XRP & Ripple Weekly News Review — Week of September 21–27, 2026

The week in one paragraph

After a week that broke its demand zone, XRP spent this one taking the zone back and then some. From the $1.25–$1.28 floor of the CLARITY-and-Fed week, the token ripped to $1.65 on Wednesday — an eight-month high and its first trade above $1.60 since February 4 — on roughly $300 million of short liquidations across the market in a single hour (Yahoo Finance; 24/7 Wall St.). The squeeze had real company: whales added 470 million XRP (~$724 million) in five days, open interest hit a nine-month record at $4.1 billion, and the ETF complex went from a literal $0.00 Monday to +$75.6 million for the week — its eleventh consecutive positive week and its best since August. Then two things tested it: Wednesday's rejection at $1.66, which closed the session at $1.50, and a $387.5 million Bitget hack on Thursday in which 102.9 million XRP was the single largest asset taken. The market absorbed both and closed the week at $1.510, up 7.1% — the strongest weekly close since the August re-rating. Sixteen items below, every figure carried with its source and date.

The week's data snapshot

Full metric-by-metric breakdown with dates in the Weekly Data Report.

How the week unfolded

The week was a short squeeze with a supply shock folded into it. Monday opened at $1.4099 and closed at $1.5330 — an 8.7% session — as exchanges forced roughly $300 million of short positions across the market to close within an hour, with XRP among the most heavily shorted assets at the time (Yahoo Finance; 24/7 Wall St.). Tuesday extended to a $1.6018 high and a $1.5718 close; Wednesday printed the week's peak at $1.6536 — the highest since February 4 — before reversing hard to a $1.4821 low and a $1.5006 close, a 6.9% daily loss (Yahoo Finance). Thursday brought the Bitget breach, disclosed at 18:31 UTC, and XRP still closed higher at $1.5331. Friday recovered to $1.5684 on the back of a $2.39 billion week for Bitcoin's ETFs, and the weekend gave a little back, settling at $1.5237 on Saturday and $1.5098 on Sunday.

Daily closes per Yahoo Finance XRP-USD daily OHLC (the series matches the CoinGlass and YCharts closes cited in prior editions line for line). Intraday extremes per Yahoo Finance and the dated session reports named in each item.

The sixteen stories

1. Monday's squeeze: XRP's best session of the quarter as ~$300M of shorts closed Market

XRP opened the week at $1.4099 and closed at $1.5330 — an 8.7% session, the largest one-day gain in the major-cap complex. The mechanism was forced buying: on September 21 exchanges closed roughly $300 million of short positions across the crypto market within an hour, and XRP, per 24/7 Wall St. and Yahoo Finance, held "one of the most heavily shorted positions at that time." The move did not need a catalyst to start; it needed a crowded short book, and it found one built during the CLARITY-and-Fed week, when the token had slid to $1.25.

My take: last week's review flagged the weekend squeeze as "the market confessing positioning." This week the confession got larger and louder — the same trade, one order of magnitude up. The honest way to read an 8.7% day that begins with no news is as the unwind of a bearish consensus, not the arrival of a bullish one. That distinction matters because the two have very different follow-through: an unwind ends when the shorts are gone, while a bid keeps going until the buyers are exhausted. Monday's volume — $7.00 billion — tells you the unwind was large, not that it was followed.

2. XRP breaks $1.60 for the first time since February 4 Market

Tuesday's high of $1.6018 was the first trade above $1.60 since February 4, 2026, per Santiment data — an eight-month high — and Wednesday extended it to $1.6536, which several outlets rounded to $1.66 (COINOTAG; Blockonomi; CoinCentral; U.Today). Santiment also recorded 1,917 XRP transactions worth at least $100,000 each, the strongest high-value activity in about a month, alongside 3,647 newly created XRP wallets. The token had rallied roughly 15.8% in the week through September 23 (close-to-close) and about 28% off the September 16 low near $1.25, per BeInCrypto.

My take: the eight-month framing is the useful part, because it locates the resistance honestly. $1.60 is not a round number that appeared this week — it is the level that has capped XRP since the February breakdown, and the token's approach to it produced exactly two intraday probes and zero closes above it. Santiment's whale-transaction count is the more interesting datum, but also the more easily over-read: large transfers record repositioning, not direction, and the firm itself says as much. "More big money moving" is a fact. "Big money accumulating" is an inference this data does not support on its own — which is why item 3 exists.

3. Whales add 470 million XRP in five days — the accumulation number, named On-chain

On-chain data cited by analyst Ali Martinez showed whale balances climbing to approximately 12.80 billion XRP between roughly September 21 and September 25 — a reported accumulation of more than 470 million tokens, worth about $724 million at prevailing prices (BeInCrypto, Sep 25). The accumulation ran alongside the ETF bid rather than replacing it, and it put the $1.60 level back in focus as the technical line that separates the recovery from the trend, with an inverse head-and-shoulders neckline sitting near it.

My take: this is the week's cleanest on-chain claim, and also the one to hold most carefully. Whale-balance series are provider-specific — the threshold that defines a "whale" wallet differs between analytics firms, and a reclassification of addresses can move the aggregate without a single coin changing hands. What makes this reading more than noise is that it is directionally consistent with two independent data points: Santiment's 1,917 large transactions and the ETF complex's +$75.6 million. Three different methodologies pointing the same way beats one precise-looking number; treat the magnitude as approximate and the direction as solid.

4. Open interest hits $4.1 billion — a nine-month record Derivatives

XRP futures open interest climbed to $4.1 billion within a 24-hour window on September 23, a nine-month high that moved XRP above both Hyperliquid and Zcash in futures-market depth (CoinGlass via Blockonomi). The composition shifted with it: CME futures open interest jumped more than 16% to $756 million and Binance's futures open interest rose 10% to almost $700 million. Futures volume across derivatives venues reached $9.4 billion against $2.2 billion of spot, and the session's liquidation flow included $9.50 million of shorts closed, among them a single $5.09 million XRPUSDT liquidation on Binance.

My take: last week the story was a book that thinned — $3.06B down to $2.86B — and this week it rebuilt 43% in a single session. That is the mechanical explanation of both the size of Wednesday's reversal and its speed: an 11.6% intraday band requires a leverage stack on both sides, and OI at a nine-month high supplied it. The detail I would keep is the CME line. Regulated, institutional, cash-settled open interest growing 16% in a day to $756M is a different kind of participation from offshore perpetual leverage, and it is the first time this year that the two have expanded together. It does not make the tape safer; it makes the participants more heterogeneous, which is generally a durability improvement.

5. Wednesday's rejection: $1.66 high, $1.48 low, $1.50 close Market

September 23 was the week's most instructive session. XRP printed $1.6536 — an eight-month high — then fell to $1.4821 and closed at $1.5006, a 6.9% daily decline off a 11.6% intraday band (Yahoo Finance; 24/7 Wall St.; Finobird). It was the second consecutive session that traded above $1.60 and closed below it. The sellers were identified: traders who bought during XRP's August 22 spike to $1.70 — a day that closed at $1.46 — using the recovery as an exit, plus longer-term holders who bought above $2.75 (Yahoo Finance; Finobird).

My take: this is the item that keeps the week from being a story about strength. The oversupply at $1.60–$1.70 is not mysterious — it is a known, dated cohort of trapped buyers from one specific August session, and its existence was documented before this rally started. A market that must absorb the August 22 cohort before it can trend is a market whose next leg up has a funding requirement. The two closes below $1.60 with two intraday probes above it is textbook distribution into strength; the counter-argument, which the flow data supports, is that the selling was met rather than merely absorbed.

6. ETF flows: $0.00 on Monday, +$75.6M for the week Market & ETF

US spot XRP ETFs went from nothing to a real number in five sessions. Net flows were $0.00 on September 21, then +$20.02M (Sep 22), +$18.04M (Sep 23), +$14.90M (Sep 24) and +$22.65M (Sep 25), for a weekly total of +$75.6 million — the 11th consecutive week of net inflows and roughly eight times the prior week's $9.57M (SoSoValue via Finobird, BeInCrypto, U.Today, Blockonomi). Bitwise led every session and reached about $677 million cumulative; Franklin Templeton's fund added $4.26M on Friday to reach roughly $501 million and overtook Canary as the second-largest complex by cumulative inflows.

My take: this is the week's most consequential reversal, because it is the first time since August that the ETF number and the price agree. Last week's review called the complex "one issuer deep"; this week it is still Bitwise-led — Bitwise took about 81% of Friday's total — but Franklin has now compounded past Canary and the weekly total is the best since the record August month. One caution worth stating: the $75.6M arrived in four sessions, not five, and September's month-to-date total is about $117.5M against August's ≈$159.2M. That is a recovery, not yet a re-rating.

7. Cumulative inflows reach ~$1.79B, net assets $1.77B — and most holders are still under water Market & ETF

Cumulative net inflows across US spot XRP ETFs reached about $1.79 billion as of September 25, with total net assets near $1.77 billion — roughly a 1% gap in favour of capital contributed, which is unusual for a complex whose underlying asset is up 46% over three months (SoSoValue via Finobird; U.Today). XRP represented approximately 1.80% of the funds' net asset value (U.Today, Sep 25), and the funds held 1.18 billion XRP across seven products as of September 26 (XRP Radar). Daily dollar volume across the five largest products was $57.75M on September 25, with Bitwise accounting for $37.07M of it.

My take: the gap between cumulative inflows and net assets is the most under-reported number in the ETF story. When contributed capital exceeds current assets, the average dollar in the complex is down — and that is exactly what Finobird concluded: "most XRP ETF holders remain underwater." This changes the interpretation of every future flow print. In a complex where the average holder is below water, outflows are redemption pressure and inflows are averaging-down; neither behaves like the allocation bid the coverage assumes. Watch the inflow-minus-net-assets gap as its own series from here.

8. The Bitget hack: $387.5 million, with 102.9 million XRP as the largest single asset Security

Bitget disclosed a security breach on September 24 at 18:31 UTC involving unauthorized transfers from hot wallets, initially estimated at $351.6 million and subsequently revised to $387.5 million after further transfers were found on the Zcash and TRON networks (cryptonews.net; ForkLog; Decrypt via SolanaWire; Coinpedia). Lookonchain's asset breakdown identified 102,926,478 XRP worth $157,477,511 as the largest component — about 44.1% of the itemized total, and nearly 1.84 times the value of the second-largest asset, 31,890 ETH at $85.75 million. The remainder: $34.75M USDT, $21.06M USDC, $19.67M USDT0, 3,000 XAUt ($12.82M), 12,719 BNB ($9.88M), 821,012 AVAX ($8.38M) and 20.59M TRX ($7.07M).

My take: the XRP line is the story inside the story, and it cuts two ways. On the alarming side, XRP was the asset the attackers took most of — which says something about where a large exchange keeps liquid inventory, and about XRP's depth on that venue. On the reassuring side, 102.9 million XRP is 0.10% of the 100 billion supply and 0.51% of the 20.32 billion XRP this site's Sep 26 custody read places on exchanges. That is a rounding error in float terms, which is a large part of why the price closed higher on the day of disclosure. It is not, however, a rounding error in market-structure terms: an unknown holder now controls a hoard whose disposition is a live question.

9. North Korea "very likely," and a bridge link to an earlier Lazarus-attributed exploit Security

Bitget CEO Gracy Chen said on a live broadcast that North Korean hackers were "very likely" behind the breach, citing IP addresses matching the VPN preferences of a specific DPRK-linked group and an intrusion pattern resembling prior operations attributed to North Korean units; she said the exchange does not believe it was an inside job (COINOTAG; Finobird; Decrypt via SolanaWire). Mechanically, Chen said the attackers never obtained private keys for hot, warm or cold wallets and did not forge customer withdrawal requests — they compromised a backend system inside the wallet infrastructure and spoofed transaction data to trick the authorization process. Analyst Specter reported that the stolen XRP was bridged and links directly to funds from the AFX Trade exploit, a $24 million July theft attributed to the Lazarus-associated TraderTraitor unit. Bitget's User Protection Fund, which it values above $464 million (5,500 BTC), covers the loss; a 5% recovery bounty was offered on frozen assets, and staged withdrawals were scheduled to reopen September 28.

My take: two things deserve credit here and one deserves scepticism. The credit: the loss figure was revised upward within 48 hours, which is the opposite of the industry's usual disclosure pattern, and the protection fund is publicly verifiable on-chain. The scepticism: attribution to a state group before a published technical report is a claim, not a finding — Chen herself promised the full report once forensics confirm the entry path, and until it lands, "very likely" is doing a lot of work. The bridged-XRP link to TraderTraitor is the most concrete thread in the case, and it is worth tracking precisely because it implies the stolen XRP left the XRP Ledger rather than being dumped into XRP markets.

10. Absa launches Africa's first bank-led digital asset custody on Ripple's stack Institutional

Absa Corporate and Investment Banking launched Absa Digital Asset Custody on September 21, built on Ripple Custody, which the bank says makes it the first African bank to offer institutional digital-asset custody to corporate and investment banking clients (Ripple via Reece Merrick; CCN; FinWire; CryptoNinjas). The service covers key management inside secure hardware, multi-layer governance and approval workflows, transaction auditing and compliance oversight — it is not an exchange or trading venue. Absa's balance sheet exceeds 2.07 trillion South African rand (~$119.5 billion); the original partnership was announced October 15, 2025, and Ripple Custody v1.41 shipped September 14. Both Absa and Ripple were explicit that the service does not require customers to use XRP or hold assets on the XRP Ledger.

My take: the disclosure discipline here is the interesting part, and it is worth restating plainly: this is a Ripple technology win, not an XRP demand event, and the coverage that framed it otherwise is wrong. What it does evidence is the part of Ripple's business that does not depend on the token's price — Ripple's own 2026 survey of more than 1,000 finance leaders found 89% of banks and asset managers evaluating tokenization partners rank custody a top priority. Custody is the gate through which institutional balance sheets enter; supplying the gate is a durable position even if the tokens passing through it are not XRP. The first activity and audit report for the platform is expected at the end of Q4, which is the date that will actually test the claim.

11. Permission Delegation enters its 14-day activation countdown — earliest go-live October 5 XRPL

The PermissionDelegationV1_1 amendment entered its final two-week activation period on September 21 after reaching 29 of 35 trusted-validator votes, with an earliest possible mainnet activation of 11:18 UTC on October 5, 2026 (XRPScan via CoinAlertNews, U.Today, Banx Network, Finance Review Daily). The condition is strict: support must stay above 80% for the entire 14-day window, and any dip to 80% or below rejects the proposal and resets the clock to zero. The amendment ships inside xrpld 3.3.0 and is coded under the XLS-75 standard, letting an account assign narrowly defined authorities to other accounts without transferring signing keys; delegated permissions are revocable instantly, and certain account-level controls cannot be delegated at all. It is the corrected replacement for an earlier Permission Delegation amendment that was disabled before reaching mainnet after a community tester found a flaw — unauthorized transactions were validated for permission after the signature check, so rejected submissions still deducted fees.

My take: the governance mechanics deserve more attention than the activation date, because they are the reason this is credible. Validators rejected the first attempt, the flaw was diagnosed publicly, a replacement shipped in a versioned release, and the corrected version is being run through the same 80% test — that is a functioning security process, not a headline. On substance, permission delegation is the least glamorous and most institutional amendment on the XRPL roadmap: compliance teams, treasury operators and asset movers can be given operational authority without holding master keys, which is exactly how regulated issuers operate on other chains. Ripple's stablecoin product lead Lauren Berta said the RLUSD team has already begun building and testing the functionality in a development environment — a preparatory step, not a deployment.

12. Two amendments, two countdowns: Batch on ~September 29 and Permission Delegation on ~October 5 XRPL

The live XRPL amendment dashboard showed two amendments inside simultaneous 14-day activation windows — BatchV1_1 projected for September 29 and PermissionDelegationV1_1 for October 5 — provided each maintains the required validator majority (Banx Network; U.Today). Batch groups up to eight transactions into a single atomic operation across four modes, with delivery-versus-payment the headline commercial use; Permission Delegation determines who is authorized to execute them. The February 2026 fix history runs in parallel: both amendments are corrected re-issues rather than new features, and both were held back by validator votes rather than by schedule.

My take: running two governance clocks at once is a real test of the federated-consensus model, and it is the kind of test that only shows up in the calendar rather than the price. The pair is also unusually complementary for a payments and settlements chain: Batch answers "how do multiple legs settle together" and Permission Delegation answers "whose key does the settling" — the two questions an operations desk asks before it will use a ledger for anything with a compliance department attached. What no calendar can supply is a user. Watch for a named institutional user of Batch after activation; that, not the activation, is the milestone.

13. SEC staff publish post-functional FAQs on buybacks, staking receipts and network maintenance Regulation

The SEC's Division of Corporation Finance published new FAQs on September 25 clarifying how federal securities law applies to crypto assets, building on the March 17 interpretive release and the August 18 Regulation Crypto Assets proposal (Crypto Daily; CoinAlertNews; Blockonomi; CryptoRank; The Latest Crypto News). The substance: services to secure, maintain, improve or enhance a functional crypto network — and funding development that builds network effects — do not by themselves constitute "essential managerial efforts" under the Howey test. An announced buyback of a non-security crypto asset on a functional system generally is not a promise of managerial efforts either, though the analysis changes where the system is not functional and the buyback is marketed as creating yield for holders. A staking receipt token that merely evidences ownership of a deposited digital commodity qualifies as a digital tool, and one issued by a protocol-based liquid-staking provider may itself be a digital commodity — provided the issuer cannot transfer, lend, pledge, rehypothecate or otherwise use the deposited assets. Staff stated the FAQs are non-binding views with "no legal force or effect."

My take: the value of this document is in how narrow it is, which is also why the coverage over-read it. It does not classify XRP or any other asset, it does not create a safe harbour, and it explicitly preserves the Kraken-era distinction between protocol-based staking and centralized staking-as-a-service. What it does do is retire one specific and expensive legal argument — "the developers are still working on it, therefore it is a security" — which is the argument that has hung over every functional chain with funded development. Read together with the three rules published the week before, the pattern is now unmistakable: the agency is writing the framework it spent a decade refusing to write, and it is doing so in documents that each carry an expiration.

14. RLUSD takes 92.1% of the XRPL stablecoin market as the ledger total hits $1.159B RLUSD

The XRP Ledger's tracked stablecoin market capitalization reached $1.159 billion on September 25, up $67.12 million (+6.15%) in seven days, of which Ripple's RLUSD accounted for $1.067 billion — 92.1% of the total (DefiLlama via Analytics Insight, BigGo Finance, Pluang). RLUSD's ledger-side value grew 11.55% over 30 days, ahead of the broader ledger stablecoin market's 9.8%. The contrast within the ledger is stark: USDC's XRPL balance fell 21.86% over the month to $4.62 million (0.4% share), Valtorum USD declined 7.03% to $72.77 million and EUR CoinVertible slipped 2.37% to $11.37 million. At the token level, RLUSD's total supply stood at about $2.49 billion on September 26, split roughly 44% on XRPL ($1.10 billion) and 56% on Ethereum ($1.39 billion) (XRP Radar on-chain read).

My take: the 92.1% share sounds like dominance and is better read as an absence of competition — a stablecoin market where the runner-up holds $4.62 million is a market with one participant. The number that carries information is the chain split, which has been the standing caveat in this column for three editions: Ethereum holds $290 million more RLUSD than XRPL does, so the stablecoin's growth is still arriving on the chain where it earns DeFi yield rather than the one where it pays fees in XRP. A settlement rail should eventually invert that ratio. It has not started to.

15. Binance pays $800,000 in XRP to RLUSD holders Payments

Binance launched a four-week campaign distributing $800,000 worth of XRP to users holding RLUSD in eligible accounts, with rewards paid every Friday through October 23 and bonuses for increasing holdings and using RLUSD Simple Earn; margin accounts carry a 60% haircut on borrowed RLUSD for reward calculation (Pluang). The campaign began September 25, the same week the RLUSD-led stablecoin total on the ledger rose 6.15%.

My take: a subsidy is not adoption, and it is worth being blunt about that — an $800,000 incentive program paid in XRP to hold a dollar stablecoin will move balances, and it will move them for four weeks. What makes it worth recording anyway is who is paying and what they are buying. Binance is not Ripple; it is the largest venue by XRP turnover, and it is spending on the distribution side of a product whose supply is already growing faster than its usage. If the ledger stablecoin total holds its 6% weekly pace in the four weeks after the campaign ends, this will have been marketing. If it flattens on October 24, it was a purchase.

16. What comes next: escrow on October 1, Batch on the 29th, Swell in four weeks Outlook

Three dates now sit on the near calendar. September 29: Batch V1.1's projected activation, conditional on validator support holding. October 1: Ripple's monthly escrow release, up to 1 billion XRP (~$1.5 billion at current prices), the large majority of which has historically been re-escrowed inside the same cycle. October 5: PermissionDelegationV1_1's earliest activation at 11:18 UTC. Beyond those, Ripple's Swell conference runs October 27–29, 2026, where the delegation amendment is expected to feature. On supply, this edition's refreshed custody map puts 31.98 billion XRP in escrow (down from 32.445 billion on July 26), 20.32 billion on 24 tracked exchanges, 1.18 billion in ETF custody, 473.3 million in corporate treasuries (~$729 million, led by Evernorth Holdings) and 394.1 million locked in 6 XRPL DeFi protocols and AMM pools (~$611 million) (XRP Radar on-chain read, Sep 26).

My take: the escrow date will generate a hundred "1 billion XRP unlock" headlines and deserves none of them, because the re-escrow rate is the only thing that matters and it is published a few days late. The date that actually deserves attention is the one nobody will write about: September 29, because an amendment activation is a capability and capabilities are the only thing on this list that compounds. On the supply map, the honest summary is that the float is now legible in a way it was not a month ago — and that legibility is itself the finding, because a market that can name who holds 20.32 billion XRP on exchanges can start pricing venue risk instead of guessing at it.

FAQ

Related reading

• XRP Ledger Weekly Data Report — Week of September 21–27, 2026
• XRP Market Intelligence — Week of September 21–27, 2026
• The Largest Line: Reading the Bitget Breach Through Its 102.9 Million XRP