Key takeaways

• Cardano trades near $0.222 on Monday after rallying more than 15% last week.
• ADA’s long-to-short ratio of 0.94 shows slightly more bearish than bullish positioning.
• Positive funding rates and large whale orders provide mildly bullish signals.
• The RSI and MACD indicate strengthening upside momentum.

Cardano holds gains following 15% weekly rally

Cardano (ADA) trades around $0.222 on Monday after gaining more than 15% last week.

Mixed derivatives data and mildly positive on-chain indicators reflect cautious sentiment among traders. However, strengthening technical momentum suggests ADA could extend its recovery if buyers overcome a cluster of resistance levels between $0.231 and $0.245.

The token currently trades above its 50-day and 100-day exponential moving averages, reinforcing its improving short-term outlook.

Cardano’s derivatives market presents a divided picture on Monday. CoinGlass data shows ADA’s long-to-short ratio at 0.94. A reading below 1 means short positions outnumber long positions, indicating that slightly more traders are betting on a price decline than an advance.

However, the difference between bullish and bearish positioning remains relatively narrow, suggesting traders are cautious rather than strongly bearish.

Funding rates offer a more encouraging signal. Cardano’s open interest-weighted funding rate turned positive on Saturday and stood at 0.0097% on Monday.

A positive funding rate means traders holding long positions are paying those holding shorts, typically reflecting increased demand for bullish exposure. The shift suggests sentiment has improved following ADA’s double-digit weekly rally.

CryptoQuant’s summary data also points to cautiously optimistic sentiment around Cardano.

Large whale orders have appeared in ADA’s futures market, indicating increased activity among well-capitalized traders. Most other tracked metrics remain neutral, limiting the strength of the bullish signal.

The combination of large orders and neutral broader indicators suggests institutional or whale interest may be increasing, but the market has not yet established overwhelmingly bullish positioning.

Continued buying from large traders could support ADA’s recovery, while a decline in whale activity could leave the token vulnerable to profit-taking.

Cardano momentum indicators strengthen

ADA’s price remains above the 50-day and 100-day EMAs, both clustered around the psychologically important $0.200 level.

The Relative Strength Index stands near 61 on the daily chart. This reading reflects solid bullish momentum while remaining below the overbought threshold of 70, suggesting ADA may have room to rise before the rally becomes overstretched.

The Moving Average Convergence Divergence indicator has also turned marginally positive. This shift signals that buyers are gradually gaining control, although a descending trendline continues to act as dynamic resistance.

Together, the RSI and MACD support a constructive short-term outlook, but ADA must clear several overhead barriers to confirm an extended recovery.

Cardano faces immediate resistance at the 61.8% Fibonacci retracement near $0.231. A move above that level would bring the horizontal resistance at $0.236 into focus.

The 200-day EMA sits around $0.243, just below another key resistance level at $0.245. This concentration of technical barriers could attract profit-taking and slow ADA’s advance.

A sustained break above $0.245 and the descending trendline would strengthen the bullish case and potentially open the door to a more substantial recovery.

Conversely, failure to clear $0.231 could trigger a pullback toward the 50% Fibonacci retracement at $0.213.

Below that level, the 100-day EMA around $0.200 and the 50-day EMA near the 38.2% Fibonacci retracement at $0.195 form a broader support zone. Deeper support levels sit at $0.173 and $0.150.

ADA’s outlook remains cautiously bullish while the price stays above $0.200, but overcoming the $0.231–$0.245 resistance region will be crucial for extending the rally.

Bitcoin sidechain Liquid has paused operations after the federation that governs the network lost roughly 4,000 BTC worth about $320 million to actors who claimed they were “white-hat” hackers. Liquid’s operators disabled bridge nodes and moved to stop L-BTC deposits and withdrawals, while stressing that other Liquid-issued assets were not affected.

Blockstream, the technology provider behind Liquid, said it corresponded with the actors through signed on-chain messages. The actors told Blockstream they would return most of the Bitcoin after the underlying vulnerability was fixed and every node installed the patch—though, at the time of publication, the funds had not yet been returned.

Key takeaways

• Liquid disabled bridge nodes and halted new bridge transactions after about 4,000 BTC was withdrawn from its federation wallet.
• L-BTC deposit and withdrawal processing was halted or expected to be halted by exchanges, while other Liquid-issued assets reportedly continued without interruption.
• About 95% of the federation wallet’s roughly 4,200 BTC balance was reportedly moved to the actors.
• Blockstream says it communicated with the actors via signed on-chain messages, and the actors promised a return after patching and node updates.

Liquid pauses bridging as federation funds are pulled

Liquid said on Sunday that bridge nodes were disabled, preventing new transactions. It also indicated that exchanges were either halting or preparing to halt L-BTC deposits and withdrawals, reflecting the sidechain’s need to maintain custody and accounting for its pegged token.

Liquid emphasized that other assets issued on the network—such as USDT, DePix, and tokenized real-world assets—were unaffected by the incident. That distinction matters for users holding non-LBTC assets on Liquid, because it suggests the disruption is centered on the bridge and federation-controlled Bitcoin backing rather than on a broad contract or issuance failure across the sidechain.

The federation wallet withdrawal is described as roughly 95% of the federation’s approximately 4,200 BTC balance. Liquid uses Bitcoin held by its federation to back L-BTC issued on the sidechain. As a result, most of the Bitcoin backing remained under the actors’ control until it is returned, creating a direct liquidity and settlement problem for L-BTC as bridging is paused.

Negotiations via on-chain contact and PGP messaging

According to Blockstream’s reported engagement with the actors, communication took place through signed on-chain messages. Public details of the exchange were later compiled by Samson Mow, CEO of Jan3 and a former Blockstream chief strategy officer, who pointed to a timeline embedded in Bitcoin transactions.

In that account, the actors identified themselves as “white hats” and requested on-chain contact at around 11:30 a.m. Pacific time. Blockstream reportedly responded about an hour later, directing them to its security email. It then allegedly sent a PGP-encrypted message after further correspondence.

Later, the actors reportedly asked whether they could return most of the Bitcoin to a Blockstream address. They also demanded that the vulnerability be fixed and that every node update before the return transfer would occur. Blockstream’s reply—described as acknowledging the address question—was presented publicly by Mow, with the implication that Blockstream agreed to receive the funds at the designated location while also treating patching as a key prerequisite.

By one account relayed publicly, no additional messages were seen after roughly 9:12 p.m. Pacific time, and at the time of writing, the Bitcoin had not been returned.

Technical attribution: Elements bug vs. exchange systems

One issue raised in public discussion is where the exploited flaw originated. SideSwap—connected to peg-out operations—said the withdrawal went through its peg-out service as a customer order using its Peg-out Authorization Key (PAK), but it asserted that the key itself was not compromised.

SideSwap added that the L-BTC used in the transaction traced back to a bug in Elements, the open-source software underlying Liquid, rather than originating from SideSwap’s own systems. For participants watching the fallout, this distinction can affect how quickly exchanges and service providers can operationally reassure users: a failure rooted in underlying Liquid/Elements code generally requires broad patching at the protocol layer, while a failure tied to an exchange-specific signing component would typically be resolved by rotating or securing that component.

Liquid’s decision to disable bridge nodes and coordinate L-BTC deposit/withdrawal freezes aligns with the practical need to stop flows that depend on the federation-controlled Bitcoin backing while technical remediation is verified across the network.

What investors and users should monitor next

The immediate risk from this event is settlement and liquidity disruption for L-BTC, not necessarily for every Liquid-issued token. The key question now is whether the actors follow through on their stated plan to return most of the Bitcoin once a patch is confirmed and every node has updated.

Readers should watch for confirmations from Liquid and Blockstream that the patch is deployed across all nodes, that bridge nodes are restored, and—most importantly—that the returned funds actually reach the federation wallet. Until then, the sidechain’s peg mechanics remain constrained by the absence of the withdrawn Bitcoin backing.

One billion tokens hit the open market on September 1. Instead of dumping, XRP rallied. The monthly escrow release that once spooked retail traders has become background noise for an asset that just logged its strongest on-chain quarter in years.

For eight years, Ripple’s monthly escrow unlock has played out like clockwork. On the first day of every month, the XRP Ledger’s built-in escrow contracts release up to 1 billion XRP into Ripple-controlled wallets. Each time, a wave of anxious posts floods social media. Each time, traders brace for a dump that rarely arrives. And each time, the market moves on.

September 1, 2026, was no different in mechanics. Whale Alert flagged three transactions: 500 million, 400 million, and 100 million XRP, all released from escrow within minutes. The total haul was worth about $1.38 billion at the time. What was different, though, was everything around it.

XRP had just posted its best August in five years. Active addresses on the ledger were at all-time highs. Spot ETFs were pulling in nine-figure inflows. Ripple, freed from its four-year SEC battle, was signing deals with names like Deutsche Bank and JPMorgan. The billion-token release landed in a market that was not scared of it anymore, and for good reason.

This is the story of how the scariest thing about XRP became one of the least interesting.

The anatomy of a billion-token unlock

The escrow program dates back to December 2017, when Ripple locked 55 billion XRP into time-based contracts on the XRP Ledger. The idea was straightforward: remove the supply overhang that critics used to argue XRP was centrally controlled. The protocol would release up to 1 billion tokens on the first of each month, and anything Ripple did not sell would go back into escrow at the end of the queue.

Nine years later, the program has released tens of billions of XRP. Ripple’s escrow balance has dropped from 55 billion to 31.28 billion as of the September release, according to crypto.news data on XRPL escrow mechanics. But the net effect on circulating supply has been modest. Ripple typically re-escrows 700 to 900 million XRP each month, leaving only 100 to 300 million for operational use, OTC liquidity deals, or institutional payments.

The math is simple. A billion tokens sound alarming. But when 70 to 90 percent go right back into lockup, the actual supply entering the market is a fraction of the headline number. Historical data backs this up: monthly escrow releases have produced average 7-day price swings of negative 3.1% to positive 1.7%, with 30-day volume bumps of 15 to 22 percent. Not nothing, but not the catastrophic sell events that early critics predicted.

Compare that to traditional equity markets. When a public company’s lockup period expires and insiders can sell, the stock often drops 5 to 15 percent in a single session. XRP’s monthly unlock is milder than a typical IPO lockup expiry. The difference is predictability. Everyone knows when the tokens are coming. Everyone knows how many. And everyone knows Ripple’s historical re-escrow behavior. There is no information asymmetry, which means there is no panic.

Rocket has suspended deposits, withdrawals and trading after an attacker manipulated a dormant perpetual market and withdrew approximately $287,000 in positive PnL from the platform’s Bridge.

Rocket said in a Sept. 7 update on X that the security incident occurred at approximately 19:00 UTC on Sept. 5, when an attacker targeted an inactive perpetual market using a burner account.

The attacker placed orders at artificially inflated prices and traded against themselves, creating artificial profits in one account while pushing the burner account into bankruptcy. The profitable account subsequently withdrew around $287,000 from the Bridge, leaving the resulting loss to be socialized across the platform.

Rocket attack used self trading to create artificial profits

Instead of describing a smart contract vulnerability, Rocket’s initial account of the incident centered on the manipulation of a dormant perpetual market with limited activity.

Using a disposable account, the attacker was able to post orders at inflated prices before acting as both sides of the trades. Rocket said the transactions generated “fake profits” for one account while the burner account accumulated the corresponding losses and became insolvent.

The account showing positive PnL then withdrew approximately $287,000 through the Bridge before the activity was stopped.

Rocket has since paused all trading, deposits and withdrawals while its team investigates the incident. The project did not provide a timeline for restoring the affected services or disclose how many users were exposed to the socialized loss.

Blockchain security tracker SlowMist classified the incident as a price manipulation attack and recorded the loss at $287,000.

The method bears similarities to previous incidents in thin perpetual markets where traders have been able to manipulate prices or positions and transfer resulting losses to liquidity providers or other parts of a trading platform.

In March 2025, a trader targeted Hyperliquid’s thin JELLY market by opening a large short position while buying the token on decentralized exchanges. The activity drove JELLY’s price sharply higher and pushed the short toward liquidation, eventually transferring the position to Hyperliquid’s liquidity vault.

As crypto.news previously reported, Hyperliquid restricted the trader’s accounts to reduce-only mode before validators later voted to delist the JELLY perpetual market and settle outstanding positions.

A separate Hyperliquid incident in March 2025 saw its HLP vault absorb around $4 million in losses after a trader withdrew collateral from a highly leveraged Ether position before liquidation. Hyperliquid said at the time that the event was not a protocol exploit and subsequently changed leverage requirements for Bitcoin and Ether positions.

Rocket seeks to freeze the stolen $287,000

With platform operations suspended, Rocket said it is working with security firms and law enforcement agencies to investigate the attack and recover the funds.

The team is coordinating with cryptocurrency exchanges, cross-chain bridges and stablecoin issuers to trace the stolen assets and attempt to freeze them. Rocket has not disclosed the identities of the security companies or law enforcement agencies involved in the investigation.

Similar measures have been used after other recent DeFi incidents, particularly when attackers attempt to move funds through bridges or centralized trading venues.

AFX suffered a cross-chain bridge exploit in July that drained 24.15 million USDC. Security firm Blockaid worked with the Arbitrum team to investigate the incident as the attacker transferred the stolen USDC to Ethereum and converted the proceeds into 12,467.5 ETH.

Earlier in June, Axelar disabled bridge routes connected to Secret Network after an exploit resulted in roughly $4.7 million in losses. Axelar said the incident was limited to bridged assets on Secret Network and did not compromise its core protocol.

Rocket has not disclosed whether any portion of the $287,000 has been frozen or recovered so far.

Smaller Rocket accounts are first in line for refunds

The team is preparing a recovery plan for users affected by the incident, with smaller accounts expected to receive priority when refunds begin.

Rocket said it understands that compensation is the update affected users are waiting for but will provide specific details only when it can do so responsibly. The platform has not yet disclosed the size of its available recovery funds, eligibility requirements, payment method or a timetable for reimbursements.

Recovery programs have taken different forms following previous attacks on decentralized trading protocols.

GMX, for example, completed a roughly $44 million compensation plan in August 2025 for liquidity providers affected by an exploit of its V1 GLP pool. The protocol used GLV tokens for distributions, while its DAO treasury covered a $2 million shortfall.

The GMX attacker had previously returned approximately $37.5 million of the roughly $42 million stolen after the protocol offered a 10% white-hat bounty. The affected V1 system was paused after the attack, while GMX V2 remained operational.

Rocket has not announced a similar bounty or offered terms directly to the attacker. Its current recovery effort remains focused on tracing the withdrawn funds and developing a reimbursement plan.

The platform warned users to watch for impersonators attempting to take advantage of the incident. Rocket said recovery information will be published only through its official X account and Discord channels, adding that team members will not contact affected users first through direct messages.

On Sept. 7, unidentified actors controlling nearly 4,000 BTC taken from Liquid Network offered to return “most” of the funds after Blockstream fixes the vulnerability behind the estimated $320 million incident.

The actors communicated their offer through Bitcoin transactions carrying OP_RETURN messages, according to a reconstruction published by Galaxy Research head Alex Thorn. They asked whether returning “most” of the Bitcoin to the federation’s address would be acceptable.

A later message told Blockstream to “fix the bug first” and ensure every node received the patch. The actors claimed the chain remained exposed under its latest software version and promised to transfer the money after confirming the repair.

That promise remains unverified. The actors did not define how much “most” represents, disclose their identities or provide a deadline. No confirmed return transaction had appeared when this article was prepared.

On-chain messages authenticate the negotiation

Blockstream initiated contact at Bitcoin block 965,822 by sending 1,000 satoshis with a message directing the recipient to its security team. Another transaction contained encrypted material and a detached signature verifiable against Blockstream’s published PGP key.

At block 965,869, the actors sent 1,000 satoshis to the federation’s peg address and asked about returning most of the funds. They provided their patch demand six blocks later. The messages establish that someone controlling the relevant Bitcoin could respond to Blockstream. They do not independently prove the actors’ motives.

The incident began with a peg-out of approximately 3,996 BTC. The corresponding Bitcoin transaction was confirmed in block 965,783 on Sept. 6. A separate transaction carried the initial claim: “we are whitehats. contact us on chain.”

The 4,000 BTC withdrawal exposed Liquid’s peg

Liquid confirmed that approximately 4,000 BTC had left its federation wallet. It described those responsible as “purported white-hat hackers,” preserving uncertainty around their status.

The network said the withdrawal used SideSwap’s Peg-out Authorization Key, or PAK. However, it said there was no evidence that the key itself was compromised. Liquid has not publicly explained the underlying vulnerability or released a technical postmortem.

Liquid operates as a Bitcoin sidechain whose users lock BTC and receive L-BTC for activity on the network. The federation holds the underlying Bitcoin and authorizes withdrawals back to the base layer. The transfer reportedly removed about 95% of the wallet’s Bitcoin.

Liquid disabled its bridge nodes and asked exchanges to suspend L-BTC deposits and withdrawals. It said other issued assets, including stablecoins and real-world assets, were not directly removed. The sidechain remained effectively paused while the investigation continued.

The episode adds another large loss to a year dominated by infrastructure failures. As crypto.news reported, crypto protocols lost at least $1.3 billion to hacks during the first eight months of 2026. In related coverage, an examination of cross-chain bridge security explained how concentrated custody and authorization systems can create large points of failure.

Blockstream must patch the network before any restart

Blockstream’s immediate task is to identify the flaw, prepare a patch and distribute it across the federation. The actors specifically demanded that every node be updated before repayment. Blockstream has not announced a patch version or reopening time.

A return can only be treated as confirmed after the Bitcoin moves to an address controlled by the federation. Even then, the amount retained by the actors and any proposed bounty would require disclosure.

Liquid must also account for the remaining reserves, explain how the peg-out bypassed normal controls and specify how L-BTC redemptions will resume. A technical postmortem would be needed to show whether the problem involved software, authorization logic, federation operations or another part of the withdrawal process.

Until those steps occur, the repayment remains a conditional promise and the “white hat” description remains disputed.

The key catalyst for the Australian dollar remains the July inflation data released on 26 August. The figure came in at 3.5% year-on-year, versus expectations of 3.2%, while the Trimmed Mean increased by 0.5% month-on-month, compared with a forecast of 0.3%. The following day, 27 August, NAB revised its forecast for the RBA’s next policy decision. The bank now expects a 25-basis-point rate hike at the September meeting, taking the rate to 4.6%, with the risk of another increase in November.

For the Canadian dollar, the key factor was the Bank of Canada’s decision. On 2 September, the central bank left its policy rate unchanged at 2.25% for the seventh consecutive meeting, highlighting economic uncertainty stemming from US tariffs and Canada’s retaliatory trade measures.

Technical Analysis of AUD/CAD

The four-hour AUD/CAD chart shows a pronounced uptrend that has lifted the pair towards the current resistance level at 0.9985. A pattern resembling a converging triangle formed near the top of this advance, with price fluctuations gradually narrowing within the formation. However, volume dynamics during the second half of the pattern’s formation have been atypical, casting doubt on its reliability.

Nevertheless, the price has broken out of the pattern while also moving above the upper boundary of the current market profile at 0.9950, and is attempting to establish itself above this level. If the advance continues, the red resistance level around 0.9985 is the next key obstacle on the upside.

In the event of a false breakout, the price could return to the profile. If the scenario turns bearish, the pair would need to break not only the upper boundary of the profile but also the Point of Control (POC) at 0.9935 and the lower boundary at 0.9910. Below the market density, a green support level is located around 0.9895.

The RSI + MAs indicator is showing readings of 59, 52 and 54. The RSI has moved above the neutral zone, while both the fast and slow moving averages remain below its upper boundary.

Key Takeaways

The atypical volume dynamics during the formation of the triangle leave the reliability of the breakout uncertain, while the price’s attempt to establish itself above the market profile has yet to receive confirmation from the RSI + MAs indicator. The pair’s further direction could depend largely on whether the expected tightening of RBA policy materialises against the backdrop of the Bank of Canada’s wait-and-see stance.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.