks we’ve seen this year,” according to Deddy Lavid, co-founder and CEO of blockchain security firm Cyvers:
“The attackers bypassed access control layers to manipulate asset balances directly, a critical failure in operational governance rather than core protocol logic.”
Lavid said the attack demonstrates that static code audits are no longer sufficient. Instead, he called for continuous, real-time monitoring to flag suspicious flows before funds are drained.
Lazarus Group paused illicit activity for months ahead of the $1.4 billion Bybit hack
The infamous North Korean Lazarus Group has also been known for extensive preparations ahead of their biggest hacks.
According to blockchain analytics firm Chainalysis, illicit activity tied to North Korean cyber actors sharply declined after July 1, 2024, despite a surge in attacks earlier that year.
North Korean hacking activity before and after July 1. Source: Chainalysis
The significant slowdown ahead of the Bybit hack signaled that the state-backed hacking group was “regrouping to select new targets,” according to Eric Jardine, Chainalysis cybercrimes research Lead.
“The slowdown that we observed could have been a regrouping to select new targets, probe infrastructure, or it could have been linked to those geopolitical events,” he told Cointelegraph.
It took the Lazarus Group 10 days to launder 100% of the stolen Bybit funds through the decentralized crosschain protocol THORChain, Cointelegraph reported on March 4.
The bankruptcy estate of defunct crypto exchange FTX has abandoned a motion seeking to limit creditor distributions to “potentially restricted foreign jurisdictions.”
The FTX Recovery Trust on Monday filed a notice withdrawing its motion for entry of an order in support of the confirmed plan authorizing it to implement restricted jurisdiction procedures in potentially restricted foreign jurisdictions like China.
“If and when the FTX Recovery Trust seeks to renew the relief requested in the Motion, the FTX Recovery Trust shall file a motion and provide notice in accordance with the applicable rules,” the notice states, adding that the motion has been withdrawn without prejudice.
The trust filed the motion in early July, seeking the court’s authorization to freeze payouts to creditors in 49 countries such as China, Saudi Arabia, Russia and Ukraine, citing unclear or restrictive local crypto laws.
Do not celebrate too early, creditor warns
The withdrawal is a significant win for affected FTX creditors, but some say it’s too early to celebrate.
“This is a victory for all potentially affected creditors. But until you receive the compensation you’re owed, stay vigilant and keep acting together,” Weiwei Ji, a creditor known as Will on X, wrote in a post on Tuesday.
The estate’s decision to withdraw the motion came after intense pushback from creditors, with at least 70 objections filed in bankruptcy court within weeks of the motion’s submission.
Amid the objections in July, Ji warned that court approval of the FTX estate’s motion regarding restricted countries could have set a standard for future crypto bankruptcies.
“This motion isn’t just about FTX creditors. It sets a dangerous precedent that could destroy trust in the global crypto ecosystem,” he wrote at the time.
Decentralized finance platform Stream Finance says it has paused deposits and withdrawals after an external fund manager overseeing its funds found a $93 million loss in its assets.
The Stream Finance team said in an X post on Monday that the fund manager reported the loss on Sunday and the project has since hired lawyers from Perkins Coie to investigate the incident.
“We are actively withdrawing all liquid assets and expect this process to be completed in the near term,” it said. “We will provide periodic updates as additional information becomes available.”
Before Stream Finance posted on X on Monday, XUSD had already started to depeg below a dollar as many users had sensed trouble on Sunday, questioning why deposits and withdrawals had been paused without communication from the team.
Labs founder Omer Goldberg posted on X about 10 hours before Stream’s announcement that XUSD had “began to depeg materially below its target range” after an over $100 million exploit on the automated market maker Balancer.
At the time of writing, XUSD has dropped to as low as $0.51, according to data from CoinGecko.
XUSD’s price over the last 24 hours. Source: CoinGecko
On Friday, Stream Finance posted to X in response to community questions about discrepancies between the platform’s total value locked (TVL) reported on its website and what was listed on the popular data service DefiLlama.
“DefiLlama has decided that recursive looping is not TVL per their own definitions. We disagree with this, but to be transparent to users the website now makes a distinction between user deposits (~$160M) and total assets deployed across strategies. (~%$520M),” it said.
“This underscores the critical importance of understanding exactly how protocols generate yield and the significant risks involved in complex DeFi strategies, especially those that disagree with standard metrics like DefiLlama’s TVL,” said CoinDCX’s head of DeFi Ecosystem Growth, Minal Thurkal.
Crypto market sentiment took a major fall on Tuesday after Bitcoin briefly fell below $106,000 for the first time in over three weeks.
The Crypto Fear & Greed Index on Tuesday dropped by half from the day before to a score of 21 out of 100, indicating “Extreme Fear” in the crypto market.
Bitcoin (BTC) fell to a 24-hour low of $105,540 on Monday, sliding from an intraday peak of over $109,000. It’s currently down 2% on the day, recovering above $106,500, per CoinGecko.
The crypto sentiment tracking index’s score on Tuesday is its lowest in nearly seven months, having dropped to 18 out of 100 on April 9, as the wider stock and crypto markets fell in reaction to US President Donald Trump’s sweeping global tariffs that went into action that day.
The Crypto Fear & Greed Index dropped from 42 to 21 points in a single day on Tuesday. Source: Alternative.me
“Extreme Fear” seen when Bitcoin slides
The Crypto Fear & Greed Index last fell to the level of “Extreme Fear” on Oct. 22, hitting a score of 25 out of 100 after Bitcoin slid from over $110,000 to below $108,000.
The index has swung between “Extreme Fear” and “Neutral,” after the market crash over Oct. 9-10, when Bitcoin rapidly cooled from its Oct. 6 peak of over $126,000.
The index was last above a score of “Neutral” before the early-October crash, hitting a high over the past month of 74, indicating “Greed,” on Oct. 5.
Analysts have attributed Bitcoin’s current dip to reduced institutional demand and blockchain activity, as well as concerns over an increasingly hawkish Federal Reserve.
The Fed cut interest rates for the second time this year on Wednesday, but signaled that it might not do so again in 2025, which caused crypto markets to drop as investors had hoped for further rate reductions.
Last week, Bitcoin-tied exchange-traded funds saw net outflows of nearly $800 million, with institutional buying dipping below the daily mined supply for the first time in seven months.
Crypto bulls are hoping for a so-called “Moonvenber,” as Bitcoin has historically gained an average of over 42% in November, typically its best month for growth.
Bitcoin mining company Cipher Mining surged more than 32% after revealing a new 15-year deal with tech giant Amazon, adding to a wave of partnerships between major technology companies and crypto miners.
The 15-year lease agreement with Amazon Web Services, valued at $5.5 billion, requires Cipher to provide turnkey space and power for AI workloads in two phases, starting in July and August next year, the Bitcoin (BTC) miner announced on Monday.
Cipher Mining also posted a significantly narrowed net loss of $3 million and a rise in adjusted earnings of $41 million for the third quarter, compared to a net loss of $46 million and adjusted earnings of $30 million in the previous quarter.
This led to Cipher’s stock shooting up 32% from $18.65 to a peak of $24.80 during trading on Monday before settling back to $22.76 by the end of the trading day.
In September, Google acquired a 5.4% stake in Cipher Mining as part of a $3 billion, multi-year data center deal with AI data center company Fluidstack.
Cipher CEO Tyler Page said in a statement on Monday that the company “executed a pivotal transaction with Fluidstack and Google, which firmly established our credibility in the HPC space.”
“We are now following that transaction with another major step forward by signing our first direct lease with a Tier 1 hyperscaler,” he added.
Along with the Amazon deal, Cipher also announced it has a majority stake in a joint venture to develop a one-gigawatt AI hosting site in West Texas, known as Colchis. Under the deal, Cipher provides most of the financing and will take a 95% equity ownership.
Miners and tech giants making deals
Tech giants have become increasingly involved with Bitcoin miners this year. Bitcoin mining company IREN signed a multi-year GPU cloud services contract with Microsoft worth $9.7 billion on Monday as well.
Global index provider FTSE Russell has partnered with Chainlink to publish its benchmark equity and digital asset indexes onchain, highlighting how blockchain technology is being used to deliver institutional-grade market data.
On Monday, Chainlink announced that data for the Russell 1000, Russell 2000 and Russell 3000 small-cap indexes, the FTSE 100 Index and several digital asset benchmarks will be made available across multiple blockchains via DataLink, an institutional-grade publishing service powered by the oracle network.
The Russell indexes, widely used as benchmarks for US small- and mid-cap stocks, are tracked by more than $18 trillion in assets globally.
Fiona Bassett, CEO of FTSE Russell, said the move is part of the company’s strategy to enable “innovation around tokenized assets” and exchange-traded funds.
As Cointelegraph reported, FTSE Russell introduced a series of digital asset indexes in January through a partnership with SonarX, aiming to provide institutional investors with standardized benchmarks for the crypto market.
In 2023, FTSE Russell partnered with digital asset manager Grayscale to launch five indexes that categorize the cryptocurrency market by sectors, including smart contract platforms, utilities and consumer products.
Institutional adoption of blockchain technology gains traction
FTSE Russell is among several major financial institutions exploring blockchain technology for applications such as tokenization, settlement and stablecoin integration. As Cointelegraph recently reported, JPMorgan has expanded its tokenization efforts through its private Kinexys blockchain, bringing private equity funds onchain.
Goldman Sachs and BNY have also begun offering tokenized money market funds for clients, featuring round-the-clock settlement and onchain ownership tracking.
In April, US banking giant Citigroup said the growing institutional interest in blockchain is being fueled partly by a clearer regulatory environment, particularly regarding stablecoins.
“The main catalyst for their greater acceptance may be regulatory clarity in the US, which could enable greater integration of stablecoins specifically, and blockchain more widely, into the existing financial system,” Citi said.
Cryptocurrency advocacy organization Coin Center has weighed in on the ongoing criminal trial of two brothers who allegedly exploited the Ethereum blockchain using maximal extractable value (MEV) bots.
In a Monday amicus curiae brief — a document filed by an entity that is not a party to the case — Coin Center argued against one of the prosecutors’ key case theories involving Anton and James Peraire-Bueno. The two individuals are allegedly responsible for a $25 million MEV exploit in April 2023.
According to Coin Center, the US government’s claims of “honest validation” lack merit and should be rejected by the court.
“‘Honest validation’ in cryptocurrency communities is a mathematical check rather than a legal or normative judgment, and Defendants appear to have contravened none of the clear rules or controls found within the Ethereum protocol in a manner deserving outside interference or enforcement,” said Coin Center, adding:
“[T]he prosecution is asking the Court to impose a novel and alien code of conduct on top of those protocol rules, not only without justification, but in a manner that would be detrimental for the government to do through criminal prosecution.”
The amicus brief, filed on the 14th day of the Peraire-Buenos’ criminal trial, came amid opposition from US prosecutors, who claimed Coin Center would encourage a jury to acquit the two brothers using policy arguments rather than legal ones.
At the center of the case is the MEV bot exploit, which occurs when a validator manipulates the order of transactions within a block to maximize earnings. The outcome of the case is likely to have significant implications among cryptocurrency traders and platforms.
According to reporting from the courtroom by Inner City Press, lawyers for the US government said on Wednesday that they planned to argue that “the defendants engaged in false pretenses by holding themselves out as honest validator[s],” allowing them to commit the exploit.
“Within the Ethereum ecosystem, ‘honest’ validation simply means obeying the specified rules of consensus articulated in the protocol software,” said the Coin Center brief. “[A]doption of the prosecution’s ‘honest validator’ theory of fraud would be alien to widespread industry practice and contravene longstanding legal principles of damnum absque injuria—harm without legal injury—and fair notice.”
Defense attorneys reportedly called the theory a “nonsensical allegation,” claiming in their opening arguments that the “victims here were sandwich bots.”
The two face charges of conspiracy to commit wire fraud, money laundering and conspiracy to receive stolen property. If found guilty, a judge could sentence the brothers to up to 20 years in prison for each count.
Cryptocurrency investment products saw $360 million in outflows last week as investors reacted to Federal Reserve Chair Jerome Powell’s cautious remarks on future rate cuts.
Despite Wednesday’s rate cut, Powell’s remark that another one in December was “not a foregone conclusion,” combined with the absence of economic data due to the ongoing government shutdown, appears to have left markets uncertain, CoinShares reported on Monday.
Most of the selling pressure came from the US markets, which saw $439 million in outflows, partly offset by modest inflows from Germany and Switzerland. Bitcoin ETFs led the decline with $946 million in redemptions.
Even as Bitcoin funds bore the brunt of outflows, not all assets followed suit. Solana stood out, attracting $421 million in inflows, its second-largest on record, driven by demand for newly launched US exchange-traded funds (ETFs), lifting year-to-date totals to $3.3 billion.
Ethereum also saw $57.6 million in inflows, although daily activity suggested a mixed sentiment among investors.
The outflows come after crypto products amassed $921 million in inflows the previous week, driven by lower-than-expected Consumer Price Index (CPI) data released on Oct. 24.
Bitwise’s new Solana Staking ETF (BSOL) debuted last Tuesday at $222.8 million in seed assets, signaling strong institutional demand for Solana staking products.
BSOL offers investors direct exposure to Solana (SOL) with an estimated 7% annual yield from onchain staking rewards.
Vincent Liu, chief investment officer at Kronos Research, told Cointelegraph the trend reflects growing interest in staking yields and ongoing “capital rotation,” as traders take profits from recent Bitcoin (BTC) and Ether (ETH) rallies.
Although Solana ETF inflows have surged, at the time of writing, SOL was trading around $166, down over 9% during the past 24 hours and around 26% over the past 30 days, according to CoinGecko data.
Reuters estimates Trump-linked ventures earned $802 million in crypto in early 2025.
Income came from WLFI tokens, the TRUMP coin and USD1 stablecoin yields.
Alt5 Sigma’s deal and foreign buyers helped turn token value into cash.
As US crypto enforcement eased, experts noted possible conflict concerns.
In the first half of 2025, Trump-linked ventures booked roughly $802 million in crypto income, primarily from World Liberty Financial (WLFI) token sales and the Official Trump (TRUMP) memecoin, dwarfing revenue from golf, licensing and real estate.
Reuters’ investigation and methodology papers detail where the cash came from and how it was tallied. This guide explains the mechanics, the buyers and the policy context without the hype.
What is World Liberty Financial?
WLFI launched in late 2024 as a token-centric project tied to the Trump family. Its governance token, WLFI, offers limited holder rights compared with traditional decentralized finance (DeFi) governance models. The company’s lawyer argues that the token has “real utility.”
The core monetization model is straightforward. A Trump Organization affiliate is entitled to 75% of token-sale revenue after expenses, according to WLFI’s “Gold Paper.” Reuters used this document as the basis for its income model.
In the first half of 2025, Reuters estimates that WLFI token sales were the single largest cash contributor. They accounted for the bulk of the family’s crypto windfall.
The Alt5 Sigma deal
In August 2025, WLFI marked a Nasdaq deal in which Alt5 Sigma raised hundreds of millions of dollars to purchase WLFI tokens. The move provided a major demand catalyst and converted a portion of on-paper value into realized cash for Trump-controlled entities.
Separate reporting in August outlined a broader plan for a $1.5-billion WLFI “treasury” strategy linked to Alt5. The plan aimed to hold a significant portion of the token supply, details that help explain the scale of flows into WLFI.
How the TRUMP memecoin generated cash
The TRUMP coin launched on Jan. 17, 2025, and its creators earned a share of the trading fees from Meteora, the exchange where it first traded. Within two weeks, onchain forensics firms cited by Reuters estimated between $86 million and $100 million in fees, mostly on Meteora.
In its analysis of the first half of 2025, the outlet modeled roughly $672 million in coin sales and, using a conservative 50% share assumption, attributed around $336 million to Trump-linked interests. The methodology acknowledges uncertainty because ownership and fee splits are not fully disclosed.
Who bought the tokens?
Most WLFI buyers are pseudonymous wallet addresses, but the investigation identified several high-profile participants and concentrated foreign demand. The investigation highlights the Aqua1 Foundation’s $100-million WLFI purchase and reports that Eric Trump and Donald Trump Jr. participated in a global investor roadshow promoting the token.
The review also notes that identifiable major buyers include overseas investors. While attribution remains probabilistic, foreign participation among large WLFI holders appears significant.
The USD1 stablecoin (and its interest stream)
WLFI also promotes USD1, a dollar-pegged stablecoin backed by reserves in cash and US Treasurys, with custody handled by BitGo.
Reuters reports that the reserves backing USD1 generate an estimated $80 million annual interest run rate at prevailing yields and notes that a portion of that interest accrues to a company 38%-owned by the Trump Organization, though the actual realized amount for 2025 remains unspecified.
In May 2025, Abu Dhabi-backed MGX announced a $2-billion investment in Binance, which, according to reports and public statements by WLFI, was set to be settled using USD1. The deal stands as a marquee example of how WLFI’s stablecoin is positioned to facilitate very large transactions.
How Reuters got to “$802 million”
Because much of the Trump business empire is private, Reuters combined presidential disclosures, property records, court-released financials and onchain trade data. It then applied explicit assumptions, such as WLFI’s 75% revenue share for WLFI token sales and a 50% share on TRUMP, which were reviewed by academics and certified public accountants.
The outlet’s conclusion was that nearly $802 million of the Trump family’s income in the first half of 2025 came from crypto ventures, compared with just $62 million from their traditional businesses.
Did you know? WLFI disputes parts of Reuters’ analysis, arguing that its revenue model was oversimplified, wallet data misinterpreted and the project’s real-world utility overlooked.
The policy backdrop (and the conflict question)
Since January 2025, the US enforcement posture toward crypto has shifted. The Justice Department disbanded its National Cryptocurrency Enforcement Team and narrowed its priorities, while the US Securities and Exchange Commission dropped or paused several high-profile cases, including its motion to dismiss Coinbase and the termination of actions against other major firms.
Ethics experts told Reuters that a sitting president overseeing crypto policy while his family earns substantial crypto income presents a novel conflict of interest, even if it is not unlawful.
The White House and company representatives have denied any wrongdoing.
Findings and broader context
In short, what appears to be an $800-million “gold rush” is, beneath the surface, a blend of brand-driven token sales, fee-rich memecoin mechanics, a high-velocity treasury deal and a yield-bearing stablecoin.
The totals are drawn from documented splits and modeled flows. The controversy, however, centers on who the buyers were, how transparent the ventures remain, and how US policy shifted as the money flowed in. For anyone tracking crypto politics, this story now serves as a live case study in incentives, disclosure and governance risk.
This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.
