TL;DR:

• THORChain’s RUNE token climbed more than 13% to $0.67 after Binance confirmed a $6.3 billion security breach. The price increase came as on-chain investigators reported that funds connected to the Binance and Bitget hacks had passed through THORChain, bringing renewed attention to the protocol’s role in cross-chain cryptocurrency transactions.
• THORChain’s native RUNE token recorded a significant rally on Friday, gaining more than 13% following news of Binance’s record-breaking $6.3 billion security breach.

According to TradingView data, RUNE climbed to approximately $0.67 from a local low of $0.59 recorded earlier in the day. The price movement came as investigators examined the movement of stolen cryptocurrency through decentralized platforms, including THORChain.

The development has placed the cross-chain protocol back in the spotlight, particularly because it has previously been used to move funds associated with several major cryptocurrency exploits.

Binance Hack Brings THORChain Under Scrutiny

Reports show that funds connected to the Binance breach and September’s $388 million Bitget hack had passed through THORChain before being consolidated at the same Ethereum address.

The Bitget incident has been attributed to TraderTraitor, a hacking group linked to North Korea. Blockchain intelligence firms TRM Labs and Chainalysis have also linked the Binance attack to North Korean hackers.

Binance estimated the total impact of its security incident at approximately $6.3 billion, making it one of the largest cryptocurrency thefts ever reported.

The exchange said its preliminary investigation pointed to a potentially compromised DevOps engineer’s laptop, which may have allowed attackers to access internal infrastructure and submit unauthorized withdrawal transactions.

Bitcoinist previously examined the massive Binance security breach and its estimated $6.3 billion impact.

THORChain’s Role in Previous Crypto Hacks

THORChain enables users to exchange digital assets across different blockchain networks without relying on traditional centralized exchanges.

However, its permissionless structure has also attracted criticism after stolen cryptocurrency was reportedly moved through the protocol.

Hackers previously used THORChain to move funds connected to the $1.4 billion Bybit attack in February 2025. The protocol was also involved in transactions associated with the Bitget incident.

THORChain rejected the request, explaining that it does not have the technical mechanism to block individual swaps. Instead, node operators can pause trading on an entire blockchain or across the network.

The controversy also created divisions within the THORChain community following the Bybit incident. Core developer Pluto announced his departure after an Ether trading halt was reversed, while validator TCB threatened to leave unless the protocol stopped processing funds linked to North Korean hackers.

RUNE Rally Comes Amid Renewed Security Concerns

Despite the controversy surrounding the protocol, Thorchain’s RUNE’s latest price movement suggests that traders were responding positively to the market developments.

However, the reported rally does not necessarily indicate improved confidence in THORChain’s security or long-term outlook.

The situation instead highlights a growing challenge for decentralized finance platforms. Permissionless infrastructure allows users to move assets freely across blockchain networks, but the same openness can make it difficult to prevent stolen funds from passing through.

For THORChain, the latest Binance incident renews questions about how decentralized protocols should respond when their infrastructure is used to move assets connected to major cryptocurrency thefts.

As investigators continue tracking the stolen funds, attention will remain on THORChain’s handling of suspicious transactions and whether its governance structure can address concerns without compromising its decentralized model.

TL;DR

• Binance hack shows an attacker reportedly used Ethereum’s EIP-7702 authorization feature to drain approximately $2.5 billion from Binance’s Ethereum hot wallet.
• The attacker gained the ability to move funds without repeatedly requesting individual transaction approvals. The incident forms part of a wider Binance security breach estimated at $6.3 billion.
• Binance suffered one of the largest cryptocurrency security incidents on record after an attacker exploited an Ethereum authorization mechanism to drain approximately $2.5 billion from one of its hot wallets.

The attack targeted a wallet identified as Binance 14 and involved Ethereum’s EIP-7702 functionality, which allows externally owned accounts to temporarily execute smart contract code without migrating to a separate smart contract wallet.

According to blockchain analysis, the attacker used a malicious authorization to give a smart contract control over the wallet’s transaction execution. This effectively transformed the exchange’s wallet into an automated fund-draining mechanism.

The incident is part of a broader security breach that affected multiple Binance wallets across several blockchain networks, with estimated losses reaching approximately $6.3 billion.

How EIP-7702 Enabled the Binance Wallet Drain

EIP-7702 was introduced as part of Ethereum’s Pectra upgrade to improve wallet functionality and support features such as transaction batching and account abstraction.

However, the same flexibility can introduce serious security risks when authorization requests are not properly verified.

In Binance’s case, blockchain security analysts reported that the attacker prepared 50 EIP-7702 authorization requests targeting Binance 14. Each authorization was associated with a specific transaction nonce, meaning only one would match the wallet’s current transaction sequence. One of those authorizations was accepted, allowing the wallet to execute code from a malicious sweeper contract.

The binance hack shows the attacker subsequently called the contract to transfer assets out of the wallet. The first major transaction moved approximately 167,464 ETH, alongside roughly $1.6 billion in USDT and dozens of other tokens.

The combined value of the assets transferred was approximately $2.5 billion.

According to Bitquery’s investigation, the attacker continued using the delegated functionality to execute additional transfers over the following hours.

Binance’s Broader Security Breach Reaches $6.3 Billion

The Ethereum wallet incident was only one component of a much larger attack.

Binance estimated that approximately $6.3 billion in cryptocurrency was affected across multiple blockchain networks. Its preliminary investigation pointed to a potentially compromised DevOps engineer’s laptop, which may have provided access to internal infrastructure and enabled unauthorized withdrawal requests.

The exchange said it had found no evidence that wallet private keys were leaked.

Meanwhile, blockchain security companies identified unusual authorization activity and suspicious transaction patterns across the affected wallets.

Binance also coordinated with stablecoin issuers and blockchain partners to freeze portions of the stolen assets. Approximately $3 billion had reportedly been frozen, although the recovery process remained ongoing.

Bitcoinist previously reported on the massive Binance hack and the estimated $6.3 billion impact.

Ethereum’s Wallet Flexibility Raises New Security Questions

The incident highlights an important distinction between introducing more functionality into cryptocurrency wallets and maintaining secure authorization processes.

EIP-7702 offers legitimate benefits for Ethereum users, including more flexible transaction execution. However, delegating execution to external code also means that malicious permissions can create significant exposure if signing systems fail to identify suspicious requests.

The Binance incident does not establish that EIP-7702 itself contains a vulnerability. Instead, it demonstrates how a legitimate protocol feature can become part of an attack when authorization controls are compromised.

For the broader cryptocurrency industry, the incident adds urgency to discussions about transaction verification, wallet permissions, and operational security.

TL;DR:

• Coinbase reported $719 million in net income for Q3 2026, marking a 66% increase year over year. However, total revenue declined 35% to $1.22 billion, while prediction markets generated more than $200 million in annualized revenue as the exchange expanded beyond traditional crypto trading.
• Coinbase reported a significant increase in third-quarter net income, returning to profitability after a challenging period for its core trading business.
• According to its October 29 earnings report, Coinbase generated $719 million in net income, compared with $433 million during the same quarter last year.

Total revenue reached approximately $1.22 billion, representing a 35% decline year over year. The results highlight the difference between Coinbase’s reported profitability and the pressure still affecting its traditional trading operations.

Prediction Markets Become a New Revenue Driver

One of the most notable developments in Coinbase’s Q3 earnings was the expansion of its prediction markets business.

The company reported that annualized revenue from prediction markets surpassed $200 million, approximately doubling from the previous quarter. CEO Brian Armstrong described the segment as one of the fastest-growing products in Coinbase’s history.

Bernstein analysts noted that prediction markets and derivatives helped offset weaker activity in spot cryptocurrency trading. Together, these businesses accounted for approximately 25% of Coinbase’s transaction revenue.

The development supports Coinbase’s broader ambition to become an everything exchange, bringing multiple financial products under one platform. Bitcoinist previously covered Coinbase’s expansion into prediction markets and stock trading, which forms part of this wider strategy.

Trading Revenue Remains Under Pressure

Despite the growth of newer products, Coinbase’s traditional trading business continued to face challenges.

Transaction revenue fell 43% year over year to approximately $590 million. Spot trading volume also declined 8% quarter over quarter, reaching $135 billion. Derivatives trading volume decreased 7% from the previous quarter to approximately $986 billion, although the decline was smaller than the broader industry’s 11% contraction, according to Bernstein.

Meanwhile, subscription and services revenue contributed $570 million, accounting for nearly 49% of net revenue. Stablecoin-related revenue reached $328 million, increasing 3% quarter over quarter.

This growing contribution from subscriptions and stablecoins reflects Coinbase’s efforts to reduce its dependence on market-driven trading fees. The exchange has also continued expanding its USDC ecosystem, including through its growing stablecoin integration strategy.

Coinbase’s Diversification Strategy Faces Its Next Test

The Coinbase Q3 earnings and latest financial results demonstrate progress in building revenue streams beyond conventional cryptocurrency trading.

The company’s prediction markets business, derivatives offerings, and subscription services are becoming increasingly important as trading activity fluctuates with broader market conditions. However, the $715 million investment gain behind its quarterly profit also highlights how closely Coinbase’s reported earnings remain connected to cryptocurrency valuations.

The exchange will need to demonstrate that its newer businesses can sustain growth even when digital asset prices and trading volumes weaken.

For now, Coinbase’s Q3 results offer evidence that its diversification strategy is gaining traction, although its core trading business remains exposed to the broader crypto market cycle.

TL;DR:

Trezor issuses Safe 5 warning and urged customers who purchased hardware wallets through CryptoBilis since March 2026 to transfer their funds to a new device. The warning follows a disclosure alleging that a Safe 5 wallet contained a hidden cellular implant capable of capturing recovery phrases.

Hardware wallet manufacturer Trezor has issued a security warning to customers who purchased its devices through Southeast Asian reseller CryptoBilis, following reports of an alleged physical implant inside a Safe 5 wallet.

In a blog post published Friday, the company said it received a responsible disclosure on October 28 describing an additional circuit board allegedly installed inside the device. Trezor is advising affected customers to move their cryptocurrency to a newly generated wallet rather than wait for its investigation to reach a final conclusion.

The warning applies to customers who purchased Trezor hardware wallets through CryptoBilis from March 2026 onward.

Alleged Cellular Implant Raises Concerns About Wallet Security

According to the disclosure, the suspicious Safe 5 device was purchased through Indonesian marketplace Tokopedia in August 2026. The alleged modification involved an additional circuit board positioned between the wallet’s main board and its display.

The component reportedly contained a cellular module and antenna capable of reading information displayed on the device, potentially including the user’s recovery phrase, before transmitting the captured information over a mobile network.

However, Trezor has not physically examined the device in question. Its preliminary assessment is based on a video interview with the customer who reported the discovery. Despite the lack of a laboratory inspection, the company considers the disclosure credible enough to issue an immediate warning.

“We’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor Chief Commercial Officer Danny Sanders said.

Trezor also confirmed that customers who contact its support team will be offered replacement devices.

The company has reportedly inspected four other returned CryptoBilis devices so far, finding no evidence of tampering in those units. No customer fund losses connected to the alleged Trezor incident have been reported.

CryptoBilis Faces Scrutiny Following Ledger Incident

The latest warning adds another complication to the ongoing security concerns surrounding CryptoBilis.

Trezor had already removed the reseller from its authorized distribution network earlier in October, following reports of tampered Ledger hardware wallets being sold through the same distributor.

Ledger previously confirmed physical tampering involving devices distributed through CryptoBilis, while OneKey also ended its relationship with the reseller, suspended new approvals, and offered customers free replacements.

The financial consequences of the Ledger incident could also be substantial. Onchain analysts have estimated that more than $86 million in cryptocurrency was lost across Bitcoin, Ethereum, and Tron. However, Ledger has not independently confirmed that figure.

Hardware Wallet Supply Chains Become a Growing Security Concern

As Trezor issues safe 5 warning, it only highlights a broader issue facing cryptocurrency investors: hardware wallet security depends on more than the technology inside the device.

Although cold wallets are designed to keep private keys offline, physical interference during distribution can introduce risks that ordinary software protections may not detect.

The importance of protecting recovery phrases has also become increasingly apparent following previous incidents involving cryptocurrency wallet phishing and supply-chain attacks. Bitcoinist has previously examined a Ledger seed phrase scam targeting hardware wallet customers.

For now, Trezor’s warning remains precautionary, as the company has not yet completed a physical examination of the reported Safe 5 device. Nevertheless, customers who purchased through CryptoBilis are being encouraged to take immediate action.

The incident serves as another reminder that securing cryptocurrency requires careful attention to where hardware wallets are purchased, how devices are handled, and whether recovery phrases remain protected.

TLDR

• XRP Ledger developers have proposed four fixes to close gaps in issuer approval requirements for restricted tokens.
• The changes would strengthen checks on trading pool shares and token transfers, preventing unapproved accounts from acquiring restricted assets through exceptions.
• Holders without approval would generally only be able to return affected tokens to the issuer, unless the issuer authorizes their account.
• The proposals are not live on mainnet. The XRP Ledger Foundation described the work as routine protocol hardening and reported no known outsider exploitation of the remaining exceptions.

XRP Ledger Developers Target Token Approval Gaps

XRP Ledger developers are proposing tighter controls over who can receive and hold tokens that require issuer authorization.

The four proposed fixes are grouped under an amendment called fixCleanup3_5_0. They aim to make existing approval requirements apply consistently across different ways tokens move through the network.

Issuers of assets such as regulated stablecoins or tokenized funds can require approval before an account holds their tokens. This allows an issuer to conduct identity checks or apply other eligibility requirements.

That authorization is recorded on a trust line, the connection an account establishes to hold another party’s issued token.

The proposed changes address exceptions in how those requirements are enforced. They concern restricted issued tokens, rather than introducing an issuer-approval requirement for holding native XRP.

Trading Pool Shares Face Stronger Checks

One proposed fix would require an account to have the necessary authorization for both assets in an automated market maker pool before acquiring its liquidity provider token.

These pool shares, often called LP tokens, represent a claim on the assets held inside the pool.

Developers identified a gap between depositing directly into a pool and receiving its LP tokens through another route. Although deposits already required the relevant authorizations, transfers of pool shares could allow an unapproved account to gain exposure to restricted assets.

The proposal extends checks across those acquisition routes, including payments, trading offers and NFT offers involving LP tokens.

The aim is to ensure that receiving a pool share cannot bypass the approval requirements attached to its underlying assets.

Existing Balances Would No Longer Bypass Authorization

A second proposal addresses an exception involving trust lines that already carry a token balance.

Under the behavior developers identified, an authorization check in the payment engine applied when a trust line’s balance was zero. A line that already held tokens could continue receiving more despite lacking approval.

The fix would prevent unauthorized trust lines from receiving additional restricted tokens through that route.

The broader package also seeks to keep authorization rules consistent across existing and future XRP Ledger features.

For an account already holding restricted tokens without approval, the proposed rules would generally allow those tokens to be returned to their issuer. The issuer could subsequently approve the holder’s trust line and restore normal use.

Foundation Says Work Is Unrelated to a Security Incident

The XRP Ledger Foundation described the proposals as routine improvements to protocol safeguards.

Speaking to CoinDesk, Hussein “Vet” Zangana, the foundation’s director of community and product, said the discussion concerned the guarantees the protocol should provide, rather than a report of affected users.

According to Zangana, known unauthorized balances originated from payments by issuers themselves or accounts those issuers had previously approved. The foundation said it knew of no balance created by an outside party exploiting the remaining exceptions.

Developers have also examined earlier routes involving NFT trades, including an issue addressed in August 2025.

XRP Ledger Changes Still Require Validator Support

As of the October 30 report, the four fixes had not been merged into the network’s main software or activated on mainnet.

Software inclusion would be only one step toward implementation. The amendment would also need sustained support from the network’s trusted validators for two consecutive weeks before activation.

Validator approval is also central to other network changes, including the separately proposed XRP Ledger Batch upgrade.

If adopted, the restricted-token fixes would give issuers more consistent enforcement of their existing approval requirements. For holders, the practical distinction would be whether their account has the issuer’s authorization.

Follow Bitcoinist’s latest Ripple news for further coverage of XRP and developments across the ecosystem.

TLDR

• Elon Musk warned that advanced AI agents could eventually exploit cryptocurrency systems to obtain money for themselves.
• His remarks followed reports that a Binance-linked attacker deposited 60 million USDT into Aave and borrowed approximately $44.6 million in wrapped Ether.
• Musk did not claim AI was involved in the Binance hack. His warning concerned the potential behavior of future autonomous systems.
• Aave introduced restrictions across its V3 and V4 lending markets, while Binance reported approximately $6.3 billion in affected assets and $3 billion frozen.

Musk Warns AI Agents Could Seek Their Own Funds

Elon Musk has raised concerns that AI agents could eventually use cryptocurrency systems to acquire funds independently, following reports about the Binance attacker’s borrowing activity on Aave.

In an October 29 post on X, Musk responded to an account of how stolen stablecoins were used as collateral to borrow Ethereum-based assets.

“Super intelligence agents will at some point do this to gain currency for themselves, not a human,” he wrote.

The comment described a possible future risk. Musk did not suggest artificial intelligence carried out the Binance attack, identify an existing system capable of doing so, or provide a timeline.

His warning comes as crypto companies develop tools that allow software agents to interact with digital assets, including self-custodial wallets for AI agents.

Binance Attacker Borrowed $44.6 Million Through Aave

According to an October 30 assessment from risk management firm LlamaRisk cited by crypto.news, a wallet linked to the Binance attacker deposited 60 million USDT into Aave V3 on Ethereum.

The deposits occurred between 20:58 and 21:01 UTC on October 29. The wallet then borrowed 19,762 wrapped Ether, valued at approximately $44.6 million at the time.

The activity took place roughly 40 minutes before Aave introduced its first emergency restrictions.

The transaction used Aave’s existing lending functions. It was not reported as an exploit of the protocol’s lending contracts.

At the time of LlamaRisk’s assessment, the position held approximately $59.9 million in collateral against $43.8 million in outstanding debt. The firm said it remained overcollateralized and subject to normal liquidation procedures, with no immediate risk to suppliers.

Why the Stablecoin-to-Ether Route Matters

The borrowing activity highlighted a difference between centrally issued stablecoins and assets such as native Ether.

Tether can freeze USDT at specific blockchain addresses. Native ETH has no centralized issuer with an equivalent power to block transfers.

Using stolen stablecoins as collateral to borrow wrapped Ether gave the attacker access to another asset while issuers were working to restrict the stolen funds.

Musk’s concern was that a sufficiently advanced autonomous system might eventually use similar financial mechanisms for its own objectives.

That possibility remains a prediction. The reported transactions do not establish that an AI system independently stole or borrowed funds.

The broader issue is becoming more relevant as products such as Binance’s AI suite and automated trading workflows expand the ways software can interact with cryptocurrency markets.

Aave Restricts New Deposits and Borrowing

Aave’s risk teams coordinated with Aave Labs, TokenLogic and Certora to prevent the attacker from opening additional lending positions.

Between 21:42 and 23:04 UTC on October 29, teams froze 175 reserves across 16 Aave V3 networks and another 117 reserves across four V4 networks, according to the reported assessment.

The restrictions blocked new deposits and borrowing. Loan repayments, withdrawals of available assets and liquidations remained operational.

The response therefore differed from a complete shutdown of the protocol.

It also extended across multiple deployments as Aave V4’s lending footprint continued to expand.

LlamaRisk said the attacker had distributed assets among more than 20 wallets, with activity involving Ethereum, Arbitrum, Optimism and Avalanche. Risk teams planned a staged restoration of services once fund movements stopped and containment became clearer.

Binance Reports $3 Billion Frozen After Breach

Binance estimated the security incident affected approximately $6.3 billion in cryptocurrency. Around $3 billion had been frozen through cooperation with blockchain partners, according to its initial update.

The exchange’s preliminary investigation pointed to a compromised DevOps engineer’s laptop that may have enabled access to internal infrastructure and unauthorized withdrawal transactions.

Binance said it had found no evidence of leaked wallet private keys and pledged to cover customer losses through its SAFU fund and company resources.

The incident has brought two separate issues into focus: containing an ongoing cryptocurrency theft and assessing how future AI agents might interact with financial systems.

Musk’s warning concerns the second. The reported Binance breach and subsequent Aave borrowing do not demonstrate that autonomous AI was behind either activity.

TLDR

• Bitcoin price dropped roughly 2% to around $78,420 as the market reacted to Binance’s $6.3 billion security breach.
• Crypto liquidations reached $1.54 billion over 24 hours, with long positions accounting for approximately $1.3 billion.
• Binance said about $3 billion in affected assets had been frozen and pledged to cover losses through its SAFU fund and company resources.
• US spot Bitcoin ETFs attracted fresh inflows, while $80,188 emerged as an immediate resistance level for BTC.

Bitcoin Price Slides as Leveraged Positions Unwind

Bitcoin price remained below $80,000 on October 30 as traders responded to the Binance breach and a wave of forced position closures.

At the attached report’s market snapshot, BTC traded near $78,420, down roughly 2% over 24 hours. The cryptocurrency had briefly slipped below $77,000 before recovering some ground.

CoinGlass figures cited in the report showed approximately 239,000 traders liquidated during that period. Total liquidations reached $1.54 billion, including around $1.3 billion in long positions.

The imbalance shows that traders betting on higher prices absorbed most of the damage. Forced closures of leveraged bullish positions can intensify a decline, adding selling pressure as the market moves lower.

The largest individual liquidation reported was an $11.09 million BTC/USDT position on Binance.

Binance Outlines Breach and Recovery Efforts

In its security incident update, Binance estimated the breach’s impact at approximately $6.3 billion. The exchange said coordination with blockchain partners had helped freeze roughly $3 billion on-chain.

Its preliminary investigation pointed to a compromised DevOps engineer’s laptop. According to Binance, the attacker may have used that access to enter a service container and submit unauthorized withdrawal transactions.

The company said it had found no evidence of leaked wallet private keys. Those findings remain preliminary, with a detailed technical account expected after investigators establish what happened.

Binance also pledged to cover losses using its SAFU emergency fund and company funds. It said an updated proof-of-reserves report would follow remediation.

The recovery effort remains a central issue for traders assessing the fallout. Frozen assets reduce the amount potentially lost, but they do not by themselves establish when funds will be recovered or how the remaining shortfall will be covered.

Rate Decision Adds to Market Uncertainty

The sell-off followed an already difficult stretch for Bitcoin in the news today.

According to the attached report, the Federal Reserve held its benchmark interest rate at 3.75%–4% on October 28, while two officials supported a quarter-point increase. Bitcoin subsequently fell below $80,000 before the Binance incident added another source of uncertainty.

The rate backdrop and exchange breach presented separate pressures. One concerned monetary policy and investor appetite for risk; the other raised questions about exchange security and the recovery of affected assets.

Their timing helps explain the cautious market environment, although it does not establish how much of Bitcoin’s decline came from either development.

Bitcoin ETF Inflows Offer a Mixed Signal

Institutional fund flows were more resilient than the broader market.

SoSoValue data cited in the attached report showed US spot Bitcoin ETFs recording $17.07 million in net inflows on October 29. That extended their positive streak to four trading sessions.

The previous three sessions had attracted approximately $423.66 million combined, following about $773.5 million in outflows on October 22 and 23.

The return of inflows suggested continued demand through ETF products. However, those purchases

TLDR

• The Binance hack affected an estimated $6.3 billion in cryptocurrency, exceeding the scale of the $1.5 billion Bybit theft in February 2025.
• Binance said approximately $3 billion had been frozen on-chain through coordination with blockchain partners.
• The exchange announced a temporary suspension of deposits and withdrawals while teams carried out security checks and worked with law enforcement.
• Initial findings point to a compromised employee laptop, while Binance pledged to cover losses and said it found no evidence of leaked wallet private keys.

Binance Hack Affects $6.3 Billion in Crypto

Binance confirmed a major security breach affecting approximately $6.3 billion in cryptocurrency, sending fresh uncertainty through digital asset markets on October 30.

The world’s largest cryptocurrency exchange by daily trading volume said it was working with blockchain partners to contain the incident. Approximately $3 billion in affected assets had been frozen on-chain, according to its announcement.

The estimated impact is more than four times the $1.5 billion stolen from Bybit in February 2025. That attack, attributed to North Korean-linked hackers, had previously set the benchmark for the largest cryptocurrency theft.

However, the $6.3 billion figure represents the estimated assets affected by the Binance hack. The final loss remains uncertain as investigators trace funds and pursue additional freezes.

Binance Suspends Transfers and Pledges to Cover Losses

At approximately 00:30 GMT on October 30, Binance announced that deposits and withdrawals had been temporarily suspended. The exchange said its teams were conducting security checks, freezing funds and coordinating with law enforcement.

Its public updates paired assurances about customer balances with a commitment to absorb losses.

In its security incident update, Binance said coverage would come from its Secure Asset Fund for Users, known as SAFU, and company funds.

The pledge addresses who would bear the financial impact. Recovering the affected assets and restoring normal operations remain separate parts of the response.

Binance also said the amount frozen could rise as law enforcement agencies, token issuers, blockchain intelligence firms and other partners continued tracing the funds.

Compromised Engineer Laptop Emerges as Initial Lead

Binance’s preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer.

According to the exchange, that access allowed an unauthorized party to enter a service container and submit withdrawal transactions through internal infrastructure.

Binance said investigators had found no evidence that wallet private keys were

TLDR

• The US Treasury has sanctioned 10 individuals and one entity linked to North Korean IT worker fraud.
• Two Russian nationals, Ilya Boykov and Vitold Obertas, allegedly converted millions in crypto for North Korea.
• The Treasury also designated a North Korean-run center in Russia, along with eight crypto addresses on Ethereum and Tron.
• The schemes use fake identities to land jobs at legitimate firms and send wages to Pyongyang’s weapons programs.

Treasury Targets Crypto Conversion Networks

The Treasury Department’s Office of Foreign Assets Control (OFAC) announced the sanctions on October 28. The action goes after financial intermediaries and workers based in Russia and North Korea who support IT worker operations.

Treasury says Boykov exchanged and converted about $3.5 million in crypto for Alis, a company sanctioned in March 2024 over links to North Korean IT workers. Obertas allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.

How the IT Worker Schemes Operate

North Korean operatives use stolen identities, forged documents and invented personas to secure remote jobs at legitimate companies. The regime then keeps most of the wages, turning routine software work into state revenue.

The danger goes beyond paying a disguised employee. Treasury says these workers have used corporate network access to plant malware and steal sensitive and proprietary data.

Chainalysis reports that operatives have also used generative AI to write resumes and cover letters and to prepare for technical interviews. In some cases, AI-generated profile photos and deepfake video helped hide their identities during hiring calls.

Garantex Link and Russian Front Center

Chainalysis traced crypto earned by a North Korean IT worker to Boykov, who sent the funds to Garantex, a now-sanctioned Russian exchange, to cash out.

OFAC also designated the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia. Six workers sanctioned alongside it generated over $750,000 for the group since 2025, according to Treasury. The designation notice lists eight crypto addresses on Ethereum and Tron tied to those sanctioned.

The latest action follows a March sanctions round in which Treasury targeted six people and two companies accused of laundering $800 million in crypto for North Korea.

Together, the moves show US authorities increasingly focusing on the middlemen who turn North Korean earnings into usable cash, rather than only on the workers themselves.

TLDR

• Chainlink launches Chainlink 24/7, a pricing service covering weekends and holidays for stocks, commodities and other traditional assets.
• Off-hours prices are based on quotes from perpetual futures venues, not closed exchanges.
• Aave is the first partner, using the feeds on its institutional Horizon platform.
• Chainlink says its weekday infrastructure already covers more than $1.6 billion in tokenized stocks.

Blockchain markets run around the clock, but the assets many of them track do not. Stock exchanges close at night, on weekends, and on holidays, leaving on-chain applications without a reliable price.

Until now, protocols had a few poor options: freeze markets, rely on the last known price, or build their own valuation tools. Chainlink 24/7 aims to remove that problem by supplying one continuous price series per asset.

How Chainlink 24/7 Works

The service blends two sources. When traditional markets are open, it uses prices from regular and extended sessions. When they shut, it switches to an off-hours reference built from perpetual futures quotes.

Chainlink says the system pulls quotes from multiple futures venues, removes stale inputs and limits the influence of outliers. Importantly, the weekend price reflects derivatives trading rather than actual transactions on closed exchanges.

Lending protocols can read prices published directly onchain through Data Feeds. Trading platforms and prediction markets can use Data Streams for faster updates, which also flag the current market session so apps can adjust risk settings.

Aave Horizon Adopts the Feeds

Aave is the launch partner, integrating the feeds into Horizon, its lending platform for institutions. Horizon lets qualified investors borrow against tokenized assets, and the rollout begins with tokenized versions of heavily traded US stocks.

Reliable weekend prices matter for lenders because collateral values need to stay current to manage liquidation risk, even when stock exchanges are offline.

Building on Earlier Pricing Products

The launch follows Chainlink’s January debut of 24/5 pricing for US stocks and ETFs, which covered pre-market, regular, post-market and overnight sessions. The company says that weekday infrastructure now supports over $1.6 billion in tokenized stocks.

With the new weekend layer, Chainlink is moving toward full-time coverage as tokenized equities and other real-world assets continue to expand onchain.

TLDR

• Dubai-based startup Utexo plans to relaunch Tether’s USDT on Bitcoin using the RGB protocol, with a public launch set for November 28.
• Lightning Network support is expected in the first quarter of 2027.
• The project faces a market where roughly $300 billion in stablecoins already sits on Ethereum, Tron and other networks.
• Bridge risk and limited DeFi support remain the main hurdles.

Why USDT Is Returning to Bitcoin

USDT first appeared on Bitcoin in 2014 through the Omni protocol. Tether ended issuance there in August 2023, blaming falling usage. The company later floated an RGB-based launch in 2025, but it never materialized.

Now Utexo is taking up the task. Tether led the startup’s $7.5 million seed round in March, and the new version will rely on Tether’s USDT0 protocol.

CEO Viktor Ihnatiuk argues two things have changed: speed and privacy. Bitcoin acts as the settlement layer, while RGB keeps transaction details off the public blockchain. He claims Lightning payments can settle in around 100 milliseconds.

How RGB and Lightning Fit Together

RGB, in development since 2016, lets users issue and move assets through contracts tied to Bitcoin without publishing every detail on-chain. Participants validate transfers themselves, while cryptographic commitments anchored to Bitcoin provide security. It is neither a sidechain nor a rollup.

The protocol also works with Lightning, allowing USDT to move through payment channels without a base-layer transaction each time. Utexo believes confidentiality will appeal to businesses that dislike exposing their counterparties on a transparent ledger. The company says it can selectively disclose data for compliance and respond to law enforcement requests.

Bridge Risk Raises Questions

Utexo opened early access to its USDT Mint product on October 22, letting verified exchanges, wallets and market makers test minting and redemption on Bitcoin’s Signet network.

Getting existing tokens onto Bitcoin requires locking USDT0 on Arbitrum before an equivalent amount is minted on Bitcoin. Redemption reverses the process by burning the RGB asset. This means security depends on the bridge as well as Bitcoin and RGB, and bridges have historically attracted hackers.

Utexo’s goal is at least $1 billion in Bitcoin-based USDT within 12 months, with a median target of $5 billion and an ambitious ceiling of $10 billion. Whether demand materializes this time remains the key test.

TLDR

• European Central Bank President Christine Lagarde will leave her post on February 7, 2027.
• She will have served about seven years and three months, short of her full eight-year term.
• The European Council will appoint her successor under an EU treaty process.
• Her tenure saw progress on the digital euro, the launch of Pontes, and sustained skepticism toward Bitcoin.

Lagarde Confirms Her Departure Date

Christine Lagarde has announced she will step down as ECB president on February 7, 2027. She shared the news in a post on X, saying she had informed her colleagues at the central bank.

Lagarde took office in November 2019, which means she is leaving roughly eight months before her mandate was due to expire in October 2027. Reports of an early exit first emerged in February 2026, when anonymous sources told the Financial Times she was considering leaving ahead of schedule.

How the Next ECB President Gets Picked

The ECB said her successor will be selected under Article 283 of the Treaty on the Functioning of the European Union. The European Council issues a recommendation after consulting the European Parliament and the ECB, then makes the formal appointment.

No candidate has been named so far, leaving the succession race wide open as the transition date approaches.

Digital Euro and Tokenization Under Her Watch

The ECB made notable strides in digital finance during Lagarde’s presidency. The bank pushed forward preliminary work on a digital euro intended for everyday payments, and in September it introduced Pontes.

Pontes allows financial institutions to settle wholesale tokenized asset transactions in central bank money. The system is positioned as an alternative to stablecoins, giving institutions a regulated settlement option backed directly by the central bank.

A Vocal Critic of Bitcoin

Lagarde has long been one of the most prominent central bankers skeptical of crypto. During a January 2025 press conference, she stated that central bank reserves must be liquid, secure and safe, and said she was confident Bitcoin would not enter the reserves of any central bank in the ECB’s General Council.

A lawyer by training, Lagarde previously served as France’s economy minister and as managing director of the International Monetary Fund from 2011 to 2019. At the ECB, she guided the eurozone through the Covid-19 pandemic, Russia’s invasion of Ukraine and the energy crisis that followed.

Her departure puts the ECB’s future stance on crypto, stablecoins and the digital euro under the spotlight. Markets will be watching closely to see whether her successor maintains the same cautious line or takes a different direction.

TLDR

• Polygon Labs decided to bring its Open Money Stack to Solana.
• Businesses get bank funding, wallets, cross-chain transfers and global payouts through one integration.
• Kira, a fintech focused on cross-border dollar payments, is among the first adopters.
• Solana says it has handled over $5T in stablecoin volume this year, while Polygon Chain has passed $3T cumulatively.

Polygon Extends Open Money Stack to Solana

Polygon Labs is making a clear play for the payments market. The firm has rolled out its Open Money Stack on Solana, giving companies a single entry point for bank deposits, embedded wallets, cross-network transfers, and payouts.

Developers don’t need to rebuild anything on Solana. This means that teams can adopt the whole package or plug in only the pieces they’re missing. Polygon Foundation CEO Sandeep Nailwal framed it as a way for businesses to stay on the chain their customers prefer while Polygon manages the movement of money around it.

This follows the October 8 addition of TRON support and the Coinme acquisition, which possibly gave Polygon’s US payments arm licensing coverage across 48 states.

How the Stack Works in Practice

The platform links bank transfers, cards, cash services, and crypto funding to apps running on Solana. Users receive accounts and built-in wallets, so they can hold and send digital assets without juggling a separate crypto app.

From there, some of the funds are being routed between Solana, Polygon, Ethereum, TRON and several EVM-compatible chains. Polygon handles conversions, routing, and execution on the backend.

Two examples stand out. A remittance company could pull dollars from a customer’s bank, send USDC over Solana and trigger a local bank payout abroad. A marketplace could accept stablecoins and pay sellers in crypto or local currency. In both cases, users never touch a bridge.

Kira’s use case is the is most concrete. The company serves fintechs, OTC desks and import brokers who regularly pay overseas suppliers. It already moves stablecoins on Solana, and CEO Edrizio De La Cruz said the missing piece was getting those funds into clients’ dollar bank accounts. Polygon’s infrastructure fills that gap. Kira joins Tazapay, Mesh and Toku, which Polygon named as early customers after the Coinme deal closed.

Stablecoin Volume Sets the Stage

Solana Foundation product chief Vibhu Norby said the network has processed more than $5T in stablecoin volume in 2026, and he described Polygon’s stack as another route for businesses to reach banking and payout networks.

Solana has been building its own institutional payments team too. In September it hired former Polygon executive Jamal Raees as general manager of payments. Meanwhile, Polygon says its own chain has cleared over $3T in cumulative stablecoin transfers.

This might be a sign that payments infrastructure is becoming chain-agnostic, with the competition shifting from which network wins to who controls the bridge between blockchains and bank accounts

Bitcoin’s recent struggles have sparked another heated argument between investors, and this time, there’s a potential $1 million wager involved.

Real estate investor Grant Cardone has challenged venture capitalist Jason Calacanis to bet on whether Bitcoin can return to its previous all-time high within two years.

The disagreement follows Calacanis’ prediction that Bitcoin will never reach another record and could fall toward $57,000 over the next 12 months.

Cardone sees a different future. He believes Bitcoin can recover, and he’s willing to put a substantial amount of money behind that expectation.

TL;DR

• Grant Cardone has offered Jason Calacanis a $1 million wager that Bitcoin will reach $126,210.50 by October 28, 2028.
• Calacanis expects Bitcoin to fall toward $57,000 within a year and believes its previous record will never be surpassed.
• Other Bitcoin supporters have proposed similar bets, but Calacanis has not publicly accepted Cardone’s challenge.

A $1 Million Challenge Over Bitcoin’s Future

The dispute began after Calacanis shared a pessimistic outlook for Bitcoin on October 27.

He argued that investors should consider shifting their attention toward artificial intelligence, suggesting that Bitcoin offers fewer opportunities for future growth.

His prediction was particularly bold: Bitcoin would revisit $57,000 and never surpass its previous all-time high.

Cardone responded the following day with a direct financial challenge.

He offered to wager $1 million that Bitcoin would reach at least $126,210.50 by October 28, 2028.

The proposed target is slightly higher than Bitcoin’s October 2025 record of approximately $126,080.

Cardone also suggested placing the money with an independent third party to ensure the winner receives payment.

We should emphasize that this remains a proposed wager, not a confirmed agreement.

Calacanis has responded publicly but hasn’t accepted Cardone’s terms.

Why Jason Calacanis Expects Bitcoin To Fall

Calacanis’ concerns focus on declining investor enthusiasm and the movement of capital away from Bitcoin.

He pointed to withdrawals from spot Bitcoin exchange-traded funds as evidence that demand could weaken further.

His argument also reflects a broader question facing investors: whether Bitcoin can continue attracting capital when other technologies, particularly artificial intelligence, offer competing opportunities.

We wouldn’t dismiss those concerns entirely.

Bitcoin has experienced a difficult year, and declining institutional demand can place additional pressure on prices.

However, ETF outflows don’t necessarily indicate that every category of investor is abandoning the market.

Different institutions buy and sell for different reasons.

As we follow Bitcoin market developments, separating short-term trading decisions from longer-term investment strategies remains important.

Bitcoin Supporters Join The Million-Dollar Debate

Cardone isn’t the only investor challenging Calacanis’ prediction.

Bitcoin advocate Fred Krueger has proposed another $1 million wager, although his suggested deadline extends to October 2036.

Hollywood producer and Bitcoin supporter Terence Michael also offered to participate in the dispute.

Meanwhile, JAN3 CEO Samson Mow and Blockstream CEO Adam Back expressed interest in supporting Cardone’s challenge.

The reactions demonstrate how divided investors remain about Bitcoin’s future.

Some believe the latest downturn represents another temporary correction. Others question whether Bitcoin can regain the momentum that previously pushed prices to record levels.

For us, the more interesting question isn’t who wins an argument online.

It’s whether Bitcoin can attract enough sustained demand to justify another major rally.

Bitwise Predicts A Much Higher Bitcoin Price

The disagreement arrives alongside a considerably more optimistic forecast from investment manager Bitwise.

In its October 28 Bitcoin outlook, the company raised its projected Bitcoin price for 2036 to approximately $1.6 million.

That represents an estimated compound annual growth rate of 34.3%.

Bitwise bases its forecast partly on growing institutional adoption, limited Bitcoin supply, and demand for assets that could preserve purchasing power over time.

However, the company also identifies significant risks, including quantum computing, technological disruption, and unfavorable regulatory changes.

These are projections rather than guaranteed outcomes.

We think it’s important to distinguish a financial model covering ten years from Cardone’s much shorter two-year wager.

Both express confidence in Bitcoin, but they rely on very different time horizons.

Can Bitcoin Reach Another Record By 2028?

When Cardone issued his challenge, Bitcoin was trading near $80,847, approximately 36% below its previous peak.

Reaching his $126,210.50 target from that level would require a gain of roughly 56%.

That’s a substantial recovery, although Bitcoin has experienced larger percentage moves during previous market cycles.

Several factors could influence the outcome, including institutional investment, ETF demand, economic conditions, and regulatory developments.

We’ll also be monitoring changes in the wider cryptocurrency market, where Bitcoin’s performance often influences investor sentiment.

For now, Cardone’s challenge has attracted considerable attention, but no million-dollar agreement has been finalized.

The next two years may provide an answer to the price question, regardless of whether the wager ever takes place.

Arbitrum has recorded a sharp increase in blockchain activity, with daily active addresses reaching approximately 1.09 million on October 28, their highest level in 30 days.

The jump comes as Ethereum’s Layer 2 networks continue competing for users, developers, and decentralized applications.

At first glance, the numbers suggest a major improvement in network engagement. However, when we compare active addresses with transactions and fees, the picture becomes more interesting.

Not every increase in wallet activity represents the same level of adoption.

TL;DR

• Arbitrum reached approximately 1.09 million daily active addresses on October 28, its highest reading in 30 days.
• Active addresses increased around 90.3% week over week, while transactions rose approximately 29.3% to 2.1 million.
• Network fees remained relatively stable, raising questions about what caused the sudden increase in wallet activity.

Arbitrum Sees A Sharp Increase In Wallet Activity

Arbitrum One experienced a significant increase in active addresses on October 28.

According to data from growthepie’s Arbitrum analytics dashboard, the network’s active address count climbed approximately 90.3% compared with the previous week.

The increase brought daily activity to around 1.09 million addresses.

That’s a substantial jump for a network that recorded 571,767 daily active addresses during another activity spike on October 21.

The latest figure is nearly twice that earlier reading.

We find the timing particularly interesting because Arbitrum has been expanding its role in decentralized finance, stablecoin transactions, and institutional blockchain applications.

However, the number of active addresses doesn’t necessarily represent the number of individual users.

One person can control multiple wallets, while automated systems may generate activity across numerous addresses.

That’s why we need to examine additional metrics before calling this a major adoption breakthrough.

Transactions Rise But Fail To Match Wallet Growth

Transaction activity also increased, although not nearly as dramatically.

Arbitrum processed approximately 2.1 million transactions, representing a weekly increase of 29.3%.

That compares with the 90.3% increase in active addresses.

The difference suggests more addresses participated in the network without producing an equivalent increase in total transactions.

There are several possible explanations.

Some wallets may have completed only one transaction, while others could have been interacting with applications or automated services.

We don’t yet have enough evidence to identify the specific activity responsible for the increase.

For readers following Ethereum developments, this distinction is important.

A growing address count can indicate broader participation, but transaction frequency helps us understand how intensively the network is being used.

Network Fees Remain Surprisingly Stable

Another notable finding involves transaction fees.

Despite the increase in active addresses, Arbitrum’s daily user-paid fees were approximately $19,100.

That represented a slight weekly decline of 0.8%.

In other words, significantly more addresses were active without generating a comparable increase in network fee revenue.

This doesn’t automatically indicate a problem.

Arbitrum is designed to process Ethereum transactions at lower costs, making inexpensive activity part of its appeal.

However, we think the difference between activity and fees deserves attention.

If wallet addresses increase while fees remain stable, the network may be handling more low-cost interactions rather than experiencing a proportional increase in economically significant transactions.

Why Arbitrum’s Growth Matters For Ethereum

Arbitrum is one of Ethereum’s established Layer 2 scaling networks.

It processes transactions outside Ethereum’s main execution layer while using Ethereum for settlement and security.

This approach helps applications operate with lower fees and greater transaction capacity.

The network supports decentralized exchanges, lending protocols, stablecoins, and other blockchain applications.

Its broader ecosystem has also attracted interest from financial institutions exploring tokenized assets and blockchain infrastructure.

As we cover the blockchain sector, we see Layer 2 competition becoming increasingly important.

Networks aren’t competing solely on transaction costs anymore. They’re also trying to attract sustainable activity, developers, liquidity, and real-world financial applications.

A temporary jump in addresses can attract attention, but lasting engagement is what matters most.

Can Arbitrum Maintain Its Momentum?

The next several days should provide a better indication of whether Arbitrum’s latest increase is sustainable.

We’ll be watching three measurements in particular: daily active addresses, transaction counts, and fees paid by users.

If all three continue growing, that would provide stronger evidence of expanding network usage.

If active addresses quickly return to previous levels, the October 28 increase may prove temporary.

It’s also important to separate blockchain activity from the performance of ARB, Arbitrum’s governance token.

Higher network usage doesn’t guarantee an increase in token prices.

For investors following the wider cryptocurrency market, Arbitrum’s latest figures offer an encouraging development, but not yet proof of sustained growth.

The network has demonstrated that it can attract substantial activity.

Now we’ll be looking for evidence that those addresses remain active beyond a single record-setting day.

Ripple is preparing to finish 2026 with a projected $900 million annualized product revenue run rate, marking an important step in its expansion beyond cryptocurrency payments.

The company announced the target during its Swell 2026 conference in New York on October 28, alongside updates about its RLUSD stablecoin, institutional partnerships, and banking operations.

What’s interesting to us is how much Ripple’s business has changed. The company is no longer concentrating primarily on international payments. It’s building services that connect traditional banking, digital assets, and blockchain-based financial markets.

TL;DR

• Ripple expects to reach a $900 million annualized product revenue run rate by the end of 2026, supported by payments, custody, stablecoins, and institutional services.
• The RLUSD stablecoin has reached approximately $2.6 billion in market capitalization, increasing more than 88% this year.
• Ripple has received final regulatory approval for a national trust bank and expanded partnerships with major financial institutions.

Ripple’s Business Is Growing Beyond Payments

Ripple’s latest financial target reflects a business that has become considerably broader.

According to Ripple’s official October 28 announcement, the company expects to exit 2026 with $900 million in annualized product revenue.

This is a projected year-end revenue pace, not a report of $900 million already collected during 2026.

Growth is coming from several areas, including international payments, digital asset custody, stablecoins, prime brokerage, and treasury management.

Ripple also reported that the number of customers and partners using multiple products has tripled this year.

Its infrastructure now serves more than 1,700 institutions and businesses, supported by over 85 regulatory licenses.

We see this as an important change in Ripple’s strategy. Rather than relying on one service, the company is creating several ways for financial institutions to use its technology.

RLUSD Becomes A Bigger Part Of Ripple’s Strategy

Ripple’s dollar-backed stablecoin, RLUSD, is playing an increasingly important role in that expansion.

The token has reached approximately $2.6 billion in market capitalization, representing growth of more than 88% since the beginning of 2026.

RLUSD is now available through major trading platforms, including Coinbase, Robinhood, Binance, Kraken, and OKX.

However, exchange availability is only part of the story.

Ripple is positioning the stablecoin for institutional payments, trading collateral, and blockchain-based financial transactions.

We find that development particularly relevant because stablecoins are increasingly being used for purposes beyond ordinary cryptocurrency trading.

For readers following cryptocurrency developments, RLUSD’s growth provides another example of traditional finance exploring digital dollars.

Ripple Receives Approval For A National Trust Bank

Another major announcement came on October 26, when Ripple received final approval from the Office of the Comptroller of the Currency to establish Ripple National Trust Bank.

The federally supervised institution is intended to manage reserves supporting RLUSD and provide certain digital asset custody services.

The approval doesn’t mean Ripple has become a conventional retail bank offering ordinary checking accounts.

Instead, it strengthens the regulatory structure supporting its institutional products.

We think this distinction matters because regulatory oversight is a major consideration for businesses deciding whether to use stablecoins.

Ripple’s ability to combine blockchain technology with established financial controls could make its services more attractive to institutions.

Major Financial Firms Expand Their Ripple Partnerships

Ripple also announced developments involving BNY, Robinhood, and other financial institutions.

BNY is expanding its digital asset custody relationship with Ripple and exploring tokenized trade finance using the XRP Ledger.

Meanwhile, Aviva Investors has introduced a tokenized share class of its sterling liquidity fund on the network.

Ripple’s payments business is also expected to approach $150 billion in cumulative transaction volume by the end of December.

These figures demonstrate the scale of activity Ripple is pursuing, although transaction volume shouldn’t be confused with company revenue.

We are particularly interested in how these partnerships develop beyond their initial announcements.

The real test will be whether institutions use the infrastructure regularly and generate sustainable business.

The growing interest in tokenized financial products is also worth watching across the blockchain industry.

What Does This Mean For Ripple And XRP?

Ripple’s expansion is encouraging for its business, but that doesn’t automatically translate into higher XRP prices.

Company revenue, RLUSD adoption, and demand for XRP are connected in some areas, yet they remain different measures of success.

Some Ripple services can generate revenue without creating equivalent demand for the XRP token.

That’s why we’ll be watching actual transaction activity, institutional adoption, and the role XRP plays in Ripple’s expanding product lineup.

For investors following the wider Bitcoin and crypto market, Ripple’s progress offers another indication that digital asset companies are becoming more integrated with traditional finance.

Reaching a $900 million annualized revenue pace would be a meaningful milestone.

But the more important question is whether Ripple can turn its growing collection of products and partnerships into consistent long-term revenue.

Bitcoin ETFs are experiencing an interesting change in ownership. Some of Wall Street’s biggest trading firms have been reducing their positions, while sovereign wealth funds and wealth managers are quietly increasing theirs.

At first glance, declining institutional holdings might suggest that investors are losing interest in Bitcoin. But the latest research from Galaxy tells a more complicated story.

The investors leaving the market appear to be motivated largely by shrinking trading profits, while other institutions are treating Bitcoin as an investment worth holding through volatility.

We believe the difference between these two groups deserves more attention than the selling figures alone.

TL;DR

• Nine major Wall Street firms reduced their spot Bitcoin ETF exposure by approximately 68,000 BTC between September 2025 and June 2026.
• Sovereign investment funds and wealth managers increased their holdings, with other reporting institutions collectively adding 20,000 BTC.
• Declining profits from Bitcoin futures arbitrage appear to be a major reason behind the institutional selling.

Why Are Major Wall Street Firms Selling Bitcoin ETFs?

According to Galaxy Research, institutions reporting their holdings to the US Securities and Exchange Commission owned approximately 355,000 BTC-equivalent in spot Bitcoin ETFs at the end of September 2025.

By June 2026, that figure had dropped to around 307,000 BTC, a decline of 14%.

However, just nine financial firms accounted for 68,000 BTC in reduced exposure, exceeding the overall institutional decline of 48,000 BTC.

Those firms included Goldman Sachs, Millennium Management, Brevan Howard, and Tudor Investment.

That means the remaining institutional investors collectively increased their exposure rather than following the largest sellers.

For us, this is the most revealing part of the research. Institutional Bitcoin demand hasn’t disappeared; ownership is shifting between different types of investors.

The Trading Strategy Behind The Sell-Off

One reason for the selling involves a strategy known as the cash-and-carry trade.

Instead of purchasing Bitcoin ETFs solely because they expect prices to rise, some hedge funds simultaneously buy spot exposure and sell Bitcoin futures.

The goal is to capture the difference between the two prices while limiting exposure to Bitcoin’s direction.

This strategy becomes less attractive when futures premiums decline.

In Galaxy Research’s analysis, the annualized premium on front-month Bitcoin futures fell from an average of 7.9% before Bitcoin’s October 2025 peak to 4.8% in the 30 days ending October 21, 2026.

That left only a small advantage over short-term US Treasury bills, even before trading expenses.

For some institutions, maintaining the positions simply stopped making financial sense.

We shouldn’t automatically interpret those sales as a negative forecast for Bitcoin’s price.

Sovereign Funds See A Different Opportunity

While trading-focused institutions reduced exposure, several longer-horizon investors moved in the opposite direction.

Morgan Stanley’s wealth management business, Abu Dhabi’s Mubadala, and the Abu Dhabi Investment Council were among the buyers identified in Galaxy’s research.

Across other reporting institutions, approximately 20,000 BTC-equivalent was added during the period.

These purchases suggest that some investors continue to view Bitcoin ETFs as a useful way to gain cryptocurrency exposure through established financial markets.

Sovereign funds and wealth managers can have different investment objectives from hedge funds.

Rather than relying on short-term price differences, they may focus on portfolio diversification and longer-term opportunities.

Of course, institutional purchases don’t guarantee that Bitcoin prices will rise.

Still, we see an important distinction between investors closing a trading strategy and investors abandoning an asset altogether.

Bitcoin ETF Investors Have Held Up Better Than Prices

Galaxy’s research also points to a surprising difference between Bitcoin’s price performance and ETF ownership.

From the October 2025 peak to the July 2026 trough, Bitcoin ETF holdings declined approximately 11%, while Bitcoin’s price fell around 53%.

That suggests ETF investors, as a group, held on to much more of their exposure than the price decline might imply.

The funds have also accumulated approximately 87,000 BTC since Bitcoin’s June low.

We find this especially interesting because the increase occurred while leveraged futures positions were shrinking.

It raises the possibility that recent buying reflects more direct investment demand rather than another wave of arbitrage activity.

For readers tracking Bitcoin news, these ownership patterns offer useful context beyond daily ETF inflow and outflow figures.

What Could This Mean For Bitcoin’s Next Move?

The next round of institutional filings will help determine whether this shift is continuing.

Current comparisons rely on holdings reported through June 2026, so they don’t fully capture how institutions positioned themselves during the third quarter.

We’ll be watching whether sovereign funds and wealth managers continue accumulating while hedge funds remain less active.

A recovery in futures premiums could also bring trading firms back into the market.

However, the larger question is whether Bitcoin ETFs are developing a more stable base of investors.

As we follow developments across the cryptocurrency market and the blockchain industry, we think the changing composition of institutional ownership will be an important trend to monitor.

Bitcoin’s future won’t depend on one category of investor. But understanding who is buying, who is selling, and why can give us a clearer picture of the market.

Bitcoin Core developers have released security updates after an AI-powered code scan uncovered three vulnerabilities, including one that could allow attackers to crash Bitcoin nodes running on Windows and macOS.

The findings were made public on October 28, after developers verified the issues and distributed fixes across supported software versions.

The timing is particularly interesting. Bitcoin Core recently changed its security disclosure policy because artificial intelligence is making certain software weaknesses much easier to discover.

For people operating Bitcoin nodes, the message is straightforward: keeping software updated is becoming more important as vulnerability research accelerates.

TL;DR

• Bitcoin Core disclosed three vulnerabilities discovered through AI-assisted code scanning, including a flaw that could crash nodes running on Windows, macOS, and BSD.
• Security fixes are available in Bitcoin Core versions 29.5, 30.4, 31.2, and 32.1.
• Developers are speeding up vulnerability disclosures as AI tools make previously hidden software weaknesses easier to find.

AI Discovers A Bug That Can Crash Bitcoin Nodes

The most serious concern involves how Bitcoin Core handles certain network connections on operating systems other than Linux.

An attacker connected to a vulnerable node could send specially handled TCP data that causes the software to consume increasing amounts of memory.

Eventually, the affected node could run out of memory and crash.

The vulnerability was discovered on October 23 through Project Loupe, an automated code-scanning initiative developed by Elias Rohrer at Spiral.

Bitcoin Core contributor Gregory Sanders verified the finding before it reached the project’s security team.

According to Bitcoin Core’s official security advisory, the issue affects Windows, macOS, and BSD systems. Linux nodes are not vulnerable to this particular flaw because they use a different mechanism for monitoring network connections.

Importantly, this is a denial-of-service vulnerability. The advisory does not describe an attack that allows someone to steal Bitcoin from a wallet.

Two More Vulnerabilities Raise Questions

The same investigation uncovered two additional weaknesses.

One involved outdated peer connections that could remain open while messages accumulated in memory.

Under certain conditions, this could gradually exhaust a node’s resources and interfere with normal operation.

The third issue concerned the files Bitcoin Core uses to reverse blockchain changes during reorganizations.

An attacker with substantial mining capabilities could theoretically create conditions that corrupt these records and force affected nodes to shut down.

However, developers classified that vulnerability as low severity because exploiting it would require highly impractical circumstances.

The distinction matters. Not every security flaw presents the same level of danger, even when the technical description sounds alarming.

For anyone following Bitcoin developments, these disclosures offer a useful reminder that maintaining the network involves continuous software improvements.

Bitcoin Core Changes How It Reports Security Problems

Perhaps the biggest development isn’t the vulnerabilities themselves, but how quickly they were disclosed.

Previously, Bitcoin Core could keep certain security issues confidential for extended periods, giving node operators time to install fixes before details became public.

That approach becomes less effective when automated tools can independently rediscover the same weaknesses.

Under the updated policy, vulnerabilities considered easy to discover can receive faster patches and public advisories.

We can understand the reasoning. Keeping a flaw secret provides limited protection if someone else can find it with a relatively simple AI-assisted scan.

The challenge is balancing faster disclosures with sufficient testing.

Developers must ensure urgent security updates don’t introduce additional problems.

What Bitcoin Node Operators Should Know

Bitcoin Core has released patched versions 29.5, 30.4, 31.2, and 32.1.

Operators running affected versions should review the official release information and update their software.

There is one important limitation: the fix for the undo-file vulnerability does not fully protect 32-bit systems or nodes storing blockchain data on FAT32 drives.

Those configurations remain exposed to that particular issue.

For exchanges, miners, and businesses relying on Bitcoin infrastructure, software maintenance is an operational priority.

A node that crashes may temporarily stop validating and relaying transactions, potentially disrupting services that depend on it.

The broader blockchain industry faces similar challenges as software systems become more complex.

AI Is Changing The Future Of Crypto Security

AI-assisted security research presents both an opportunity and a challenge.

Developers can examine large codebases more efficiently, identify overlooked problems, and address vulnerabilities before they cause serious damage.

Unfortunately, attackers may benefit from those same capabilities.

That’s why Bitcoin Core’s decision to accelerate disclosures deserves attention.

Rather than assuming that keeping vulnerabilities confidential will always protect users, developers are adapting to a world where finding bugs may become considerably easier.

We’ll be watching how this approach affects future security updates, particularly as more AI-generated reports reach cryptocurrency development teams.

For now, the latest fixes demonstrate that Bitcoin’s security depends not only on its underlying cryptography but also on the people maintaining the software.

As we continue covering cryptocurrency security and industry news, that distinction will remain important.

TLDR

• South Korean exchange Bithumb is investigating a data leak after its in-house mobile work system was hacked.
• The exchange discovered the breach on Tuesday and notified the Korea Internet & Security Agency and the Personal Information Protection Commission the same day.
• Bithumb says the internal system is separate from its trading platform, so customer assets cannot be accessed through this breach.
• The attack is part of a wider wave hitting Korea’s financial sector, with 16 firms targeted as of Oct. 14.

Bithumb’s Internal System Compromised

There are some concerning reports coming out from South Korea. Bithumb is looking into the extent of a data leak that followed a hack of its internal mobile system earlier this week, according to Yonhap News Agency.

This is the platform employees use to communicate and share information at work. Bithumb found the breach on Tuesday and informed both the Korea Internet & Security Agency and the Personal Information Protection Commission on the same day.

Member Data Still in Question

What hasn’t been confirmed yet is whether customer information was actually exposed. Bithumb told Yonhap that it is analyzing the exact scope, including the possibility that member data was involved, and promised an official announcement on Wednesday morning.

The exchange also tried to calm down its users. It stressed that the internal work system is separated from the virtual asset trading system. In its words, that means customer crypto holdings cannot be reached through this breach. This distinction is important, but users still want to see the full findings before drawing firm conclusions.

A Wave of Attacks in South Korea

Bithumb is far from alone. This incident adds to a growing run of cyberattacks across the country’s financial industry. Financial Supervisory Authority Governor Lee Chan-jin said at a Wednesday meeting that 16 South Korean financial firms had been hit as of Oct. 14.

Other recent victims include Daishin Securities and Mirae Asset Global Investments, according to The Korea Times. Daishin said personal and credit information belonging to 38,490 customers had leaked. Mirae Asset said it blocked abnormal external access to some web systems and is investigating, adding that investor information was not affected.

However, these patterns of attacks are starting to worry the entire industry. When attackers hit the human side of the company, such its communication tools, the trust is what takes the hit.

TLDR

• Bitcoin climbed to $81,687 on Wednesday, with bid liquidity thickening around $79,000 and $80,000.
• South Korea’s KOSPI jumped 6.63% as tech stocks rebounded from earlier October losses.
• Morgan Stanley’s Mike Wilson says most of the market correction is already over.
• Analyst Rekt Capital compares Bitcoin’s weekly chart to 2022, and $82,000 remains the key resistance.

Bitcoin Rebounds Toward $82K

Bitcoin pushed higher on Wednesday, reaching $81,687 on Bitstamp, according to TradingView data. The move extended an intraday rebound, and the pair avoided printing new lower lows on the hourly chart.

CoinGlass data shows bid liquidity building around $79,000 and $80,000 which can suggest that buyers are stepping in to defend the psychological $80,000 level after repeated dips below it. Still, resistance near $82,000 has held firm for now.

Tech Stocks Fuel the Relief

I think the broader market deserves credit for this bounce. Nerves over AI spending and debt financing eased, and crypto strengthened gradually alongside equities.

South Korea’s KOSPI Composite Index closed 6.6% higher, returning above 6,000 points for the first time since Oct. 14. That puts its week-to-date gain at 9.3%. In the US, the Nasdaq Composite closed up 1.1% on Tuesday ahead of earnings from Microsoft, Alphabet, Amazon and Intel, with Samsung due to report on Thursday.

Morgan Stanley Says the Worst Is Over

Morgan Stanley chief US equity strategist Mike Wilson told CNBC he sees tech entering a new bullish phase. He argued the market has been correcting for four or five months and has digested the pullback efficiently.

His view is somewhat encouraging for risk assets in general, though it is only one strategist’s opinion. On the macro front, the markets are expecting the Fed to hold rates at its Wednesday meeting. CME Group’s FedWatch tool shows 90.6% odds of rates staying in the 3.75-4% range.

However, not everyone is convinced the rebound will last. Crypto analyst Rekt Capital drew fresh comparisons to the 2022 bear market after Bitcoin’s repeated dips under $80,000.

He pointed out that the weekly chart looks like 2022’s structure, and it remains unclear whether BTC can build a new range above the $82,000 resistance. He also said the pair has not yet discarded its macro accumulation range between $60,000 and $80,000 but $82,000 is a level that matters. A clean break could confirm the bulls’ case, while a rejection would keep the cautious 2022 comparison very much alive.