US-listed spot Bitcoin exchange-traded funds (ETFs) recorded their first daily net inflow above $200 million since early May, snapping weeks of sustained withdrawals.

The funds attracted $221.7 million in net inflows on Thursday, according to SoSoValue data, ending a 10-day streak of net outflows that totaled more than $2.7 billion.

The rebound follows one of the weakest stretches for US spot Bitcoin ETFs this year, with the funds posting a record $4.5 billion in net outflows in June.

Daily flows in US-listed spot Bitcoin ETFs. Source: SoSoValue

The inflows came as Bitcoin reclaimed the $61,000 level after briefly falling below $59,000, with some investors, including Bitwise chief investment officer Matt Hougan, suggesting the market could be nearing a bottom. Crypto market sentiment on Friday was measured at an “extreme fear” reading by the Fear & Greed Index from Alternative.me.

Fidelity leads ETF rebound as BlackRock outflows continue

Fidelity’s Wise Origin Bitcoin Fund (FBTC) led Thursday’s rebound with $166 million in net inflows, accounting for roughly 75% of the day’s total, according to Farside Investors data.

ARK 21Shares Bitcoin ETF (ARKB) followed with $91.8 million in inflows, while the VanEck Bitcoin ETF (HODL) and Valkyrie Bitcoin Fund (BRRR) attracted $4.4 million and $1.7 million, respectively.

Source: Farside Investors

Meanwhile, BlackRock’s iShares Bitcoin Trust (IBIT), the largest US spot Bitcoin ETF by assets, continued to bleed, posting $40.4 million in net outflows on Thursday. The fund has lost more than $2.2 billion during an 11-session outflow streak since June 17.

Altcoin ETFs post inflows as sentiment stays in fear

The recovery in ETF flows extended beyond Bitcoin, with altcoin investment products also posting net inflows on Thursday.

US spot Ether ETFs attracted $29.1 million on Thursday, following $14.9 million in inflows a day earlier. XRP ETFs also returned to net inflows, attracting $6.6 million after two consecutive sessions of outflows.

Related: Swan’s Cory Klippsten sees record Bitcoin holder supply revealing early bottom

The global crypto market cap climbed 2.4% to $2.22 trillion over the past 24 hours as Bitcoin recovered above $61,000, according to CoinGecko data.

Magazine: Bitcoin slides to $58K, XRP hits $1 but onchain data promising: Market Moves

Key Takeaways

• Analysts project a probability-weighted XRP price of approximately $7.90 by 2031
• The most likely scenario places XRP in the $5 to $8 range, representing a market capitalization between $325 billion and $520 billion
• By early 2026, spot XRP exchange-traded funds in the United States had attracted more than $1.5 billion in net inflows
• Institutional players such as Goldman Sachs have revealed holdings in XRP ETF products
• Pessimistic projections suggest $1–$2, while optimistic forecasts reach as high as $15–$25

As one of the most prominent digital assets by market capitalization globally, XRP faces an uncertain but potentially lucrative future. A comprehensive five-year analysis presents three distinct price trajectories for the cryptocurrency, spanning from $1 to $25 by 2031, with a weighted average settling near $7.90.

The forecast methodology applies a 50% likelihood to the moderate scenario, while allocating 25% probability each to both the pessimistic and optimistic outcomes.

Unlike Bitcoin and Ethereum, which appeal broadly to retail investors, XRP’s value proposition centers on enterprise-level adoption. Its primary use cases revolve around institutional financial services rather than individual consumer transactions.

The analysis identifies Ripple’s payment network, the underlying XRP Ledger technology, and the expanding RLUSD stablecoin infrastructure as fundamental growth catalysts. Improved regulatory frameworks and increased tokenization of real-world assets complete the list of favorable conditions.

Exchange-Traded Funds Attract $1.5 Billion-Plus

The introduction of regulated spot XRP exchange-traded funds in the United States has fundamentally altered the token’s market dynamics. By March 2026, these investment vehicles had collectively drawn over $1.5 billion in capital.

A diverse group of prominent asset management firms now provides XRP ETF access, including Franklin Templeton, Bitwise, Grayscale, Canary Capital, and 21Shares. The disclosure of XRP ETF holdings by Goldman Sachs signals expanding acceptance among traditional financial institutions.

Continued demand through these regulated investment products is anticipated to remain a critical factor influencing XRP’s valuation throughout the forecast period.

The moderate scenario—projecting $5 to $8—envisions steady expansion driven by increasing institutional integration across cross-border payment systems, tokenized securities, and compliance-focused investment channels.

Downside Risks and Upside Potential

The optimistic projection targets a price band of $15 to $25. Achieving this outcome would require significant adoption of XRP infrastructure by banking institutions, wealth managers, and payment processors for transaction settlement and liquidity management. This scenario also assumes sustained ETF capital flows and reduced exchange supply as institutional custody increases.

The pessimistic outlook confines XRP to the $1 to $2 range. The primary vulnerability centers on execution risk: Ripple’s commercial operations might expand without generating corresponding demand for the native XRP token.

Additional headwinds include intensifying competition from Ethereum, Solana, fiat-backed stablecoins, and proprietary settlement systems operated by financial institutions. Despite recent improvements, regulatory ambiguity continues to pose challenges.

The analysis emphasizes that XRP now enjoys advantages including institutional market participation, multiple regulated ETF offerings, and growing real-world asset tokenization applications on its native ledger.

The probability-adjusted price target for the five-year horizon stands at roughly $7.90 by 2031. Through March 2026, XRP ETF products from various issuers had accumulated inflows surpassing $1.5 billion.

Key Takeaways

• Leading cryptocurrency exchange Binance is preparing to anchor a major funding round for crypto payments infrastructure provider Mesh
• The anticipated investment could establish Mesh’s valuation at $2 billion, representing a 100% increase from its $1 billion worth in January 2026
• In January, Mesh secured $75 million in Series C financing spearheaded by Dragonfly Capital, with support from Paradigm and Coinbase Ventures
• The company specializes in creating bridges between digital wallets, trading platforms, stablecoins, and traditional financial systems
• Neither Binance nor Mesh has publicly confirmed the transaction details

Binance is moving forward with plans to spearhead a significant funding round for Mesh, a cryptocurrency payments and settlement infrastructure provider, according to a recent report from Axios. Sources close to the situation indicate the round could value the company at approximately $2 billion.

Both parties have yet to issue official statements regarding the transaction.

Extraordinary Valuation Surge for Payment Startup

Earlier this year in January 2026, Mesh successfully closed a $75 million Series C financing round that valued the company at $1 billion. Dragonfly Capital served as the lead investor, joined by notable participants including Paradigm, Moderne Ventures, Coinbase Ventures, SBI Investment, and Liberty City Ventures.

Should this latest funding round complete at the anticipated $2 billion mark, Mesh would achieve a remarkable doubling of its enterprise value within approximately half a year.

Previously operating under the name Front Finance, Mesh develops critical infrastructure that enables seamless connections between cryptocurrency wallets, exchange platforms, digital currencies, and conventional fiat payment rails.

The company addresses a persistent challenge in cryptocurrency commerce: users frequently possess one type of digital asset while merchants or service providers prefer receiving payment in different assets or traditional currency. Mesh provides the essential conversion and settlement infrastructure that bridges this gap.

Stablecoin Expansion Fueling Infrastructure Investment

Surging interest in stablecoin technology is directing investment capital toward crypto settlement infrastructure companies. Analysts point to increasingly clear regulatory frameworks for stablecoins and expanding tokenization initiatives across financial markets as key drivers behind this trend.

Financial institution Circle recently introduced regulated stablecoin settlement capabilities following regulatory approval in Luxembourg. The institution now facilitates USDC, USDG, and its proprietary EURI token for enterprise-level fiat-to-crypto conversions.

Meanwhile, prominent U.S. financial institutions are collaborating on a tokenized deposit infrastructure through the Clearing House initiative, with an expected rollout in early 2027. This framework will enable banks to process tokenized deposits continuously within established regulatory parameters.

Mesh occupies a strategic position within this transformation. The company concentrates on facilitating value transfer across various assets, wallets, and payment networks—precisely where institutional capital is concentrating.

Strategic partnerships have also driven the company’s expansion. During 2024, Mesh formed an alliance with Italian cryptocurrency wallet provider Conio, delivering users enhanced access to multiple exchange platforms and withdrawal capabilities through Mesh’s connectivity infrastructure.

A Binance-anchored investment round would signal that major cryptocurrency exchanges recognize payment and settlement infrastructure as a critical growth vertical.

Investment capital has increasingly shifted away from basic trading applications and token projects toward platforms supporting compliant payments, international transfers, and asset settlement operations.

Mesh’s reported valuation demonstrates this market evolution. Upon confirmation, the transaction would position Mesh as a central player within the expanding stablecoin and asset tokenization ecosystem.

The funding round’s anticipated completion timeline remains undisclosed.

Bridge has secured both a Markets in Crypto-Assets (MiCA) crypto-asset service provider authorization and an Electronic Money Institution (EMI) license in Luxembourg, giving it a regulated framework to offer services across all 27 European Union member states.

According to Bridge, the dual licensing allows the company to operate under the European Union’s MiCA framework while expanding its stablecoin and euro payment services for businesses and developers throughout the bloc. 

The company said the approvals were granted in Luxembourg and cover all EU member states under a single regulatory regime that includes requirements for capital reserves, custody, and operational safeguards.

The licenses also introduce new products for companies building on Bridge’s infrastructure. Businesses will be able to issue custom euro-backed stablecoins, create virtual IBANs in customers’ names, and offer euro accounts that work across the European Union without establishing separate banking relationships in each country, according to the announcement.

New payment tools for European businesses

Bridge said fintech companies can use the platform to provide named IBANs and cross-border euro accounts through one integration. Businesses launching loyalty programs, rewards systems, on and off ramps, or in-app payment products will also be able to issue their own EUR-backed stablecoins without building reserve management and regulatory infrastructure themselves.

The company added that enterprises can use custom stablecoins to transfer funds between subsidiaries instead of relying on correspondent banking networks. Banks, meanwhile, can settle transactions between institutions through stablecoin infrastructure rather than conventional interbank messaging systems.

“A business in the EU can now issue its own euro stablecoin and pair it with named IBANs and named EUR payouts across all 27 member states, on a single integration,” Mai Leduc Blount, Head of Product at Bridge, said in an accompanying statement.

Bridge has already been expanding its regulated payments business outside Europe as well. In March, Visa announced it was extending its partnership with the Stripe-owned company to bring stablecoin-backed Visa cards to more than 100 countries by the end of 2026.

Europe tightens stablecoin rules under MiCA

The approvals come days after the European Union completed the final phase of its MiCA transition on July 1, requiring regulated crypto platforms to support only compliant stablecoins. 

While companies such as Bridge and CACEIS continue securing MiCA authorization to expand regulated services across the bloc, other market participants have been scaling back operations that no longer meet the framework.

As previously reported by crypto.news, Coinbase, Kraken, and Crypto.com removed USDT trading for European users after Tether chose not to seek MiCA authorization. 

Crypto exchange Binance has also implemented MiCA-related service changes and said affected users would continue to have access to options previously communicated by the exchange, including withdrawals and transfers where applicable.

Peter Stokes, a 19-year-old dual U.S.-Estonian national, has been extradited to the United States over charges tied to Scattered Spider, a hacking group linked to crypto ransom demands. 

The U.S. Department of Justice said in a July 1 statement that Finnish authorities arrested Stokes in April under an Interpol Red Notice.

Stokes appeared in federal court in Chicago after his extradition last week. Prosecutors charged him with conspiracy, cyber intrusion, fraud, and related offenses. The DOJ said the charges remain allegations, and Stokes is presumed innocent unless proven guilty in court.

Jewelry retailer resisted ransom demand

The complaint centers on a May 2025 intrusion at a luxury jewelry retailer. Prosecutors allege Stokes and others used phishing calls to the company’s technology help desk while pretending to be employees who needed password resets. The attackers allegedly compromised employee accounts, including accounts with higher access rights.

The DOJ said the group stole company data and demanded about $8 million in cryptocurrency. The retailer removed the intruders from its network and did not pay, but prosecutors said the company still suffered at least $2 million in losses from business disruption, investigation, and response work.

Scattered Spider tied to wider crypto theft cases

Scattered Spider is also known as Octo Tempest, UNC3944, and 0ktapus. The DOJ said the group has been linked to “over 100 network intrusions” and more than $100 million in ransom payments. Prosecutors say the group uses social engineering, account takeovers, data theft, and crypto extortion against corporate victims.

As previously reported, U.S. prosecutors in 2024 charged five people linked to Scattered Spider in a separate case involving alleged phishing, SIM swapping, and at least $11 million in stolen cryptocurrency. That earlier case involved victims at companies and a crypto exchange, showing how the group’s methods crossed from corporate data theft into direct digital asset theft.

Crypto ransom cases remain under pressure

The Stokes case arrives as ransomware groups keep using crypto for payments, even as more victims refuse to pay. Chainalysis found that ransomware cashouts fell 35% in 2024 as law enforcement actions, sanctions, and stronger recovery plans disrupted criminal networks.

Chainalysis later said in its 2026 ransomware report that ransomware actors received more than $820 million in on-chain payments in 2025, down about 8% from 2024, while claimed attacks rose 50%. That mix shows fewer payments but continued pressure from cyber extortion groups targeting companies.

Law enforcement focuses on tracing funds

The case also shows why blockchain tracing remains central to cybercrime probes. As previously reported, blockchain forensics can help authorities track crypto transactions by linking wallets, exchange records, and transaction flows to real-world activity. Those methods do not stop every ransom demand, but they can help build cases after an attack.

Recent enforcement actions have also targeted laundering networks used by cybercriminals. As crypto.news reported, U.S. prosecutors charged alleged operators of AudiA6, a crypto laundering network accused of processing more than $389 million in transactions. 

The DOJ said the Stokes case is part of Operation Riptide, an FBI effort targeting cybercrime actors, infrastructure, and financial networks. Prosecutors say foreign-based suspects can still face U.S. charges when attacks hit American businesses or their customers. That stance may shape future cybercrime cases.

Alibaba has banned employees from using Anthropic’s Claude Code in workplace environments from July 10 over alleged security concerns involving embedded backdoors, according to a person familiar with the decision.

According to a source familiar with the matter, the restriction will apply across Alibaba’s internal work environments and takes effect on July 10. The person said the company reached the decision because of alleged security risks linked to embedded backdoors in the coding assistant.

As of publication time, Alibaba has not issued an official statement, and no further details about the alleged security concerns or the scope of the restriction were disclosed.

Claude faces another enterprise setback

The latest development comes just weeks after Anthropic’s Claude models lost access to another major enterprise customer group in Hong Kong. In June, the Financial Times reported that JPMorgan had stopped employees in Hong Kong from selecting Claude models from the bank’s approved list of large language models because of Anthropic’s licensing terms governing where the models could be used.

The report said Goldman Sachs had previously introduced a similar restriction after determining that Anthropic’s terms of service excluded use across Greater China, including Hong Kong. Anthropic later told the Financial Times that Claude had never been officially supported in Hong Kong, while JPMorgan declined to comment.

Those restrictions added to concerns among some financial institutions in Hong Kong as advanced AI tools become more deeply integrated into software development, research, and financial services workflows, according to the Financial Times.

Anthropic recently restored its newest models

The Alibaba decision also follows a turbulent few weeks for Anthropic’s latest AI systems. On July 1, the company restored public access to its Claude Fable 5 and Mythos 5 models after U.S. authorities lifted export restrictions that had forced Anthropic to suspend them in June.

Anthropic said it resumed deployment after what it described as productive discussions with U.S. officials and added new classifiers designed to detect and block more cybersecurity-related tasks. The company said the additional safeguards addressed government concerns over possible misuse through jailbreak techniques.

While defending its technology, Anthropic argued that the reported jailbreak involved a limited method rather than a universal bypass of the models’ safety protections. The company also announced expanded cooperation with the U.S. government on model testing, safety evaluations, misuse tracking, and information sharing related to jailbreak risks.

Humanity Protocol has confirmed it is repositioning toward enterprise artificial intelligence products after a $36 million exploit accelerated an internal strategic overhaul that had already been under discussion for months.

During a recent interview, Humanity Protocol founder Terence Kwok said the company had been reconsidering its long-term direction for the past six to nine months and that the June security breach pushed those plans forward sooner than expected.

Enterprise AI takes priority after hack

Rather than continuing to present itself primarily as a blockchain identity platform, Kwok said Humanity Protocol will increasingly focus on building products and services for enterprise AI customers. He explained that digital identity remains an important part of the company’s work because AI systems will require stronger methods of verifying people and credentials.

Kwok said the team has already been testing products designed for AI companies and plans to introduce additional enterprise-focused offerings. Humanity Protocol previously developed a proof-of-personhood blockchain supporting credentials for employment, assets, and credit scoring, including work with Mastercard on proof-of-assets applications. 

According to Kwok, the platform has registered around 10 million users, with a couple of million completing their credentials.

The strategic change follows one of the project’s biggest setbacks. Humanity Protocol lost roughly $36 million after attackers gained access to critical private keys, triggering a sharp collapse in the H token and forcing the project into recovery mode.

Recovery efforts continue as token migration moves ahead

Discussing the aftermath of the attack, Kwok said the chances of recovering the stolen funds are “pretty low,” adding that the team’s attention has instead turned to rebuilding the ecosystem. He compared the situation with Bybit’s unsuccessful efforts to recover approximately $1.4 billion worth of ether stolen in a separate attack last year.

As part of the recovery process, Humanity Protocol has issued a replacement token and distributed it to a range of addresses, including major cryptocurrency exchanges. Kwok said discussions are continuing around snapshot dates, suspended deposits and withdrawals, liquidity pools and custodian arrangements, while investigators work to identify every transaction that took place after the breach before completing compensation claims.

Law enforcement agencies in multiple jurisdictions, beginning with Hong Kong alongside authorities in the United States, have also been contacted as investigations continue, according to Kwok.

Earlier findings released by Humanity Protocol and security firm Quantstamp attributed the exploit to compromised private keys stored on a developer device rather than vulnerabilities in the project’s smart contracts. 

The June investigation concluded that attackers obtained control of production systems after malware infected a developer machine containing backups of several critical keys, allowing them to authorize legitimate-looking transactions that drained about 141 million H tokens from the Ethereum bridge before additional tokens were minted on BNB Smart Chain. Humanity Protocol and Quantstamp said the attack bore characteristics associated with North Korea-linked threat actors.

The breach wiped out most of the H token’s value within hours, with on-chain analysts estimating losses of more than $32 million at the time and the token falling roughly 89% as the attacker minted and sold tokens across multiple chains. Kwok said monitoring systems quickly detected unusual token movements after the compromise, although determining the full extent of the incident required several days of forensic analysis across the project’s infrastructure.