TLDR

• ProShares recorded $17 billion in first-day trading volume for its new GENIUS money market ETF.
• The firm confirmed that internal fund allocations contributed to the early surge in activity.
• The GENIUS ETF follows federal rules for stablecoin reserve standards under the GENIUS Act.
• Analysts observed that the debut outpaced previous high-profile ETF launches across the market.
• Tokenized money market funds continued to gain traction as institutions explored blockchain settlement.

ProShares opened its GENIUS-branded money market ETF with heavy trading and strong early flows as firms continued exploring tokenized fund structures, and the launch drew wide market attention as cash-management demand persisted and blockchain rails expanded. The surge placed new focus on how issuers used internal allocations while investors assessed broader shifts. The event also advanced discussion around how digital cash products could interact with regulated funds.

GENIUS ETFs and Early Market Activity

ProShares reported $17 billion in first-day volume for its Genius Money Market ETF, and the firm confirmed internal transfers fueled much of the total. The company used cash from existing funds to support treasury operations, and this move highlighted how issuers managed liquidity across products.

Bloomberg tracked the debut and compared it with other launches, and analysts noted the sharp difference in volume. The debut exceeded the first-day totals of new crypto and ESG ETFs, and it shifted attention to cash strategies.

The GENIUS structure aligned with federal requirements for payment-stable assets, and the fund held short-duration government securities. The law set clear reserve and disclosure standards, and issuers applied these rules to maintain consistent oversight. Market observers watched activity closely, and early trading showed strong operational utility. The ETF advanced its role as a treasury tool, and issuers framed the approach as a way to streamline internal flows.

Tokenized Funds Enter Broader Use Cases

Tokenized money market funds gained traction as firms tested blockchain settlement, and the products offered yield while operating within compliance frameworks. Issuers presented them as interest-bearing complements to digital dollars, and adoption increased across institutional channels.

JPMorgan Chase strategists noted that tokenized fund shares could work as collateral, and they suggested the model preserved yield during transfers. One strategist said, “You can post money-market shares and not lose interest,” and firms continued building pilots.

The growth of tokenized vehicles aligned with rising stablecoin usage, and institutions explored both products for payments and custody. Funds positioned themselves as regulated alternatives, and issuers stressed transparency requirements. The Bank for International Settlements described tokenized money funds as fast-growing instruments, and the bulletin referenced their use in settlement trials. The report added context as markets evaluated new rails.

Regulatory Alignment and Current Developments

The GENIUS Act shaped how issuers structured reserves, and fund operators adopted those guidelines for liquidity portfolios. The law reinforced the role of high-quality assets, and managers applied these standards across new launches.

Firms also expanded product research, and issuers examined how tokenized versions might fit into custody systems. The approach strengthened administration flows, and providers continued monitoring regulatory updates.

ProShares used the GENIUS branding to reflect compliance, and the ETF’s early volume elevated attention on regulated cash tools. The debut arrived as digital asset firms explored new pathways, and issuers weighed operational benefits.

The USD1 stablecoin briefly lost its dollar peg on February 23, falling to around $0.994 before quickly recovering. The token now trades close to parity, suggesting the disruption lasted only minutes.

USD1 is issued by World Liberty Financial (WLFI), a DeFi project linked to business entities associated with Donald Trump and his family. The stablecoin currently has a market capitalization near $4.8 billion.

World Liberty Financial’s Stablecoin Depeg Triggers Speculation

WLFI responded within hours. The company said attackers compromised several cofounder accounts, spread false information, and opened short positions to profit from panic selling.

Despite the rapid recovery, the incident triggered widespread concern across the crypto community. 

Some users compared the sudden depeg to early warning signs seen before the collapse of algorithmic stablecoins such as TerraUSD in 2022.

However, USD1 differs structurally. WLFI says it maintains full 1:1 reserves, unlike TerraUSD’s algorithmic design, which relied on arbitrage mechanisms rather than direct asset backing.

Meanwhile, unverified reports circulated on social media claiming that Eric Trump deleted older promotional posts related to USD1 during the volatility. 

Screenshots have circulated online, but no independent confirmation has verified these claims.

Separately, blockchain investigator ZachXBT said he plans to release findings later this week on alleged insider trading involving a major crypto company. 

He did not name the firm. Still, some social media users speculated that WLFI could be involved. There is no evidence supporting this claim at the time of writing.

Stablecoins rely heavily on confidence. Even brief depegs can trigger rapid selling if users fear insolvency or reserve weakness.

USD1’s quick recovery suggests that redemptions and liquidity mechanisms functioned as designed. Nevertheless, the incident reflects how quickly market sentiment can shift, especially for newer stablecoins tied to high-profile figures.

The company has not disclosed technical details of the alleged attack.

The coming days, including any investigation disclosures, will likely determine whether the event remains a short-lived market shock or develops into a broader credibility test for USD1.

Editor’s note: In the ongoing battle against malware, RenEngine’s reach underscores how attackers exploit trusted software channels to broaden their victim base. Today’s briefing from Kaspersky Threat Research highlights a multi-stage infection that pivots beyond gaming into widely used cracked productivity tools. The findings emphasize the importance of verifying software sources and maintaining updated defenses across personal and corporate environments. As cyber threats increasingly blend with legitimate workflows, readers should review security practices, stay vigilant about unofficial installers, and consider how threat actors opportunistically adapt to new distribution methods. This update offers context for executives, IT teams, and security professionals navigating a rapidly evolving threat landscape.

Key points

• RenEngine loader is distributed via dozens of pirated software sites, not just cracked games.
• Final payloads include Lumma, ACR Stealer, and Vidar in various infection chains.
• The distribution pattern is opportunistic and regional rather than targeted.
• The campaign uses Ren’Py-based game installers with fake loading screens to deploy malware

Why this matters

The expansion from gaming to cracked productivity software widens the potential victim pool and raises risk for individuals and organizations. Attackers use multi-stage delivery, anti-analysis checks, and broad distribution to bypass defenses. Organizations should reinforce software provenance checks, user education, and behavior-based detection to identify malicious activity masquerading as legitimate software.

What to watch next

• Watch for new distribution sites or bundles carrying RenEngine via cracked software.
• Monitor for updates from security vendors on HijackLoader-based campaigns across multiple payloads.
• Track any new payload families linked to RenEngine or related loaders.

Disclosure: The content below is a press release provided by the company/PR representative. It is published for informational purposes.

Kaspersky identifies RenEngine loader distributed through pirated games and software

Kaspersky identifies RenEngine loader distributed through pirated games and software

February 23, 2026

Kaspersky Threat Research has revealed its analysis of RenEngine, a malware loader that has recently gained public attention. Kaspersky identified RenEngine samples as early as March 2025, with its solutions already protecting users from the threat at that time.

Beyond the cracked games highlighted in recent reports, Kaspersky researchers discovered that attackers created dozens of websites distributing RenEngine through pirated software, including graphics editors like CorelDRAW. This expands the known attack surface beyond the gaming community to anyone seeking unlicensed software.

Kaspersky has recorded incidents in Russia, Brazil, Turkey, Spain and Germany, among other countries. The distribution pattern indicates opportunistic attacks rather than targeted operations.

When Kaspersky first identified RenEngine, the loader was delivering the Lumma stealer. Current attacks distribute ACR Stealer as the final payload, and Vidar stealer has also been observed in some infection chains.

The campaign exploits modified versions of games built on the Ren’Py visual novel engine. When users launch infected installers, a fake loading screen appears while malicious scripts execute in the background. The scripts include sandbox detection capabilities and decrypt a payload that initiates a multi-stage infection chain using HijackLoader, a modular malware delivery tool.

“This threat extends beyond pirated games — attackers are using the same technique to distribute malware through cracked productivity software, which broadens the potential victim pool significantly.”

— Pavel Sinenko, lead malware analyst at Kaspersky Threat Research

“Game archive formats vary by engine and title. If an engine doesn’t check the integrity of its resources, attackers can embed malware that executes the moment you click play.”

Kaspersky solutions detect RenEngine as Trojan.Python.Agent.nb and HEUR:Trojan.Python.Agent.gen. HijackLoader is detected as Trojan.Win32.Penguish and Trojan.Win32.DllHijacker.

To stay protected, Kaspersky recommends:

• Download games and software only from official sources. Pirated content remains one of the most common malware delivery methods.
• Use a reliable security solution. Kaspersky Premium protects against threats like RenEngine through its Behavior Detection component, which identifies malicious activity even when malware is disguised as legitimate software.
• Keep your operating system and applications updated to ensure known vulnerabilities are patched.
• Be skeptical of “free” offers. If a paid game or software is available for free download on an unofficial site, the cost is likely your security.

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect individuals, businesses, critical infrastructure, and governments around the globe. The company’s comprehensive security portfolio includes leading digital life protection for personal devices, specialized security products and services for companies, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help millions of individuals and nearly 200,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.

Bitcoin’s (BTC) weakness extended into the weekly open as major stocks sold off in response to US President Donald Trump’s threat to enforce a 15% global tariff after the Supreme Court ruled that his IEEPA tariffs were illegal.

Market sentiment remains fragile, as the Crypto Fear & Greed Index at 5 out of 100 remains in the “extreme fear” zone. Pseudonymous trader and investor BitcoinHyper said in a post on X that the index has been in the extreme fear zone for nearly three weeks, the longest since 2022.

Traders on the prediction market Polymarket have increased the odds of BTC falling below $55,000 to 72%. The prediction market expectations matches several analysts and financial institutions who expect a fall near or below $55,000.

While a bottom may not have formed, expectations are that BTC will eventually recover and move higher. Economist Timothy Peterson said in a post on X that BTC has been positive 50% of the time in the past 24 months. Using a statistical model, Peterson estimated that there is an 88% chance that BTC “will be higher 10 months from now.” 

Could buyers defend the support levels in BTC and the major altcoins? Let’s analyze the charts of the top 10 cryptocurrencies to find out. 

S&P 500 Index price prediction

The S&P 500 Index (SPX) has been trading between 6,775 and 7,002 for several days, indicating a balance between supply and demand.

The flat moving averages and the relative strength index (RSI) near the midpoint do not give a clear advantage either to the bulls or the bears. Buyers will have to achieve a close above the 7,002 resistance to signal the resumption of the uptrend. The index may then ascend to the 7,290 level.

This bullish view will be invalidated in the near term if the price turns down and breaks below the 6,775 level. The index may then tumble to the solid support at the 6,550 level.

US Dollar Index price prediction

The US Dollar Index (DXY) turned down from the 50-day simple moving average (97.95) on Friday, indicating that the bears are aggressively defending the level.

Sellers are attempting to sink and maintain the index below the 20-day exponential moving average (97.48). If they manage to do that, the index might slide to the 96.21 to 95.55 support zone.

Buyers are likely to have other plans. They will attempt to halt the pullback and push the price above the 50-day SMA. If they can pull it off, the index may jump toward the 99.50 level and subsequently to the 100.54 resistance.

Bitcoin price prediction

BTC fell below the $65,118 support on Monday, but the bulls are attempting to defend the level on a closing basis.

Any relief rally is expected to face selling at the 20-day EMA ($70,185). If the Bitcoin price turns down sharply from the 20-day EMA, it increases the likelihood of a drop to the vital $60,000 support. Buyers will have to defend the $60,000 level with all their might, as a break below it may sink the BTC/USDT pair to $52,500.

Buyers will have to propel the price above the 20-day EMA to signal demand at lower levels. The pair may then march to the $74,508 level, where the bears are again likely to pose a strong challenge.

Ether price prediction

Ether (ETH) fell below the nearby support at $1,897 on Monday, opening the doors for a retest of the $1,750 level.

The downsloping moving averages and the RSI near the oversold territory heighten the risk of a breakdown. If the $1,750 level is taken out, the ETH/USDT pair may resume the downtrend toward the next support at $1,537.

Contrarily, if the Ether price turns up sharply from $1,750, it suggests demand at lower levels. That may keep the pair inside the $1,750 to $2,111 range for a while longer. A close above $2,111 will be the first sign of strength, clearing the path for a rally to the 50-day SMA ($2,593).

XRP price prediction

XRP (XRP) has been trading between the support line of the descending channel pattern and the 20-day EMA ($1.47) for the past few days.

The downsloping 20-day EMA and the RSI in the negative territory indicate that the bears remain in control. If the support line cracks, the XRP/USDT pair may retest the Feb. 6 low of $1.11. A break and close below the $1.11 level may extend the decline to psychological support at $1.

Buyers have an uphill task ahead of them. They will have to swiftly propel the XRP price above the downtrend line to signal a potential trend change.

BNB price prediction

BNB (BNB) fell below the immediate support at $587 on Monday, but the long tail on the candlestick shows buying at lower levels.

The bulls will attempt to start a recovery, which is expected to face selling at the 20-day EMA ($651). If the price turns down from the 20-day EMA, the bears will again strive to pull the BNB/USDT pair below the $570 level. If they manage to do that, the BNB price may start the next leg of the downtrend to psychological support at $500.

Contrary to this assumption, if buyers pierce the 20-day EMA, the pair may rally to the breakdown level of $730.

Solana price prediction

The failure of the bulls to push Solana (SOL) to the breakdown level of $95 signals that the bears are active at higher levels.

Sellers will attempt to strengthen their position by pulling the Solana price below the $76 level. If they succeed, the SOL/USDT pair may fall to the Feb. 6 low of $67, which is a critical support to watch out for. If the level gives way, the pair may slump to $60.

Any relief rally is expected to face resistance at the 20-day EMA and then at the $95 level. A close above the $95 level suggests that the sellers are losing their grip. The pair may then surge to $117.

Related: Bitcoin traders diverge over BTC price strength with $60K in sight

Dogecoin price prediction

Dogecoin (DOGE) turned down from the 20-day EMA ($0.10) on Saturday and is likely to drop to the Feb. 6 low of $0.08.

The bulls are expected to fiercely defend the $0.08 level, as the failure to do so may start the next leg of the downward spiral toward $0.06.

The 20-day EMA remains the immediate near-term resistance to watch out for. A close above the 20-day EMA will be the first sign that the selling pressure is reducing. The DOGE/USDT pair may then ascend to the breakdown level of $0.12, where the bears are expected to mount a strong defense.

Bitcoin Cash price prediction

Buyers pushed Bitcoin Cash (BCH) above the 50-day SMA ($571) on Sunday but could not sustain the higher levels.

The bears sold aggressively and have pulled the Bitcoin Cash price below the 20-day EMA ($551). If the price maintains below $538, the BCH/USDT pair might plummet to the strong support at $500. Buyers are expected to aggressively defend the $500 level, as a close below it may sink the pair to $443.

Buyers will have to drive and maintain the price above the 50-day SMA to signal strength. The pair may then climb to $600.

Cardano price prediction

Despite repeated attempts, buyers failed to push and maintain Cardano (ADA) above the 20-day EMA ($0.28) in the past few days. 

That increases the likelihood of a drop to the support line of the descending channel pattern. If the price rebounds off the support line and breaks above the 20-day EMA, it suggests that the ADA/USDT pair may remain inside the channel for some more time.

Instead, if the Cardano price continues lower and breaks below the support line, it indicates the resumption of the downtrend. The pair may then plunge toward $0.15. A short-term trend change will be signaled after buyers clear the overhead hurdle at the downtrend line.