Corporate Bitcoin treasuries appear to be losing momentum, according to new on-chain analysis that suggests many current holders are still trading at a loss and new buying is not strong enough to offset that overhang. Glassnode data indicates listed companies acquired only a small fraction of the BTC they were purchasing during peak activity in mid-2025, while the group’s blended cost basis remains above current spot levels.

The result is a market where treasuries are less able to “support” price from the margin: if buyers have stopped accumulating and their positions are still underwater, the existing holdings function more like overhead supply than an active demand driver—at least for now.

Key takeaways

• Glassnode reports listed corporate treasuries added about 5,900 BTC in 2026 over roughly three months—far below the scale of purchases seen in July 2025.
• For existing corporate holders, the aggregate corporate treasury cost basis averages around $80.5K, keeping the cohort roughly 6% under water versus spot.
• Glassnode says 2026 has featured two attempts to reclaim that cost basis, but both failed as price could not stay above the level.
• ETF flows have turned negative again, with US spot Bitcoin ETFs recording net outflows of $462.7 million in the five trading days through Sept. 11.
• Glassnode frames current conditions as a “market in waiting,” pointing to weakening demand signals in realized cap.

Corporate buys shrink as treasuries stay underwater

In 2026, listed companies have accumulated approximately 5,900 BTC, Glassnode said, citing its “FlowsNetCompanies” treasury flow charts. The number is presented as notably small relative to acquisition intensity during July 2025, when companies bought around 89,000 BTC even while BTC/USD was trading above $100,000.

That contrast matters because it highlights a shift in corporate behavior: rather than continuing to add at a pace that could meaningfully change the supply-demand balance, many buyers appear to be waiting for clearer price confirmation. Glassnode notes that current treasuries have not yet normalized into a profitable position.

In the latest edition of its newsletter, The Week Onchain, Glassnode stated that the “Corporate Treasury Cost Basis” for existing holdings sits at about $80.5K—roughly 6% above spot—meaning the group is collectively underwater.

Glassnode also emphasized that 2026 has only produced two efforts to reclaim that cost basis, and both attempts were unsuccessful due to price failing to hold above the target level. The analysis argues that a buyer that has paused purchases while remaining in a paper loss is not acting as active support.

“A reclaim of $80.5K would put the treasuries back in profit and remove one layer of overhead supply; until then their entry is one more ceiling.”

Strategy’s pace slows, but it remains a dominant holder

While corporate demand is depicted as broadly muted, not every company has stopped buying entirely. Business intelligence firm Strategy—widely cited as holding one of the largest corporate Bitcoin treasuries—made its most recent purchase at the end of August, adding 4,603 BTC. The purchase is described by earlier reporting from Cointelegraph as the company’s first acquisition in two months.

Even with that incremental addition, Strategy’s broader position still reflects the same macro reality: Glassnode data cited in the report places the cost basis of Strategy’s 845,050 BTC holdings at $75,412. That figure is below the average corporate cost basis referenced for the overall treasury cohort, but the wider point remains that corporate accumulation is not currently acting as a steady, price-anchoring flow across the sector.

Why Glassnode calls it a “market in waiting”

The slowdown in corporate purchases is occurring alongside shifting macro and investor-risk conditions. Glassnode frames the current state as consistent with broader caution in the crypto market, where uncertainty about BTC’s forward strength tends to suppress incremental buying.

This caution was echoed in US policy developments: on Wednesday, the US Federal Reserve implemented its first interest-rate hike since July 2023, according to Cointelegraph’s coverage. Rate-hike cycles typically tighten financial conditions and can weigh on liquidity-sensitive assets, which helps explain why demand for Bitcoin products can become more reactive to short-term price moves.

One way to measure that sensitivity is through spot Bitcoin ETF flows. Earlier coverage from Cointelegraph noted that US spot Bitcoin ETFs saw net outflows of $462.7 million across five trading days through Sept. 11. The report also states this reversed a sequence of three consecutive weeks of net inflows, reinforcing the idea that near-term risk appetite has cooled.

Glassnode links these ETF and broader market patterns to what it calls a “market in waiting.” It further adds that Bitcoin’s realized cap—defined in crypto analytics as the cumulative price at which the supply last moved on-chain—has begun to fall as of Sept. 15. A decline in realized cap is interpreted as weaker demand at prevailing prices, suggesting fewer participants are willing to establish new cost anchors higher up the curve.

In the analysis, realized cap is cited at around $1.069 trillion. Glassnode’s interpretation is conditional: a return to positive daily realized cap changes would indicate that buyers are coming back and supporting prices. Conversely, outflows while BTC trades below the mean would suggest that “range’s buyers” are beginning to give up.

For investors and traders, this matters because the “ceiling” described for treasuries and the “waiting” posture described via realized cap both point to the same dynamic: demand is not being expressed aggressively at current levels. When both corporate accumulation and ETF-based flows soften, the market can become more dependent on narrow pockets of buying rather than a broad, continuous bid.

“A return to positive daily Realized Cap changes would say the buyers are back; a run of outflows while price sits under the mean would mean the range’s buyers have started to give up,” Glassnode concluded.

What to watch next in corporate and on-chain demand

The key question now is whether corporate treasuries and wider market participants will resume accumulating strongly enough to change the balance between overhead supply and fresh demand. Glassnode’s framework implies that reclaiming the corporate treasury cost basis near $80.5K could reduce that overhead layer—but it also notes that previous attempts in 2026 failed to hold.

Heading into the next trading weeks, readers should watch for two confirmations: sustained ETF inflows (rather than brief reversals) and signs that realized cap is stabilizing or turning upward again. Together, those signals would better indicate whether the “market in waiting” is easing—or whether the current pause in corporate buying will continue to weigh on sentiment.

Tom Farley, CEO of CoinDesk owner Bullish, also said the bill’s failure is not an insurmountable hurdle.

“Durable legislation would give the digital asset industry greater certainty. But even with legislation, the real work of implementation happens at the agencies, and agencies can move faster,” he said in a post on X. SEC and CFTC rulemaking may prove more consequential in the near term for tokenized securities, including how issuers, transfer agents and issuer-sponsored tokens are treated, he said.

Nilmini Rubin, chief policy officer at Hedera, said the vote does not end the legislative effort. “We’ve seen policymakers put real time and effort into studying the underlying technology, which is a positive step in the right direction,” she said. “I think most of the industry is still as ambitious as ever that we’ll get to where we need to be.”

Still, Rubin said, U.S. competitiveness remains at risk as long as the market lacks clear rules.

“The largest loser is U.S. competitiveness because uncertainty pushes innovation and adoption in the U.S. behind other countries,” she said. “The longer the market lacks clear rules, the more difficult it is to ensure the United States remains at the center of this system, rather than on the margins of it.”

Glamsterdam raised its block gas limit from 60 million to 200 million about an hour after going live on the testnet. Gas measures the computing work required by transactions, so the higher ceiling creates room for more payments, token swaps and other activity in each block.

How that helps Ethereum

A 200 million limit would let Ethereum absorb more activity before users begin outbidding one another for block space, which could make fee spikes less severe when trading surges or a popular token launch clogs the network.

Larger blocks are also harder to check and could leave smaller operators unable to keep up. Glamsterdam is Ethereum’s attempt to gain that extra capacity without making the chain prohibitively expensive to run.

Specialized builders package transactions, while validators check the resulting blocks and secure the chain. Glamsterdam would place that handoff and the accompanying payments inside Ethereum’s own rules, reducing dependence on outside relay services.

The change also extends the time available to spread block data across the network from about two seconds to nine seconds. That gives validators longer to receive and check the larger blocks Glamsterdam is designed to support.

As such, the 200 million limit remains a test setting rather than a commitment for Ethereum’s main network. Devnet-11 was also designed as a controlled rehearsal without deliberate attacks.

State-linked hackers are increasingly using public blockchains as a durable way to “dead drop” malware instructions and infrastructure details, according to a Chainalysis report cited by Cointelegraph. The firm estimates that roughly two-thirds of new quarterly activity involving these techniques is tied to state-aligned operators, while the frequency of such “dead drop” writes has surged dramatically over the past year.

Chainalysis reports that the number of times attackers stored malware-related payload information on public chains rose 420% in the last 12 months. It also highlights cases involving North Korea- and Iran-linked groups, showing how encoded blockchain data can outlast takedowns of domains, servers, or code repositories.

Key takeaways

• Chainalysis attributes about two-thirds of new dead drop blockchain activity per quarter to state-linked threat actors.
• Dead drop payload writes across public blockchains increased 420% year over year, signaling faster scaling of these tactics.
• Chainalysis linked previously unattributed activity across Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.
• Chainalysis also recorded a 440% rise in malicious blockchain writes since July 2025, coinciding with the emergence of higher-capacity open-source AI models.
• Iran-linked actors are suspected to have used Bitcoin to publish encoded command-and-control routing data that infected devices can periodically check.

More “dead drop” payloads on-chain

Chainalysis frames the technique as a way to make malware campaigns harder to disrupt. Instead of relying on websites, domains, or code hosts that can be seized or shut down, attackers encode instructions and infrastructure pointers directly into transactions on public blockchains. The information persists because blockchain data remains accessible even if off-chain components are removed.

In practical terms, the approach improves campaign durability: malware can continue operating as long as it can retrieve updated instructions from the blockchain. Chainalysis notes that in 2025, North Korean hackers used a similar concept—called EtherHiding—to conceal crypto-stealing code inside smart contracts.

North Korea-linked routing across multiple chains

One of Chainalysis’ detailed findings connects activity that previously lacked clear attribution across Tron, Aptos, and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.

Chainalysis reports that encoded pointers embedded in Tron and Aptos transactions directed compromised devices to the same BSC transaction. In the workflow described, Tron functioned as an initial route, while Aptos served as a fallback if the first path did not work as intended.

The BSC transaction, according to Chainalysis, included encrypted server addresses and configuration data. Those encrypted details tied infected devices to off-chain infrastructure used for remote access and data theft—meaning the blockchain acted as the resilient “messaging layer” while the operational work moved outside the chain once instructions were retrieved.

For investors and builders, this multi-chain structure matters because it increases the surface area responders must monitor. Instead of focusing on a single chain or a single contract address type, defenders may need to track how attackers chain together multiple networks to improve reliability.

AI tools may be boosting malicious on-chain output

Chainalysis also links a surge in harmful blockchain behavior to developments in AI capabilities. The firm recorded a 440% increase in malicious blockchain writes since July 2025, a period it associates with when high-capacity open-source Chinese AI models became capable of producing malicious code with limited safeguards.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that the company found a “clear point-in-time association.” However, he emphasized that Chainalysis could not definitively prove that the actors responsible for the malicious transactions and contracts were specifically using those models to increase output.

This distinction is important. The data indicates timing alignment, but causality remains unconfirmed. Readers should treat the finding as an early warning about how quickly automated code generation tools could lower the cost of producing and deploying blockchain-based malware—without assuming a direct “AI used” attribution for every case.

Iran-linked actors using Bitcoin as a command channel

Beyond North Korea-linked cases, Chainalysis says it identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain.

Unlike approaches that rely on blockchain activity alone, Chainalysis states its assessment was grounded in a broader set of indicators: the malware family involved, the decoding method, timing patterns, and server infrastructure tied to previously reported Iranian operations.

Chainalysis says attacker-controlled wallets sent small payments to a widely known Bitcoin address with historical ties to Satoshi Nakamoto. The report indicates that this address has no connection to the attackers; rather, it is used as a permanent public location that infected devices could check for updated routing instructions.

According to Chainalysis, the attackers could revise their server infrastructure by publishing another Bitcoin transaction. Once the malware obtained the new instructions, the operation could shift back off-chain, enabling behaviors such as remote access, credential theft, and delivery of additional malware payloads.

From a threat-management perspective, using a familiar and long-lived Bitcoin address complicates takedowns. Even if defenders act against the obvious infrastructure, the blockchain location can remain publicly available and function as a reliable beacon for compromised devices.

Why this trend is likely to keep intensifying

As dead drop techniques spread and as malicious on-chain writes accelerate, the challenge for the ecosystem is not just spotting individual malicious transactions—it’s anticipating how attackers design fallback routes, encrypt payloads, and distribute retrieval logic across chains. The most actionable takeaway for monitoring teams is to focus on behavior patterns around payload writes and encoded routing mechanisms, rather than relying solely on domain or server takedowns.

Going forward, readers should watch whether defenders and analytics firms shift toward cross-chain correlation of encoded instruction flows, and whether future reporting can move beyond “association” to clearer evidence about how AI tooling is operationally integrated into these campaigns.

As the CLARITY Act was rejected with 49 votes in favor and 50 votes against, the bill was not advanced. With substantial outflows from spot ETFs, XRP is facing selling pressure and its price continues to decline.

Investors have reduced their investment in higher-risk assets, causing an overall decline. Against the backdrop of a sluggish cryptocurrency market, more and more XRP investors are beginning to explore cloud mining to earn passive income of up to $10,000 per day.

As U.S. Treasury yields rise, investors have reduced their investment in higher-risk assets, leading to an overall decline. The yield on 10-year U.S. Treasury bonds once exceeded 5%, significantly “increasing the opportunity cost of holding non-yielding assets, including most of the cryptocurrency market.”

At the same time, oil prices exceeding $100 per barrel, geopolitical tensions, and expectations of tighter monetary policy have all intensified pressure on risk assets. “Market volatility may remain elevated,” Masabuni pointed out, as the market faces multiple challenges from monetary policy, regulation, and geopolitical risks.

Ryan Kirkley, Co-Founder and CEO of the Global Settlement Network, also pointed out that the Senate’s failure to advance the CLARITY Act immediately put pressure on the cryptocurrency market, with crypto-related stocks such as Coinbase (Nasdaq: $COIN) and Circle (NYSE: $CRCL) facing pressure.

“The reaction from investors precisely demonstrates how much they value regulatory certainty,” Kirkley told Crypto.news, adding that institutional capital needs to know “who regulates what, how assets are classified, what intermediaries can do, and the scope of responsibilities of the U.S. Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). When the answers to these questions remain unresolved, capital must price this uncertainty into the market.”

A new choice for XRP investors: UE Crypto’s path to growing returns

Given this trend, more and more XRP investors are turning their attention to UE Crypto, exploring more stable and sustainable income models through cloud mining and income aggregation mechanisms.

Compared with more volatile futures trading or ETF investments, UE Crypto provides a more straightforward and convenient way to participate in digital assets, helping users improve the efficiency of their digital assets while participating in the development of the XRP ecosystem. For users with a certain amount of capital, this model may offer greater potential for daily returns.

Unlike highly volatile leveraged trading or strategies that rely solely on price appreciation, the Crypto cloud mining platform provides a more convenient way to participate in digital assets. Users do not need to deploy mining machines or maintain hardware; they only need to select a computing-power contract to participate in mining services. This allows them to focus on the long-term prospects of XRP while maximizing the returns of their digital assets.

About UE Crypto

UE Crypto is headquartered in the United Kingdom and operates under European regulatory frameworks such as MiCA and MiFID II, continuously improving its transparency, operational standards, and user protection mechanisms.

The platform adopts a multi-layer security architecture, including:

• Annual financial and security compliance audits conducted by PricewaterhouseCoopers (PwC);
• Digital asset custody insurance provided by Lloyd’s of London;
• Enterprise-level cybersecurity protection from Cloudflare and McAfee® security systems;
• Bank-level data encryption technology and professional security infrastructure, providing multiple layers of protection for user assets and accounts.

UE Crypto supports a variety of mainstream digital assets, including XRP, BTC, ETH, USDT, USDC, DOGE, LTC, and SOL, providing users with a more flexible and convenient digital asset service experience.

How to Join UE Crypto

With just three steps, you can easily start earning daily returns:

1. Register an account

Visit the official UE Crypto website and register using your email address to receive a $20 trial reward.

2. Choose a mining package

According to your personal budget and needs, choose a suitable cloud mining contract and start mining with one click.

3. Start earning

After the contract is activated, the system will automatically allocate computing power, and returns will be automatically settled every 24 hours. Users can withdraw their returns at any time or continue participating according to their needs, achieving long-term compound growth of their assets.

Popular UE Crypto contracts:

BTC (Super Computing System Contract)
Investment Amount: $1,000
Contract Duration: 10 days
Daily Return: $13.10
Total Return at Contract Expiration: $1,000 + $131

LTC (Algorithm-Driven System Contract)
Investment Amount: $5,000
Contract Duration: 25 days
Daily Return: $72
Total Return at Contract Expiration: $5,000 + $1,800

BTC (Quantitative Intelligent System Contract)
Investment Amount: $10,000
Contract Duration: 35 days
Daily Return: $158
Total Return at Contract Expiration: $10,000 + $5,530

For more details about the contract plans, please visit the official UE Crypto website.

Conclusion

UE Crypto was founded in 2015 and is headquartered in London, United Kingdom. It is a globally leading innovative cloud computing platform. We deeply integrate cutting-edge hardware, intelligent core algorithms, and powerful cloud infrastructure to provide global users with high-performance, cost-effective crypto asset solutions. As a pioneer in the fields of cloud computing technology and digital asset services, UE Crypto brings together a team of top experts and adheres to the core values of “green, intelligent, open, and sustainable.” UE Crypto is committed to leading the global blockchain energy revolution. Through innovative cloud computing architecture and decentralized finance (DeFi) technology, we are fully committed to promoting the development of an efficient and low-carbon computing ecosystem. We are reshaping the future of an open and shared digital economy while continuously creating long-term value for global users.

UE Crypto’s cloud mining services provide users with a low-risk alternative for long-term engagement with the digital asset ecosystem, helping investors move away from short-term market noise, focus on the long-term value of their assets, and establish a more resilient and sustainable form of passive income.

For more information, please visit the official UE Crypto website and download the application.

Solana price rose back above $100 after buyers defended the $95–$96 support zone, but technical resistance and concentrated liquidation levels near $102 could determine whether the rebound develops into a wider recovery.

Solana price rebounds from $96 support

Solana (SOL) price traded near $100.50 after recovering from a 24-hour low of $96.23, according to the daily chart. The rebound followed a sharp sell-off linked to the US Senate’s failed procedural vote on the CLARITY Act and the Federal Reserve’s 25-basis-point rate increase.

The daily chart shows that SOL briefly moved below $100 before buyers entered around the $95–$96 area. The recovery carried the price back to the Murrey Math major support and resistance pivot at $100.

Holding that pivot would improve the short-term structure following the decline from the late-August peak near $110. However, the asset has not yet cleared the lower highs formed during September, leaving its broader recovery incomplete.

Crypto analyst Ella identified $95–$96 as the level Solana needed to defend. She said SOL fell to $96.13 around the Fed decision before bouncing to $98.72 and outperforming Bitcoin and Ethereum during the initial recovery.

“Get back above it and yesterday’s damage starts to look repairable,” Ella wrote, referring to the $100 level.

The analyst warned that another loss of $96 could cause the rebound to fade quickly. SOL’s recovery above $100 therefore needs confirmation through sustained closes rather than a brief intraday move.

Momentum improves, but Supertrend remains bearish

The daily Aroon indicator favors buyers after the rebound. Aroon Up stood at 85.71%, compared with an Aroon Down reading of 21.43%. The gap suggests that a recent high carries more weight than the latest low within the indicator’s 14-day lookback period.

SOL must continue holding $100 for that momentum signal to remain constructive. The next daily resistance appears at $106.25, marked as the top of the current Murrey Math trading range.

A daily close above $106.25 would strengthen the case for a return toward $110 and the next major pivot at $112.50. Higher resistance sits at $118.75 and $125, although SOL would first need to break its September sequence of lower highs.

The 4-hour chart remains less supportive. SOL traded below the Supertrend level of approximately $102.80, keeping the indicator’s short-term signal bearish. Price must reclaim that level before buyers can argue that the latest correction has ended.

The Awesome Oscillator also remained slightly below zero at about -0.76. Its negative bars were contracting, however, suggesting that bearish momentum was losing strength as SOL recovered from $96.

A move above the zero line would confirm improving 4-hour momentum. Failure to do so could leave the latest advance vulnerable to another rejection between $101 and $103.

SOL liquidation map puts $102 in focus

The three-day CoinGlass liquidation heatmap shows a dense concentration of leveraged positions immediately above the current price. The brightest nearby bands sit around $101.30 and $101.80–$102, making that zone a potential target during an upward move.

A push into those levels could liquidate short positions and help SOL test the 4-hour Supertrend resistance at $102.80. Additional liquidity appears around $105 and $105.70, close to the upper end of the $101–$106 resistance region visible on the price charts.

Liquidity also remains below the market. The clearest downside concentrations appear near $99, $96, and $95.50. Losing $99 could therefore pull the price back toward the defended $95–$96 zone as leveraged long positions come under pressure.

The heatmap does not establish price direction on its own. It instead identifies areas where forced position closures could add speed to an existing move. With sizable liquidity on both sides, a break from the $96–$103 range may produce a sharper move than the recent consolidation suggests.

Solana bulls face resistance between $102 and $106

The immediate bullish case depends on SOL holding the $100 pivot and breaking $102.80. Clearing the 4-hour Supertrend could open a move toward $105 and the daily resistance at $106.25.

Rand Group said Solana continued to defend horizontal support while pressing against a local downtrend. Its shared chart showed the asset compressing beneath descending resistance after recovering from its midyear lows, a structure the firm described as a possible breakout setup.