Bitcoin spent the week going nowhere fast, stuck in a $64,000-$66,000 band even as seven straight days of ETF inflows gave it a floor. That kind of quiet consolidation usually makes for a forgettable market recap. This week wasn’t forgettable, though: a $400 million bet from one of Wall Street’s biggest market-makers signalled real institutional conviction, while a $20+ million oracle exploit was a reminder of exactly why that conviction still comes with caveats.
MARKET RECAP
Bitcoin traded in a $64,300-$66,878 range through the week, closing little changed overall, while Ethereum outperformed modestly, peaking near $1,953 before settling around $1,877. Total crypto market cap held roughly flat near $2.25-2.38 trillion.
The headline number BTC essentially flat-sells what’s actually happening underneath it. US spot Bitcoin ETFs logged seven consecutive days of net inflows, giving the market real support in the low-$60,000s even as on-chain activity and the Fear & Greed Index both signalled caution. Capital also rotated out of speculative altcoins and into real-world asset (RWA) tokens and Layer-2 infrastructure, a sign that investors are getting more selective, not more bullish.
Whether ETF inflows can keep pace once the Fed decision lands is the more reliable signal than price alone right now.
INSTITUTIONAL WATCH
Citadel Securities made a $400 million strategic investment in Crypto.com on July 16, valuing the exchange at $20 billion, the exchange’s first outside institutional funding round in its ten-year history. The capital is earmarked for expansion into tokenised securities, equities, and broader derivatives infrastructure, with Citadel also providing institutional market-making support.
This isn’t passive capital; it’s one of the biggest market-makers in traditional finance actively building rails into crypto infrastructure, and it lands alongside Crypto.com’s conditional US National Trust Bank charter from the OCC. Read together, that’s a company positioning itself as a bridge between conventional capital markets and crypto, not just a bigger exchange. The market treated it that way too: Crypto.com’s native token, CRO, rallied roughly 25% on the news.
Worth noting: This is one exchange’s deal, not evidence the institutional floodgates are fully open, but it’s the clearest legitimisation signal crypto infrastructure has gotten in a while.
SECURITY & RISK
Ostium, an Arbitrum-based perpetuals platform, lost between $18 million and $23.75 million on July 15 after attackers compromised an off-chain private key tied to its price oracle. Using that key, they pushed fabricated, future-dated price feeds, reportedly setting BTC’s price to around $5,000 against a real market price near $60,000, then opened and closed leveraged positions against the fake price in repeated loops to drain the vault, before converting proceeds to ETH.
This is a control-and-key-management failure, not a smart-contract bug a distinction that matters because it means audits alone wouldn’t have caught it. Security researchers noted that the exploited price-feed component had been explicitly excluded from Ostium’s bug bounty scope, limiting the external scrutiny it might otherwise have received. It’s a pattern worth tracking: 2026’s biggest DeFi losses increasingly trace back to oracle and key-management gaps rather than pure code flaws.
REGULATION & MACRO — WHAT TO WATCH NEXT WEEK
July 27: CFTC comment period closes on its proposal for 24/7 trading and perpetual-style futures referencing spot bitcoin.
July 29: FOMC rate decision, with markets broadly expecting the Fed to hold rates at 3.50%-3.75%. New Fed Chair Kevin Warsh’s press conference is the real event to watch, given inflation is still running hot.
August 1: SEC’s public comment window opens for proposed safe-harbour rules covering DeFi platforms and tokenised securities.
This was a week where price action stayed quiet, but the structural story got louder: one of Wall Street’s biggest market-makers just bought a serious stake in crypto infrastructure. Defi got another reminder that oracle security is still the industry’s weakest link.
Originally published at https://markets.cryptechtoday.com on July 26, 2026.
