TL;DR: Ripple said on October 26 that the Office of the Comptroller of the Currency had granted final approval to charter Ripple National Trust Bank. The next useful evidence will be operational rather than ceremonial: confirmation of the trust bank’s commencement, the reporting and controls associated with reserve administration, and disclosures showing how RLUSD users are protected when things go wrong.

The latest development in Ripple’s corner of the digital-asset market is worth examining beyond the headline. A 2026-10-26 announcement describes a concrete change, but the investment consequences will depend on how it works in practice. The original record is available in the original company statement; here is what it establishes, why the distinction matters and what remains unproven.

What the source actually says

Ripple said on October 26 that the Office of the Comptroller of the Currency had granted final approval to charter Ripple National Trust Bank. The decision follows conditional approval granted in December 2025 and gives Ripple a federally supervised trust-bank structure for defined activities. This is not simply another exchange license or a general promise of future compliance: the company describes a specific banking charter with named functions, although the scope is not the same as that of a conventional deposit-taking retail bank.

According to Ripple, the approved activities include managing segregated reserves backing Ripple USD, its dollar stablecoin known as RLUSD, acting as collateral trustee for the benefit of RLUSD holders, and fiduciary custody of digital assets. The distinction between reserve management, custody and payment services matters. A reserve custodian safeguards assets and associated legal interests; it does not automatically guarantee the token’s market price, nor does it mean every Ripple product is directly supervised as a national bank.

A federal charter can provide counterparties with a clearer supervisory point of reference. Corporate treasurers and institutional customers have generally had to evaluate a mixture of state licensing, trust arrangements, bank relationships and private attestations before using dollar tokens operationally. Ripple is seeking to simplify part of that assessment through a supervised entity. Its announcement should nonetheless be read as the company’s account of approval, not as evidence that every commercial integration or future reserve-handling workflow is already live.

For cryptocurrency investors, the central point is to distinguish an announced milestone from an immediate change in asset value. The underlying development can strengthen a company’s product, legal position or operating capacity without determining what a token will trade for tomorrow. The linked source establishes what was disclosed; the valuation question requires a separate assessment of customers, costs, execution and market conditions. That gap between a confirmed fact and a forecast is where much of the investment risk sits.

What matters for the market next

The timing is notable because US stablecoin oversight is changing. The OCC has also finalised rules under the GENIUS Act, with a January 18, 2027 effective date. Trust-bank authority and the payment-stablecoin rulebook are related pieces of a larger framework, but they are separate regulatory questions. An institutional buyer should still examine token redemption terms, the quality and accessibility of backing assets, governance, conflicts and the precise entity against which it holds a claim.

The next useful evidence will be operational rather than ceremonial: confirmation of the trust bank’s commencement, the reporting and controls associated with reserve administration, and disclosures showing how RLUSD users are protected when things go wrong. Rival issuers may seek similar structures, but a charter by itself is not a verdict on market share. For now the verifiable development is the OCC approval announced by Ripple, and the commercial consequences remain to be demonstrated.

Market watchers should also avoid treating a company’s or regulator’s headline as a substitute for terms and conditions. Tokens, shares and regulated service agreements create different rights, even when they coexist in one wallet or platform. A reliable follow-up should ask which entity is responsible, what a holder can actually redeem or transfer, and whether the claimed advantages appear in live activity. Those questions are more informative than an unsupported price target or an assumption that adoption is inevitable.

Primary source: original company statement (2026-10-26).

Written by the News Desk and edited by Samuel Rae.

AI agents expose gaps in enterprise access controls and audit trails. Here's how security leaders can rethink identity, data governance, and oversight.

The post Your Security Stack Knows Who Logged In. But Does It Know What AI Agents Do Next? appeared first on TechRepublic.

AI agents expose gaps in enterprise access controls and audit trails. Here's how security leaders can rethink identity, data governance, and oversight.

The post Your Security Stack Knows Who Logged In. But Does It Know What AI Agents Do Next? appeared first on TechRepublic.

The fix is one comparison. Only bdk_electrum 0.24.1 has it, there’s no fixed 0.23, and LDK Node shipped on 0.23 eight hours later

In BDK’s Electrum client, the loop that gathers fee data for a wallet has a comment on line 588 of the 0.23.2 source that says exactly what it should do:

let prev_tx = self.fetch_tx(outpoint.txid)?;
// Ensure server returns the expected txout.
let txout = prev_tx
    .output
    .get(vout as usize)

The only check under that comment is that output number vout exists. Nothing checks that prev_tx is the transaction the wallet asked for. fetch_tx sends a txid to the Electrum server, takes back whatever transaction the server returns and caches it under the txid it asked for. The output then goes into a map keyed by the outpoint the wallet asked about, and that map is where BDK gets input values when it works out the fee on a transaction whose inputs the wallet doesn’t own.

So for a parent the wallet doesn’t already hold, a server could answer with any transaction that has enough outputs, and its amount would become that input’s value in the wallet’s fee numbers. That’s as far as I can follow it in the code. fetch_tx also serves the wallet’s own history, and I haven’t traced what a swapped transaction does on that path, or run any of this against a server that lies.

One comparison, merged in April

The fix is six lines in fetch_tx: compute the txid of what came back and return an error if it isn’t the one requested. It was merged to master on 24 April as PR 2188.

Master isn’t what gets published, though. bdk_electrum 0.24.0 came out on 8 May without the check; I diffed the published sources, and its fetch_tx is the same as 0.23.2’s. The backport, PR 2228, was merged on 16 June into a branch called release/chain-0.23.x, and that name nearly caught me out. I read it as the 0.23 line getting the fix. It’s the release branch for bdk_chain 0.23, and bdk_electrum’s 0.24 releases come off it. The fix sat merged there for 118 days, until 0.24.1 was published on 12 October at 05:29 UTC, 171 days after it first landed.

Who can’t take it

Cargo treats 0.23 and 0.24 as incompatible, the way it treats any minor bump before 1.0. A crate that asks for bdk_electrum 0.23 gets 0.23.2 at most, and no 0.23 release has the check. Moving to 0.24 also moves electrum-client from 0.24 to 0.25, so it takes an edit to the manifest, and cargo update won’t do it.

crates.io lists 11 crates that depend on bdk_electrum. Two use it only in tests. Of the other nine, five ask for 0.23 and four for 0.24. LDK Node is one of the five. Its 0.7.1 release came out at 13:53 UTC on 12 October, eight hours and 24 minutes after 0.24.1, still on bdk_electrum 0.23, and it asks for previous outputs in both its sync and its full scan. It does fill the client’s cache from its own wallet first, so parents it already holds never go to the server. fedimint-ldk-node 0.7.0 asks for 0.23 too. LDK Node’s main branch has moved to 0.24.0, which resolves to 0.24.1 on a fresh lockfile, so its next release should carry the check.

Downloads tell it from the other side. On 13 October, the first full day 0.24.1 existed, crates.io counted 2,050 downloads of bdk_electrum, and 530 were 0.24.1. 799 were 0.23.2, the last of the line that has no fix. Downloads are CI runs and mirrors as much as people, so I wouldn’t read them as users, but they’re the only count there is.

The case where any of this matters is a node pointed at an Electrum server somebody else runs. I don’t know of a way to count LDK Node deployments set up like that. Until LDK Node ships a release on 0.24, the apps built on it can’t get the check without patching LDK Node itself.

BDK’s Electrum txid check took 171 days to ship, and 5 of the 9 crates using it can’t get it was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.

The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.

This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver actionable strategies.

The post Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand appeared first on SecurityWeek.

Fifteen years after coining the framework, John Kindervag insists zero trust still works in the AI era—if you get the implementation right.

The post Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks appeared first on SecurityWeek.

Black Hat 2026 Series Introduction — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series. This is the series home. It collects seven vendor interviews, one...

The post Black Hat 2026: The Supply-Chain Trust Series appeared first on Cyber Defense Magazine.

Black Hat 2026 Keynote Report — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with...

The post Microsoft at Black Hat 2026: When the Attacker Comes Through the Front Door You Trust appeared first on Cyber Defense Magazine.

Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with...

The post ReversingLabs: Deep Analysis of the Final Build, File by File appeared first on Cyber Defense Magazine.

Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with...

The post NetRise: Reading the Thing That Actually Runs — and Vetting Who Wrote It appeared first on Cyber Defense Magazine.

Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with...

The post Chainguard: Structurally Deleting a Whole Category of Attack appeared first on Cyber Defense Magazine.

Black Hat 2026 Vendor Profile — Cyber Defense Magazine By Dr. Arun Lakhotia Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with...

The post ActiveState: Rebuilding Open Source From Source, With a Cool-Down and a Clock appeared first on Cyber Defense Magazine.