In a security-focused update, the XRP Ledger Foundation (CRYPTO: XRP) confirmed it patched a critical flaw in an upcoming amendment to Ripple’s XRP Ledger, averting a potential on-chain exploit. On February 19, a Cantina security engineer and its AI assistant detected a logic flaw in the signature-validation routine tied to a code batch amendment. The amendment had entered voting but had not activated on mainnet, and officials stressed that no funds were at risk at the time. The incident underscores how on-chain governance, automated discovery, and rapid patching interact in the evolving security landscape of public blockchains.

Key takeaways

• The flaw resided in the signature-validation logic of a code-batch amendment slated for the XRP Ledger, creating a theoretical path to unauthorized transactions if exploited.
• The amendment was still in the voting phase and had not been activated on mainnet, meaning funds were not exposed at the time of discovery.
• Cantina AI’s autonomous vulnerability hunter Apex identified the issue, highlighting the role of AI-powered tooling in proactive security workflows.
• The XRPL Foundation described the potential exploit as capable of eroding confidence in the XRP Ledger and destabilizing the broader ecosystem if left unpatched.
• An emergency patch, rippled 3.1.1, was released on February 23 to block the amendment from activating, reflecting a rapid, coordinated response by the Ripple engineering and validator communities.

Tickers mentioned: $XRP

Market context: The episode arrives amid increasing attention on governance safety, on-chain upgrade processes, and the growing use of AI-driven security tools to identify flaws before they can be exploited. While no funds were at risk in this instance, the incident underscores how rapid disclosure, responsible patching, and a mature validator environment help preserve confidence in public ledgers as the crypto industry navigates ongoing macro and regulatory uncertainties.

Why it matters

The XRPL ecosystem demonstrated a disciplined, defense-forward response to a potential class of vulnerability that could have had outsized consequences. In this case, the vulnerability lay in a signature-validation routine tied to a prospective amendment. Because the amendment had not yet activated on mainnet, the risk remained theoretical, but the XRPL Foundation’s decision to halt its momentum and push for a secure fix illustrates how governance processes can act as a safeguard against mischief or misconfigurations before they ever affect real users or funds.

Beyond the immediate incident, the episode spotlights the balance between improvement and risk in decentralized networks. Amendments that modify validation logic or consensus rules are powerful but carry operational risk; the governance cycle—proposal, testing, voting, and activation—must be coupled with robust security testing to prevent drift between code intent and on-chain behavior. The XRPL Foundation’s emphasis on a clear, auditable patch path reinforces the importance of reliability as developers push new features and optimizations onto a live ledger used by institutions and individuals alike.

On the security tooling front, the event contributes to a broader narrative about AI-enabled defense. Cantina AI’s autonomous discovery tool—Apex—identified the bug through static analysis of the rippled codebase and submitted a disclosure that allowed Ripple’s engineering teams to validate and patch the issue. This incident sits within a growing backdrop where AI-driven scanners and automated auditing are increasingly deployed to detect flaws that human inspectors might miss. Anthropic’s Claude Code Security, unveiled just days earlier, has already become a talking point in security circles, illustrating a trend toward AI-powered reasoning in vulnerability detection and remediation. As AI tools become more integrated into software development and security workflows, the industry may see faster mitigations but also a need to manage the risk of false positives and new threat surfaces introduced by automated processes.

A successful large-scale exploit could have caused substantial loss of confidence in XRPL, with potentially significant disruption for the broader ecosystem.

The investigation also aligns with broader discussions about the economics of security in crypto networks. Cantina’s Hari Mulackal has framed the potential impact in monetized terms, noting that the hypothetical loss could have been dramatic, given the scale of the XRP market capitalization. While the specific asset’s price is subject to broader market dynamics, the emphasis here is on preserving trust and functionality within the ledger’s architecture, rather than on short-term price moves.

In tandem with the technical response, the incident demonstrates how AI-enabled security tooling is reshaping incident response in crypto. The use of automated code analysis, prompt vulnerability disclosure, and rapid patching can shorten the window during which an attacker could act, shifting risk dynamics in favor of users and validators who uphold the network’s integrity. The ripple effect across ecosystems is unlikely to be isolated to one project; as more blockchains integrate similar tools, the bar for secure upgrade processes rises, potentially reducing the frequency and severity of major exploits in the future.

What to watch next

• Monitor updates on the amendment’s voting status and any new disclosures from XRPLF and Ripple’s engineering teams, including patch notes and rollback options if needed.
• Watch validator participation in rippled 3.1.1 adoption and downstream effects on on-chain performance and upgrade timelines.
• Follow Cantina AI’s ongoing research and any subsequent bug disclosures related to XRPL or comparable codebases embedded in other ledgers.
• Assess how AI-driven security tools influence governance and incident response timelines across the broader crypto ecosystem.

Sources & verification

• XRPL Foundation vulnerability disclosure report (xrpl.org/blog/2026/vulnerabilitydisclosurereport-bug-feb2026).
• XRPLF status update confirming the non-activation of the amendment on mainnet and the emergency mitigation (XRPL Foundation).
• Cantina AI and Spearbit leadership statements about the discovery and the Apex autonomous vulnerability hunter (X thread: https://x.com/hrkrshnn/status/2027191844988424343).
• Rippled 3.1.1 emergency patch details and rollout timing (XRPLF status updates).

What the wider story changes: patching a future risk

Bitcoin bulls managed to defend the $66K support level as the leading crypto asset reversed part of its strong gains yesterday that was partly fueled by a strong uptick in ETF inflows.

According to data from crypto.news, Bitcoin (BTC) price surged nearly 7% to roughly $70,000 on Thursday as investor sentiment for risk assets was boosted following the release of a bullish Nvidia earnings report that triggered a surge in tech stocks.

Rising equity prices often act as a catalyst for a risk-on rotation. As market confidence strengthens, capital flows out of defensive positions and into high-beta sectors like cryptocurrency.

The bellwether’s rally was also supported by a strong demand seen from institutional investors for spot Bitcoin ETFs. Data from SoSoValue shows that the 12 U.S. spot Bitcoin ETFs drew in $506 million in net inflows on Feb. 25, nearly double the figure recorded the prior day.

Shortly after its $70K rally, Bitcoin price had retraced nearly 4% to $66,641. This selloff was accompanied by a 2% drop in Nasdaq as investors booked profits after the stock’s notable run higher into the earnings event. The drawdown created a cooling effect across the broader financial landscape.

Bitcoin has since bounced back above $67,500 after bulls lodged another attempt to reclaim the $70K threshold. The momentum was supported by the $254 million inflows recorded by spot BTC ETFs on Thursday.

Despite today’s bounce, some analysts believe Bitcoin could continue its larger downtrend that began in early January before any meaningful trend reversal takes shape.

According to analyst Ted Pillows, Bitcoin price appears to be forming a recurring fractal pattern that has historically preceded downturns.

“Once more people are convinced $60,000 was the bottom, the next dump to a new low will start,” said Pillows in a Feb. 26 X post.

Bitcoin has formed a bearish flag pattern on the daily chart. This pattern consists of a sharp price decline followed by a period of steady, upward consolidation within two parallel lines.

Historically, Bearish flags have confirmed the continuation of an ongoing downtrend after short periods of consolidation.

At press time, other technical indicators also seem to show bears are currently at an advantage. Notably, the Aroon Down was at 78.55, which is significantly higher than the Aroon Up, suggesting bears were still dominating the market trend.

The Relative Strength Index, which has moved closer toward the neutral thresholds, also indicates that there is potential room for more downside pressure before the asset hits oversold levels.

For now, $65,000 remains the key support level to watch. The level has acted as a psychological defensive line for nearly three weeks and seems to be holding strong for now, as a large cluster of buy orders and long positions was seen accumulating in this range.

A sharp drop under the $65K mark could lead bears to target $60K, a psychological level bears tried to penetrate during the Feb. 6 crash.

TLDR

• Ethereum touched $2,150 this week before encountering resistance across several technical indicators
• The $2,100 level represents a critical threshold, matching the realized price for wallets containing 100,000+ ETH
• The 30-day realized volatility for ETH approaches 0.97, marking the highest point since March 2025
• Liquidations of short positions exceeded $220M across 48 hours, while funding rates shifted into positive territory
• ETF outflow pressure shows signs of weakening, although definitive accumulation trends remain absent

Ethereum surged to $2,150 during Thursday’s trading session before experiencing a retracement. The cryptocurrency continues navigating a narrow trading corridor, with $2,000 serving as crucial support and $2,100 emerging as the next significant barrier.

Closing above $2,100 on the daily timeframe carries particular significance as this price point corresponds to the realized price for addresses holding 100,000 ETH or greater. The realized price metric represents the average acquisition cost based on the last on-chain movement, providing insight into whether major stakeholders maintain profitable positions.

Historical data from 2020 onward reveals ETH has rarely traded beneath this whale cohort’s cost basis, with the most notable exception occurring throughout 2022’s bear cycle. Previous tests of this threshold have typically preceded price recoveries.

Futures and Funding Rates

The derivatives market witnessed short position liquidations exceeding $220 million during the previous 48-hour period, eliminating substantial leveraged positions. Binance funding rates, which plunged deeply negative in early May as bearish positions accumulated, have reversed course to reach positive 0.23%.

This reversal indicates that traders who opened shorts late in the cycle faced forced liquidations. Nevertheless, with funding rates now trading at elevated positive levels, the market structure favors long positions, creating potential vulnerability for a long squeeze toward $1,800 should upward momentum weaken.

Approximately $2.66 billion in long position liquidation exposure clusters around the $1,800 price zone, establishing a substantial liquidity pocket beneath current trading levels.

Volatility and ETF Flows

Ethereum’s 30-day realized volatility measured on Binance has climbed to approximately 0.97, representing the highest measurement recorded since March 2025. Heightened volatility during this phase may indicate market uncertainty and directional indecision rather than establishing a clear trend.

Price action continues trading beneath the 50-day, 100-day, and 200-day moving averages. Following the rejection near $4,800 in late 2025, each subsequent recovery attempt has established lower peaks, suggesting persistent distribution pressure.

Regarding ETF activity, selling pressure appears to be diminishing. Following substantial outflows throughout mid-2025, recent flow statistics indicate reduced movement in either direction. Institutional distribution seems to be decelerating, although convincing accumulation signals have yet to materialize.

Market analyst Leon Waidmann observed that retail participants with low conviction have predominantly exited their positions. Short interest continues declining, while highly leveraged long positions have been slow to establish meaningful presence.

Technical strategist IncomeSharks identified three overhead resistance zones, including multiple SuperTrend rejections and channel resistance positioned near $2,250. The analyst additionally highlighted April’s lows around $1,500 as a critical downside level should demand weaken once more.

At press time, ETH was changing hands at $2,034.

Bitcoin’s (BTC) downturn has spurred conspiracy theories around alleged market manipulation by firms. However, Bitwise’s Chief Investment Officer (CIO), Matt Hougan, argues that the primary reasons are more straightforward.

This narrative highlights the ongoing debate about what drives major crypto market moves, whether it’s institutional strategies, technological threats, or fundamental market cycles.

Why is Bitcoin’s Price Dropping?

Hougan addressed widespread speculation on social media that Bitcoin’s drop was the result of coordinated moves. BeInCrypto previously reported that some users made allegations against Binance.

More recently, some community members pointed to recurring patterns such as the alleged “10 AM Bitcoin dump” by Jane Street. The executive dismissed these narratives directly, calling the actual explanation “far more boring” than the theories suggest.

“The conspiracy theories are wild. First it was Binance and then it was Wintermute and then it was an unknown offshore macro hedge fund and then it was paper bitcoin and. today it is Jane Street and next week it will be someone else,” he said.

Follow us on X to get the latest news as it happens

Hougan said the “real reason Bitcoin is down” is that long-term holders have been reducing exposure. According to him, investors cut positions by selling spot Bitcoin, closing leveraged trades, and writing covered calls, creating downward pressure on the price.

The Bitwise CIO attributed selling behavior to three factors:

• The four-year market cycle theory.
• Concerns surrounding quantum computing.
• Capital rotation from crypto into artificial intelligence (AI) startups.

The quantum computing discussion has gained traction in the crypto community recently. While MicroStrategy co-founder Michael Saylor recently downplayed concerns about quantum risks, some investors remain cautious.

Kevin O’Leary, the Canadian businessman and Shark Tank investor, has warned that institutional investors are capping Bitcoin allocations at around 3% until the industry demonstrates a credible solution to quantum vulnerabilities. Jefferies’ global head of equity strategy, Christopher Wood, went further, removing a 10% Bitcoin allocation from the model portfolio over the same concerns.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Crypto Winter’s Timeline and Prospects for Recovery

Meanwhile, Hougan added that most of the selling is likely complete. He claimed that Bitcoin is in the “process of bottoming” and could eventually reach new all-time highs. According to him,

“This is a classic crypto winter and there will be a classic crypto spring.”

Hougan previously stated that the current crypto winter began in January 2025, and given the 13-month historical duration, the end could be near.

On-chain analyst Willy Woo offered a more nuanced view. He said the recent sell-off appears exhausted but cautioned that deteriorating spot and futures liquidity could cap any near-term rebound.

Woo’s timeline places the end of bearish conditions in Q4 2026, with bullish momentum potentially returning in Q1 or Q2 2027.

“~45k would be a typical bear market bottom. BTC has only ever existed in a secular global macro bull market 2009-2026. If global macro breaks down, then 30k is the fall back level of support, 16k as the final line to maintain BTC’s bull trend,” Woo wrote.

The distance between these timelines reflects a broader uncertainty about where exactly the market sits in its cycle. What analysts broadly agree on is that Bitcoin’s current weakness reflects structural and psychological forces, not manipulation.

Australia’s crypto market is making progress in user growth and regulatory reforms, but there are still a range of issues to iron out in the sector, crypto executives told Cointelegraph.

On the sidelines of the XRP Australia 2026 event in Sydney on Friday, Coinbase APAC managing director John O’Loghlen said the country has seen positive regulatory momentum and growing expertise among those tasked with policing the industry.

“Multiple arms of government, mainly Treasury, who are writing the draft regulation and ASIC have thoroughly upskilled their teams and have pretty deep digital asset domain expertise internally. So I think there’s been pretty positive movement.” 

O’Loghlen also said institutional interest and access are growing through products like crypto exchange-traded funds. Australia’s first ETF, which holds Bitcoin (BTC) directly, went live in June 2024, followed by an ETF that holds Ether (ETH) in October 2024.

He also noted that Coinbase Global’s inclusion in the Standard & Poor’s 500 (S&P 500) index offers Australian institutions a means to access crypto-related stocks, allowing them to learn “about the industry in a very passive way.”

A 2025 report from crypto exchange Independent Reserve found that crypto adoption among Australians reached 31%, up from 28% in 2024. Additionally, 29% said they planned to invest in the next 12 months.

Self-managed super fund investors eye crypto

OKX Australia CEO Kate Cooper noted that a significant area of growth for the exchange has come from sophisticated traders, self-managed super fund (SMSF) trustees and high-net-worth individuals.

At the same time, she said across the industry there are a growing number of new self-managed super funds being set up specifically so trustees can invest in digital assets, “because they currently can’t invest via the big super funds.”

SMSFs are retirement funds set up and managed by individuals, rather than conventional funds managed by large institutions on behalf of users.

In a yet-to-be-released OKX report on SMSFs, Cooper said many respondents were interested in digital assets to diversify their holdings.

“That’s the feedback that we got through the research: a significant number of people wanting a diversified portfolio, wanting not just crypto, but digital assets more broadly, to be held as part of their portfolio. And SMSF is one of the main ways to do that.” 

Lingering issues remain in Australia’s crypto scene

Last September industry executives, including Cooper, told Cointelegraph that users in Australia still face banking barriers when engaging with exchanges and other crypto businesses.