XRP is once again under pressure as renewed selling activity and weakening market structure raised fresh concerns about whether the token can maintain support above the critical $1 level.

Related Reading

After briefly attempting a recovery earlier this month, XRP has slipped back into a corrective phase, reflecting broader weakness across digital asset markets and growing caution among traders.

Recent price action shows how quickly sentiment can shift. What appeared to be a potential breakout has instead turned into another test of investor confidence, with technical indicators and macroeconomic trends now shaping the short-term outlook.

XRP's price trends to the downside on the daily chart. Source: XRPUSD on Tradingview

Heavy XRP Selling Sparks Fresh Downtrend

The latest decline followed a large wave of selling on South Korean exchange Upbit, where roughly 50 million XRP were offloaded within a 15-hour window. Market data indicates that nearly all of the activity represented genuine spot selling rather than wash trades, suggesting real liquidation from retail or institutional participants.

The sell-off pushed XRP toward the $1.44–$1.5 range, marking a two-day low and extending losses across the broader crypto market. The token has dropped about 11% in 24 hours and nearly 30% over the past month despite a brief rebound attempt earlier in February.

Technically, XRP has broken below a multi-month descending trendline, turning former support near $1.51 into resistance. Analysts now view the $1.35–$1.40 zone as a key defense level.

Failure to hold the defense zone could expose downside targets at $1.30 and potentially the February lows near $1.15, with some projections pointing toward $1.00 if selling pressure persists.

Institutional Developments Offer Mixed Signals

While XRP price action remains weak, developments around the ecosystem paint a more complex picture. Trading data shows derivatives activity increasing, with open interest rising and options volume surging, indicating that traders are actively positioning around current volatility.

Meanwhile, comments from SBI Holdings CEO Yoshitaka Kitao clarified that the Japanese financial group holds roughly a 9% stake in Ripple Labs rather than billions of dollars worth of XRP, dispelling speculation circulating online.

Regulatory momentum also drew attention after Ripple CEO Brad Garlinghouse joined a U.S. Commodity Futures Trading Commission advisory committee, a move viewed as a sign of improving industry relations with regulators.

Long-Term Utility vs Short-Term Market Pressure

Beyond market turbulence, activity on the XRP Ledger continues to expand, particularly in tokenized real-world assets such as commodities. Data shows rapid growth in the value of tokenized commodities recorded on the network, positioning it among the leading blockchain platforms in this emerging sector.

However, analysts caution that network adoption does not immediately drive price appreciation. Broader macro factors, including liquidity rotation toward artificial intelligence investments, geopolitical uncertainty, and cautious monetary policy expectations, continue to weigh on crypto assets.

Cover image from ChatGPT, XRPUSD chart on Tradingview

• More than $107,000 in total losses have already been identified through on-chain analysis.
• No specific wallet provider or exploit vector has yet been confirmed by investigators.
• Attackers are siphoning small amounts under $2,000 per wallet, delaying detection and spreading risk widely.

A new on-chain alert has drawn attention to a discreet but wide-reaching crypto theft campaign affecting hundreds of users across EVM-compatible blockchains.

The warning, shared by blockchain investigator ZachXBT, points to a coordinated wallet-draining operation that has already resulted in more than $107,000 in cumulative losses.

What sets this incident apart is not the size of individual thefts, but how they are carried out. Instead of targeting large balances, the attacker appears to be siphoning relatively small sums from a large number of wallets.

Most losses remain under $2,000 per address, allowing the activity to spread quietly without drawing immediate attention from victims or monitoring systems.

A stealthy pattern emerges

The affected wallets span several EVM-compatible networks, confirming that this is not limited to a single chain or ecosystem.

Transaction data reviewed by investigators shows consistent timing and similar transfer amounts, indicating a coordinated effort rather than isolated incidents.

So far, no specific wallet provider, decentralised application, or smart contract vulnerability has been identified as the entry point. There has also been no official confirmation linking the drains to compromised software updates or phishing campaigns.

What has been established is that the stolen funds are being funnelled into related addresses, suggesting a single actor or closely connected group is responsible.

This lack of a clear exploit vector has complicated efforts to contain the issue.

Without knowing how access is being gained, users and developers are left with limited immediate options beyond heightened vigilance.

Why small losses create big risks

While the financial impact on individual users may appear limited, the method itself raises broader concerns.

By spreading theft across many wallets, attackers can delay detection and reduce the likelihood of rapid, coordinated responses.

Victims may notice missing funds days or weeks later, if at all.

The approach also underlines the persistent risks facing self-custody users who interact with multiple chains, protocols, and permissions.

Each interaction increases the surface area for potential compromise, particularly within the interconnected EVM ecosystem.

The timing of the incident has added to unease in the crypto community.

It follows a series of security breaches in late 2025 that renewed scrutiny around wallet approvals, private key management, and cross-chain activity.

Exploits remain a constant threat

This episode fits into a wider pattern of ongoing security issues across the digital asset sector.

Data from blockchain security firm PeckShield shows that December saw around 26 major crypto exploits, resulting in losses of roughly $76 million.

While that total was significantly lower than November’s $194 million, it confirms that exploit activity remains persistent.

One of the most prominent incidents during the period involved Trust Wallet, which disclosed a security issue linked to a specific version of its browser extension.

The breach, which occurred over the Christmas period, led to about $7 million in losses.

The company has since started compensating affected users and introduced updates to strengthen verification and reimbursement processes.

ZachXBT has said the wallet-draining case is still developing, with fund movements continuing to be tracked.

There is currently no confirmed explanation for how the wallets were compromised, and no single product or service has been publicly blamed.