Bitcoin Magazine

Russia Approves Securities Group to Oversee Crypto Exchanges

The National Association of Securities Market Participants, known as NAUFOR, has won self-regulatory organization status for digital depositories and crypto exchanges. The Central Bank of Russia made the decision on October 29, according to Interfax.

The move turns a law into a working system. Russia’s framework, “On Digital Currency and Digital Rights,” passed the State Duma in July. It requires exchange operators and depositories to sit in central bank registries, and it requires them to join an SRO. 

Interfax reports that the registry lists 23 crypto exchanges and eight digital depositories, including VTB, Sberbank, and units of T-Technologies, the holding company behind T-Bank. Firms on those registries have 90 days to join an SRO. In short, an SRO writes industry standards, monitors members, and represents the industry to regulators.

NAUFOR says it will help shape standards for digital asset markets and push the central bank on rule changes. Earlier in October, it received the same status for information system operators. The association has operated since 1996 and counts 725 members, including brokers, dealers, and fund managers from traditional markets.

JUST IN: Russia's central bank approved NAUFOR as a self-regulatory body for crypto exchanges and custodians.

Russia's new crypto law requires all registered crypto firms to join a self-regulatory organization within the next 90 days. pic.twitter.com/pchpFYg6KP

— Bitcoin Magazine (@BitcoinMagazine) October 29, 2026

Russia’s crypto legal gateway

Traditional finance built NAUFOR’s model for stocks and bonds. Placing the same body over bitcoin exchanges and custody gives the state a familiar hand on the wheel. 

Bitcoin Magazine reported in July that the law stops bitcoin from becoming money for everyday purchases. Domestic crypto payments stay banned. The law licenses exchanges and depositories, caps retail purchases, and opens a state-supervised channel for cross-border trade, a route that helps Russia move around Western sanctions.

The details matter for users. A depository would record holdings, and one reading of the framework lets it restrict transfers to personal wallets. Non-qualified retail buyers can purchase up to 300,000 rubles a year through a single intermediary, near $3,800. 

Qualified investors face higher ceilings. These choices shape who can use the platforms and how.

Earlier this fall, the Moscow Exchange reportedly began testing cryptocurrency trading with professional market participants and planned to launch trading this December. 

The exchange intended to use existing infrastructure and a partner digital depository following the introduction of Russia’s new cryptocurrency regulations in September. 

Sberbank also received approval to custody Bitcoin and other cryptocurrencies, while President Vladimir Putin had previously acknowledged Bitcoin’s resistance to being banned.

This post Russia Approves Securities Group to Oversee Crypto Exchanges first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

For decades, gold has played an important role in how governments manage their financial reserves. Countries hold gold because it is a valuable asset that can be stored for the long term and may help diversify their reserves.

But what if Bitcoin started playing a similar role?

Bitcoin is different from gold in almost every practical way. It exists digitally, moves across a global network, and has a supply limit built into its design. Yet, some policymakers and investors believe these features could make it worth considering as a strategic asset.

The United States has already brought this idea into the policy discussion. But creating a Bitcoin reserve involves much more than simply buying some Bitcoin and keeping it in a digital wallet.

To understand why, it helps to look at how gold reserves work, what makes Bitcoin different, and what the potential benefits and risks could be.

Why Do Governments Hold Gold?

Gold has been used as money and a store of value for thousands of years. Today, central banks and governments continue to hold it as part of their financial reserves.

These reserves can serve several purposes.

First, gold provides an asset that is not directly dependent on the financial condition of a single company or government. Second, it can help diversify a country’s reserve holdings. Third, gold has an established global market, making it possible to buy or sell it in many parts of the world.

However, gold is not risk-free. Its price can rise and fall, storing and transporting it requires physical security, and selling large quantities can take time.

Governments still hold gold because they consider its potential benefits useful over the long term.

This raises an interesting question: Could Bitcoin serve a similar purpose in the future?

What Makes Bitcoin Different From Gold?

Bitcoin is often called digital gold because both assets have limited supplies and can be held without depending on a traditional bank account.

But the similarities only go so far.

Gold is a physical asset. Bitcoin is a digital asset secured by a decentralized network.

Bitcoin’s protocol sets a maximum supply of 21 million coins. Gold, on the other hand, has no fixed total supply because new deposits can be discovered and mined.

Bitcoin can also be transferred across borders without physically moving anything. However, transactions require network confirmation, and access to the coins depends on properly managing the relevant cryptographic keys.

The biggest difference is price stability.

Gold has a long history as a reserve asset, while Bitcoin is much younger and has experienced significant price swings. Bitcoin’s price can change sharply in a short period, which makes it harder for governments to predict the value of their holdings.

For example, imagine a government holds Bitcoin worth $1 billion. If Bitcoin’s market price falls by 30%, the value of that holding would drop to $700 million, assuming the amount of Bitcoin remains unchanged.

The government would still own the same number of coins, but their market value would be lower.

This is one reason Bitcoin cannot simply be treated as identical to gold.

How Could the US Build a Bitcoin Reserve?

There is more than one way a government could accumulate Bitcoin.

One option is to retain Bitcoin obtained through asset seizures and legal proceedings instead of selling it. Another is to purchase Bitcoin through an authorized government program.

These approaches may sound similar, but they raise different questions.

Retaining seized Bitcoin means managing assets already in government custody. Purchasing Bitcoin requires a separate decision about funding, legal authority, and the use of public resources.

The distinction is important in the United States, where policymakers have been discussing how government-held Bitcoin should be managed and whether a more formal reserve framework should be established.

Coinpedia’s exclusive report examining whether the US could establish a Bitcoin reserve before January 3, 2027 explores the legislative timeline and the remaining hurdles facing the proposal. The central question is not simply whether the government can hold Bitcoin, but what legal framework would allow it to maintain a strategic reserve.

That difference matters because a policy proposal, an approved law, and an operational reserve are three separate stages. A proposal does not automatically mean that new Bitcoin purchases have been authorized or that a reserve is fully established.

What Could Be the Benefits of a US Bitcoin Reserve?

Supporters of a Bitcoin reserve point to several possible benefits.

1. Diversification of government assets

Governments generally try to avoid depending too heavily on one type of asset.

A Bitcoin reserve could provide another form of exposure alongside traditional holdings such as gold and foreign currencies. If Bitcoin becomes more widely accepted over time, supporters believe it could offer long-term diversification benefits.

However, diversification does not guarantee better returns. Bitcoin could fall in value at the same time that other financial markets experience stress.

2. Exposure to a limited-supply asset

Bitcoin’s supply limit is one of its most widely discussed features.

Unlike currencies that can be issued according to monetary policy, Bitcoin’s issuance follows rules built into its protocol. Its supply schedule is designed to approach a maximum of 21 million coins.

Supporters argue that this makes Bitcoin worth considering as a long-term asset.

But limited supply alone does not guarantee rising prices. Demand still matters. An asset can remain scarce while losing value if fewer people want to own it.

3. Participation in a developing financial system

Digital assets and blockchain technology are becoming part of broader discussions about payments, financial infrastructure, and investment.

Holding Bitcoin could give a government direct experience with digital-asset custody and the practical challenges of managing a decentralized asset.

That experience might help policymakers better understand both the opportunities and the risks associated with the technology.

Still, a government does not need to hold Bitcoin to study blockchain technology or develop digital-asset regulations.

What Are the Risks?

A Bitcoin reserve would also create challenges that governments would need to consider carefully.

1. Price volatility

Bitcoin can experience large price changes over short periods.

If a government holds a substantial amount of Bitcoin, a market downturn could reduce the reported value of its holdings. This could create political pressure, especially if taxpayers believe public resources are being exposed to unnecessary risk.

The long-term outcome would remain uncertain, even if Bitcoin had performed well over an earlier period.

2. Security and custody

Gold can be protected in secure physical facilities. Bitcoin requires a different kind of protection.

Access to Bitcoin depends on private keys. If those keys are lost, stolen, or improperly controlled, the assets could become inaccessible or be transferred without authorization.

A government reserve would therefore require strong security procedures, careful access controls, backup arrangements, and clear rules about who can authorize transactions.

The fact that Bitcoin operates on a decentralized network does not automatically make every wallet or storage system secure.

3. Legal and political questions

A national reserve would raise questions about who has the authority to acquire Bitcoin, how the holdings should be managed, and whether the government should ever sell them.

There would also be questions about transparency. Should the public receive regular reports on the amount held, the cost of acquisition, and changes in market value?

These decisions matter because a reserve is not just a collection of digital coins. It is a government policy that may affect public finances and future administrations.

4. The opportunity cost

Money used to purchase Bitcoin cannot be used for another purpose at the same time.

If a government spends public funds on Bitcoin, it must consider what else those funds could have supported. Even if Bitcoin rises in value, the decision should be evaluated against the alternatives available when the money was committed.

This is a basic principle of public finance: every major financial decision involves trade-offs.

Could a US Bitcoin Reserve Affect the Crypto Market?

A formal US Bitcoin reserve could influence how investors think about Bitcoin, but the actual effect would depend on the details.

For example, if the government retains Bitcoin it already owns, the immediate effect on market demand could be different from a policy that authorizes regular purchases.

If a government buys additional Bitcoin, those purchases could create new demand. If it simply holds existing coins rather than selling them, the market may instead focus on the amount of Bitcoin that remains available for trading.

Announcements could also affect expectations before any action takes place. Investors might interpret a reserve policy as a sign that Bitcoin is gaining recognition as a strategic asset.

However, expectations are not the same as actual buying activity.

Bitcoin’s price is influenced by many factors, including investor demand, interest rates, global liquidity, institutional investment, regulation, and market sentiment. A government reserve would be only one part of that picture.

It would also be a mistake to assume that other countries would automatically follow the United States. Governments have different financial priorities, regulatory systems, and levels of comfort with volatile assets.

Does Bitcoin Need Governments to Succeed?

This is perhaps the most interesting question in the entire debate.

Bitcoin was designed to operate without requiring a central authority to approve transactions or manage its supply. Its network can continue operating whether or not governments choose to hold it.

A national reserve would therefore not be necessary for Bitcoin to function.

Government participation could, however, influence how financial institutions, businesses, and investors view the asset. It could also bring more attention to the questions of regulation, custody, and long-term financial use.

At the same time, government involvement could create new political risks. Future administrations might change their approach, revise reserve policies, or decide that holding Bitcoin no longer fits their priorities.

Bitcoin’s future would still depend on whether people and institutions choose to use, hold, and value it.

Final Thoughts

Holding Bitcoin like gold is an interesting idea, but the two assets are not interchangeable.

Gold has a long history as a reserve asset, while Bitcoin offers a digital form of scarcity and can be transferred through a global network. Those features may make Bitcoin attractive to some policymakers, but its volatility, custody requirements, and uncertain long-term value create real challenges.

For the United States, the question goes beyond whether Bitcoin belongs in a government wallet. It involves deciding how the asset would be acquired, who would control it, what rules would govern its use, and how the public would be informed about the risks.

The most useful way to follow the debate is to separate announcements from legislation and legislation from implementation.

A Bitcoin reserve could become an important development in the relationship between governments and digital assets. But whether it proves to be a sound long-term strategy will depend on the policy behind it, the risks governments are willing to accept, and how the reserve is managed over time.

---

What Happens If the US Starts Holding Bitcoin Like Gold? was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Stablecoins accounted for 60% of crypto purchase value processed through Mercuryo’s on-ramp in H1 2026, up from 43% six months earlier. Meanwhile, accepted stablecoin off-ramp transactions grew 446% year on year, based on the company’s on-ramp report and off-ramp data.

These figures come from one provider, not the entire market. Still, they highlight something worth discussing: how money moves between bank accounts and crypto platforms.

If I were managing those flows for a business, I’d start with two questions. Which currencies are we moving, and where are our bank accounts? The answers help determine which payment routes make sense.

So, What Does Each Payment Route Actually Do?

A company with European partners, a Swiss bank account and international USD settlements might use several payment routes, even through the same crypto platform.

SEPA — for EUR transfers across Europe. It connects participating banks across the Single Euro Payments Area and supports euro transfers between eligible accounts.

SWIFT — for international bank transfers. A global financial messaging network used for cross-border payments in USD and other currencies. Costs and timing depend on the banks involved.

SIC — for Swiss franc transfers. Switzerland’s interbank clearing system handles CHF payments between participating financial institutions.

ZEN.COM — for local PLN payments. Unlike SIC, ZEN.COM is a payment provider rather than a clearing system. Its local PLN transfers use ELIXIR, with availability depending on the provider’s integration and customer eligibility.

Other routes, including ACH in the US and PIX in Brazil, become relevant when businesses need to serve customers in different markets.

Let’s Look at Three Different Business Scenarios

1. A Polish Fintech Needs Both EUR and PLN

Imagine a fintech in Warsaw receiving euros from European partners while paying local expenses in Polish zloty. It needs both currencies and a way to move funds into and out of crypto.

WhiteBIT On/Off-Ramp could be worth considering. It lists EUR transfers through SEPA and PLN through ZEN.COM within one crypto ecosystem.The fee for EUR deposits and withdrawals is a flat €5, while limits depend on KYB level and agreed conditions.

The service also lists USD via SWIFT and CHF via SIC, alongside TRY, GEL and AUD among its supported currencies. Routes for those additional currencies require separate confirmation.

For this fintech, having several fiat options in one place could simplify treasury operations. I’d first confirm which PLN transactions are available to its legal entity and whether the limits suit its volumes.

2. What If Your Wallet Serves Customers Across Different Markets?

Now imagine a wallet provider that wants customers to buy and sell crypto directly inside its app. Some users pay in EUR, others prefer cards or local payment systems. The company needs an integrated payment experience across its supported markets.

Kraken Ramp, also marketed as Payward Ramp, takes this approach. Its institutional offering lists 24+ payment methods, including SEPA, ACH, PIX, debit cards, Apple Pay and Google Pay. The service offers API and SDK integration, with payment processing, compliance and crypto conversion handled through Kraken’s infrastructure.

The attraction is the combination of local payment methods and embedded crypto access. However, supported methods differ by market, and the company would need to confirm which currencies, countries and transaction directions are available to its customers.

For this type of wallet, the integration experience matters alongside currency coverage. A payment method listed on a product page is useful, but the full customer journey — from funding to completed conversion — needs to work in the intended markets.

3. And What About Thousands of USD Payouts?

Imagine a US fintech where customers convert digital assets into dollars and withdraw funds to their bank accounts. With thousands of payouts, settlement speed and integration become important.

zerohash On & Off Ramp supports fiat-to-crypto and crypto-to-fiat conversions through ACH, RTP, SEPA and payment service providers. It also supports 100+ digital assets, with availability depending on the market and integration.

For this business, I’d check which USD payout methods are available, how returned payments are handled and whether prefunding is required. These details can make a big difference when customer withdrawals are part of everyday operations.

So, What Would I Check Before Choosing?

I wouldn’t rank these payment routes from best to worst. A longer currency list doesn’t necessarily mean a better setup, especially when availability depends on jurisdiction, account type and banking partners.

I’d start by checking three things: which currencies and payment methods are actually available, whether the money belongs to the business or its customers, and how much each completed transfer costs.

Processing times matter too. Domestic real-time payments may suit frequent customer withdrawals, while international transfers can work well for corporate treasury operations. Fees, conversion spreads and reconciliation requirements should all be part of the calculation.

Finance can map currencies and volumes, operations can verify settlement schedules, and compliance can confirm eligibility. Sometimes one provider will cover most needs, while other businesses may benefit from combining several services.

I’d rather check those details upfront than discover halfway through a transfer that the selected route doesn’t work as expected.

Disclaimer: This is not financial or investment advice. Do your own research before making any decisions. Use at your own risk.

---

Three Companies, Three Fiat Problems, Three Different Ramps was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Bitcoin Magazine

Crypto Midterm Election Spending Reaches $176 Million as Industry Builds for the Next Congress

The crypto industry has spent about $176 million across more than 100 midterm races this cycle, according to a Reuters review of campaign spending. The money is part of a plan to build a bipartisan coalition in Congress that can protect the sector after President Donald Trump leaves office.

Fairshake, the industry’s largest super PAC, leads the effort. The group spent $196 million in the 2024 cycle and is directing strategy again. Through October 20, Fairshake and its affiliate PACs had spent about $150.8 million this year, while other crypto groups spent around $25 million. Fairshake said 53 of the 58 candidates it backed in primaries or special elections won, and those candidates will be on the November 3 ballot, per Reuters. 

Super PACs can raise and spend unlimited sums but cannot coordinate with campaigns. Fairshake’s ads run through affiliates with names such as “Defend American Jobs” and “Protect Progress,” and they often focus on taxes and immigration rather than crypto. Voters have little way of knowing who pays for them. 

The watchdog group Public Citizen said crypto was the largest corporate spender in federal races in 2026. Crypto firms led corporate political spending at that point, citing the same watchdog’s analysis.

Coinbase, Ripple and Andreessen Horowitz are the primary financiers. Industry strategists and campaign staff said the money is a calling card meant to build relationships with elected officials. 

Crypto’s long game in Congress

Colin McLaren, head of government relations at the Solana Policy Institute, which has given $4.9 million to the midterms, called it “an investment in the future,” per Reuters.

The approach reflects a sharp change. In 2018, lawmakers could not secure a room in the House or Senate office buildings for the first bipartisan crypto roundtable, so they met at the Library of Congress. Then, under the Biden administration, the Securities and Exchange Commission levied more than $6 billion in penalties across 98 cases, according to a Georgetown University Law study. 

Executives concluded they needed political force. Coinbase Chief Policy Officer Faryar Shirzad helped launch Stand With Crypto and Fairshake in 2023. The number of lawmakers rated “A” by Stand With Crypto rose to 332 from 96 when the group launched.

Legislation followed. The GENIUS Act, enacted in 2025 with broad bipartisan support, created the first federal regulatory framework for stablecoins. The industry’s next goal, the Clarity Act, would place oversight under the Commodity Futures Trading Commission. That bill stalled this session. Senate Democrats blocked it from reaching a final vote over an ethics provision that would have forced the Trump family to sell its crypto holdings. 

Fairshake helped defeat Sherrod Brown, who chaired the Senate Banking Committee, in 2024, and the industry has since spent more than $68 million on his rematch against Republican Jon Husted, according to AdImpact. 

Fairshake’s ads against Brown do not mention crypto, and Brown’s campaign manager, Patrick Eisenhauer, said “the special interests are panicking.” In Illinois, Fairshake spent over $10.1 million attacking Lieutenant Governor Juliana Stratton and $2.5 million against state Representative La Shawn Ford, per Reuters, yet both are expected to win on November 3. 

Cameron and Tyler Winklevoss each gave about $13 million this cycle, most of it to MAGA Inc.

What voters think

Public attitudes are mixed. A September survey seen by Bitcoin Magazine of 1,545 U.S. adults by Ipsos for the DeFi Education Fund found that 22% have owned or used crypto, up from 18% in 2025. Only 19% believe the U.S. financial system is secure. 

The survey also found 35% say it is important for candidates to support building the next generation of financial technology in the United States. Only 13% said the same when the question named blockchain, crypto or DeFi. The DeFi Education Fund is a digital asset advocacy group, so its framing reflects that perspective. 

Stand With Crypto’s leadership has argued that the crypto vote will decide the midterms.

This post Crypto Midterm Election Spending Reaches $176 Million as Industry Builds for the Next Congress first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

This post contains affiliate links. We may earn a commission at no extra cost to you. The Deel links are my referral links. Remote did not pay for or see this post.

The short answer

Deel and Remote list the same starting price to employ someone for you abroad: $599 per employee per month. Remote is cheaper for contractors, at $29 per contractor per month against $49, and it does not ask for an employer-of-record deposit as standard.

Deel goes much further with stablecoins. A company can fund its invoices in USDC or USDT. Employees can take up to 25% of their net pay in stablecoins. Contractors can withdraw USDC or USDT to their own wallet across seven networks, Solana and Tron among them. Remote’s stablecoin option is USDC only, for contractors only, paid through Stripe in about 67 countries.

A crypto company that keeps its money in stablecoins and has people who want to be paid in them should pick Deel. A team that pays contractors in local bank money and watches every dollar of fees will pay less at Remote.

How we use Deel

We have paid a small team of contractors through Deel, between 6 and 20 people, all by bank transfer. Setup was fast: adding a contractor and getting the contract signed took little effort. Payments landed on time. And Deel produced the contracts, invoices and tax forms, so we never had to build that paperwork ourselves.

We have not used Remote, and none of our contractors withdrew in crypto. The Remote and stablecoin sections below rely on each company’s own pricing pages, help articles and fee tables, read on 26 October 2026.

Three products that people mix up

Both companies sell three different services, and their prices are far apart.

Employer of record (EOR)

You want a full-time employee in a country where you have no company. The provider’s local company becomes the legal employer. It runs payroll, withholds tax, pays social charges, provides the benefits the law requires, and handles the contract and any termination under local labor law. You still direct the work. This is the product that starts at $599 per month.

Global payroll

You already own a company in that country and only want someone to run its payroll: pay, tax and filings. You stay the legal employer. Both charge $29 per employee per month.

Contractor management

The person is self-employed and sends you invoices. The provider issues the contract, collects invoices and tax forms, and pays out in many currencies. Deel charges $49 per contractor per month and Remote charges $29.

A fourth service sits between the last two. Under a contractor of record setup, the provider signs the freelancer itself and takes on the misclassification risk, meaning the chance that a tax office decides your contractor was really an employee. Both list it from $325 per month.

Our own setup is all contractors. A team that needs someone on the books in a particular country adds EOR hires on top.

Plans and prices side by side

For employer-of-record hires, both list $599 per employee per month as a starting price, and the real figure depends on the country. Deel’s EOR page claims 150+ countries, with its own companies in 130+ of them. Remote covers 90+ countries and says every one runs on a company it owns. Deel takes a deposit for each EOR hire of 1 to 1.5 times the monthly cost (salary, employer costs and fees) and refunds it after the final invoice. Remote’s pricing page says there is no standard deposit, though a refundable reserve may apply in some cases. On onboarding speed, Deel claims as little as one day and Remote quotes a three-day average.

Global payroll costs $29 per employee per month on both. Deel lists 130+ countries on its pricing page. Its payroll specialists run it for you, and in the US and Canada your own team can run it instead. Remote lists 100+ countries and lets you choose self-serve or managed.

Contractors are where Remote is cheaper: its base plan costs $20 less per contractor per month. Remote also sells Contractor Management Plus at $99, which adds $100,000 of misclassification cover per contractor, up to $1 million per company. Deel’s $49 plan includes invoicing, tax-form collection and payments in 120+ currencies, plus a possible fee of up to $5 per month for any contract with no payments recorded for two months in a row.

Remote gives pre-seed, seed and Series A companies 15% off EOR and contractor plans for their first 12 months. Deel’s pricing page shows no matching discount.

Crypto and stablecoins side by side

Paying contractors in stablecoins

Deel gives contractors three routes into crypto. The most direct is a withdrawal to their own wallet: USDC on Ethereum, Base, Polygon, BNB Chain or Solana, or USDT on Ethereum, Tron, BNB Chain, Polygon or Tempo. The fee table lists a 2% service charge plus a $1 network fee, with a $5 minimum, and the route does not work for accounts in the US or the UK.

Contractors can also cash out through Coinbase. BTC, ETH and SOL cost 1.5%. USDC costs a flat $5 under $300 and 1.6% above that. Withdrawals into BTC or ETH also carry an exchange fee on top.

The third route is the DLUSD wallet, launched in June 2026 and live in 80+ countries across Latin America, Africa, the Middle East and Asia-Pacific, though not in the US, the UK, the EU or Australia. Moving money between the wallet and the contractor’s Deel balance is free, and Deel pays the blockchain fees.

Deel’s help center calls DLUSD “Deel’s internal USD-equivalent digital balance” and says plainly that it is not a cryptocurrency. Stripe, whose Bridge unit issues it, calls it a custom stablecoin settled on the Tempo blockchain. I would treat it as a dollar balance inside the app that runs on crypto rails. At launch it could not be sent to an outside wallet. Deel called that a planned feature, and we found no page saying it has shipped.

Deel said in June 2026 that 10,000 contractors in 100 countries already got paid in stablecoins.

Remote gives contractors one route: USDC through Stripe, on Base, Aptos or Polygon, into a wallet the contractor controls, such as MetaMask. Stripe says the money arrives within minutes. The company must be billed in US dollars, and the contractor must be an individual or a sole proprietor, because Stripe does not yet pay out to companies. The contractor must also live in a country on Stripe’s list, which had 67 entries when we read it. Germany, the UK, Spain, Italy, India, Brazil, Nigeria, Ukraine, Vietnam, Indonesia, Pakistan, Turkey and Japan are not on it. Neither Remote nor Stripe publishes a fee for these payouts.

What a $3,000 payout costs on Deel

Take a contractor who bills $3,000 in US dollars. Here is the Deel fee on each route, from Deel’s own fee table. Converting to another currency adds exchange costs on top.

• Local bank transfer in the same country and currency: $0 ($5 if the money crosses a border)
• Wise or Revolut: $0
• USDC or USDT to the contractor’s own wallet: $61 (2% plus $1)
• USDC through Coinbase: $48 (1.6%), plus any exchange fee
• Into the DLUSD wallet: $0, though the money stays inside Deel until it goes out by one of the routes above

Putting stablecoins into your own wallet costs about 2% of the payment, while plain dollars to Wise or a local bank carry no Deel fee. Whether that 2% is worth it depends on what the contractor would pay to buy the same stablecoins on an exchange.

Paying employees partly in stablecoins

Deel lets EOR and payroll employees take 10% to 25% of their net salary in USDC, EURC or USDT, with the rest going to their bank. It covers employees in the US, the UK and 30 European countries, though USDT is not offered in the EU. Employees pay nothing. The employer pays $10 per month for each employee who uses it.

Remote has no such option. Its stablecoin payouts cover contractors only.

Funding payroll from a crypto treasury

Deel accepts invoice payments in USDC (Ethereum, Polygon, Base or Solana) or USDT (Ethereum, Polygon, Tron or Tempo), sent to a deposit address unique to your company and converted to dollars at 1:1. Deel says most of these payments settle within minutes. Its two help pages disagree on the provider fee, 1% in one and 1.5% in the other, so budget for 1.5%. The option does not cover the US payroll product or US contractor payments.

Remote’s payment methods are bank transfers, direct debit and cards. Crypto is not on the list.

That fee adds up. On a $50,000 monthly payroll, 1% to 1.5% comes to $500 to $750. Whether that beats selling stablecoins for dollars and wiring them depends on your exchange and bank fees. What Deel saves you is the trip through an exchange and the wait for a wire to land.

A worked example: 10 contractors and 2 employees

Take a seed-stage crypto company that pays 10 contractors and employs 2 people through EOR, at list prices.

• Deel: 10 × $49 plus 2 × $599 comes to $1,688 per month, or $20,256 per year.
• Remote: 10 × $29 plus 2 × $599 comes to $1,488 per month, or $17,856 per year. With the 15% startup discount, the first year drops to about $1,265 per month.

Remote saves this company $200 per month at list price and about $423 per month in its first year. Deel also holds an EOR deposit of 1 to 1.5 months of each employee’s full cost.

For a crypto company, the extra $200 buys reach. Suppose four of the ten contractors live in Germany, India, Brazil and Nigeria and want stablecoins. Remote’s USDC route does not reach those countries. Deel’s help page names only US and UK accounts as excluded from its own-wallet route, so ask Deel to confirm each country. If the two employees want part of their salary in USDC, only Deel offers that. And if the company’s treasury sits in USDC, only Deel takes it directly.

Verdict

Pick Deel if you run a crypto company whose money sits in USDC or USDT, whose contractors want stablecoins in countries Stripe does not cover (or want USDT on Tron or USDC on Solana), or whose employees want part of their pay in stablecoins. Any one of those is reason enough. Our own use of Deel for contractors gives us no reason to doubt the basics: setup was quick and payments arrived on time. You can see the plans and sign up through my referral link.

Pick Remote if your contractors are happy with bank payouts and price is the deciding factor. An early-stage team gets the 15% discount and the $29 contractor fee, and its EOR hires need no standard deposit.

Five checks before you sign

1. Ask for an EOR quote for each country you hire in. The $599 figure is a starting price on both platforms.
2. Check your contractors’ countries against Stripe’s stablecoin list (for Remote) and Deel’s excluded countries.
3. Find out whether your contractors invoice as individuals or through a company. Remote’s USDC route only pays individuals and sole proprietors.
4. Ask Deel which crypto funding fee applies to you, 1% or 1.5%.
5. Ask Deel whether DLUSD can now be sent to an outside wallet. At launch it could not.

---

Deel vs Remote for Crypto Teams: Payroll, Contractors and Stablecoin Pay was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

It’s no longer a proper month without Microsoft breaking its own record for security fixes, and October’s Patch Tuesday was no exception. Brian Krebs brings the roundup: more than 1,400 vulnerabilities fixed in a single batch, dwarfing September’s record of nearly 1,000, which itself was about ten times the normal monthly load. According to Tenable, Microsoft has now passed 4,000 CVEs for the year with two months still to go.

Only one of the fixes is for a vulnerability already being exploited in the wild: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch, giving attackers a head start, and with modern AI tooling, it seems like not much of a head start is needed. At least 78 of the bugs are rated critical, and most of those allow remote code execution with little or no user interaction. Windows 10 holdouts can relax a little: Microsoft quietly extended free updates through October 2027.  Given the pace of exploitation, this is probably the only way to prevent an Internet-scale meltdown.

Microsoft credits LLM-driven bug hunting for the volume, which leaves the poor admins who have to test and deploy all of this in an unenviable spot. Fortra’s analysis shows that only 26 Microsoft vulnerabilities have landed in the CISA KEV catalog of actively exploited bugs so far this year, so start there. For the rest, the SANS Internet Storm Center and Cisco Talos have the usual breakdowns by severity. Or, you know, just patch everything and hope for the best, which is roughly what everyone does anyhow.

The CA private key is… 4

Originally I was calling this the “big one” for the week, but this week that just keeps on giving. The private keys for eight eMudhra intermediate certificates have been compromised, and the way they were compromised is going to be a security talk punchline for years.  Remember the Debian SSL and SSH key debacle?  Of that scale.

Some background first. When your browser connects to a website over HTTPS, the site presents a certificate saying “I am example.com”, signed by a Certificate Authority (CA). Your browser and OS ship with a list of trusted root CAs, but roots are too valuable to use day to day, so they sign intermediate certificates, and the intermediates sign the actual website certificates. Whoever holds an intermediate’s private key can mint a certificate for any website, and every client that trusts the root will believe it. The whole system depends on those keys staying secret, and on them being generated properly in the first place.

eMudhra, an Indian CA which sells certificates under the emSign brand, had six TLS intermediates and two code-signing intermediates chaining to the emSign ECC Root CA – G3, which is trusted by Chrome and Apple, and Mozilla. A researcher identified only as Wayne proved the keys were compromised by signing the message “We have a problem here – Wayne” with each of them and sending it to the root programs.

How did Wayne get the keys? Flüpke posted one on Mastodon, and the secret value for the “EM OV TLS CA – G3C” key is… 4. Not four followed by 380 bits of randomness: the integer four. A reply quickly brute-forced the rest, and they’re all equally tiny: 56, 230, 237, 115, 155, 156, and 66. The keys were “incorrectly generated by the CA”, and anyone could recover them from the public certificates, which has been true since they were created in April 2025.

The browsers moved fast. According to The Hacker News, Chrome pushed a block within two hours of the report, and Mozilla blocked the certificates in under three, pulled the root from NSS, and shipped Firefox updates (CVE-2026-113470) for anyone with automatic updates disabled. There are no Certificate Transparency logs of rogue certificates, so modern browsers were never at risk. Everything that isn’t a browser is going to be the real problem and the extremely long tail of this fault: plenty of software never checks for revoked certificates and keeps trusting these keys until its bundled root list is updated.

Go hard-coded the eight bad keys into its standard library (CVE-2026-111943), but as Penligent points out, that only protects Go programs once they’re rebuilt with the new release. Python, Rust, Java, Node.js, curl, and most Linux distributions have updated root bundles, and the we-have-a-problem.com site has a full list, a checker, and manual workarounds for macOS, whose built-in curl and git don’t check revocation. There are also fixes for Linux, Windows, and the BSDs. Update everything, then go rebuild everything you compiled yourself. And then wonder how you’re going to update appliances, IoT devices, cameras, and everything else that fetches code over HTTPS or SSL.

php2shell: PHP gets owned by running out of memory

PHP, the language behind a significant percentage of the web had a rough week. WordPress, Drupal, Magento, phpMyAdmin, and just about every hosting control panel, major ecommerce sites, home project blogs, and even Hackaday itself was potentially impacted. Details of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked onto Hacker News a day ahead of the embargo, and Huntress covers the scramble that followed as PHP rushed its release out early. Now that patches are available, Ryan Austin of Calif has published the full writeup, demonstrating pre-authentication remote code execution against important apps on default configurations, in PHP versions back to 5.4.0. That’s over a decade of PHP.

The trick is an old one, first found by Stefan Esser back in 2004. PHP enforces a memory limit for each request, and when a request exceeds it, PHP stops immediately with a fatal error. If that happens in the middle of native code updating some internal structure, the structure is left half-built, and the cleanup code that runs afterward trusts it anyhow. That’s a classic “use-after-free” style bug, where the program uses memory that’s already been released or was never properly set up, and those are frequently exploitable. Calif found ways to reliably push a request over the memory limit at exactly the right moment (deeply nested empty file uploads turn out to balloon into hundreds of megabytes of internal tables, while staying under PHP’s upload size limits), and three different places where the interruption leaves a dangerous mess. Austin found the first bug with a generally available LLM, but only because he knew PHP’s twenty-year history of memory-limit bugs well enough to point it in the right direction.

Amazon reports that its honeypots caught a php2shell exploitation attempt on October 17th, four days before the embargo lifted, and that it’s now being broadly exploited. Their advice is worth repeating: for critical bugs on internet-facing systems, measure your patch window in hours, not weeks, and start investigating from the earliest exploitation date, not the disclosure date. If you can’t patch right now, Calif suggests disabling session.upload_progress and removing the memory limit, which comes with its own obvious problems.

One word of caution: alongside the legitimate writeups, there are many self-published “corrected findings” and “proof-of-concept” posts that can’t seem to decide whether their own exploit works, while offering a downloadable “weaponized” bundle. A leaked-bug panic is the perfect time to hand anxious admins a zip file. Read the real advisories, and don’t run random proof-of-concept bundles.

A Sixteen-year-old forever-day in Broadcom WiFi

Quentin Kaiser has the long-form writeup of his Hexacon talk on a bug in Broadcom’s WiFi stack, present since at least 2010, which gives an attacker a root shell on a router from across the street.  So called “parking lot” attacks that can happen from someone not even on your property have long been the boogeymen of WiFi security, and it’s been a little bit since we’ve gotten a new one.

The bug lives in WPS, WiFi Protected Setup: the “push the button on your router and then on your printer” pairing system that was supposed to save people from typing long WiFi passwords. WPS has a long and spotty security history, and this bug can be triggered over the air without knowing the network password, and without completing a WPS pairing. Kaiser’s demos show him pulling the WiFi password straight out of a router’s settings and sending it back over WiFi, and getting a fully interactive remote shell carried entirely over WiFi frames. No Internet connection required.

The really grim part is the patch history. Broadcom quietly released an incomplete fix in 2018, then suggested vendors switch to the open-source hostapd instead. For the older eCos-based chipsets that’s effectively never going to happen, which makes it a permanent “forever-day”. Broadcom refused to assign a CVE, and because Broadcom is its own CVE authority, CERT/CC closed Kaiser’s case the same day it was opened.

As of disclosure, the cable and DSL gateways he tested from three of Belgium’s four major ISPs were still vulnerable, and his napkin math puts it at over a million and a half devices in Belgium alone. Broadcom chips are, of course, sold everywhere. If you’re running ISP-provided hardware, there isn’t much you can do about the firmware. Turning off WPS can’t hurt if your router allows it, although Kaiser doesn’t say whether that blocks the attack. Disabling the gateway’s own WiFi and running your own access point that you can actually update is the safer bet.

GitLab regex bug reaches back twelve years

GitLab has released fixes for CVE-2026-110264, a maximum-severity CVSS 10.0 bug allowing unauthenticated attackers to run code on self-hosted GitLab servers. The flaw is an integer overflow when compiling a specially crafted regular expression in Onigmo, the Ruby regex engine which GitLab bundles into its own packages, so it affects every version back to GitLab 7.0 in 2014.

This is the fourth regex engine code execution bug from the same researcher in about a month (after CVE-2026-97229, CVE-2026-93577, and CVE-2026-89078), and comes with a nasty gotcha: the new fixed versions are one release past the October 12th fix, so if you diligently patched nine days ago, you’re vulnerable again. GitLab hasn’t said what’s needed to trigger the bug, so there’s no configuration workaround. If you’re running GitLab at home or in the shop, patch, and budget for some downtime while the database migrations run.

Node.js Brotli bug

Node.js shipped security updates for the 22, 24, and 26 branches, headlined by CVE-2026-111497, an out-of-bounds write in the bundled Brotli decompression library. Vercel’s advisory notes that researchers have demonstrated both memory leaks and command execution.

Node doesn’t decompress Brotli data on its own, but plenty of applications and libraries do, whether on incoming requests or on responses fetched from other servers. Vercel deployed firewall rules for traffic coming into its own platform, but no firewall can protect your code from a malicious response it goes and fetches itself. Node 20 is end-of-life and won’t be fixed. As a bonus, the same releases carry the eMudhra certificate distrust, so that’s two reasons to go update.

Header accordions and HTTP/3

HTTP/3 is the newest version of the protocol behind the web, running over QUIC (a UDP-based transport) instead of TCP. To save bandwidth, it compresses request headers using a scheme called QPACK: common headers can be sent as a one-byte reference into a table instead of the full text. Compression is great for bandwidth, but any time a small input can turn into a big output, there’s a risk of a “decompression bomb”.  Similar tricks resulted in “zip bombs” in the 2000s, and what’s old is new again.

FoxIO found exactly that in seven of the ten HTTP/3 implementations they tested. One approach packs about 160,000 unique short headers into a single 1MB request; another stores one 4KB header and then references it thousands of times, a 4000-to-1 amplification. The HTTP/3 spec already says how to limit the decoded size, but implementations got it wrong in every possible way: checking only the compressed size, decompressing everything before checking, ignoring the per-header overhead, or reading the limit setting and then never enforcing it.

Fixed so far are quic-go (CVE-2025-64702), which is used by Caddy, Traefik, and Cloudflare’s tunnels; Cloudflare’s quiche (CVE-2026-12523); lsquic 4.9.0; and even Wireshark (CVE-2025-13945), whose QPACK decoder crashed during testing. Bun, the hyperium h3 Rust crate, and aioquic/mitmproxy remain unpatched. Bun gets special mention for an integer overflow that turns a single 516KB request into a permanent 100% CPU infinite loop. The lesson applies to any compression format: limit the decompressed size as you go, not just the bytes on the wire.

Metamorphic macOS ransomware

Patrick Wardle of Objective-See digs into Heartbreaker, macOS ransomware written in Rust that has sat on VirusTotal since May 2025, undetected by every antivirus engine.

Most antivirus detection relies on signatures: a hash or byte pattern identifying a known-bad file. Metamorphic malware tries to dodge signatures by rewriting itself so every copy looks different while behaving the same. Heartbreaker takes a delightfully brute-force approach: it carries its own Rust source code inside the binary, and after running, it shuffles variable names, adds junk functions, installs a Rust compiler if one isn’t present, recompiles itself, and replaces itself with the new build. It is about as subtle as a brick through a window.

As ransomware it’s not very scary. It only encrypts the Downloads folder, and uses the same hard-coded key for every victim, so Wardle simply wrote a decryptor. The rebuilding also depends on a GitHub library which has since disappeared, so it mostly fails anyhow. Wardle uses it to demonstrate his free RansomWhere? tool, which ignores signatures completely and instead watches for an untrusted process rapidly writing files that look encrypted (using a bit of entropy math). The malware can change its hash all day long, but to ransom anything it still has to encrypt the files, and that’s much harder to disguise.

UpdraftPlus vendor breached

TeamUpdraft, the company behind the very popular UpdraftPlus WordPress backup plugin, disclosed a breach of their customer database over the weekend. Names, emails, addresses, hashed passwords, and two-factor authentication settings were taken, and more worryingly, the connection keys for UpdraftCentral, their cloud dashboard for managing many WordPress sites at once. UpdraftPlus previously made an appearance back in June, when a vulnerability in the plugin was used in the Awesome Motive supply chain attack.

Those UpdraftCentral keys can send commands to every connected site, which turns one vendor breach into a remote control for potentially thousands of customer websites. TeamUpdraft has released UpdraftPlus 1.26.12 and 2.26.12, which automatically disconnect the old keys. If you or anyone you know manages WordPress sites through UpdraftCentral, log in to each site directly, update the plugin, and check for unexpected admin accounts and plugins (including the easy-to-miss “Must-Use” plugins tab).

Spyware delivered by ad network

Citizen Lab has published research showing that the Israeli ad-tech company Discover-Tech helped deliver spyware through ordinary online ads, targeting at least 45 devices at the news outlet Al Jazeera in 2024 and 2025. Citizen Lab attributes the spyware to Candiru, a commercial spyware vendor.

When you load a web page with ads, the ad slot is typically auctioned off in real time to the highest bidder, based on a profile of who you seem to be. This “programmatic advertising” system is, by design, a mechanism for running third-party content on a very specific person’s device. It’s easy to see why that’s attractive to a spyware vendor. According to Citizen Lab, Discover-Tech’s platform could profile users and infect a device just by displaying an ad, no click required. CPJ reports that the company’s ads reached nearly 200,000 websites and apps, and researchers at Confiant found them on government networks including the US Department of Defense, NATO, and the UN.

Malicious ads are nothing new, but this is the first public evidence of an ad platform being used for targeted, zero-click spyware delivery. “Don’t click on ads” has always been good advice. An ad blocker isn’t just a quality-of-life improvement; it’s attack surface reduction.

Ransomware negotiators on the wrong side

Last week we covered a ransomware “recovery” CEO charged with secretly paying ransoms while billing customers for decryption. This week, Brian Krebs reports that investigators chasing ShinyHunters (the group behind the FBI hack) have identified executives at two ransomware negotiation firms with unusually friendly relationships with the gang. Chats seized when Dutch police arrested a suspected ShinyHunters member reportedly show negotiators who knew about new victims before the victims themselves did. One Canadian executive has already been arrested, and investigators believe an executive at an unnamed, prestigious US consulting firm helped run the gang’s extortion website.

It’s not the first time: the DOJ sentenced Florida negotiator Angelo Martino to 70 months in July for feeding his own clients’ negotiating positions to the BlackCat ransomware gang, and for helping deploy ransomware against even more victims. The government seized $10 million in assets from him, including a luxury fishing boat and, for reasons unknown, a food truck.

Part of the problem is structural. Some negotiation firms charge a percentage of the ransom paid, which gives the “negotiator” every incentive to pay, and pay big. Firms which refuse to facilitate payments often just get swapped out by the insurance company for ones that will. Meanwhile, ShinyHunters is reportedly furious with Coveware, an incident response firm, for telling victims not to pay, which is probably the best endorsement Coveware could ask for.

An army of AI agents

The Verge reports that security firm Norforge found an attacker using a swarm of mostly autonomous AI agents to break into more than 100 websites, including sites belonging to John Deere, SharkNinja, and Cummins. The agents ran on Cairn, an open-source “general-purpose problem-solving engine”: you give it a starting point and a goal, and the agents work toward it while documenting their progress. That documentation is how they were caught: the attacker’s Cairn instance was exposed to the Internet, along with about 20 others that appear malicious.

According to Reuters, the attacker described their preferred intrusion tactics in fewer than 100 Chinese characters, and each successful breach took about 23 hours. The victims say the impacted sites were standalone support pages, and Cairn’s author insists it was “never a ‘hacking tool'”. Many tools can be double-edged, but the effort balance here is hard to ignore: a short prompt and a day of waiting on one side, and defenders who have to close every hole on the other.

Staples hacked to fund a gift cards

404 Media pieced together, from an unsealed search warrant, that a Chinese organized crime ring hacked Staples in 2023 and issued more than 15,000 gift cards worth over $5 million. Staples’ internal customer support system was supposed to be reachable only from inside the company, but wasn’t. The attackers requested “heap dumps”, a debugging feature which captures everything an application has in memory, and pulled out the active login sessions of customer service reps. With those, they simply logged in as the reps and issued gift cards.  A similar trick was used in a hack of payment data from Target years ago, where attackers leveraged access through the air conditioner control network into the cash register network, and then dumped credit cards directly from RAM as they were processed.

If you’ve ever wondered why debugging endpoints left exposed in production show up in every penetration test report, this is why. The gift cards were then laundered the old-fashioned way: crews of shoppers hitting Target stores with phones full of gift cards, buying Apple and Bose gear by the cartload (about $141,000 across 85 Target stores in 18 states in two days), with the goods shipped back to China. The larger ring this fed into reportedly moved over $100 million in gift cards.

PingCAP breach claims

An extortion group calling itself FulcrumSec has posted a leak site claiming a massive breach of PingCAP, makers of the TiDB Cloud managed database service. The group claims it found cloud credentials committed to PingCAP’s own source code repositories, and used them to set up a replication feed of PingCAP’s production control database that re-exported everything to the attackers every six hours for 22 days, without being noticed.

The claims haven’t been independently verified, but they’re very specific: 10.6TB of data, 115,000 customer API keys stored in plaintext, 20 million customer SQL queries, four years of connection logs with customer IP addresses, and 413 private source repositories. The attackers quote a 2022 internal security ticket noting that any member of a customer organization, even a billing-only account, could reset the root password on every database in that organization. Perhaps most damaging, support engineers allegedly pasted live customer credentials into support tickets, including cloud keys with admin access to other companies’ storage. If you’re a TiDB Cloud customer, assume your API keys, connection strings, and anything ever pasted into a support ticket are burned, and rotate accordingly.

Fake WhatsApp on the Play Store

Android Authority found a fake WhatsApp app on Google Play with over half a million downloads, a week after a fake Chrome app racked up over 100,000. The fake copied the real listing’s screenshots and description word for word, and in some cases appeared as a sponsored result when searching for the real app.

The trick that let it linger is Google Play’s “Early Access” program, which disables public reviews. Normally a fake app gets buried in one-star “THIS IS A SCAM” reviews; in Early Access, nobody can see them. As of publication it was still available. “Only install from the official store” is still good advice for family members, but it’s a little less reassuring when the official store is selling ad placement to the fake.

Meta Muse leaks via DNS

Back in September, we covered a serious vulnerability in Muse, Meta’s extremely privileged AI agent. This week, Meta suspended Muse’s chat sharing feature after researchers at Claroc found they could find and read thousands of shared conversations.

Each shared chat got its own web address, with the conversation title as part of the hostname. Hostnames get looked up in DNS, and many DNS lookups are recorded by “passive DNS” services, essentially a giant searchable history of which names have been resolved. One search returned a ready-made table of contents of shared chats. Claroc found 6,800 of them, including a small business loan application, a bank fraud alert with partial account details, and internal company documents. “Secret URL” sharing only works if the URL stays secret, and putting the secret in a DNS hostname is roughly the opposite of that.

Password1 strikes again

The UK Information Commissioner’s Office reprimanded IT provider Ogi Networks and the Welsh public sector data organization Data Cymru over a 2024 ransomware attack which exposed data on 3,300 people, most of them children. The way in? A test account named “Test2”, created in 2012, never reviewed, and protected with the password “Password1”. The local administrator accounts on three systems also shared a single password for the same twelve years.

There’s nothing exotic here, sadly. Old accounts nobody remembers, passwords that would fall to the first guess of any automated tool, and an outsourcing arrangement where each side assumed the other was handling security. None of it makes for exciting headlines, but these are the things that keep causing very real breaches.

Trezor wallets also implanted

As a follow-up to last week’s coverage of hardware implants in Ledger crypto wallets, Kim Zetter reports that Trezor’s claim of “not a single piece of evidence” that its devices were compromised doesn’t quite line up with reality. Joe Grand found implants in two Trezor wallets, bought through Facebook Marketplace and a TikTok shop, and reported them to Trezor in August.

The Trezor attack is different from the Ledger implant. Instead of adding a radio to spy on the screen, the attackers replaced the main microcontroller with one running modified (open source) firmware. The firmware “randomly” generates one of a dozen recovery phrases the attackers already know. To pass Trezor’s integrity checks, it presents a copy of the legitimate firmware for verification before switching to the malicious code. The takeaway hasn’t changed from last week: buy only directly from the vendor, and if you’re holding enough crypto to make this worth someone’s while, consider whether you can really trust any single device.

NGINX gets more critical bugs

F5 has released out-of-band (meaning outside their normal patch schedule) updates for three critical vulnerabilities in NGINX, the web server and reverse proxy that sits in front of a huge chunk of the Internet, and quite possibly in front of the services on your home lab. The Cyber Security Agency of Singapore has a summary: all three are rated CVSS 9.2, can be triggered remotely without authentication, and can crash worker processes or, under the right conditions, allow remote code execution.

The bugs are CVE-2026-15176, a heap overflow in the “alias” and “rewrite” directives; CVE-2026-97205, a use-after-free in asynchronous file I/O combined with Server Side Includes; and CVE-2026-93479, a heap overflow in the “map” directive. Code execution requires the vulnerable configuration to be in use, and requires bypassing ASLR (the randomization of memory layout which makes exploits harder to aim). Affected versions include NGINX Open Source 1.30.5 and below and 1.31.6 and below, NGINX Plus R33 through R37, and a long list of F5’s NGINX-based products, including the Kubernetes Ingress Controller.

Back in May we covered “nginx-poolslip”, where the suggested mitigation was to avoid unnamed regex capture groups in rewrite rules. The mitigation for the “map” bug this time? Use named captures instead of unnamed captures. If you’ve been putting off cleaning up those “$1” references in your config, now’s the time. For the other two, avoid “alias” inside “location” blocks (and the “$request_filename” variable), or disable AIO or SSI, until you can update.

Linux kernel bugs posted to the wrong list

Normally, security bugs in the Linux kernel are reported privately to the kernel security team, which coordinates a fix before details go public. This is “coordinated disclosure”: the bug and fix are published together, ideally giving admins a chance to patch before attackers can start writing exploits. The Linux Kernel Mailing List (LKML), on the other hand, is about as public as it gets.

Phoronix reports that Trend Micro’s Zero Day Initiative, seemingly by accident, sent a batch of unpatched vulnerability reports straight to LKML. Greg Kroah-Hartman replied to each report asking about the choice of mailing list, which I can only imagine was done with remarkable restraint. The most serious two are both CVSS 9.0 remote code execution bugs in ksmbd, the kernel’s built-in SMB (Windows file sharing) server: an integer underflow in SMB Direct, and a race condition. The rest include local privilege escalation bugs in the networking code, the VMware graphics driver (an out-of-bounds write), and a stack overflow in search-domain TCP query handling, plus an information leak in the NVMe-over-fabrics target code.

Some of the bugs already have patches being tested or queued for future kernel releases, and those will presumably be expedited now. Most systems don’t run ksmbd (the userspace Samba server is far more common), but if you’ve enabled it on a NAS or a home server, it’s worth disabling until patched kernels land. As Phoronix puts it: “the bug and security reports keep on coming in the AI fueled world.”

---

Bitcoin Magazine

Stand With Crypto Director: The Crypto Vote Will Decide the Midterms | Mason Lynaugh

The midterms are November 3, and a shift in congressional power could reshape Bitcoin and crypto policy for years. Mason Lynaugh, Executive Director of Stand With Crypto, joins Grace Remington and Sean Hagan to break down the final push: 3.1 million advocates, 50 state chapters, 47 college chapters and 45 endorsed candidates. He explains why crypto voters are the low-propensity swing bloc campaigns spend millions to find, why the Clarity Act and GENIUS Act votes prove the issue is bipartisan, and why he expects the most pro-Bitcoin Congress in history no matter who wins.

Stand with Crypto: Check your registration, find your state’s deadline, and see where your candidates stand on crypto in one place: https://www.standwithcrypto.org/vote

Chapters:
0:00 Stand With Crypto’s Final Push: 3.1 Million Advocates and 45 Endorsed Candidates
1:18 The Voter Hub and Making the Next Congress the Most Pro-Bitcoin in History
2:12 Why Crypto Voters Are the Low-Propensity Swing Vote Campaigns Want
3:16 Tight Races Decided by Hundreds of Votes and Tens of Thousands of Advocates
4:08 Bipartisan Support: 100 Democrats on the Clarity Act and the GENIUS Act Vote
5:03 From 90 to 338 A-Rated Lawmakers in Three Years
5:44 Why Some Democrats Still Oppose Crypto and How Skeptics Come Around
7:32 Give Them a Job or Take It Away: Organizing Against Anti-Bitcoin Lawmakers
9:28 Fair Shake’s $95 Million vs. Volunteer Phone Calls
11:05 The GENIUS Act Rollout, Clarity Act Disappointment and Why AI Advocates Are Allies

DISCLAIMER: The views and opinions expressed in this show are those of the participants and do not necessarily reflect the official policy or position of BTC Inc., Bitcoin Magazine, or any affiliated entities. This content is provided for informational and educational purposes only and should not be construed as investment, legal, tax, or accounting advice. Nothing contained in this show constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or financial instruments. Viewers should consult their own advisors before making financial or business decisions.

This post Stand With Crypto Director: The Crypto Vote Will Decide the Midterms | Mason Lynaugh first appeared on Bitcoin Magazine and is written by Patrick Green.

The digital asset unit, helmed by Chris Dixon, broadens its scope.

Cardano payroll could support ADA salaries and automated payments, but employers must address price volatility, tax obligations, wallet security and compliance.

TL;DR: Archax has adopted Chainlink Data Streams to supply pricing information for GOVY, its tokenised US Treasury product, as it develops collateral use cases.

Putting Treasury bills on a blockchain is only the beginning. If an institution wants to borrow against them or use them as margin in an automated market, the software also needs reliable, timely information about their value.

That is the gap Archax is addressing with Chainlink. The regulated digital asset platform said it has adopted Chainlink Data Streams for GOVY, its continuously rolling tokenised US Treasury product. The aim is to supply pricing data to support lending, treasury management and other on-chain collateral applications.

GOVY is designed to provide exposure to short-dated US government bills, with the underlying securities held in regulated custody. Archax describes features including transfers between approved wallets and subscriptions or redemptions using supported stablecoins.

Those details matter because a tokenised security still needs rules around custody, eligibility and price discovery. A faster oracle feed cannot remove credit, liquidity or operational risk, and a proposed DeFi integration still has to be approved by individual markets. What it can do is make the underlying asset’s price usable by programmable financial systems. That is a practical step towards institutions treating tokenised Treasuries as working collateral, not simply a digital certificate.

Written by the News Desk and edited by Samuel Rae.

TL;DR: In a newly published explanation of its European consultation response, the Cardano Foundation argues for regulating activities and intermediaries rather than creating blanket rules for decentralised technology.

The Cardano Foundation has spelled out why it believes Europe’s next round of crypto policymaking should avoid treating every blockchain interaction as a regulated financial service. In an October 21 article, its legal team explained the positions it submitted to the European Commission’s MiCA review.

The response itself was filed on September 30, an important date distinction. The Foundation is not announcing that new laws were passed this week. It is describing the changes it wants policymakers to make as they assess decentralised finance, staking, lending, stablecoins and the practical limits of the existing regulation.

Its argument rests on function and control. An intermediary taking custody or exercising discretion over customer assets is doing something different from a person delegating ADA stake without surrendering custody, or software that simply provides access to a public network.

The Foundation also wants clearer treatment of hybrid tokens, overlaps with other European financial rules and cross-border legal issues. These are lobbying positions, not binding exemptions. The significance for Cardano is that staking and permissionless infrastructure sit near the centre of the EU debate over who, precisely, should face financial-services obligations.

Written by the News Desk and edited by Samuel Rae.

TL;DR: Fhenix says CoFHE is available on Ethereum and Arbitrum mainnets, giving approved applications a way to perform computations involving encrypted data.

A major weakness of public blockchain applications is that transparency is often the default, even where participants would prefer to keep commercial details private. Fhenix is trying to address that with CoFHE, its fully homomorphic encryption-powered computation system.

The company’s public developer information now describes CoFHE as live on Ethereum and Arbitrum mainnet. Applications can use its coprocessor to work with encrypted inputs instead of revealing every sensitive value to the wider network. That is relevant to private trading, financial positions and other cases where full public disclosure can be a drawback.

The important limitation is access. Fhenix says its early mainnet deployment uses an allowlist for contracts submitting CoFHE workloads, while open testnets remain available for experimentation. Its technical materials also distinguish research throughput measurements from results achieved in live production.

The development doesn’t magically make all Ethereum transactions private. It provides an additional tool to developers prepared to adopt encrypted computation and work within the initial deployment restrictions. If it proves practical under real workloads, confidential finance could move closer to established smart contract ecosystems rather than demanding a wholly separate chain.

Written by the News Desk and edited by Samuel Rae.

TL;DR: PancakeSwap’s ‘The Flip’ vote would boost liquidity providers‘ share of certain trading fees to 88% while cutting daily CAKE emissions to 7,000.

PancakeSwap holders are being asked to decide how much value should go to liquidity providers and how much new CAKE the protocol should continue issuing. Voting has opened on ‘The Flip’, a proposal first outlined to the community earlier in October.

Under the plan, liquidity providers on v3 and Infinity pools would keep 88% of swap fees, up from roughly two-thirds on many pools. The protocol’s remaining 12% fee share would go to its treasury. V2’s existing fee setup would not be changed by this part of the proposal.

The other major adjustment is on the emissions side: effective daily CAKE issuance would fall from 22,500 to 7,000, a reduction of approximately 69%. The remaining issuance is intended for PancakeSwap’s ecosystem growth fund, known as the Pantry.

Supporters will argue that paying liquidity more generously can improve trading depth and that cutting new token issuance may reduce dilution. The trade-off is how the treasury finances development and incentives over time. Nothing is final until the vote passes and code changes are rolled out. The proposed implementation would take place in phases from November, rather than changing every supported chain overnight.

Written by the News Desk and edited by Samuel Rae.

TL;DR: Zcash’s NU7 upgrade is targeted for early November, promising 25-second blocks, while final activation parameters still require implementation work.

Zcash developers are moving closer to a substantial change in the network’s basic rhythm. The NU7 schedule points to November 5 for mainnet activation, with the upgrade designed to shorten target block spacing from 75 seconds to 25 seconds.

That change could make multiple confirmations arrive much sooner than under the existing parameters. NU7 also includes the Network Sustainability Mechanism and changes affecting older transaction formats, including the retirement of legacy Sprout-related functionality.

But a date on a community roadmap is not the same thing as a completed activation. The development teams still have to lock down the mainnet height in software, finish releases and ensure the network’s operators are ready. The Zcash Foundation’s latest engineering notes describe syncing fixes and work on the Zebra node release needed for NU7.

For users, the visible effect should be quicker block confirmations once the change is actually live. For node operators and infrastructure providers, the near-term task is upgrading carefully enough to remain on the correct chain. Zcash’s privacy architecture is not being replaced wholesale; this is an engineering upgrade with real compatibility consequences.

Written by the News Desk and edited by Samuel Rae.

TL;DR: NGRAVE says attackers hijacked a notification provider used by LIQUID, directing users to a fake recovery-page and stealing at least $2.56 million.

A convincing security notification became the entry point for a costly crypto phishing campaign. Hardware wallet maker NGRAVE says a third-party provider used to send LIQUID app alerts was compromised, allowing attackers to push a fake warning to customers on October 17.

The notification directed recipients to a website resembling NGRAVE’s own pages. People who entered their recovery phrase or Perfect Key handed the attacker the information needed to take their funds. In its October 19 incident report, NGRAVE said it had traced approximately $2.56 million taken from about 70 wallet addresses across four networks.

The company broke that total down into roughly $1.77 million in Bitcoin, $454,000 in XRP, $316,000 in Ethereum assets and $18,000 in Stellar. NGRAVE described the figure as a minimum while it continues examining affected accounts.

Crucially, this was not evidence that the ZERO hardware device’s cryptography had been cracked. The attacker exploited trust in an apparently legitimate software alert and then persuaded victims to reveal secrets. NGRAVE says it disabled the notification channel and replaced keys. The immediate advice for wallet holders is unchanged: a legitimate security alert should never require typing a recovery phrase into a website.

Written by the News Desk and edited by Samuel Rae.

TL;DR: Standard Chartered has signed definitive agreements to acquire Zodia Custody, deepening its push into institutional digital asset safekeeping.

Standard Chartered is bringing one of its better-known digital asset ventures closer to the centre of the bank. On October 21, the banking group announced definitive agreements to acquire 100% of Zodia Custody Limited through Standard Chartered I H Limited.

The agreement follows a previously accepted non-binding offer and remains subject to regulatory approvals and customary closing conditions. Until those steps are complete, this is a signed acquisition agreement rather than a completed takeover.

Zodia’s regulated custody operations are intended to be integrated into Standard Chartered’s Securities Services activities, where the bank already services traditional institutional assets. Its software and professional-services business will instead be separated into Zodia Solutions under SC Ventures, with participation from existing institutional backers.

That split tells an interesting story about where traditional finance sees value in crypto. Keeping custody alongside established securities services could make it easier for institutional customers to access both, while a separate technology business can supply infrastructure to a wider group of financial firms. Standard Chartered says existing Zodia custody clients should see no disruption during the process. The integration, not a speculative token launch, is the real development to watch.

Written by the News Desk and edited by Samuel Rae.

TL;DR: The OCC has published its final GENIUS Act rule, setting out how payment stablecoin issuers under its supervision will be regulated from January 18, 2027.

America’s national banking regulator has put considerably more detail around the new federal framework for dollar-backed stablecoins. The Office of the Comptroller of the Currency issued its final rule on Wednesday, covering issuers under its jurisdiction and certain custody activities carried out by regulated institutions.

The regulations address eligible reserve assets, redemption, risk management, supervisory reporting, custody, applications and oversight of foreign issuers. In other words, the debate is moving from whether the United States should regulate stablecoin issuance to what a company must actually do to issue one.

There is an important distinction in the rollout. The rule takes effect on January 18, 2027, rather than immediately. The OCC also made clear that Bank Secrecy Act, anti-money-laundering and OFAC sanctions requirements will be covered by a separate rulemaking coordinated with the Treasury Department.

For banks and stablecoin businesses considering the US market, the rule provides a concrete compliance framework. It does not, however, mean every dollar token has already received a federal licence. Applications, supervisory approvals and the practical work of meeting the requirements still matter.

Written by the News Desk and edited by Samuel Rae.

Crypto transfers move in seconds. Compliance data now has to move with them.

Send a bank wire and you send more than money. Somewhere in that message sits the name of the person paying and the person being paid.

Crypto never really worked that way. For a long time, a wallet address was about all you got.

That’s changing, and faster than many teams expected. The reason is the Crypto Travel Rule. Crypto businesses now have to tell each other who is sending and who is receiving when they move digital assets between themselves.

For exchanges, custodians, payment platforms and fintechs with a crypto feature, this isn’t something to plan for later. It’s already part of the plumbing.

What does it actually ask for, then, and why does it give teams so much trouble?

What Is the Crypto Travel Rule?

The rule traces back to FATF Recommendation 16. That global standard was written for plain old wire transfers.

Then in 2019, the Financial Action Task Force (FATF) applied it to virtual assets as well, and to Virtual Asset Service Providers (VASPs): exchanges, custodial wallet providers, brokers.

When one VASP sends crypto to another, the originator and beneficiary details have to “travel” with it, immediately and securely.

Worth saying clearly: the rule isn’t there to stop crypto transfers. It’s there to make them traceable, the way regulated fiat payments already are.

What Information Has to Travel?

Details differ by country. FATF guidance generally asks for the originator’s name, their account number or wallet address, and one extra identifier: a physical address, national ID number, customer ID, or date and place of birth.

On the receiving side, it’s the beneficiary’s name and their account number or wallet address.

FATF suggests a de minimis threshold of USD/EUR 1,000. Above that, the full data set should be collected and shared. Below it, a reduced set still applies, so small transfers don’t get a free pass.

Thresholds Are Not the Same Everywhere

Here’s where it gets messy. Each jurisdiction is free to implement the rule its own way.

A few examples:

• United States: a USD 3,000 threshold applies to certain transfers under Bank Secrecy Act rules
• European Union: Regulation (EU) 2023/1113 has applied since 30 December 2024. If an EU crypto asset service provider is involved, originator and beneficiary information is required, whatever the amount
• Self-hosted wallets in the EU: over EUR 1,000, the provider has to check whether the customer really owns or controls that wallet

Serving several markets? Then one workflow rarely covers it. Usually you end up maintaining a few.

Why the Travel Rule Is Hard to Implement

1. The Sunrise Problem

Not every country has adopted the rule yet. The ones that have don’t all enforce it the same way.

That leaves a compliant VASP in an awkward spot. It may have to send data to a counterparty in a country where the rule doesn’t apply yet, or to one that simply can’t receive the data.

2. Counterparty Identification

Before any data goes out, a VASP needs to know who is on the other end. Is the destination wallet held by another VASP, or is it self-hosted?

Answering that usually means combining blockchain analytics and wallet attribution data with due diligence on the counterparty VASP. Sometimes it also means simply asking the customer to declare it.

3. Interoperability Between Protocols

Travel Rule solutions don’t all speak the same language.

Most of the industry has settled on IVMS101 as a common data standard. Even so, two VASPs on different Travel Rule networks can still have trouble swapping information cleanly. A shared format doesn’t automatically mean a shared pipe.

4. Self-Hosted Wallets

With a self-hosted wallet, there’s no second VASP waiting to receive anything.

Depending on the jurisdiction, a business may have to collect the information from its own customer, verify who owns the wallet, or run extra risk-based checks instead.

5. Data Protection

Travel Rule data is personal data. That part gets overlooked.

VASPs have to share it securely and still meet their data protection obligations. In practice, that puts encryption, access control and secure API integration right at the centre of the build.

Where the Industry Stands in 2026

There’s real progress. It’s just uneven.

FATF’s seventh Targeted Update on virtual assets, published in July 2026, puts some numbers on it:

• 83% of surveyed jurisdictions (91 of 109) have passed Travel Rule legislation, up from 73% in 2025
• Another 11 jurisdictions say implementation is under way
• Almost half of jurisdictions with Travel Rule laws haven’t yet taken any related supervisory or enforcement action

Laws on paper, in other words, are running ahead of enforcement.

FATF also points out that most identified on-chain illicit activity now involves stablecoins. For payment businesses running on stablecoin rails, that ties Travel Rule compliance directly to how they move money every day.

What VASPs Should Build Into Their Infrastructure

A workable Travel Rule setup tends to include:

• KYC and KYB data that’s ready to share
• Counterparty VASP discovery and due diligence
• Wallet screening and blockchain analytics
• A messaging solution that supports IVMS101
• Rules for missing or incomplete information
• Self-hosted wallet verification workflows
• Secure data storage and record keeping
• Threshold logic for each jurisdiction

The point is to have compliance happen inside the transaction flow. Not as a manual review someone does after the money has already moved, because by then fixing a missing field is far harder.

The Future of Travel Rule Compliance

Stablecoin payments, on and off ramps, tokenized assets. All of it is drifting into mainstream finance, and the Travel Rule keeps dragging crypto infrastructure toward traditional AML frameworks.

A bank getting into digital assets will run into this. So will a fintech adding a crypto wallet, or a payment provider settling in stablecoins. Each ends up asking the same thing: can our systems share compliance data as fast as they move value?

In regulated crypto, the on-chain transfer is only half of it. The other half is the information that travels with it.

Build it in now and the later conversations get easier, with regulators, with banking partners, and when it’s time to expand.

---

The Crypto Travel Rule Explained: What VASPs Need to Know was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.