One billion tokens hit the open market on September 1. Instead of dumping, XRP rallied. The monthly escrow release that once spooked retail traders has become background noise for an asset that just logged its strongest on-chain quarter in years.

For eight years, Ripple’s monthly escrow unlock has played out like clockwork. On the first day of every month, the XRP Ledger’s built-in escrow contracts release up to 1 billion XRP into Ripple-controlled wallets. Each time, a wave of anxious posts floods social media. Each time, traders brace for a dump that rarely arrives. And each time, the market moves on.

September 1, 2026, was no different in mechanics. Whale Alert flagged three transactions: 500 million, 400 million, and 100 million XRP, all released from escrow within minutes. The total haul was worth about $1.38 billion at the time. What was different, though, was everything around it.

XRP had just posted its best August in five years. Active addresses on the ledger were at all-time highs. Spot ETFs were pulling in nine-figure inflows. Ripple, freed from its four-year SEC battle, was signing deals with names like Deutsche Bank and JPMorgan. The billion-token release landed in a market that was not scared of it anymore, and for good reason.

This is the story of how the scariest thing about XRP became one of the least interesting.

The anatomy of a billion-token unlock

The escrow program dates back to December 2017, when Ripple locked 55 billion XRP into time-based contracts on the XRP Ledger. The idea was straightforward: remove the supply overhang that critics used to argue XRP was centrally controlled. The protocol would release up to 1 billion tokens on the first of each month, and anything Ripple did not sell would go back into escrow at the end of the queue.

Nine years later, the program has released tens of billions of XRP. Ripple’s escrow balance has dropped from 55 billion to 31.28 billion as of the September release, according to crypto.news data on XRPL escrow mechanics. But the net effect on circulating supply has been modest. Ripple typically re-escrows 700 to 900 million XRP each month, leaving only 100 to 300 million for operational use, OTC liquidity deals, or institutional payments.

The math is simple. A billion tokens sound alarming. But when 70 to 90 percent go right back into lockup, the actual supply entering the market is a fraction of the headline number. Historical data backs this up: monthly escrow releases have produced average 7-day price swings of negative 3.1% to positive 1.7%, with 30-day volume bumps of 15 to 22 percent. Not nothing, but not the catastrophic sell events that early critics predicted.

Compare that to traditional equity markets. When a public company’s lockup period expires and insiders can sell, the stock often drops 5 to 15 percent in a single session. XRP’s monthly unlock is milder than a typical IPO lockup expiry. The difference is predictability. Everyone knows when the tokens are coming. Everyone knows how many. And everyone knows Ripple’s historical re-escrow behavior. There is no information asymmetry, which means there is no panic.

Rocket has suspended deposits, withdrawals and trading after an attacker manipulated a dormant perpetual market and withdrew approximately $287,000 in positive PnL from the platform’s Bridge.

Rocket said in a Sept. 7 update on X that the security incident occurred at approximately 19:00 UTC on Sept. 5, when an attacker targeted an inactive perpetual market using a burner account.

The attacker placed orders at artificially inflated prices and traded against themselves, creating artificial profits in one account while pushing the burner account into bankruptcy. The profitable account subsequently withdrew around $287,000 from the Bridge, leaving the resulting loss to be socialized across the platform.

Rocket attack used self trading to create artificial profits

Instead of describing a smart contract vulnerability, Rocket’s initial account of the incident centered on the manipulation of a dormant perpetual market with limited activity.

Using a disposable account, the attacker was able to post orders at inflated prices before acting as both sides of the trades. Rocket said the transactions generated “fake profits” for one account while the burner account accumulated the corresponding losses and became insolvent.

The account showing positive PnL then withdrew approximately $287,000 through the Bridge before the activity was stopped.

Rocket has since paused all trading, deposits and withdrawals while its team investigates the incident. The project did not provide a timeline for restoring the affected services or disclose how many users were exposed to the socialized loss.

Blockchain security tracker SlowMist classified the incident as a price manipulation attack and recorded the loss at $287,000.

The method bears similarities to previous incidents in thin perpetual markets where traders have been able to manipulate prices or positions and transfer resulting losses to liquidity providers or other parts of a trading platform.

In March 2025, a trader targeted Hyperliquid’s thin JELLY market by opening a large short position while buying the token on decentralized exchanges. The activity drove JELLY’s price sharply higher and pushed the short toward liquidation, eventually transferring the position to Hyperliquid’s liquidity vault.

As crypto.news previously reported, Hyperliquid restricted the trader’s accounts to reduce-only mode before validators later voted to delist the JELLY perpetual market and settle outstanding positions.

A separate Hyperliquid incident in March 2025 saw its HLP vault absorb around $4 million in losses after a trader withdrew collateral from a highly leveraged Ether position before liquidation. Hyperliquid said at the time that the event was not a protocol exploit and subsequently changed leverage requirements for Bitcoin and Ether positions.

Rocket seeks to freeze the stolen $287,000

With platform operations suspended, Rocket said it is working with security firms and law enforcement agencies to investigate the attack and recover the funds.

The team is coordinating with cryptocurrency exchanges, cross-chain bridges and stablecoin issuers to trace the stolen assets and attempt to freeze them. Rocket has not disclosed the identities of the security companies or law enforcement agencies involved in the investigation.

Similar measures have been used after other recent DeFi incidents, particularly when attackers attempt to move funds through bridges or centralized trading venues.

AFX suffered a cross-chain bridge exploit in July that drained 24.15 million USDC. Security firm Blockaid worked with the Arbitrum team to investigate the incident as the attacker transferred the stolen USDC to Ethereum and converted the proceeds into 12,467.5 ETH.

Earlier in June, Axelar disabled bridge routes connected to Secret Network after an exploit resulted in roughly $4.7 million in losses. Axelar said the incident was limited to bridged assets on Secret Network and did not compromise its core protocol.

Rocket has not disclosed whether any portion of the $287,000 has been frozen or recovered so far.

Smaller Rocket accounts are first in line for refunds

The team is preparing a recovery plan for users affected by the incident, with smaller accounts expected to receive priority when refunds begin.

Rocket said it understands that compensation is the update affected users are waiting for but will provide specific details only when it can do so responsibly. The platform has not yet disclosed the size of its available recovery funds, eligibility requirements, payment method or a timetable for reimbursements.

Recovery programs have taken different forms following previous attacks on decentralized trading protocols.

GMX, for example, completed a roughly $44 million compensation plan in August 2025 for liquidity providers affected by an exploit of its V1 GLP pool. The protocol used GLV tokens for distributions, while its DAO treasury covered a $2 million shortfall.

The GMX attacker had previously returned approximately $37.5 million of the roughly $42 million stolen after the protocol offered a 10% white-hat bounty. The affected V1 system was paused after the attack, while GMX V2 remained operational.

Rocket has not announced a similar bounty or offered terms directly to the attacker. Its current recovery effort remains focused on tracing the withdrawn funds and developing a reimbursement plan.

The platform warned users to watch for impersonators attempting to take advantage of the incident. Rocket said recovery information will be published only through its official X account and Discord channels, adding that team members will not contact affected users first through direct messages.

On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million incident.

The actors communicated their offer through Bitcoin transactions carrying OP_RETURN messages, according to a reconstruction published by Galaxy Research head Alex Thorn. They asked whether returning “most” of the Bitcoin to the federation’s address would be acceptable.

A later message told Blockstream to “fix the bug first” and ensure every node received the patch. The actors claimed the chain remained exposed under its latest software version and promised to transfer the money after confirming the repair.

That promise remains unverified. The actors did not define how much “most” represents, disclose their identities or provide a deadline. No confirmed return transaction had appeared when this article was prepared.

On-chain messages authenticate the negotiation

Blockstream initiated contact at Bitcoin block 965,822 by sending 1,000 satoshis with a message directing the recipient to its security team. Another transaction contained encrypted material and a detached signature verifiable against Blockstream’s published PGP key.

At block 965,869, the actors sent 1,000 satoshis to the federation’s peg address and asked about returning most of the funds. They provided their patch demand six blocks later. The messages establish that someone controlling the relevant Bitcoin could respond to Blockstream. They do not independently prove the actors’ motives.

The incident began with a peg-out of approximately 3,996 BTC. The corresponding Bitcoin transaction was confirmed in block 965,783 on Sept. 6. A separate transaction carried the initial claim: “we are whitehats. contact us on chain.”

The 4,000 BTC withdrawal exposed Liquid’s peg

Liquid confirmed that approximately 4,000 BTC had left its federation wallet. It described those responsible as “purported white-hat hackers,” preserving uncertainty around their status.

The network said the withdrawal used SideSwap’s Peg-out Authorization Key, or PAK. However, it said there was no evidence that the key itself was compromised. Liquid has not publicly explained the underlying vulnerability or released a technical postmortem.

Liquid operates as a Bitcoin sidechain whose users lock BTC and receive L-BTC for activity on the network. The federation holds the underlying Bitcoin and authorizes withdrawals back to the base layer. The transfer reportedly removed about 95% of the wallet’s Bitcoin.

Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals. It said other issued assets, including stablecoins and real-world assets, were not directly removed. The sidechain remained effectively paused while the investigation continued.

The episode adds another large loss to a year dominated by infrastructure failures. As crypto.news reported, crypto protocols lost at least $1.3 billion to hacks during the first eight months of 2026. In related coverage, an examination of cross-chain bridge security explained how concentrated custody and authorization systems can create large points of failure.

Blockstream must patch the network before any restart

Blockstream’s immediate task is to identify the flaw, prepare a patch and distribute it across the federation. The actors specifically demanded that every node be updated before repayment. Blockstream has not announced a patch version or reopening time.

A return can only be treated as confirmed after the Bitcoin moves to an address controlled by the federation. Even then, the amount retained by the actors and any proposed bounty would require disclosure.

Liquid must also account for the remaining reserves, explain how the peg-out bypassed normal controls and specify how L-BTC redemptions will resume. A technical postmortem would be needed to show whether the problem involved software, authorization logic, federation operations or another part of the withdrawal process.

Until those steps occur, the repayment remains a conditional promise and the “white hat” description remains disputed.

Harmony is moving toward a full shutdown of its blockchain and a migration of its ONE token to Ethereum, according to a proposal shared by the network. The plan would culminate in a final network snapshot, followed by an airdrop of ERC-20 ONE tokens to the same addresses on Ethereum and steps to transition validator operations.

The announcement arrives after a recent Harmony exploit that involved the minting of unauthorized ONE tokens and raised the prospect of a rollback. With the latest proposal, Harmony’s approach appears to shift from repairing a compromised chain to ending the network as a standalone platform.

Key takeaways

• Harmony’s proposal targets a final block snapshot and issuance of ERC-20 ONE tokens on Ethereum, with holders receiving the new tokens to the same addresses.
• Harmony says the snapshot would include wallets, staking delegations, validator rewards, smart contracts, and centralized exchanges, with “no claims required.”
• The migration is not presented as binding, and the proposal does not specify when the final block would be produced or whether shutdown timing depends on a full on-chain governance vote.
• Users are told to exit smart contracts before Sept. 10 because “multisig safes, liquidity pools and onchain applications cannot be migrated.”
• Validators may choose to stop nodes, remain as governors, or join Harmony’s “AI-video initiative,” with a $1.372 million pool set aside for compensation for validators who exit on time and agree to serve as governors.

A planned end to Harmony’s mainnet—followed by an ERC-20 migration

In its Sunday proposal, Harmony outlined a transition designed to preserve token balances while discontinuing the underlying chain. The network stated it would take a final network snapshot and then issue ERC-20 ONE tokens on Ethereum, allocating the new tokens to the same addresses that held ONE at the time of the final block.

Harmony further described the snapshot scope as broad. It would record ONE balances across wallets, staking delegations, validator rewards, smart contracts, and centralized exchanges. The network also emphasized that holders would not need to take action to receive the new ERC-20 tokens—an important detail for retail participants and custodians alike.

Still, the proposal draws a clear boundary around what can and cannot be migrated. Harmony said multisig safes, liquidity pools, and onchain applications cannot be transferred, warning participants to unwind any smart-contract positions before Sept. 10. That requirement effectively shifts risk management onto users and protocol operators, particularly where liquidity or contract-based funds are involved.

Validator options, governance mechanics, and the open question of timing

Harmony’s transition plan is centered on validator decisions. The network said validators would receive options: stop their nodes, continue operating as governors, or participate in Harmony’s new AI-video initiative.

Harmony also referenced a governance framework consistent with its published network governance rules. According to Harmony’s governance documentation, elected validators can create proposals, while unelected validators may vote with voting power proportional to total stake. Under those rules, a proposal must reach participation threshold first: 51% of total stake weight must participate. Then it requires 66.7% support after a seven-day introduction period and a 14-day voting period.

However, Harmony described the Sunday proposal itself as “non-binding,” and it did not clarify whether the shutdown is guaranteed to follow the full validator-governance voting cycle or how precisely the final block timing would be determined. For investors and market participants, that uncertainty matters: the practical mechanics of when balances become fixed for snapshot purposes—and how orderly exchanges and custodians can coordinate—depend on the final execution plan.

Harmony also mentioned a compensation pool of $1.372 million for validators who shut down on time, keep their stakes, and agree to serve as governors. That figure indicates Harmony expects to retain some validator participation even after the main chain ceases producing blocks, but it does not specify how long governors would remain active in that role.

Recent exploit pressures: from rollback plans to a system-wide exit

The migration proposal comes less than four weeks after an exploit that created forged ONE tokens. Harmony said earlier it was considering a rollback after reports that an attacker had minted nearly 4 billion unauthorized ONE, an amount characterized at the time as roughly 26% of the token supply. Harmony later said it planned to revert the blockchain to an Aug. 11 checkpoint, discarding 109,126 regular transactions and 315 staking transactions.

According to Harmony’s earlier statements, investigators traced nearly all forged tokens to specific wallets or service boundaries and said they were working with exchanges, bridges, and law enforcement. While the rollback narrative focused on restoring the chain by undoing affected transactions, the new proposal effectively reframes the endgame: rather than continuing to operate Harmony’s blockchain and maintain state updates, Harmony is proposing a migration that relocates token ownership onto Ethereum.

For holders, this is a meaningful shift. A rollback aims to correct the ledger while preserving the chain’s continuity; a shutdown-and-migrate approach focuses on stabilizing token ownership by anchoring balances to an Ethereum-issued standard. The trade-off is that the ecosystem built atop Harmony—especially DeFi liquidity and onchain application state—may not survive in the same form because Harmony has said those components cannot be migrated.

What users should do before the September deadline

Harmony’s most urgent operational message is directed at smart-contract participants. By Sept. 10, Harmony urged users to exit all smart contracts, citing the inability to migrate multisig safes, liquidity pools, and onchain applications. That means users relying on staking-related smart-contract interactions, liquidity positions, or complex contract mechanisms may need to ensure they are fully withdrawn before migration-related execution begins.

While Harmony indicated that smart-contract-related ONE balances would be recorded at the final snapshot and ERC-20 tokens would be issued accordingly, the network’s warning suggests token balances alone may not capture the full value of positions that depend on liquidity pools or application-specific states. In other words, the migration can preserve ONE ownership, but it may not preserve the surrounding infrastructure in which ONE is locked or used.

Traders and long-term holders should also watch for how exchanges and custodians handle the ERC-20 distribution process. Harmony said the snapshot would include centralized exchange holdings, but the operational steps—such as whether exchanges require internal mapping from Harmony addresses to Ethereum accounts—are not detailed in the proposal text provided.

With Harmony moving toward an end-of-chain event and a token migration, market participants should track: whether validators ultimately ratify the shutdown through the governance thresholds described by Harmony’s framework, how Harmony confirms the snapshot and final block timing, and how DeFi and other onchain users unwind positions ahead of Sept. 10. The answers will determine how smoothly ONE holders can transition—and how much of the broader Harmony ecosystem can be meaningfully preserved.