Tomas RADA

The $6.3 billion hack of Binance on Thursday has forced a technical and ethical showdown between U.S. law enforcement and the decentralized infrastructure of THORChain [2][3]. As the TraderTraitor group, linked to North Korea’s Lazarus Group, moves millions of dollars through cross-chain bridges, the FBI has issued a direct plea to the 100 nodes that power the THORChain network [2]. The agency wants these operators to block transactions from a specific list of 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address [3].
The tension lies in how THORChain is built. Unlike a centralized exchange that can flip a switch to freeze an account, THORChain is a collection of independent node operators. According to developer Chad Barraford, about 50 individuals run these 100 nodes [2]. For the FBI’s request to become reality, a "one-third plus one" majority of these operators would have to vote to halt activity or implement a blocklist [2]. So far, the protocol has maintained a stance of neutrality.
The Mechanics of the Move
The scale of the laundering attempt is massive. On the Tron blockchain alone, hackers took approximately $628 million [3]. While Tether managed to freeze 378.7 million USDT on that network, the attackers still had roughly $249 million to move [3]. They didn't waste time. Within two days, $242 million was laundered through various bridges [3].
Relay handled the largest portion of these outflows at $48 million [3]. THORChain followed with $44 million, while Chainflip and Symbiosis processed $32.1 million and $16 million respectively [3]. The goal for these attackers is usually to convert stolen assets into Ethereum or Bitcoin to make them harder to track or claw back [3]. Onchain data shows the attackers sent 185.1 million TRX and 3.83 million USDT into THORChain across 2,697 deposits [3]. In return, the protocol paid out 17,019 ETH and 53.25 BTC to various addresses [3].
A Bug Saves the Day
In a strange twist of timing, a technical flaw did what the FBI could not: it stopped the hackers in their tracks. On Saturday at 11:34 UTC, a one-block reorganization on the Ethereum network triggered a bug in THORChain’s code [1]. An Ethereum reorg happens when the network replaces a recent block with a competing one. In this case, a 10 ETH deposit that THORChain had already credited was removed by the network [1].
When the swap failed to meet its price limit, the THORChain vault issued a refund for funds it never actually received [1]. Because the sender’s original deposit was also eventually refunded, it resulted in an extra 10 ETH payout. This mismatch triggered an automatic safety pause [1]. This "refund bug" effectively froze swaps involving assets on 10 different networks, including Bitcoin, Ethereum, Solana, and Tron [1].
Chainalysis noted that this emergency pause inadvertently delayed the movement of a significant amount of the Binance loot [1]. Until the nodes decide to re-enable these chains, the hackers are stuck. As of Sunday afternoon, trading from Tron remained halted [3].
The Philosophy of Permissionless
The refusal to cooperate with law enforcement isn't just about technical difficulty; it is a matter of ideology for the people who built the protocol. John-Paul Thorbjornsen, the founder of THORChain, has been vocal about the risks of giving in to external pressure. He argued that if node operators decide to take the protocol offline or start filtering transactions because of government requests, the "experiment is over" [1][2].
From this perspective, THORChain is a neutral settlement layer. If it stops being neutral for one group, it ceases to be decentralized. Thorbjornsen warned that if the nodes comply, it would mean the end of the "last bastion of unencumbered and neutral settlement" [1]. However, this stance comes with high stakes. Given the $6.3 billion scale of the theft and the involvement of the FBI, Secret Service, and IRS, there is open speculation that node operators could face individual prosecution if they continue to facilitate the movement of these funds [2].
Bridge Risks and Slippage
While THORChain and Relay are the primary venues, the hackers are paying a high price for their exit. SomaXBT reported that the attackers lost about 12% of their funds to fees and slippage during the laundering process [3]. Additionally, front-end interfaces for these protocols earned approximately 145,800 RUNE, worth about $95,000, in affiliate fees from the hacker's volume [3].
The use of Relay is particularly notable because the protocol claims to screen addresses using third-party risk data from firms like Chainalysis [3]. Despite this, one Ethereum address managed to receive 2,804 ETH and 1.02 million USDT from Relay’s router in just 80 minutes on Saturday [3]. This suggests that "permissionless" infrastructure often moves faster than the blocklists intended to secure it.
The markets have reacted to the sheer volume of assets being shuffled. Bitcoin dropped 3% to $77,745, and Ethereum fell 3.5% to $2,260 by the end of the week [2]. There is a lingering concern that if the 18,000 BTC and 430,000 ETH currently held by the attackers are dumped onto the market quickly, prices could see significant downward pressure [2].
Sources
1. Cointelegraph, THORChain halts swaps after block reorg bug, slowing Binance hackers, https://cointelegraph.com/news/thorchain-halts-swaps-after-block-reorg-bug-slowing-binance-hackers
2. Cointelegraph Magazine, 36b flees Binance on reopen, THORChain co-founder opposes coin freeze: Hodler’s Digest, https://cointelegraph.com/magazine/36b-flees-binance-on-reopen-thorchain-co-founder-opposes-coin-freeze-hodlers-digest
3. The Block, North Korean hackers launder $242 million of Binance loot via Tron as FBI presses THORChain: analyst, https://www.theblock.co/news/defi/2026-11-01-north-korean-hackers-launder-242-million-of-binance-loot-via-tron-as-fbi-presses-thorchain-analyst-432257
Charts and the full source list: https://medium.com/@tomasrada8080/the-decentralization-dilemma-thorchains-stand-against-the-fbi-6caf2a73fd08

The Depository Trust & Clearing Corporation (DTCC) is the invisible plumbing of the American financial system. Most people never interact with it, but it holds $114 trillion in securities under custody through its subsidiaries [1]. On Wednesday, October 28, 2026, this giant officially went live with its tokenization service, moving a massive portion of the $30 trillion U.S. securities market toward blockchain infrastructure [1].
This is not a small experiment by a startup. This is the central clearinghouse for U.S. stocks and bonds creating a bridge. The DTCC Tokenization Service (DTS) allows eligible firms to convert traditional securities into tokens. These tokens are backed one-for-one by the actual assets held at the Depository Trust Company (DTC) [1]. Unlike synthetic tokens that just track a price, these represent real ownership, preserving the same investor protections and rights as the original shares [2].
The rollout follows a pilot program from July 2026 and a demonstration earlier this year [2]. It rests on a regulatory foundation from December 2025, when the SEC issued a no-action letter essentially giving the green light for this specific tokenization program [2].
Institutional adoption
Twenty major financial firms have already signed agreements to use the service. The list includes names like JPMorgan, Citi, Morgan Stanley, Bank of America, UBS, and Fidelity Investments [1]. Other participants include Citadel Securities, State Street, Barclays, and Alpaca [2].
These firms can now convert securities into tokens during standard business hours. The DTCC is targeting a processing time of 15 minutes or less for these conversions [1]. Once the assets are in token form, they can move between registered blockchain wallets 24/7 [1]. This effectively breaks the traditional "9-to-5" constraint of the stock market for these specific assets, allowing for around-the-clock transfers and collateral management.
Analysts at Citi have projected that tokenized securities could become a $5.5 trillion market by 2030 [1]. The DTCC's move is a step toward making that projection a reality by providing the standardized infrastructure that big banks require before they commit serious capital to a new technology.
Network infrastructure
The service is currently live on two specific networks: the Canton Network and a private version of Ethereum called Besu [1]. These are permissioned environments, meaning they aren't open to the public like a standard DeFi protocol. They are designed to meet the strict compliance and privacy needs of Wall Street.
However, the road map is expanding. The DTCC plans to integrate with the Stellar network and Arc in 2027 [1]. This suggests a move toward broader interoperability over time. The goal is to make blockchain technology a part of the mainstream market infrastructure rather than a separate, siloed system [1].
The infrastructure also aims to solve the "cash leg" of the transaction. In 2027, the DTCC plans to add tools for settling these transactions using digital cash and using the tokenized securities themselves as collateral [1]. This would allow a bank to move a stock token and receive a digital payment token simultaneously, reducing the risk that one side of the trade fails.
Corporate treasury shifts
While the DTCC builds the rails for stocks and bonds, large corporations are already moving toward tokenized money. A survey by DBS and EY of 422 finance leaders at companies with over $500 million in revenue found that 88% are either using or piloting tokenized money [3].
Stablecoins are the most popular instrument in this category, with 63% of these large businesses using or planning to use them [3]. Tokenized deposits follow at 53%, and tokenized money market funds at 52% [3]. The primary drivers here are speed and traceability. About 71% of these leaders expect real-time cross-border payments within two years [3].
Some of this is already happening at scale. Citi reported that hundreds of its clients move nearly $1 billion daily through its own token services to manage liquidity [3]. In September, DBS and Citi completed a dollar payment between Singapore and New York using tokenized deposits that settled in minutes over a weekend [3]. This type of efficiency is what the DTCC is now trying to bring to the much larger world of equities and treasuries.
Future market structure
The DTCC is not the only legacy player moving in this direction. Nasdaq and the New York Stock Exchange (NYSE) are also developing their own tokenized securities infrastructure [1]. The Intercontinental Exchange (ICE), which owns the NYSE, is working on a blockchain-based trading venue under an SEC innovation exemption in partnership with the exchange OKX [1].
The shift toward "issuer-sponsored" models is also gaining traction. In these models, the token itself is the share, which preserves full rights and control for the company issuing the stock [1]. This removes the need for a separate digital representation of a paper asset.
As more assets move onchain, the distinction between "crypto" and "traditional finance" continues to blur. The DTCC’s current system handles clearing and settlement for a massive portion of global trading. By moving these functions to a distributed ledger, they are betting that the future of the $114 trillion in assets they hold will eventually be digital. The next major milestone for this project is the planned expansion to additional blockchain networks like Stellar in 2027 [1].
Sources
1. CoinDesk, Wall Street backbone DTCC brings $30 trillion securities closer to blockchain with major banks, https://www.coindesk.com/business/2026/10/28/wall-street-backbone-dtcc-brings-usd30-trillion-securities-closer-to-blockchain-with-major-banks
2. Cointelegraph, DTCC unit launches tokenization services, https://cointelegraph.com/news/dtcc-subsidiary-launches-tokenization-services
3. CoinDesk, Nearly 90% of large businesses are embracing tokenized cash to speed up payments: DBS, https://www.coindesk.com/business/2026/10/28/nearly-90-of-large-businesses-are-embracing-tokenized-cash-to-speed-up-payments-dbs
Charts and the full source list: https://medium.com/@tomasrada8080/wall-streets-30-trillion-leap-dtcc-launches-tokenization-rails-5bd1c13350c4

National trust charter
Ripple has received final approval from the Office of the Comptroller of the Currency (OCC) to launch the Ripple National Trust Bank (RNTB). This move transitions the company from a state-regulated fintech into a federally supervised banking entity. The application process began in July 2025, followed by conditional approval in December 2025. With this final sign-off, Ripple joins a small group of crypto firms, including Circle and BitGo, that have successfully brought their operations under the direct oversight of the primary regulator for U.S. national banks.
The bank is not a full-service commercial institution; it does not take deposits or issue loans. Instead, it operates under a specialized national trust charter focused on fiduciary activities. Its primary mandate is to manage the reserves for Ripple’s stablecoin, RLUSD, and provide digital asset custody for institutional clients. This structure creates a split regulatory model where the New York-regulated unit, Standard Custody & Trust Company, continues to issue the stablecoin, while the federal bank manages the assets backing it.
Federal oversight of reserves
The launch of RNTB places the management of RLUSD reserves under the scrutiny of the OCC. Since its debut in December 2024, RLUSD has grown to a market capitalization of approximately $2.5 billion. It currently ranks among the top 50 stablecoins globally. The asset is backed by a mix of U.S. dollar deposits, U.S. government securities, and other cash-like instruments. BNY currently holds the majority of these reserves.
By moving reserve management to a national trust bank, Ripple is attempting to satisfy the requirements of large-scale institutions that demand federal-level accountability. The bank will act as a trustee, meaning it has a legal obligation to manage the collateral specifically for the benefit of RLUSD holders. This setup is intended to provide a layer of protection that mirrors traditional financial trust structures. This oversight arrives as the U.S. prepares to implement new stablecoin regulations under the GENIUS Act, which Ripple has indicated it will follow in coordination with the OCC and New York regulators.
Institutional custody and payments
Beyond stablecoin reserves, the new bank is authorized to provide fiduciary custody services. This allows the bank to hold digital assets for large corporations and financial institutions engaged in trading, treasury management, and payments. Ripple’s existing business model relies heavily on its payments infrastructure and Ripple Prime, where RLUSD is used as collateral. The company also continues to use $XRP , the fifth-largest digital asset by market cap, to facilitate cross-border transactions.
The goal of the national charter is to bridge the gap between blockchain-native assets and the traditional financial system. For years, the argument from leadership has been that for crypto to scale, it must reside within a regulated framework that banks can trust. The RNTB provides that framework by offering a federally regulated entry point for institutions that were previously hesitant to interact with state-chartered or unregulated entities.
Tokenization on the XRP Ledger
While Ripple secures its banking infrastructure in the U.S., its technology is being applied to traditional fund management in the UK. Aviva Investors recently launched a tokenized share class of its £22 billion ($29.4 billion) Sterling Liquidity Fund on the XRP Ledger. This follows a similar launch of a U.S. dollar liquidity fund share class in July. Aviva has invested £50 million ($66.7 million) into this new sterling offering, bringing its total investment across tokenized money market funds to over £86 million ($114.8 million).
The fund uses a digital twin model. The actual fund operations remain offchain, but investors' holdings are represented on the XRP Ledger. This project involves several traditional and crypto-native partners, with BNY holding the fund’s assets and Komainu and Licuido providing infrastructure support. The tokenized shares maintain the same risk profile and regulatory protections as the traditional fund, which has been active since 2002. This integration shows how the underlying ledger is being used for real-world asset (RWA) tokenization alongside the development of Ripple’s new banking entity.
Political and regulatory friction
The expansion of national trust charters to crypto firms has not been without pushback. Some lawmakers, including Senator Elizabeth Warren, have criticized the OCC for granting these approvals, suggesting they might violate the National Bank Act. Critics argue that allowing crypto firms into the federal banking system poses risks to financial stability. Conversely, industry groups like The Digital Chamber have defended the move, noting that these charters are limited in scope and that firms are voluntarily choosing to submit to stricter federal supervision rather than avoiding it.
In other regions, the intersection of crypto and state policy is even more contentious. In Israel, the central bank recently rejected a suggestion by Prime Minister Benjamin Netanyahu to use blockchain networks to bypass potential international sanctions. The Bank of Israel stated that digital currencies cannot be used to circumvent sanctions because public blockchains are transparent and traceable. This highlights the ongoing tension between the perceived anonymity of crypto and the reality of public ledger forensics, which Israel itself has used to seize 24 million shekels from sanctioned wallets.
Sources
1. CoinDesk, Ripple gets a final go-ahead to launch its own U.S. national trust bank, https://www.coindesk.com/markets/2026/10/27/ripple-gets-a-final-go-ahead-to-launch-its-own-u-s-national-trust-bank
2. The Block, Ripple gains final OCC approval to launch national trust bank and bring RLUSD under federal oversight, https://www.theblock.co/news/regulation/2026-10-26-ripple-gains-final-occ-approval-rlusd-431810
3. The Block, Aviva Investors, Ripple launch tokenized share class of $29 billion sterling fund on XRP Ledger, https://www.theblock.co/news/business/2026-10-26-aviva-investors-ripple-tokenized-share-class-sterling-fund-xrp-ledger-431712
4. Decrypt, Israel's central bank rebukes Netanyahu plan to use crypto to dodge sanctions, https://decrypt.co/381789/israels-central-bank-rebukes-netanyahu-plan-to-use-crypto-to-dodge-sanctions
Does having a federal bank charter make you more likely to trust a stablecoin over one that is only state-regulated?
Charts and the full source list: https://medium.com/@tomasrada8080/ripples-federal-leap-the-launch-of-a-u-s-national-trust-bank-3b022eef1674

The promise of privacy in the hardware wallet industry often hits a wall when it meets the reality of e-commerce. Keystone, a manufacturer known for its air-gapped security, recently confirmed a breach that exposes the gap between marketing claims and data retention practices. On October 20, the company detected suspicious activity on its website. By October 23, after reviewing API activity with Shopify, it confirmed that an unauthorized third party had accessed customer names, contact details, shipping addresses, and order specifics [1][2].
Keystone has not yet disclosed the total number of affected customers [1]. While the company maintains that private keys, recovery phrases, and payment card details remain safe, the leak of physical addresses creates a specific type of vulnerability for crypto holders. When an attacker knows exactly where a person lives and what specific security hardware they purchased, the threat shifts from digital phishing to physical confrontation.
The 180 Day Promise
For nearly two years, Keystone used its data retention policy as a competitive advantage. In January 2024, the company posted on X that shipping data is permanently deleted 180 days after an order [2]. They doubled down on this in March and August, claiming they delete info in "180 days max" while other manufacturers keep it forever [2]. The company's Privacy Promise page even states that this deletion is automatic [2].
The breach has revealed that this automation might not be as absolute as advertised. Since the news broke, several customers have reported receiving breach notifications despite their orders being significantly older than the 180-day window. One user, trintaetres, noted they received a notification for a device purchased over two years ago [1]. Another customer, BlockchainBarmy, pointed out that 214 days had passed since their last order [2].
The discrepancy suggests a failure in the data purging process. Keystone’s own help center articles note that while they intend to delete data, the final process is handled by Shopify, and records of a customer's city and country are explicitly not deleted [2]. This technical nuance means that even if a full street address is removed, a database of crypto-heavy households by city still exists.
Physical Security and Wrench Attacks
The primary concern for the security community isn't just a leaked email address. It is the "wrench attack," a term for physical violence or threats used to force a holder to surrender their assets. CertiK recorded 52 verified wrench attacks globally in the first half of 2024, which is a 33% increase from the 39 attacks recorded during the same period in 2023 [1].
When shipping data leaks, it essentially provides a map for these types of crimes. Scammers are already using the Keystone data to build credibility. One user, OG DEGEN, reported receiving a call from someone posing as law enforcement investigating fraud [1]. The caller had specific details from a 2024 Keystone order, which they used to try and convince the user that their private keys were exposed, likely as a lead-in to a phishing link [1].
Another user reported a call from a spoofed Montreal police number [2]. The caller specifically asked if the names "Amazon, eBay or Keystone" meant anything to the victim [2]. This suggests that attackers are cross-referencing the leaked Keystone data with other databases to create a highly personalized profile for social engineering.
Patterns of Failure
Keystone is not an isolated case. The hardware wallet industry has struggled with e-commerce security throughout 2024. In August, Trezor disclosed that a breach at its shipping partner, ShipMonk, exposed data for nearly 14,000 customers [2]. Later, that number jumped by another 67,000 U.S. customers after it was discovered that ShipMonk had given written assurances of data deletion that were not actually followed [2].
SafePal also faced a similar issue in August when a flaw in its order-tracking system exposed the personal information of approximately 40,000 customers [2]. Even Ledger, which faced a massive data leak years ago, was in the news recently because resellers were found selling devices with hardware implants designed to capture recovery phrases [2].
The recurring theme is that while the hardware itself might be air-gapped and secure, the business of selling that hardware relies on centralized, third-party platforms like Shopify or Global-e. These platforms are built for convenience and tracking, which is the exact opposite of the privacy many crypto users expect. Keystone’s privacy policy, last updated in May 2021, states it erases order info for customers who haven't ordered in 180 days, but the reality of the Shopify API suggests that "deletion" is a complicated term in a SaaS environment [2].
Technical Vulnerabilities and Disclosure
Keystone has blocked the unauthorized access and fixed the vulnerability that allowed the third party in [1]. However, the company has not yet explained how the attacker bypassed their systems or why the data was still there to be stolen in the first place. They have promised a detailed report in the coming days [2].
In the meantime, the advice for affected users is to be on high alert for physical mail, texts, and calls. Scammers may offer "replacement" devices or "fixes" for the breach, which are almost certainly attempts to get users to enter their recovery phrases into compromised hardware [2].
The industry is currently grappling with the fact that shipping a physical product requires a physical address, creating a permanent paper trail. Some users have suggested using PO boxes or office addresses to mitigate this, but for the thousands already in the Keystone database, that ship has sailed. The company confirmed the breach on October 23, 2024 [2].
Sources
1. Cointelegraph, Keystone says website breach exposed hardware wallet buyers’ addresses, https://cointelegraph.com/news/keystone-says-website-breach-exposed-hardware-wallet-buyers-addresses
2. The Block, Keystone customers say breach exposed data the hardware wallet maker promised to delete, https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613
Charts and the full source list: https://medium.com/@tomasrada8080/the-keystone-breach-when-deleted-data-reappears-5a562aad577f