Demand for US spot crypto ETFs cooled Wednesday, reversing recent inflow streaks in both Ether and XRP products. After more than a week of persistent buying, spot Ether ETFs saw net outflows totaling $48 million, while spot XRP ETFs recorded $7.2 million in net withdrawals.

Bitcoin ETFs moved in the opposite direction, drawing fresh inflows even as broader cryptocurrency prices slipped. The flow shift matters because ETF purchases are often treated as a barometer for US institutional sentiment toward major digital assets.

Key takeaways

• Spot Ether ETFs pulled $48 million in net outflows on Wednesday, ending 12 consecutive trading days of inflows.
• Spot XRP ETFs recorded $7.2 million in net outflows, ending an 11-session inflow streak that added about $170 million.
• Ether’s largest products led withdrawals, with BlackRock’s iShares Ethereum Trust (ETHA) down $53.4 million on the day.
• Bitcoin ETFs saw inflows of $101.2 million after a prior day of net outflows.

Ether spot ETFs break a 12-day inflow run

According to SoSoValue, US-listed spot Ether ETFs recorded $48 million in net outflows on Wednesday. This marked the end of a 12-trading-day streak during which the funds collectively attracted $1.62 billion.

Farside Investors data showed that withdrawals were broad-based across the largest Ether vehicles. BlackRock’s iShares Ethereum Trust (ETHA) led the day’s outflows with $53.4 million, while Fidelity’s Ethereum Fund (FETH) lost $26.2 million. Grayscale’s Ethereum Staking ETF (ETHE) also saw $23.5 million in net outflows.

One product, however, helped cushion the overall move: BlackRock’s staked Ether ETF (ETHB) posted roughly $53 million in net inflows. Together, these figures suggest that Wednesday’s redemptions were not uniform across every Ether-related wrapper—investors appeared to reallocate rather than exit the theme entirely.

XRP ETFs end an 11-session inflow streak

Spot XRP ETFs also flipped from steady demand to withdrawals. According to SoSoValue, the funds posted $7.2 million in net outflows on Wednesday, ending an 11-session inflow streak.

That inflow run had brought in roughly $170 million, lifting cumulative XRP ETF inflows to about $1.68 billion. The reversal on Wednesday therefore matters less as a single-day withdrawal and more as an indicator that recent momentum may be losing traction.

Bitcoin ETFs attract money as Ether and XRP slip

While Ether and XRP saw net outflows, Bitcoin ETFs took the opposite path. Wednesday’s activity brought $101.2 million in net inflows, following a day earlier marked by $236.5 million in net outflows.

This divergence is notable: it suggests investors were not necessarily retreating from crypto ETFs altogether, but instead rotating exposure across assets during a softer pricing tape.

Price weakness coincides with the rotation in flows

The shift in ETF flows came alongside a broader pullback in major tokens. CoinGecko data cited in the original reporting indicated that over the previous seven days, Ether was down 3.4%, XRP down 2.4%, and Bitcoin down 1.3%.

At the time of publication, Ether, XRP, and Bitcoin were trading around $1,360, $2,407, and $77,744, respectively. While the direction of ETF flows doesn’t always map perfectly to short-term price moves, the timing here aligns with a market mood shift—investors appeared to pause or rotate capital as returns weakened.

For traders and allocators, this combination—slowing inflows in Ether and XRP paired with inflows into Bitcoin—can be interpreted as a near-term preference for the most liquid exposure during uncertainty. It also highlights that the “ETF flow narrative” may vary significantly by asset, even when the overall crypto market is moving in tandem.

What to watch next

Investors should monitor whether Wednesday’s withdrawals in Ether and XRP are followed by another reversal back into inflows, or whether the streak break reflects a more durable shift. Given that one staked Ether product recorded substantial inflows even as other Ether funds saw outflows, upcoming flow data may further reveal whether the market is reallocating within the Ether ETF complex or reducing overall exposure.

Meta announced on 26 August that it had reached an agreement with a bipartisan group comprising 52 state and territorial attorneys general, together with the Attorney General of the District of Columbia. Under the terms of the agreement, the company is expected to pay approximately $18 billion over ten years and introduce tighter protections for underage users of Facebook and Instagram. These measures include a two-hour daily usage cap and an overnight restriction blocking access to the apps between midnight and 6:00 am.

Of the total amount, around $5.3 billion would only become payable if TikTok and YouTube adopt comparable measures and make equivalent payments. Meta also anticipates recording roughly $10 billion in legal expenses during Q3 2026 as a result of the agreement.

On the four-hour META chart, the medium-term structure remains broadly range-bound, with price continuing to fluctuate between the 690 and 540 areas. During the decline from 15 to 30 July, a converging triangle-like formation developed close to the lower portion of the broader range. Its boundaries gradually contracted as the amplitude of price movements narrowed.

However, the volume profile accompanying the formation is not particularly characteristic of this type of consolidation. This unusual volume behaviour raises some doubt over the reliability of the pattern and whether the subsequent move should be interpreted as a fully confirmed technical breakout.

Following the move above the upper boundary, Meta remains inside the current market profile and is now trading in the relatively narrow zone between the Point of Control (POC) at $587.00 and the profile’s upper boundary at $600.00. Price is effectively attempting to hold above the former pattern.

The next red resistance area sits near $612.00, only a short distance above the profile ceiling. Conversely, a return into the previous structure would become more concerning if price establishes itself below the profile’s lower boundary at $564.00. In that scenario, attention could shift towards the green support around $550.00, which is also positioned relatively close to the profile.

The RSI + MAs indicator currently reads 62, 54 and 49. The oscillator has moved above the neutral area, while the moving averages remain around the neutral zone. As a result, the technical picture has improved, but there is not yet enough confirmation to treat the breakout as firmly established.

Key Takeaways

Meta has managed to remain above the converging structure, but the unusual volume behaviour during the pattern’s development weakens the conviction behind the move. The RSI + MAs readings are also not sufficiently aligned to confirm a decisive change in momentum.

The outlook therefore remains dependent on whether price can sustain itself above the current structure and move through the $600.00–$612.00 area. A failure to hold the breakout zone, particularly a move below $564.00, would increase the risk of a return towards $550.00.

The legal settlement also adds a separate layer of uncertainty, as part of the financial commitment remains conditional on whether Meta’s competitors adopt comparable measures. This leaves both the technical breakout and the broader fundamental backdrop subject to further confirmation.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

Australia’s financial regulator issued a final warning on Sept. 2 to crypto businesses relying on temporary enforcement relief.

Qualifying firms have until Sept. 30 to apply for the licences required under existing financial services law.

The Australian Securities and Investments Commission said firms operating without authorization from Oct. 1 could face civil and criminal penalties. Potential fines may reach 10% of annual turnover.

ASIC has recorded more than 45 digital asset-related licence applications since it updated its guidance in October 2025. The figure rose from approximately 30 applications reported when the regulator extended its original June deadline.

The regulator’s warning applies to businesses providing digital asset products or services that qualify as financial products under existing law. It does not mean that every crypto asset or activity automatically requires the same licence.

ASIC’s crypto deadline covers several licence routes

Businesses that require an Australian Financial Services licence must submit a new application or request a variation to an existing licence by Sept. 30. The appropriate route depends on the products and services each company provides.

Firms that need an Australian Market Licence or a Clearing and Settlement facility licence face different conditions. They must notify ASIC in writing that they intend to apply and complete a pre-application meeting before the deadline.

ASIC’s updated Information Sheet 225 provides examples showing how financial product rules can apply to digital assets, custody services, wrapped tokens, staking arrangements and stablecoins. Companies must assess the rights attached to each product rather than relying only on its technical description.

Bitcoin and some other digital assets may not qualify as financial products by themselves. However, related services, investment arrangements or derivatives can still fall within the licensing regime.

The legal distinction has already received attention from Australian courts. In related coverage, crypto.news reported that the High Court ruled 7–0 that Block Earner’s fixed-yield product required a financial services licence.

ASIC’s temporary relief ends on Oct. 1

ASIC introduced its sector-wide no-action position after consulting the industry in December 2024. The relief gave eligible businesses time to review the updated guidance and prepare licence applications.

The regulator initially set June 30, 2026, as the deadline. It later extended the period by three months and expanded the arrangements to cover some authorized representatives and intermediary structures. As crypto.news reported, the extension moved the licensing deadline to Sept. 30.

The no-action position is not a licence, legal exemption or confirmation that a company’s activities comply with the law. It only describes circumstances in which ASIC does not intend to pursue enforcement during the transition.

Companies lose that protection if they fail to meet its conditions. From Oct. 1, ASIC may investigate businesses that appear to provide regulated financial services without authorization.

The warning about fines of up to 10% of annual turnover describes the possible maximum penalty. It does not mean that every unlicensed firm will automatically receive a fine at that level. Courts determine penalties after considering the applicable law and circumstances of each case.

Australia’s 2027 crypto framework is a separate regime

The Sept. 30 deadline concerns duties that already exist under Australian financial services law. It is separate from the Corporations Amendment (Digital Assets Framework) Act 2026.

Parliament passed that legislation on April 1. It received Royal Assent on April 8 and will take effect on April 9, 2027, according to ASIC’s implementation roadmap.

The law establishes dedicated rules for digital asset platforms and tokenized custody platforms. ASIC will license and supervise companies covered by the new categories.

Existing authorizations will remain relevant after the framework begins. Some businesses may therefore need to obtain licences under the current rules and later vary those licences to cover activities regulated by the 2027 framework.

ASIC plans to consult on standards and publish further regulatory guidance during the implementation period. The regulator will also continue meeting with companies and industry groups as the new licensing system takes shape.

Previous crypto.news coverage examined ASIC’s developing approach to stablecoins and wrapped tokens, including how particular products may fall within existing financial regulation.

Crypto firms must decide whether to apply or stop services

Businesses relying on the relief must determine before Sept. 30 whether their activities require an AFS, market or clearing and settlement licence. Firms uncertain about their position may need legal advice based on their products, custody arrangements and customer agreements.

Submitting an application does not guarantee approval. Applicants must satisfy ASIC’s requirements concerning competence, financial resources, compliance systems, risk management and dispute resolution.

Companies that cannot meet the relief conditions may need to stop providing affected services from Oct. 1. Operating while an application is being prepared will not necessarily protect a firm if it missed the applicable deadline.

ASIC’s latest figures show that more than 45 businesses have entered the licensing process. The regulator has not identified those applicants or disclosed how many applications involve exchanges, custodians, tokenization providers or other services.

Enforcement activity may become clearer after the temporary relief expires. ASIC has not announced a specific investigation or prosecution connected to the deadline, but it has stated that noncompliant firms could face both civil and criminal action.

Ledger has been hit with a proposed class action seeking at least $500 million over allegations that poor security and disclosure failures tied to a December 2023 incident exposed customers to cryptocurrency theft and other financial losses.

The complaint, filed by Douglas Kim in the U.S. District Court for the Southern District of New York on Aug. 27, accuses the hardware wallet maker of failing to adequately protect customer personally identifiable information and cryptocurrency security data. Kim brought the case individually and on behalf of a proposed nationwide class.

Kim alleges that Ledger failed to properly notify customers after the December 2023 security incident and did not fully disclose its scope. The lawsuit claims hackers later used customer contact information to impersonate Ledger representatives and gain access to customers’ cryptocurrency wallets and private keys.

The complaint brings seven causes of action, including claims under New York General Business Law Sections 349 and 350, negligence, negligent misrepresentation, promissory estoppel and breach of the implied covenant of good faith and fair dealing.

Ledger lawsuit centers on December 2023 security incident

The December 2023 incident involved Ledger Connect Kit, a software library used to connect hardware wallets with websites and decentralized applications.

The complaint says attackers gained access to the NPMJS account of a former Ledger employee through a phishing attack. Ledger had failed to properly revoke the former employee’s access after their employment ended, according to the filing.

Ledger acknowledged the access control failure at the time, stating that the former employee’s NPMJS access had not been properly revoked.

Once inside the account, the attackers uploaded a malicious version of Ledger Connect Kit that could redirect transactions to addresses they controlled by inducing users to approve malicious transactions. Ledger publicly acknowledged that the malicious software could trick users into signing transactions that drained their wallets.

crypto.news previously reported that a former Ledger employee was phished before an attacker used the compromised access to publish malicious code. Ledger CEO Pascal Gauthier said at the time that the incident was isolated to third party applications and that Ledger hardware wallets remained unaffected.

Estimates at the time put losses from the Connect Kit exploit between roughly $480,000 and $600,000. Ledger later said it would reimburse affected users and announced plans to phase out blind signing for Ethereum virtual machine decentralized applications.

The new lawsuit goes beyond losses reported immediately after the Connect Kit compromise. Kim alleges that hackers accessed and used Ledger customer PII, including names, email addresses and phone numbers, and that Ledger failed to provide customers with sufficient warning about the incident.

Plaintiff says scammers stole nearly $1.95 million in crypto

Kim, who first bought a Ledger hardware wallet around 2017 and purchased a Nano X in New York City in 2021, says he later became the victim of a Ledger impersonation scheme.

On Feb. 18, 2025, Kim received a call from someone claiming to represent Coincover, which the caller presented as a department within Ledger, according to the complaint. The caller allegedly told Kim that someone in the Netherlands had attempted to register for Ledger Recover using his information and that his cryptoassets could be at risk.

A second person then contacted Kim while posing as another Ledger representative and asked him to check his email as proof that the caller was legitimate.

Kim received what appeared to be an email from Ledger, the filing says. The complaint alleges, on information and belief, that the attackers used customer contact information originating from the December 2023 incident to identify him as a Ledger customer and trigger the email. Kim reserved the right to amend that allegation after obtaining Ledger’s breach forensics and incident response records through discovery.

The purported representative directed Kim to a website designed to resemble Ledger’s services and instructed him to enter his confidential passphrase to reset the device, according to the lawsuit. Kim complied and was given what he believed was a replacement passphrase.

Two days later, Kim checked his holdings and discovered that cryptoassets valued at $1,948,074 had been stolen, the complaint alleges. He has not recovered any of those assets.

Ledger customers have continued to face impersonation attempts. In February 2026, scammers sent fake Ledger letters directing recipients to phishing websites designed to collect wallet recovery phrases.

Similar physical mail attacks were reported in April 2025, when scammers reportedly used data leaked in 2020 to send Ledger branded letters containing QR codes that directed customers to websites seeking their recovery phrases.

Complaint points to Ledger’s 2020 data breach

Kim’s lawsuit uses Ledger’s earlier security history to support its allegations of inadequate safeguards.

A 2020 breach affected more than 270,000 Ledger customers, according to the complaint, exposing information that included names, physical addresses and phone numbers. The data later became available on black market channels online. Litigation over that breach was separately brought in the Northern District of California.

The new complaint alleges Ledger failed to sufficiently improve its security practices following that incident and accuses the company of downplaying both the earlier breach and the December 2023 incident.

Kim argues that Ledger’s security representations were particularly important because the company requires customers to provide information when buying its products. The complaint lists names, email addresses, delivery addresses, phone numbers, payment details, product information and order amounts among the customer data collected by Ledger.

Ledger has advertised security measures including encryption, employee training, role based authentication, two factor authentication, continuous system monitoring and independent security testing, according to statements reproduced in the complaint.

The lawsuit alleges those representations were deceptive because Ledger failed to implement adequate measures to protect customer information and did not sufficiently address foreseeable risks after earlier cybersecurity incidents.

Security questions around Ledger resurfaced in August when the company said an Ethereum signing flaw was fixed before another security company publicly disclosed the issue. Ledger CTO Charles Guillemet said users running updated firmware and applications were protected, while no independently verified thefts linked to that specific vulnerability had been reported at the time.

Days later, Ledger rejected claims it was hacked after OneKey’s security team reproduced a transaction substitution flaw using an outdated version of Ledger’s Ethereum application. Ledger said protections had already been added in a newer application version.

Class action seeks at least $500 million

Kim proposes a nationwide class covering U.S. individuals whose PII, cryptoassets, cryptocurrencies or crypto credentials were compromised as a result of the alleged data breach and who suffered financial losses, unauthorized transactions or identity theft mitigation costs. The complaint says the proposed class could number in the thousands.

A separate New York subclass would cover qualifying customers whose transactions with Ledger, including product or service purchases or the creation of Ledger accounts, occurred in New York.

The complaint estimates Kim’s damages at approximately $2 million and claims collective class damages could reach at least $500 million, potentially running into billions of dollars depending on the number of customers affected and the size of individual losses. Those figures are estimates advanced by the plaintiff and have not been established by the court.

Kim’s filing seeks declarations that Ledger violated New York’s SHIELD Act and General Business Law Sections 349 and 350, along with findings of negligence and negligent misrepresentation. The requested relief includes actual, compensatory, statutory, treble and punitive damages, as well as attorneys’ fees and costs.

The plaintiff has demanded a jury trial.

Sign up for crypto news and market insights

Get crypto market analysis and curated news delivered right to your inbox every week.

You have successfully joined our subscriber list.

Researchers affiliated with the Bank for International Settlements tested the XRP Ledger as a verification layer for official statistics, according to a working paper published on Sept. 2.

The prototype connected the XRP Ledger with Statistical Data and Metadata eXchange, or SDMX, an international standard used by organizations including the BIS to exchange statistical information.

Instead of placing complete statistical datasets onchain, the system calculated cryptographic fingerprints representing the data. It then recorded those fingerprints on the XRP Ledger’s Devnet, allowing a recipient to check whether a downloaded file matched the version originally published.

The experiment does not represent a production deployment, partnership with Ripple or endorsement of XRP as an investment. The paper also states that its conclusions belong to the authors and may not reflect the institutional position of the BIS.

XRP Ledger prototype verifies whether data changed

Official statistics are commonly distributed through websites, databases and automated data feeds. A recipient must trust that the downloaded file is authentic and that its contents have not changed since the publisher released it.

The researchers designed their prototype to provide an independent verification record. Before publication, the software converted an SDMX file into a standardized format and calculated a SHA3-512 cryptographic hash.

A hash functions like a unique digital fingerprint. Changing even a small part of the source file produces a different result. A recipient can therefore repeat the calculation and compare the result with the fingerprint recorded onchain.

The prototype supported checking an entire file or selected statistical series within it. When multiple series were included, the system combined their hashes into a Merkle root. This allowed several data components to share one onchain record while remaining independently verifiable.

The root was anchored through an XRP Ledger transaction. A reference to that transaction was then embedded in the SDMX file, giving recipients the information required to locate the onchain record and complete the comparison.

The design means the XRP Ledger did not establish whether the statistics themselves were accurate. It only provided evidence that the verified data matched the version connected to the original record.

BIS researchers reported verification within seconds

The paper reported median publication latency of approximately three to five seconds under controlled testing conditions. Verification took approximately one to two seconds.

Publication latency covered the process of creating and confirming the blockchain record. Verification involved recalculating the fingerprint and checking it against information stored in the relevant XRP Ledger transaction.

Those results should not be treated as guaranteed performance under production conditions. The researchers conducted the measurements through an experimental system operating on XRPL Devnet rather than the public main network used for real transactions.

Devnet supplies test XRP through a faucet and allows developers to experiment without using assets carrying market value. Its activity, reliability requirements and operating environment differ from those of the XRP Ledger mainnet.

The researchers selected XRPL partly because of its relatively fast transaction confirmation and low transaction costs. However, the experiment did not compare XRPL performance directly against Ethereum, Solana, permissioned databases or conventional digital timestamping services.

The code was released in a public BIS repository. Its documentation describes the software as an experimental proof of concept that is neither intended for production nor actively maintained.

Identity checks strengthen the statistical record

Confirming that data has not changed solves only part of the verification problem. A malicious actor could create a valid hash for a fraudulent file and publish it from an unrelated blockchain address.

The prototype addressed that risk with a publisher identity system. It used a W3C Verifiable Credential signed by an identity key associated with the publisher’s XRP Ledger address.

A recipient could use that credential to check that the party publishing the file controlled the recognized address. The verification process therefore assessed both data integrity and publisher identity.

The SDMX message carried the transaction reference, ordered Merkle leaves and credential required for the check. A verifier could reproduce the root from the received file and compare it through one ledger lookup.

The researchers said the architecture could eventually support zero-knowledge proofs. Such technology could let an organization prove selected facts about restricted data without disclosing the full dataset.

They also identified potential use by artificial intelligence agents. Automated systems increasingly retrieve statistics without a person manually confirming each source. A machine-readable verification record could allow software to reject altered or incorrectly attributed files.

These remain proposed extensions. The published repository provides experimental code rather than a production service for central banks, national statistics agencies or AI companies.

XRP Ledger use case does not require XRP adoption

The prototype used XRP Ledger infrastructure because every onchain record requires a transaction. However, it did not use XRP for payments, liquidity, settlement or cross-border transfers.

Only a small transaction fee would be required to anchor each record on mainnet. The amount would depend on network conditions and the publication method selected by an institution.

That distinction matters because use of the XRP Ledger does not necessarily create material demand for its native asset. A data publisher could anchor many statistical series through a single Merkle root, reducing the number of transactions required.

The experiment nevertheless extends the types of applications tested on XRPL beyond payments and tokenized financial assets. The network is also developing institutional features covering permissioned trading, lending and asset issuance.

In related coverage, XRP Ledger’s institutional infrastructure has expanded through permissioned markets and native lending proposals. Those financial applications are separate from the BIS researchers’ statistical verification system.

The network’s activity has also become more concentrated. XRP Ledger order-book volume rose 79% while daily traders declined during the second quarter, according to research published by Evernorth.

Neither development establishes that the statistical prototype will enter production. They provide broader context for the different financial and nonfinancial applications being tested across the XRP Ledger ecosystem.

Production adoption would require further testing

The prototype would need additional security, governance and operational work before an official statistics provider could rely on it. Institutions would need policies governing publisher keys, compromised credentials, transaction failures and corrections to previously issued datasets.

The permanence of blockchain records creates another challenge. Official statistics are frequently revised after agencies receive new information or correct errors. A production system must distinguish legitimate revisions from unauthorized alterations without suggesting that the earliest version remains current.

Publishers would also need to decide whether to depend on a public blockchain, run additional infrastructure or combine blockchain records with existing digital signature systems. Privacy rules may restrict which metadata can appear in public transactions.

The authors said their approach is not limited to SDMX. It could be adapted for other structured formats, including XBRL, which companies and regulators use for financial reporting.

No implementation deadline was provided. The repository states that the software is unmaintained, and the BIS has not announced plans to deploy it across its official statistical publications.

The verified result is therefore narrower than claims that the BIS adopted the XRP Ledger. BIS-affiliated researchers demonstrated that an experimental system could use XRPL Devnet to authenticate statistical files within seconds under controlled conditions.