Analyst says public XRPL metrics are down 50–80%, but private institutional flows may explain the apparent decline.

XRP Ledger activity has dropped steeply, with public metrics showing active users, payment volume, and sender accounts falling between 50% and 80% within weeks, according to market watcher Arthur.

The data has sparked debate over whether the network is weakening or simply shifting activity away from public dashboards after a new institutional trading feature went live.

Public XRPL Stats Fall

In a thread posted on X on February 23, Arthur said active users with tags fell to about 38,000 from more than 200,000, while payment volume dropped to roughly 80 million XRP from over 2.5 billion. Additionally, unique sending accounts slid to about 3,000 from above 40,000, with the analyst describing the figures as “bad” but arguing they may not reflect real network demand.

He linked the drop to the February 18 activation of XLS-81, a permissioned decentralized exchange system that allows regulated entities to trade inside restricted pools. Transactions routed through those channels do not appear on public trackers. Furthermore, he suggested the late-2025 spike in activity came from retail flows visible on-chain, whereas institutional flows could now be moving privately.

At the same time, the XRP advocate criticized viral price forecasts, such as a February 22 post from trader CryptoBull2020 predicting XRP could hit $15 by March and $70 by May. He argued that liquidity and macro conditions matter more than social media optimism.

The asset was trading near $1.39 at the time of writing, down about 2% in the last 24 hours, 5% in seven days, and 27% over the past month. Across the last year, it has fallen by more than 46% and is now more than 60% below its July 2025 peak of $3.65.

By comparison, Bitcoin (BTC) has mostly ranged sideways recently, according to pseudonymous analyst Darkfost, which they said has limited direction across altcoins.

You may also like:

Darkfost also reported that more than 31 million XRP moved into wallets on Binance in a single day, largely from large holders. They estimated the transfers could represent about $45 million in potential sell pressure if the funds reach the market.

Loss Data and Valuation Metrics Offer Mixed Signals

A recent report from Santiment adds longer-term context, saying XRP recorded its largest realized loss spike since 2022 after falling from about $3.60 to near $1.10 earlier this month. The firm noted that similar spikes previously came right before a 114% price rise within eight months, though it did not predict that pattern would repeat.

In another analysis, Santiment compared MVRV ratios to rank Ethereum as the most undervalued major crypto at -14.3%, followed by Bitcoin at -6.9%, with XRP at -4.1%. The metric measures whether holders are in profit or loss relative to their cost basis.

Welcome to the US Crypto News Morning Briefing—your essential rundown of the most important developments in crypto for the day ahead.

Grab a coffee — because stablecoins may be about to reshape the US bond market. A new Standard Chartered report suggests rising demand for Treasury bills from digital dollar issuers could quietly force Washington to rethink how it finances its debt.

Crypto News of the Day: Stablecoin Demand Could Force Washington to Rethink US Debt Strategy

Stablecoins may soon reshape the US Treasury market, potentially forcing a radical shift in debt issuance, according to a new report from Standard Chartered.

The bank projects that stablecoin issuers could generate between $0.8 trillion and $1 trillion of fresh demand for Treasury bills (T-bills) by the end of 2028.

This trend, when combined with Federal Reserve purchases, could push total short-term Treasury demand to $2.2 trillion.

The report warns that the Treasury could use this emerging excess demand as justification to increase T-bill issuance while reducing long-term bond supply. Such a move could, in effect, allow the US government to suspend all 30-year bond auctions for the next three years.

“We think the US Treasury may use this potential excess demand as a reason to issue more T-bills,” wrote Geoff Kendrick in the latest Standard Chartered report, highlighting stablecoin issuers as increasingly significant buyers of short-term US debt.

Emerging market stablecoins are expected to drive the majority of this demand. Standard Chartered estimates that two-thirds of projected T-bill demand will come from emerging markets, representing net new demand. Meanwhile, stablecoins in developed markets largely substitute for existing holdings.

This pattern highlights the growing role of digital assets in global capital flows and their influence on traditional fixed-income markets.

The potential implications for the Treasury yield curve are substantial. Shifting roughly $9 billion from long-term bonds to T-bills could initially flatten the US Treasury curve.

Yield Curve Risks Mount as Treasury Weighs Expanding T-Bill Share

Standard Chartered notes, however, that long-term premia, fiscal deficit concerns, and market sentiment could influence investor reaction over time.

The bank cautions that a bull flattening at the front end may be the immediate response, but structural factors, including term premia and rollover risk, could shape yields differently in the longer term.

Treasury Secretary Scott Bessent could leverage this scenario to increase the share of T-bills within the overall debt portfolio.

Raising the T-bill share by just 2.5% over three years would generate roughly $900 billion of additional T-bill supply, offsetting the projected excess demand.

This could ease scarcity at the front end of the curve while keeping the 10-year Treasury yield manageable.

The report also notes that historically, T-bills have averaged 26.1% of outstanding marketable debt. This is well above the Treasury Borrowing Advisory Committee’s recommended 15–20% range, suggesting room for an increase.

Despite short-term stagnation, stablecoin market capitalization is projected to reach $2 trillion by the end of 2028. Growth has recently stalled at around $304 billion, influenced by weaker digital asset markets and regulatory delays following the US GENIUS Act.

However, Standard Chartered considers these factors cyclical rather than structural. Stablecoin demand, combined with ongoing Fed Reserve Management Purchases and replacement of maturing mortgage-backed securities, could therefore drive a historic reshaping of short-term US debt markets.

The report concludes that while suspending 30-year bond auctions would not be unprecedented—the Treasury paused them from 2002 to 2006—the current deficit environment differs markedly.

Chart of the Day

Byte-Sized Alpha

Here’s a summary of more US crypto news to follow today:

San Francisco, CA – NEAR is launching Near.com, a new crypto wallet and consumer app that aims to make blockchain technology feel as simple as using a traditional finance app, while positioning itself at the intersection of crypto and artificial intelligence (AI).

Polosukhin previously co-authored the paper that introduced the transformer model, the architecture underpinning modern AI systems like ChatGPT and many other large language models, and has increasingly focused on how blockchain infrastructure can support the next wave of AI-driven applications.

“We are entering the world where AI is becoming our interface to compute,” Polosukhin said during the presentation.

NEAR token is down nearly 3% over the last 24 hours.

At its core, Near.com is designed to remove much of the friction that has long made crypto confusing for everyday users. Instead of worrying about gas fees, private keys or switching between different blockchains, users can manage their assets in one place.

“You don’t need to think about blockchains. You don’t need to think about gas, keys,” Polosukhin said. “You just use it as your main wallet.”

Near.com supports a range of digital assets, including bitcoin, stablecoins, NFTs and other tokens. The idea is to bring together activity that is typically spread across multiple wallets and networks into a single, streamlined interface.

Advertisement

But NEAR’s ambitions extend beyond building just another wallet. The company is betting that the next big wave in crypto will come from its convergence with AI.

As AI agents become more capable, like booking travel, managing emails or handling online purchases, they will increasingly need the ability to transact. That’s where crypto infrastructure comes in. Blockchains can provide programmable payments, global transfers and automated settlement without relying on traditional intermediaries.

Polosukhin argued that as AI systems begin interacting with each other, they effectively become “economic actors,” software programs that negotiate, pay and coordinate tasks. In that world, crypto becomes the financial layer that allows these agents to operate.

Near.com is designed to serve as that layer, acting as both a user-friendly wallet for people and an economic backend for AI-driven activity.

A key part of the announcement is privacy. One of blockchain’s longstanding tradeoffs is transparency: transactions are typically visible to anyone. While that openness can build trust, it can also expose sensitive financial information.

“Everything you do onchain is transparent,” Polosukhin said. “That’s not realistic for usual use cases, for day-to-day usage.”

To address this, NEAR introduced a “confidential mode” within Near.com. The feature allows balances, transfers and trading activity to remain private within the network’s security framework. The company says this makes the wallet more practical not only for individuals and businesses, but also for AI agents that may need to transact without revealing strategy or sensitive data.

The launch signals a broader shift for NEAR.

“We have the stack. We have all the components. We have the product,” Polosukhin said. “Now we’re switching … to how we actually scale adoption — how we bring this to billions of people around the world.”

Read more: Most Influential: Sam Altman

Kraken’s decision to fund savings accounts for every child born in Wyoming this year is being viewed as the latest move aligning the exchange with the crypto-friendly Trump administration.

The cryptocurrency exchange currently ranks as the sixth largest globally by 24-hour trading volume, with about $1 billion traded over the past day – behind Binance, Bybit, OKX, Coinbase, and Bitget, according to CoinGecko.

Last week, Kraken said it would sponsor “Trump Accounts” for every child born in Wyoming in 2026, essentially pledging a financial contribution to each account as part of a savings program introduced by President Donald Trump.

While the exchange framed the plan as a way to grow financial opportunity for families, experts say it also underscores its close relationship with Wyoming (where it is headquartered), as well as the Trump administration.

Trump Ties

Jamie Green, COO at Superset, told The Defiant that funding the accounts is about “maintaining goodwill in the jurisdiction” that afforded Kraken its most significant banking license. In 2020, Wyoming approved Kraken’s plan to launch Kraken Bank, making it the first crypto company in the U.S. to receive an SPDI charter – a state banking license that lets it hold and safeguard digital assets.

However, Green said the move could invite political backlash, as opposed to regulatory scrutiny. “The greater risk is political. Democrats and progressive critics will cite this as further evidence of a cozy relationship between crypto firms and the White House,” he added.

Jesse Powell, Kraken’s co-founder, publicly backed Trump during the 2024 campaign, announcing in June of that year that he had personally donated $1 million to the president’s re-election bid, according to a congressional staff report.

Reuters also reported last year that Payward Inc., Kraken’s parent company, hired the Trump-aligned lobbying firm Ballard Partners in late 2024, joining several crypto companies that hoped to shape policy under the new administration.

“Being visibly Trump-aligned is an asset today – and a liability when political winds change,” Green said.

Wyoming’s Crypto Influence

Daniel Bara, director of the Olympus Association, told The Defiant that the move reflects Kraken’s long-standing relationship with Wyoming – a state that has often served as a testing ground for crypto policy and where initiatives launched are closely watched by other states.

“Wyoming built one of the first regulatory frameworks in the country that treated digital assets as a legitimate financial category,” Bara said. Earlier this year, the state also launched FRNT, the first U.S. state-issued dollar-backed stablecoin, managed by Franklin Templeton and available through partners including Kraken.

And in March 2025, Wyoming Senator Cynthia Lummis and Congressman Nick Begich introduced the BITCOIN Act – legislation that would establish a U.S. Strategic Bitcoin Reserve and codify a national digital asset policy.

“Committing $1.2 million to fund Trump Accounts for every child born in the state this year reflects the depth of that relationship,” Bara said. “And for a company preparing for a public offering, that kind of visible community investment likely carries weight.”

A Growing Convergence

From a broader standpoint, experts said that Kraken’s move aligns with a larger shift of crypto firms deepening ties with policymakers.

“We have a sitting president who has launched a meme coin, a DeFi platform, and has interests in Bitcoin mining,” Christopher Perceptions, lead at Jubilee Labs and a strategic advisor to Wisconsin State Senator Dora Drake, said. “The convergence is here, and the tidal wave is still gathering momentum.”

Bara added that just a few years ago, crypto companies largely operated outside the political system or rebelled against it. “Now you have hundreds of millions flowing into super PACs, companies relocating to regulatory-friendly states, and corporate sponsorships tied to federal initiatives,” he said.

A top economist has sounded a major warning on key assets like stocks, gold, silver, and the crypto market. 

The stark warning as these assets have become highly volatile in the past few weeks or months. Crypto prices have sunk, with Bitcoin (BTC) and most altcoins being in a technical bear market.

American stocks have also wavered, with the S&P 500 Index remaining below its all-time high. It has barely moved this year. Similarly, the Dow Jones and Nasdaq 100 indices have remained in a tight range lately. Gold and silver prices have also pulled back from their all-time highs.

Mark Zandi warns on stocks, gold, silver, and crypto prices

In a statement on Sunday, Mark Zandi, the top economist at Moody’s, warned that the financial market was fraught and that it may experience a sharp pullback soon.

He pointed to the ongoing complacency among investors, who are using dips as buyiyyng opportunity. Also, he pointed to the increasing speculation, where investors believe that prices will rally in the future because they did so in the past.

Zandi has identified more risks in the market. For example, he observed that the US economy was growing below its potential, with the real GDP growing by slightly above 2%. The estimated potential is about 2.5%. 

At the same time, the labor market has flatlined, with the unemployment rate remaining above 2%. The economy added less than 200,000 jobs last year, the smallest increase in years.

Zandi also pointed to the ongoing woes in the Treasury market, where long-term bond yields have continued rising in the past few months. Hedge funds have increased their leverage in the market, leading to more risk as the US public debt continues rising.

Zandi also believes that the stock market has become highly overvalued and disconnected from the economy.

Two major risks persist 

Stock and crypto prices are vulnerable amid major risks in the market. The first major risk is that Donald Trump may launch an attack against Iran anytime soon.

In a statement last week, Trump noted that he was considering a limited strike to push the Iranians to the negotiating table. Iran, on the other hand, has warned that any attack will lead to a wider war that may lead to a wider war in the region. 

A war would lead to more volatility in the stock and crypto markets by stimulating inflation in the US. A high inflation rate, on the other hand, would make it hard for the Federal Reserve to cut interest rates.

There are also trade risks as Donald Trump considers responding to his Supreme Court loss last Friday. He announced a global tariff of 15% using another rule that allows the president to levy tariffs for 150 days.

TLDR

• ProShares recorded $17 billion in first-day trading volume for its new GENIUS money market ETF.
• The firm confirmed that internal fund allocations contributed to the early surge in activity.
• The GENIUS ETF follows federal rules for stablecoin reserve standards under the GENIUS Act.
• Analysts observed that the debut outpaced previous high-profile ETF launches across the market.
• Tokenized money market funds continued to gain traction as institutions explored blockchain settlement.

ProShares opened its GENIUS-branded money market ETF with heavy trading and strong early flows as firms continued exploring tokenized fund structures, and the launch drew wide market attention as cash-management demand persisted and blockchain rails expanded. The surge placed new focus on how issuers used internal allocations while investors assessed broader shifts. The event also advanced discussion around how digital cash products could interact with regulated funds.

GENIUS ETFs and Early Market Activity

ProShares reported $17 billion in first-day volume for its Genius Money Market ETF, and the firm confirmed internal transfers fueled much of the total. The company used cash from existing funds to support treasury operations, and this move highlighted how issuers managed liquidity across products.

Bloomberg tracked the debut and compared it with other launches, and analysts noted the sharp difference in volume. The debut exceeded the first-day totals of new crypto and ESG ETFs, and it shifted attention to cash strategies.

The GENIUS structure aligned with federal requirements for payment-stable assets, and the fund held short-duration government securities. The law set clear reserve and disclosure standards, and issuers applied these rules to maintain consistent oversight. Market observers watched activity closely, and early trading showed strong operational utility. The ETF advanced its role as a treasury tool, and issuers framed the approach as a way to streamline internal flows.

Tokenized Funds Enter Broader Use Cases

Tokenized money market funds gained traction as firms tested blockchain settlement, and the products offered yield while operating within compliance frameworks. Issuers presented them as interest-bearing complements to digital dollars, and adoption increased across institutional channels.

JPMorgan Chase strategists noted that tokenized fund shares could work as collateral, and they suggested the model preserved yield during transfers. One strategist said, “You can post money-market shares and not lose interest,” and firms continued building pilots.

The growth of tokenized vehicles aligned with rising stablecoin usage, and institutions explored both products for payments and custody. Funds positioned themselves as regulated alternatives, and issuers stressed transparency requirements. The Bank for International Settlements described tokenized money funds as fast-growing instruments, and the bulletin referenced their use in settlement trials. The report added context as markets evaluated new rails.

Regulatory Alignment and Current Developments

The GENIUS Act shaped how issuers structured reserves, and fund operators adopted those guidelines for liquidity portfolios. The law reinforced the role of high-quality assets, and managers applied these standards across new launches.

Firms also expanded product research, and issuers examined how tokenized versions might fit into custody systems. The approach strengthened administration flows, and providers continued monitoring regulatory updates.

ProShares used the GENIUS branding to reflect compliance, and the ETF’s early volume elevated attention on regulated cash tools. The debut arrived as digital asset firms explored new pathways, and issuers weighed operational benefits.

The USD1 stablecoin briefly lost its dollar peg on February 23, falling to around $0.994 before quickly recovering. The token now trades close to parity, suggesting the disruption lasted only minutes.

USD1 is issued by World Liberty Financial (WLFI), a DeFi project linked to business entities associated with Donald Trump and his family. The stablecoin currently has a market capitalization near $4.8 billion.

World Liberty Financial’s Stablecoin Depeg Triggers Speculation

WLFI responded within hours. The company said attackers compromised several cofounder accounts, spread false information, and opened short positions to profit from panic selling.

Despite the rapid recovery, the incident triggered widespread concern across the crypto community. 

Some users compared the sudden depeg to early warning signs seen before the collapse of algorithmic stablecoins such as TerraUSD in 2022.

However, USD1 differs structurally. WLFI says it maintains full 1:1 reserves, unlike TerraUSD’s algorithmic design, which relied on arbitrage mechanisms rather than direct asset backing.

Meanwhile, unverified reports circulated on social media claiming that Eric Trump deleted older promotional posts related to USD1 during the volatility. 

Screenshots have circulated online, but no independent confirmation has verified these claims.

Separately, blockchain investigator ZachXBT said he plans to release findings later this week on alleged insider trading involving a major crypto company. 

He did not name the firm. Still, some social media users speculated that WLFI could be involved. There is no evidence supporting this claim at the time of writing.

Stablecoins rely heavily on confidence. Even brief depegs can trigger rapid selling if users fear insolvency or reserve weakness.

USD1’s quick recovery suggests that redemptions and liquidity mechanisms functioned as designed. Nevertheless, the incident reflects how quickly market sentiment can shift, especially for newer stablecoins tied to high-profile figures.

The company has not disclosed technical details of the alleged attack.

The coming days, including any investigation disclosures, will likely determine whether the event remains a short-lived market shock or develops into a broader credibility test for USD1.

Editor’s note: In the ongoing battle against malware, RenEngine’s reach underscores how attackers exploit trusted software channels to broaden their victim base. Today’s briefing from Kaspersky Threat Research highlights a multi-stage infection that pivots beyond gaming into widely used cracked productivity tools. The findings emphasize the importance of verifying software sources and maintaining updated defenses across personal and corporate environments. As cyber threats increasingly blend with legitimate workflows, readers should review security practices, stay vigilant about unofficial installers, and consider how threat actors opportunistically adapt to new distribution methods. This update offers context for executives, IT teams, and security professionals navigating a rapidly evolving threat landscape.

Key points

• RenEngine loader is distributed via dozens of pirated software sites, not just cracked games.
• Final payloads include Lumma, ACR Stealer, and Vidar in various infection chains.
• The distribution pattern is opportunistic and regional rather than targeted.
• The campaign uses Ren’Py-based game installers with fake loading screens to deploy malware

Why this matters

The expansion from gaming to cracked productivity software widens the potential victim pool and raises risk for individuals and organizations. Attackers use multi-stage delivery, anti-analysis checks, and broad distribution to bypass defenses. Organizations should reinforce software provenance checks, user education, and behavior-based detection to identify malicious activity masquerading as legitimate software.

What to watch next

• Watch for new distribution sites or bundles carrying RenEngine via cracked software.
• Monitor for updates from security vendors on HijackLoader-based campaigns across multiple payloads.
• Track any new payload families linked to RenEngine or related loaders.

Disclosure: The content below is a press release provided by the company/PR representative. It is published for informational purposes.

Kaspersky identifies RenEngine loader distributed through pirated games and software

Kaspersky identifies RenEngine loader distributed through pirated games and software

February 23, 2026

Kaspersky Threat Research has revealed its analysis of RenEngine, a malware loader that has recently gained public attention. Kaspersky identified RenEngine samples as early as March 2025, with its solutions already protecting users from the threat at that time.

Beyond the cracked games highlighted in recent reports, Kaspersky researchers discovered that attackers created dozens of websites distributing RenEngine through pirated software, including graphics editors like CorelDRAW. This expands the known attack surface beyond the gaming community to anyone seeking unlicensed software.

Kaspersky has recorded incidents in Russia, Brazil, Turkey, Spain and Germany, among other countries. The distribution pattern indicates opportunistic attacks rather than targeted operations.

When Kaspersky first identified RenEngine, the loader was delivering the Lumma stealer. Current attacks distribute ACR Stealer as the final payload, and Vidar stealer has also been observed in some infection chains.

The campaign exploits modified versions of games built on the Ren’Py visual novel engine. When users launch infected installers, a fake loading screen appears while malicious scripts execute in the background. The scripts include sandbox detection capabilities and decrypt a payload that initiates a multi-stage infection chain using HijackLoader, a modular malware delivery tool.

“This threat extends beyond pirated games — attackers are using the same technique to distribute malware through cracked productivity software, which broadens the potential victim pool significantly.”

— Pavel Sinenko, lead malware analyst at Kaspersky Threat Research

“Game archive formats vary by engine and title. If an engine doesn’t check the integrity of its resources, attackers can embed malware that executes the moment you click play.”

Kaspersky solutions detect RenEngine as Trojan.Python.Agent.nb and HEUR:Trojan.Python.Agent.gen. HijackLoader is detected as Trojan.Win32.Penguish and Trojan.Win32.DllHijacker.

To stay protected, Kaspersky recommends:

• Download games and software only from official sources. Pirated content remains one of the most common malware delivery methods.
• Use a reliable security solution. Kaspersky Premium protects against threats like RenEngine through its Behavior Detection component, which identifies malicious activity even when malware is disguised as legitimate software.
• Keep your operating system and applications updated to ensure known vulnerabilities are patched.
• Be skeptical of “free” offers. If a paid game or software is available for free download on an unofficial site, the cost is likely your security.

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. With over a billion devices protected to date from emerging cyberthreats and targeted attacks, Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services to protect individuals, businesses, critical infrastructure, and governments around the globe. The company’s comprehensive security portfolio includes leading digital life protection for personal devices, specialized security products and services for companies, as well as Cyber Immune solutions to fight sophisticated and evolving digital threats. We help millions of individuals and nearly 200,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com.