US-listed spot Bitcoin exchange-traded funds (ETFs) finished July in the green despite a late-month wave of selling and BTC price volatility.

Bitcoin ETFs attracted a modest $172.4 million in net inflows in July, reversing two consecutive months of outflows, according to SoSoValue data.

The monthly inflows came despite a volatile end to July, as the funds logged a $265.4 million net outflow on Friday, marking their largest daily withdrawal since July 13.

July’s return to positive territory improved Bitcoin ETF flows after nearly $7 billion in combined outflows over the previous two months, including the largest monthly outflow of 2026 in June at $4.5 billion. However, the weak finish showed investors remained cautious heading into August.

Bitcoin ETFs remain negative in 2026 with $5.29 billion in outflows

Despite a modest net inflow in July, US-listed spot Bitcoin ETFs have recorded around $5.3 billion in net outflows year to date.

March, April and July were the only positive months of 2026, bringing in a combined $3.46 billion in inflows, while January, February, May and June posted outflows totaling about $8.75 billion.

Monthly spot Bitcoin ETF flows in 2026. Source: SoSoValue

The products have still attracted $51.32 billion in cumulative net inflows since launch, while total net assets stood at $76.29 billion at the end of July.

Related: Bitcoin price sinks to 2-week lows as US stocks fail to copy Asia rebound

Weekly flows turned negative at the end of the month after three consecutive weeks of inflows, with Bitcoin ETFs recording a $61.53 million outflow for the week ending July 31.

Ether ETFs end July with four-week inflow streak

While Bitcoin ETFs faced renewed selling pressure at the end of July, some altcoin ETFs maintained steadier inflows.

Ether ETFs stood out, posting four consecutive weeks of inflows and ending the month with a $365.2 million net inflow, according to SoSoValue.

The inflows marked the second month of positive flows for Ether ETFs year to date after April’s $356 million inflow. Despite the recovery, the products remained about $1.1 billion in net outflows year to date.

XRP ETFs also maintained steady demand, recording $27.3 million in July inflows and marking their fifth positive month of 2026. The products have recorded about $343 million in net inflows year to date, making them one of the stronger-performing crypto ETF categories this year.

Magazine: A quantum roadmap would push Bitcoin much higher: Charles Edwards

Moneyflip CEO Marcos Arturo Kleiman Tronllan faces a federal murder-for-hire charge after allegedly paying undercover agents $40,000 to kidnap and kill a businessman over an unpaid debt.

Moneyflip CEO arrested in Miami

Homeland Security Investigations agents arrested Kleiman in Miami on July 30 in connection with a federal complaint filed in San Diego.

Kleiman, 40, is a Mexican citizen and lawful permanent resident of the United States. He previously lived and worked in San Diego, according to the U.S. Attorney’s Office for the Southern District of California.

Moneyflip is a registered money services business offering cross-border currency exchange services. Kleiman previously operated the company as MXN Financial LLC before it changed its name to Moneyflip LLC in 2025.

Investigators began examining Kleiman while investigating currency exchange businesses in San Diego and Imperial counties. Authorities suspected that he used cross-border transactions to avoid Bank Secrecy Act reporting requirements and launder proceeds from drug sales.

The complaint contains allegations rather than proven facts. Kleiman is presumed innocent unless convicted.

Undercover agents converted $750K into crypto

Undercover HSI agents approached Kleiman in February and asked him to convert U.S. dollars into cryptocurrency. The agents allegedly told him that the money came from drug sales.

Prosecutors said Kleiman created an email account and shared its password with the agents. The parties allegedly communicated through unsent draft emails to avoid transmitting messages directly.

Kleiman then allegedly converted approximately $750,000 into cryptocurrency and arranged for the assets to be transferred to an undercover agent’s wallet. Authorities said he charged a 10% fee.

“Kleiman converted approximately $750,000 of United States currency into cryptocurrency and caused the transmission of those crypto coins into an undercover federal agent’s wallet,” prosecutors said.

During those discussions, Kleiman allegedly asked whether the agents could recover a debt from a Mexican businessman and kill him. Prosecutors said he agreed to pay $40,000 for the kidnapping and murder, including two $5,000 advance deposits.

Agents staged murder before 25,000 USDT payment

Kleiman allegedly arranged for a third party to deliver the first $5,000 deposit to an undercover agent in San Diego in May. Prosecutors said he later paid another $5,000 deposit after an agent requested money to reserve the purported killers.

On July 28, the undercover agents showed Kleiman three photographs and a video that falsely depicted the businessman as having been captured, tortured and killed. No murder occurred as part of the operation.

Authorities said Kleiman responded that the agents could count on him to complete the payment. On July 29, he allegedly delivered another $5,000 in cash and transferred approximately 25,000 USDT to an undercover cryptocurrency wallet.

USDT is a dollar-pegged stablecoin issued by Tether. Unlike cash, transfers made through public blockchain networks can leave transaction records that investigators may use alongside messages, surveillance, and other financial evidence.

Federal charge carries a 10-year maximum sentence

Kleiman faces one count of murder-for-hire under Title 18, Section 1958(a) of the U.S. Code. The charge carries a maximum sentence of 10 years in federal prison and a fine of up to $250,000.

The case is being prosecuted by Assistant U.S. Attorneys Michael Deshong and Christopher Beeler. HSI led the investigation with support from the U.S. Postal Inspection Service, Drug Enforcement Administration, Customs and Border Protection, IRS Criminal Investigation, and local law enforcement agencies.

Money services businesses that exchange or transmit convertible virtual currencies may fall under federal Bank Secrecy Act requirements. Registration as a money services business does not represent government approval of a company or its activities.

A Hong Kong woman reportedly lost around $3.3 million after an online romantic partner directed her to a fraudulent cryptocurrency investment platform.

Crypto romance scams cost victims nearly $9M

Hong Kong authorities recorded 25 investment fraud cases involving online romantic relationships during the week ending July 30, according to police statistics cited by Binance Square News.

The reported losses totaled nearly HK$70 million, or roughly $9 million. One case accounted for more than a third of that amount.

A 50-year-old insurance professional reportedly met a person online who presented himself as a car dealer. After establishing a romantic relationship, the person persuaded her to invest in virtual currencies through an unfamiliar platform.

The victim continued transferring money after the platform displayed rising account balances. By last month, it claimed that her portfolio had generated returns exceeding 800%.

However, the platform denied her withdrawal request. The purported romantic partner and an alleged investment adviser then stopped responding, leaving the woman with cumulative losses exceeding HK$26 million or around $3.3 million.

Authorities did not disclose which cryptocurrencies were involved or whether any of the transferred funds had been recovered.

Fake profits kept the victim investing

The case follows a common pattern in relationship-based cryptocurrency fraud. Scammers first build trust through dating applications, social media or messaging services before introducing an investment opportunity.

Victims are then directed to trading websites or applications controlled by the fraudsters. These platforms may display fabricated profits, allow a small initial withdrawal, or encourage victims to increase their deposits.

The scheme typically becomes apparent when a victim attempts to withdraw a larger amount. Operators may block the transaction or demand additional payments described as taxes, processing charges or penalties.

Hong Kong police urged investors to treat investment recommendations from newly established online contacts with caution. Warning signs include guaranteed returns, unusually high profits and requests to transfer funds through an unfamiliar platform.

The FBI describes the same method, saying criminals control the supposed investments and often steal all funds deposited by victims.

Hong Kong employment scams also surged

The romance cases add to a wider increase in online fraud affecting Hong Kong residents.

Police recorded 2,148 online employment scams between January and May 2025, up 92.1% from the same period a year earlier, according to figures reported by the South China Morning Post and HRD Asia.

Reported losses increased from HK$260 million to HK$480 million, an 89% rise. Authorities registered 621 cases in May alone, with 60% originating on WhatsApp and another 22% on Telegram.

Investigators attributed much of the increase to “click farming” schemes. Fraudsters initially pay participants small commissions for completing simple online tasks, such as following social media accounts or purchasing products to inflate a seller’s activity.

After gaining trust, scammers ask victims to commit larger sums for higher-paying assignments. Withdrawal attempts are then rejected, with operators claiming the victim made an error or damaged a company system and must pay a penalty.

US crypto fraud losses reached $7.2B

Similar investment schemes remain a major threat to US users. Cryptocurrency investment fraud produced $7.2 billion in reported US losses during 2025, making it the country’s largest category of financial loss reported to the FBI’s Internet Crime Complaint Center.

The FBI’s 2025 report said scammers commonly approach victims through social media, dating platforms and unsolicited messages before moving conversations to private messaging services.

US authorities advise victims to stop sending money immediately and preserve wallet addresses, transaction hashes, platform domains and communications. The FBI also warns against paying supposed recovery services, which may operate a second scam targeting people who have already lost funds.

Hong Kong police similarly advised users not to lower their financial safeguards because of emotional attachment or trust. Investors should independently verify platforms and avoid offers promising guaranteed or abnormally high returns.

XRP Ledger developers are preparing five proposed amendments for the upcoming xrpld 3.3.0 release, targeting privacy, atomic settlement, and easier institutional onboarding.

XRP Ledger v3.3.0 targets institutional transactions

Jazzi Cooper, head of product at RippleX, outlined the proposed changes in a post on X. The xrpld 3.3.0 release is anticipated next week, although releasing the software will not immediately activate its amendments.

“XRPL has already proven it can support tokenized assets at scale. Now it’s time to put these assets to use: global transfers, trading, collateralizing, and settling,” Cooper said.

She added that the five amendments would move the network closer to supporting those activities. The proposals cover confidential token transactions, transaction batching, delegated permissions, sponsored costs, and adjustable token properties.

Each amendment must pass through the XRP Ledger’s validator-governed approval process. Amendments affecting transaction processing generally need at least 80% support from trusted validators for two consecutive weeks before taking effect.

The upgrade follows the activation of fixCleanup3_2_0 on July 29. XRPScan data showed that the amendment received support from 30 of 35 participating trusted validators, equivalent to 85.71%.

Its activation made version 3.2.0 the minimum software release compatible with the updated mainnet rules. Nodes running version 3.1.0 or earlier became amendment-blocked and could no longer follow validated ledgers correctly.

Confidential MPT would add token privacy

Confidential MPT would add native privacy features for Multi-Purpose Tokens on XRPL. The proposal uses elliptic-curve encryption and zero-knowledge proofs to conceal token balances and transfer amounts while allowing authorized verification.

Issuers and holders could keep transaction data private from the public while granting access to a designated third party, such as an auditor or regulator. The arrangement is intended to balance commercial confidentiality with institutional reporting and compliance requirements.

“For financial institutions, privacy is often a prerequisite for using public blockchain infrastructure,” Cooper said.

The proposal could be relevant to US-regulated institutions evaluating public blockchains for tokenized assets. Banks, broker-dealers and asset managers often need transaction confidentiality while retaining records that can be reviewed by auditors or regulators.

However, the amendment would represent a network-level technical function, not regulatory approval for any specific financial product or activity.

Batch and delegated permissions support settlement

The proposed Batch amendment would allow transactions involving multiple accounts to execute atomically within one ledger. Either every part of the batch would succeed, or the entire operation would fail.

The structure can support delivery-versus-payment, where the transfer of an asset and its corresponding payment occur together. It could also reduce settlement risk in more complicated workflows involving several accounts or assets.

Permission Delegation would allow an account holder to grant narrowly defined transaction permissions without transferring control of the account’s signing authority. An institution could therefore authorize a treasury or operations team to perform specific tasks while keeping its issuance keys under separate control.

Sponsored Fees and Reserves would address another onboarding issue by allowing a bank, issuer, or platform to cover transaction fees and account reserves for users.

“Users continue to own their accounts and keys, while removing one of the biggest onboarding hurdles: requiring every participant to acquire and manage XRP before they can interact with the network,” Cooper said.

Dynamic MPT would make issued tokens adjustable

Dynamic MPT, the fifth proposed amendment, would let issuers modify selected token properties after issuance. Adjustable fields could include transfer fees, metadata, and other predefined features.

Issuers currently may need to create a replacement token when important terms require changes. Dynamic MPT is intended to provide limited flexibility without requiring an entirely new issuance, although the final amendment specifications will determine which properties can be changed.

The proposed features arrive as XRPL records increased tokenized real-world asset activity. RWA.xyz data showed that the network added approximately $2.6 billion in RWA value during the six months through July 26, excluding stablecoins.

That ranked XRPL second among tracked networks for net RWA inflows, behind BNB Chain at about $3 billion and ahead of Stellar at roughly $2.1 billion. XRPL’s combined distributed and represented RWA value reached approximately $4.38 billion.

Validator operators will be able to review the amendments as their specifications become available. Activation will depend on whether each proposal independently secures the required consensus after xrpld 3.3.0 is released.

Validators (entities that supply their resources to run and maintain a network) were advised to reject it, and an emergency server release marked it unsupported to prevent activation. No funds were lost, because it never reached the main network.

Permission Delegation, which lets an institution grant another account narrowly scoped authority without handing over full signing power, was disclosed as vulnerable in September 2025 and disabled.

The bug allowed one account to charge transaction fees to another and potentially drain its balance. The ledger’s documentation has listed both amendments as obsolete since, to be replaced by revised versions.

The other three are new. Confidential MPT combines zero-knowledge proofs, which let someone prove a statement is true without revealing the underlying data, with elliptic-curve encryption, so that balances and transfer amounts on Multi-Purpose

Tokens stay private while auditors or regulators can still verify them when required.

Sponsored Fees and Reserves lets a bank or platform cover another account’s XRP fees and reserve requirement, removing the need for every user to acquire XRP before transacting.

Lastly, Dynamic MPT lets an issuer specify at creation which token properties can be changed later, avoiding a full migration to a new token when fees or metadata need updating.

Every step of that runs on the attacker’s machine. The victim’s device is not involved at any point and could be powered off in a safe on another continent.

Galaxy’s breakdown shows the process running. Of the drained wallets, 1,183 used the modern native segwit address format, seven used an older standard and six an older one still. Nobody targets a specific victim across three address formats at once.

That is systematic enumeration, checking each candidate seed against every path it might have produced. The operator can widen the search, refine it and return whenever they choose.

Galaxy warned further waves are likely if owners do not move their funds.

Nor can an owner determine whether they are exposed. There is no test to run against your own wallet that reveals whether your seed sits inside the reproducible range.

Attack might not be fully finished

Coinkite, Coldcard’s maker, has warned Mk3 owners and says its newer devices are unaffected, while Block’s report places the Mk2, Mk4, Q and Mk5 in scope as well. Until that is resolved, anyone who generated a seed on the affected firmware has to assume the worst rather than verify it.

The attacker did make one mistake, however.

Block’s Clay Garrett said on X that the operator used a paid account at a “well-known blockchain data provider” to query the source addresses during the sweeps, and that the provider’s internal logs matched the suspected workflow with what he called extraordinary specificity, down to the number, timing and sequence of requests.