Bitcoin spent the week going nowhere fast, stuck in a $64,000-$66,000 band even as seven straight days of ETF inflows gave it a floor. That kind of quiet consolidation usually makes for a forgettable market recap. This week wasn't forgettable, though: a $400 million bet from one of Wall Street's biggest market-makers signaled real institutional conviction, while a $20+ million oracle exploit was a reminder of exactly why that conviction still comes with caveats.

Bitcoin traded in a $64,300-$66,878 range through the week, closing little changed overall, while Ethereum outperformed modestly, peaking near $1,953 before settling around $1,877. Total crypto market cap held roughly flat near $2.25-2.38 trillion.

The headline number BTC essentially flat-sells what's actually happening underneath it. US spot Bitcoin ETFs logged seven consecutive days of net inflows, giving the market real support in the low-$60,000s even as on-chain activity and the Fear & Greed Index both signaled caution. Capital also rotated out of speculative altcoins and into real-world asset (RWA) tokens and Layer-2 infrastructure, a sign that investors are getting more selective, not more bullish.

Whether ETF inflows can keep pace once the Fed decision lands is the more reliable signal than price alone right now.

Citadel Securities made a $400 million strategic investment in Crypto.com on July 16, valuing the exchange at $20 billion, the exchange's first outside institutional funding round in its ten-year history. The capital is earmarked for expansion into tokenized securities, equities, and broader derivatives infrastructure, with Citadel also providing institutional market-making support.

This isn't passive capital; it's one of the biggest market-makers in traditional finance actively building rails into crypto infrastructure, and it lands alongside Crypto.com's conditional US National Trust Bank charter from the OCC. Read together, that's a company positioning itself as a bridge between conventional capital markets and crypto, not just a bigger exchange. The market treated it that way too: Crypto.com's native token, CRO, rallied roughly 25% on the news.

Worth noting: This is one exchange's deal, not evidence the institutional floodgates are fully open, but it's the clearest legitimization signal crypto infrastructure has gotten in a while.

Ostium, an Arbitrum-based perpetuals platform, lost between $18 million and $23.75 million on July 15 after attackers compromised an off-chain private key tied to its price oracle. Using that key, they pushed fabricated, future-dated price feeds, reportedly setting BTC's price to around $5,000 against a real market price near $60,000, then opened and closed leveraged positions against the fake price in repeated loops to drain the vault, before converting proceeds to ETH.

This is a control-and-key-management failure, not a smart-contract bug a distinction that matters because it means audits alone wouldn't have caught it. Security researchers noted the exploited price-feed component had been explicitly excluded from Ostium's bug bounty scope, which limited the external scrutiny it might otherwise have gotten. It's a pattern worth tracking: 2026's biggest DeFi losses increasingly trace back to oracle and key-management gaps rather than pure code flaws.

This was a week where price action stayed quiet, but the structural story got louder: one of Wall Street's biggest market-makers just bought a serious stake in crypto infrastructure. Defi got another reminder that oracle security is still the industry's weakest link.