InsideBitcoins

Bitcoin Core merged a rule change on Oct. 22 that opens a faster lane for vulnerability fixes: a flaw judged easy for attackers to find again can now be patched across every maintained release line at once, with an advisory published as each fix lands. The change comes as a network snapshot from the Karlsruhe Institute of Technology (KIT) shows 43.6% of sampled public Bitcoin Core peers running versions that no longer receive patches.
Under the new rule, developers can classify a flaw at triage, judging how readily it can be turned up again, including with the help of large language models. Bitcoin Core developer Antoine Poinsot announced the change on the bitcoindev mailing list in the merged pull request updating the project’s security policy. He argued the old embargo achieves little while it delays the availability of a fixed release. The trade-off he flagged is that mitigations get less time to prove themselves on development branches. As of Oct. 23, the new category had not yet been applied publicly to any specific bug.
The change ends a policy that held medium- and high-severity bug details until two weeks past the end of life of the last affected release, a span that could stretch close to a year. Embargo, the period during which vulnerability details stay withheld until fixed releases are widely deployed, has relied on bugs being hard to rediscover. AI tools weaken that assumption, so long silences now delay fixes more than they protect operators.
How the old policy played out
The project’s practice is visible in the disclosure of CVE-2024-52911. The high-severity use-after-free in block validation, which affected versions later than 0.14.0 and earlier than 29.0 and let a crafted invalid block crash a node, was reported in November 2024, fixed in 29.0 in April 2025 and disclosed on May 5, 2026, about 388 days after the fix. The pattern continues: the 32.0 release notes state that three medium- or high-severity flaws corrected in version 30.0 stay under wraps until two weeks after the new version ships.
The unsupported share
Bitcoin Core maintains only its three newest major release lines, currently 29.x, 30.x and 31.x. The KIT snapshot from Oct. 18 counted 3,671 of 8,422 self-reported Bitcoin Core peers on lines already past end of life, with the rest on 31.x (3,243), 30.x (712) and 29.x (635). The count covers public IPv4 and IPv6 peers only, so Tor-only nodes, non-listening nodes and privately run exchange, custodian and miner infrastructure fall outside it. Readers who want the basics can start with what crypto nodes are and how they work.
The share is set to grow. When version 32.0 ships, 29.x leaves the maintenance window, and a projection from the snapshot puts 4,306 of the 8,422 peers, or 51.1%, on unsupported lines if the sample stayed unchanged. The project’s life cycle page still listed the 32.0 release date as TBA as of Oct. 24, with only release candidates in the download directory.
Core 32.0 also switches the default partially signed Bitcoin transaction format from version 0 to version 2, which matters for multisig setups mixing old and new nodes. Because Bitcoin has no central authority to force upgrades, network security depends on operators choosing to update.

SoFi’s Fifth Crypto Product in a Year Pays 4.40% APY
SoFi launched SoFi Earn (SOFIE) on October 22, a tokenized bank deposit that pays a 4.40% APY and carries FDIC protection, the company said in a post on X. SoFi called it the first-ever bank deposit token for SoFi Crypto.
Meet SoFi Earn (SOFIE), with 4.40% APY* and FDIC protection.^
It's the first-ever bank deposit token for SoFi Crypto, designed to provide a home for idle crypto funds, like stablecoins. Buy and hold SOFIE to earn interest and protect your deposit.
Learn more about SoFi Earn… pic.twitter.com/kgw1i1vTtU
— SoFi (@SoFi) October 22, 2026
Each SOFIE token stands for $1 held on deposit at SoFi Bank. For on-chain use, holders swap the token at a one-to-one rate for SoFiUSD, the bank’s stablecoin. Chief executive Anthony Noto said the product combines “the earning power and protections of a bank deposit with the speed and utility of digital assets.”
The launch is the fifth crypto product SoFi has rolled out in under a year. SoFi reportedly resumed retail crypto trading in late 2025 after pulling out of that line earlier, which the bank says made it the first U.S. bank with a national charter to serve retail crypto customers. Its SoFiUSD stablecoin, issued on Ethereum and Solana, reportedly settles the bank’s card program over Mastercard’s network, and SoFi Crypto reportedly offers trading in more than 40 tokens. SoFi is also not the only fintech heading to the banking regulator: Ramp has applied to the OCC for a national trust bank charter to custody digital assets.
The pitch targets money sitting still. SoFi pointed to Federal Reserve research it cited at launch putting roughly $64 billion in stablecoins, about one-fifth of that market, in wallets no one touches anymore. Ordinary stablecoins pay no interest and carry no deposit insurance, while SOFIE offers both. SoFi has not said which blockchain SOFIE is issued on.
SoFi lists the 4.40% APY as a promotional rate, meaning it can change.

Sen. Richard Blumenthal is demanding records from Tether over reported multimillion-dollar payments to a consulting firm co-founded by Bo Hines, the White House’s former top crypto adviser.
Blumenthal, the ranking Democrat on the Senate Permanent Subcommittee on Investigations, said Thursday he had sent letters to Tether CEO Paolo Ardoino and to Nxum, the consulting firm Hines started with his father, in a press release from his office. The letters request records and information related to contracts, payments, communications and lobbying between Tether and Nxum. A third letter reportedly went to Hines himself.
The inquiry targets payments Blumenthal’s letter describes as exceeding $6 million, reportedly under a strategic communications arrangement that began weeks after Hines took office. Hines led the President’s Council of Advisers on Digital Assets from January to August 2025, then joined Tether as a strategic adviser and later became chief executive of Tether US. During his White House tenure he helped steer the GENIUS Act, the first federal framework for stablecoins, through Congress, and Tether launched its US-based stablecoin USAT under the new law.
“Tether’s alleged multimillion-dollar payment to a firm controlled by the White House official primarily responsible for cryptocurrency policy implicates federal ethics, anticorruption, and lobbying laws,” Blumenthal said in the letter.
Tether pushed back. A company spokesperson said Tether is aware of the allegations that form the basis of the senator’s letter, and that “external counsel previously conducted an in-depth internal investigation into the matter, which found no evidence of wrongdoing.” The company, which issues the world’s largest stablecoin, said it was still reviewing the letter.
It is the senator’s second move against Tether in a month. Last month his office released findings that Tether had become central in Iran’s shadow banking system and the financing activities of terrorist groups, which Tether disputed at the time, saying it helps authorities find bad actors. The new letter is an inquiry and does not establish that Tether, Hines or Nxum acted unlawfully.

Ethereum has postponed the Glamsterdam upgrade on the Hoodi testnet, pulling a planned 200 million gas-limit test scheduled for October 26 off the calendar.
Core developers agreed at ACDE #248, their regular execution-layer call on October 22, to delay the activation while they investigate how EIP-8037 interacts with mainnet smart contracts. The Ethereum Foundation said the postponement supersedes the schedule and activation instructions in the earlier testnet announcement.
The delay removes three things at once: the Amsterdam activation on the execution layer, the Gloas activation on the consensus layer, and the gas-limit schedule that would have raised Hoodi’s limit to 200M at the same epoch. That gas test was the point of the exercise. Hoodi, Ethereum’s rehearsal testnet, was meant to validate a reportedly roughly 3.3x capacity increase ahead of Glamsterdam, a raise developers had been weighing as the network’s next scaling step. With the activation pulled, that validation slips until the EIP-8037 work is done.
For the scaling roadmap the practical consequence is timing. Glamsterdam’s mainnet schedule was never tied to a fixed date, and the Foundation said this announcement does not set a Glamsterdam mainnet activation date, so no deadline has formally moved. What has moved is the evidence base: the 200M gas limit now has no test run scheduled, and no replacement date exists yet for Hoodi.
The change is procedural on the testnet itself. The Foundation said the move rolls back Hoodi’s configuration for a future upgrade and does not revert the chain’s history. Client releases tagged for the original activation, including Lodestar v1.50.1, Besu 26.10.1 and Nethermind 2.2.1, now belong to a superseded schedule.
No action is required from Ethereum mainnet users or ETH holders, the Foundation said. The delay concerns the Hoodi testnet only.

Ramp has applied to the Office of the Comptroller of the Currency for a national trust bank charter to custody digital assets, the company said.
The New York-based spend-management fintech reportedly filed the application on October 16 for a new entity called Ramp National Trust Bank. The proposed bank would focus on fiduciary investment management and custody services for digital assets. Ramp said the new entity “will not take deposits or make commercial loans” , keeping it inside the narrow lane carved out for crypto custody regulation rather than the full banking system. The company said the charter would put it under a consistent federal regulatory framework.
The charter Ramp is seeking allows fiduciary activities such as custody and investment management, but not deposit-taking or commercial lending. That structure has become the preferred entry point for crypto-adjacent firms. The OCC’s trust charters granted to crypto firms include Stripe-owned Bridge, which won conditional approval for a national trust bank charter in February, and Circle, which received final approval in July for First National Digital Currency Bank. Others have fared worse. The OCC rejected Wise’s trust bank bid in July, citing compliance and money laundering concerns, while Revolut took a broader path, securing conditional approval for a full national bank charter in September that still requires steps with the FDIC and the Federal Reserve.
Ramp brings unusual scale to the queue. The company, valued at $60 billion in its latest funding round and carrying an annualized revenue run rate of about $2 billion, serves more than 85,000 teams, according to figures the company has given to press. It was valued at $8.1 billion after a $750 million funding round in 2022.
The application also lands in contested territory. On October 2, the Independent Community Bankers of America sued the OCC in federal court in Washington over the limited trust charters it has granted crypto firms. Rebeca Romero Rainey, the trade group’s chief executive, said Congress did not create the charter as “a side door into the banking system for crypto firms” .
The OCC has not disclosed a review timeline for the application. More than 30 companies applied to become US banks in 2025, among them Interactive Brokers and PayPal, according to consulting firm Klaros Group.

France’s National Assembly has voted 38 to 37, with 25 abstentions, to end the tax deferral French crypto investors currently enjoy when swapping cryptocurrency for stablecoins, a step that would bring those trades under the country’s 31.4% capital gains levy from Jan. 1, 2027.
The vote on Oct. 16 adopted amendment I-3898 to the 2027 budget bill, according to the Assembly’s roll-call for the vote. It advances a proposal the Assembly’s finance committee approved earlier in the budget process.
Under current French tax rules, exchanges of one cryptocurrency for another without an additional cash payment generally do not trigger a taxable event. Tax is deferred until the investor sells into fiat. The amendment removes that deferral when investors receive e-money tokens, the stablecoin category defined by the EU’s Markets in Crypto-Assets framework. It also drops France’s portfolio-wide method for working out capital gains: the cost of each asset actually sold would be figured individually, using the average of the prices the investor paid for the units offloaded.
The change is not law yet. It remains subject to the budget’s remaining parliamentary stages, where it could still be amended or removed. Public Accounts Minister David Amiel raised questions about how the measure would work and asked for it to be withdrawn. “We first need to define stablecoins, then ensure our ability to monitor and trace reallocations within a portfolio of assets,” Amiel said in remarks to the Assembly. Finance committee rapporteur general Philippe Juvin spoke for keeping the deferral, arguing crypto’s swings in value made it necessary.
Francois Volpoet, Chainalysis’ regional sales director for France, warned the measure risks pushing French investors toward on-chain protocols, trades settled directly between wallets, and platforms in countries that sit outside the international system for sharing tax information.
The proposal would make France one of the first major EU countries to treat crypto-to-stablecoin swaps as taxable disposals, a change that lands as EU regulators tighten their grip on non-compliant stablecoins across the bloc.

Index provider MSCI has adopted eligibility rules that could push Strategy and Metaplanet out of its global equity indexes from Nov. 30, and the question now is how much passive money would actually have to leave the stocks.
MSCI said in its announcement that companies qualifying as non-operating businesses, meaning those whose assets are primarily held for investment rather than used in an operating company, will be ineligible for its Global Investable Market Indexes. The screen first checks whether a company has substantial operating assets. It then applies five financial ratios covering expenses, cash flow, asset value changes and reliance on outside financing, and failing the asset test plus at least four of the five makes a company ineligible.
Existing constituents generally leave the indexes only if they fail the screen in each of their two most recent annual filing periods. MSCI said buffers on the thresholds and on removal timing will limit turnover, and it may use the most recent interim filing when one is available.
The $2.8 billion question
Analysts at JPMorgan estimated that an MSCI exclusion could trigger about $2.8 billion in outflows from Strategy stock. That figure addressed MSCI’s earlier digital-asset proposal, not the rules adopted Oct. 15, so it does not directly measure the impact of the final methodology.
Strategy argued in August that the hit would be smaller. The company said funds tracking the indexes hold roughly 13 million of its shares, about 3.1% of basic shares outstanding and less than one day’s trading volume. Any selling would come from index-tracking funds adjusting portfolios to match index composition, not from Strategy selling its bitcoin.
Strategy also pushed back on the methodology itself. In a September letter to MSCI it wrote, “If adopted, the proposal would have no meaningful impact on Strategy’s business, but it would profoundly harm MSCI’s reputation as a reliable and neutral index provider.” Executive Chairman Michael Saylor and CEO Phong Le called MSCI’s approach discriminatory against digital asset treasuries earlier this year.
MSTR closed at $151.29 on Thursday, down about 72% from its record high of $543 in November 2024. The stock fell as much as 4.3% in after-hours trading after the announcement before recovering, and stood down 1.5% in extended trading. Strategy holds 848,250 BTC worth about $69.67 billion as of mid-October. Tokyo-listed Metaplanet closed at 277 yen ($1.75) on Friday, down from a June 2025 peak of 1,930 yen.
Approval of the rules does not by itself remove any company. MSCI will publish the final list of affected companies on Nov. 11.

Richard Heart, founder of the Hex and PulseChain tokens, was reportedly detained in Istanbul alongside his wife on an Interpol Red Notice requested by Finland, Turkish media reported.
Turkish news agency IHA and the newspaper Daily Sabah said police detained Heart, whose legal name is Richard James Schueler, in the Beşiktaş district on Wednesday morning at a residence officers had been monitoring. Turkey’s National Intelligence Organization, MİT, supported the operation by Istanbul police’s intelligence and financial-crimes units, which IHA said was coordinated by Istanbul’s Chief Public Prosecutor’s Office.
What was reportedly seized
The Turkish outlet Haberler said police took about $4 million in cash and 64 luxury watches from the apartment, along with firearms, computers and crypto mining equipment. Euronews reported the seizure also included three handguns, four rifles, 1,360 rounds of ammunition and a dagger. A post on X put the cash at $600,000 and the watches at 24. Istanbul police and Interpol had not confirmed the figures, and Turkish authorities have released no official inventory.
The Red Notice was issued in December 2024 at Finland’s request over alleged aggravated tax fraud. A Red Notice asks police worldwide to locate a person pending extradition; it is not an arrest warrant, and a subject remains presumed innocent. Finnish authorities have also sought Schueler over an allegation of assault, which he has not been convicted of.
A legal saga that moved to Helsinki
The detention moves Heart’s legal troubles across the Atlantic. In 2023 the US Securities and Exchange Commission charged Heart, Hex, PulseChain and PulseX with unregistered securities offerings that it alleged raised more than $1 billion, and it accused him of spending at least $12 million of investor funds on sports cars, watches and a 555-carat black diamond called The Enigma. Those were allegations in a civil case: a federal judge dismissed it in February 2025 for lack of personal jurisdiction, and the SEC declined to amend its complaint that April.
Hex token prices fell sharply on the detention reports, with declines reported between 25% and 45%, and the PulseChain token PLS dropped 35% in a day. Hex already traded for fractions of a cent, down more than 99% from its 2021 high of about $0.44.
Turkish media reported the investigation into Schueler and his wife continues, and no extradition to Finland has been established.

Gasoline prices jumped 9.1% and drove more than half of September’s 3.7% US inflation reading, the print that sent Bitcoin toward $81,300 and put a Fed rate hike back in play this month.
The Bureau of Labor Statistics reported Wednesday that the Consumer Price Index rose 3.7% annually in September, above the 3.6% forecast and up from August’s 3.4%. Gasoline accounted for more than half the headline increase, and the broader energy index climbed 5.2%. Prices have now run above the Fed’s 2% target for 67 straight months.
The pump, not the economy
The catalyst traces back to oil. Crude has reportedly traded above $90 a barrel for most of the past two months amid the war between the US and Iran, and pump prices followed it up through September. That makes this an energy-driven inflation spike rather than a broad demand one, which matters for how the central bank reads the print: the Fed raised rates 25 basis points in September to a 3.75% to 4% target range, its first hike in more than three years, and now pricing on a second consecutive move has rebounded sharply.
Prediction markets roughly doubled the odds of a 25-basis-point October hike after the report, though the level depends on the venue: Kalshi showed the probability rising to 55% from 21%, while CME’s FedWatch tool put it at 44% to 49% from 22%.
Bitcoin fell as yields jumped, with the 10-year Treasury yield climbing to roughly 5.3% near 24-year highs and the 2-year up about 10 basis points to about 4.9%. The asset traded near $82,142, down 1.5%, in early Wednesday trading, then touched the $81,300 level analysts at Bitget flag as immediate support, where a sustained break below would invite further losses.
The Fed meets Oct. 27 and 28, and its decision lands before the September PCE release on Oct. 29, leaving officials to weigh the hot CPI without their preferred inflation gauge in hand. The next reading arrives Thursday with the Producer Price Index.

Standard Chartered has launched direct bitcoin and ether trading for wealthy UAE clients in a service that keeps custody, settlement and pricing entirely inside the bank’s own system. The launch went live on October 14 under a licence from Dubai’s Virtual Assets Regulatory Authority (VARA), the bank said in its announcement.
No wallets, no exchanges
The design is the point. In a closed-loop model, custody and settlement are handled within Standard Chartered’s own systems, so clients never need a separate crypto wallet or a third-party trading platform. Money and tokens move inside the bank’s walls and stop there. The service runs through Zodia Markets, a firm backed by the bank’s SC Ventures unit, and draws on both the wealth and retail banking arm and the corporate and investment bank.
For hesitant wealthy clients, the pitch is compliance by architecture. Crypto never leaves bank custody, so the usual anxieties about exchange failure or self-custody mistakes do not apply. The bank also runs the pricing itself: spreads reach up to 2%, with no additional transaction or custody fees in certain contexts, according to the announcement.
Eligibility is narrow. The service is initially limited to clients classified as professional investors, a regulatory category with thresholds for investment knowledge and liquid net worth that the bank has not disclosed. It covers bitcoin (BTC) and ether (ETH) only, bought and sold through existing bank accounts.
Competition with exchanges, not banks
The closed-loop structure positions Standard Chartered against crypto exchanges rather than rival lenders. The bank’s clients can already reach crypto ETFs, structured products and over-the-counter derivatives. What the bank is selling instead is the venue itself: a regulated, bank-run place where the asset, the custody and the settlement all sit inside one institution.
Standard Chartered says it is the first international bank to offer direct crypto trading in the UAE, and the first time it has sold crypto trading directly to wealthy clients in any market. Both claims come from the bank and are not independently verified.
The service is UAE-only at launch. The bank plans to expand it to other markets but gave no timetable.

Wallets linked to the US government moved hundreds of millions of dollars in seized crypto to Coinbase Prime this week, and no sale has been confirmed.
Blockchain analytics firm Arkham traced 833.6 BTC, worth about $71.6 million, and roughly 40,285 BNB, worth $31.63 million, from wallets it labels as US government holdings to Coinbase Prime deposit addresses on Oct 7. The coins came from forfeited funds in the HashFlare fraud case and from seizures in the Bitfinex hack and Alameda Research cases, according to Arkham’s tracing as carried by several outlets.
The totals grew as trackers caught up. Arkham put a same-day figure at about $470 million, adding WBTC and USDT from the Bitfinex and Alameda seizures. Galaxy Research counted 9,261 BTC, or $770 million, sent to Coinbase Prime over two days, including 2,456 BTC from holdings not previously identified, which it read as possible new law enforcement seizures. Lookonchain put three-day deposits at 17,733 BTC, about $1.48 billion, plus 750 WBTC, and reported another 12,267 BTC, $1.01 billion, moved on Oct 8. Each figure covers a different wallet set and window, so the numbers describe one series of transfers rather than competing counts.
A transfer is not a sale
None of the trackers reported a sale. Coinbase Prime has been the US Marshals Service’s custodian for seized digital assets since July 2024, so a deposit can mean storage. A mid-July 2026 move of $288-297 million in seized crypto to the same platform turned out to be storage.
A sale of reserve Bitcoin would nonetheless clash with President Trump’s March 2025 executive order, which directs forfeited Bitcoin into a Strategic Bitcoin Reserve that “shall not be sold,” with exceptions for court-ordered distributions and victim restitution. The Marshals Service and the Justice Department have not commented on the transfers.
The market read it anyway
Bitcoin dropped 6.9% in the same window, briefly touching about $80,500, with roughly $1.14 billion in liquidations, about $930 million of them long positions. Macro pressures were also at work, including a 5.34% Treasury yield and a stronger dollar, and one market analysis concluded the unconfirmed sale alone does not explain the drop. The pattern is familiar: in December 2024, a transfer of 19,800 BTC from the Silk Road haul to Coinbase, then worth about $1.92 billion, coincided with a fall of more than 2% within 24 hours.
The US government remains the largest known state holder of Bitcoin, with Arkham’s estimates running from about 306,795 to 325,000 BTC, roughly $25-28 billion depending on the as-of date.

Ledger has halted sales by its Southeast Asia reseller CryptoBilis after wallets belonging to customers who bought devices through that channel were drained of an estimated $72 million to nearly $90 million.
The hardware wallet maker said it is investigating the losses and has asked CryptoBilis to pause all sales and shipments of Ledger devices pending the outcome. Ledger advised users who purchased from the reseller in the past 90 days not to set up unused devices, and to move assets to a new Ledger device with a new seed phrase if their device is already in use. It said it would keep customers informed as the investigation progresses.
On-chain estimates of the losses differ. The analyst Specter traced ten collection addresses and counted inflows from hundreds of victim wallets across Ethereum, TRON and Bitcoin, putting total losses above $86 million as the count was still rising. The analyst tanuki42 put the figure above $72 million, and MistTrack estimated almost $90 million. Ledger has confirmed no dollar amount.
CryptoBilis claims to be the authorized reseller of Ledger products in Malaysia and sells devices in Indonesia, Malaysia and the Philippines. It has not responded to a request for comment.
The suspected mechanism is supply-chain tampering rather than a flaw in Ledger’s software. Binance founder Changpeng Zhao said the available information points to a supply chain attack at a single vendor, with a small number of people likely having bought fake or tampered devices. Security researcher Taylor Monahan, for her part, insisted there is no zero-day in Ledger products and warned that hasty fund-moving exposes users to phishing risk greater than the incident itself.
Some stolen funds have already moved. On-chain tracking shows the suspected attacker has laundered about 430 ETH, worth roughly $1.07 million, through the mixer Tornado Cash, and Arkham-tracked wallets linked to the thefts still hold about $70.6 million. Tether has frozen USDT on addresses tied to the thefts, after which the attacker began swapping USDT into USDD, a Tron-based stablecoin Tether cannot freeze.
Ledger declined further comment. Its investigation is ongoing.

ESMA told EU-authorized crypto platforms to stop services in non-MiCA-compliant stablecoins such as USDT, with customer holdings resolved by Jan. 8, 2027.
In an opinion issued to national regulators on Oct. 8, ESMA said crypto-asset service providers, or CASPs, should not offer services in asset-referenced tokens or e-money tokens that fail MiCA’s authorization, reserve, redemption, governance and disclosure requirements. Keeping noncompliant stablecoins available through authorized platforms would weaken those rules, the regulator argued.
The opinion names no tokens. Its effect, though, lands on two of the market’s biggest tokens: Tether’s USDT, the biggest stablecoin by market capitalization, and PayPal USD (PYUSD), the third-largest, neither of which is authorized under MiCA. The upshot for European users is that holding those tokens on a regulated platform now has a clock on it.
National regulators should require remaining customer holdings to be resolved “as soon as possible, and no later than three months” after the opinion’s publication, ESMA said, a window that runs out on Jan. 8, 2027.
During the wind-down, platforms may still let customers sell, convert, withdraw, transfer or safekeep the tokens. Purchases, promotion, trading and continued market availability are off the table. The restrictions cover exchange services, trade execution, transfers, custody, administration, advice and portfolio management.
How individual users’ balances are actually resolved, whether by sell-off, conversion or withdrawal, is left to national regulators and the platforms they supervise, so outcomes will vary by country and venue. Several platforms had already restricted USDT for European users before the opinion landed.
The move extends MiCA enforcement from issuers to the venues themselves, closing the gap where a fully authorized platform could still offer an unauthorized asset. MiCA’s stablecoin rules have applied since June 2024, and its full platform rules took effect on July 1, forcing firms without authorization to stop serving EU clients.

FinCEN has withdrawn its 2020 proposal that would have required banks and crypto exchanges to report transfers of more than $10,000 to or from private wallets, along with a 2023 proposal on crypto mixers. Neither rule ever took effect.
The U.S. Treasury’s Financial Crimes Enforcement Network announced the withdrawals in a news release published Sunday, Oct. 5. The agency said in the release that both moves were part of the Trump administration’s deregulatory agenda and an effort to make digital-asset rules “fit-for-purpose.”
What the withdrawn rule would have required
FinCEN first proposed the wallet reporting rule in December 2020, in the final weeks of the first Trump administration. It would have required banks and money-service businesses, a category that includes crypto exchanges, to file reports whenever customers sent more than $10,000 in crypto to or from unhosted wallets, meaning wallets controlled by users rather than a financial institution. Transfers that crossed the threshold when added together over 24 hours would have triggered a report too.
Firms would also have had to collect and retain information on the customer and on the wallet on the other side of the transfer. The proposal drew thousands of public comments and sat unresolved for nearly six years.
The mixer rule went with it
FinCEN also withdrew a separate 2023 proposal that would have classified crypto mixing transactions as a primary money-laundering concern, a designation that would have allowed the government to impose additional reporting requirements on financial institutions handling mixed funds. That proposal never took effect either.
The withdrawals remove a long-running compliance question for exchanges and banks that serve customers who self-custody. Existing reporting obligations under the Bank Secrecy Act remain in place; only these two proposals were dropped.

The CFTC’s plan for crypto exchange rules would tighten oversight of custodial trading platforms while leaving self-custody and on-chain trading outside the federal net, the agency said Monday.
The Commodity Futures Trading Commission outlined two linked frameworks, Regulation CTX and Regulation CAM, in an advance notice of proposed rulemaking published Monday. The step seeks public comment before formal rules are drafted, and the public would have 60 days to comment once the notice appears in the Federal Register.
Under Regulation CTX, simply offering leverage, even through terms of service, could bring fully paid trades under CFTC watch as long as the purchased crypto sits on the exchange’s internal books rather than in the customer’s own wallet. Trades escape that oversight only through “actual delivery,” which the agency suggests could require customers to hold their private keys. The CFTC also said on-chain trading protocols would usually clear that bar.
The private-key standard is a preliminary suggestion, not settled policy. The agency is also weighing proof-of-reserves requirements and standards against listing tokens prone to manipulation, but neither is decided.
The carve-out cuts a clear line through the US market. Exchanges that keep customer assets on their books and offer leverage would face a federal regime, with Regulation CAM creating a “crypto asset market” license modeled on the status held by futures exchanges. Trades under that license would run through futures commission merchants, brokers subject to anti-money laundering rules, and leverage could come only from those brokers or banks they sponsor. Exchanges that offer no leverage could keep operating under state money transmitter licenses.
The approach also marks a turn for the agency itself. The notice describes its past cases against Kraken, Ooki DAO and Uniswap, brought during the Biden administration, as “regulation by enforcement.”
The plan arrived after Congress came up short. The Clarity Act, legislation that would have set ground rules for most US crypto activity, failed in the Senate in September, and the CFTC sent its framework to the White House for review days later. Chairman Michael Selig had said in August the agency would write its own rules if Congress did not act.
Selig said the rules are “designed to prevent, rather than only prosecute after the fact, fraudulent schemes such as FTX.”
The SEC is moving on a parallel track, having proposed its own Regulation Crypto Assets in August and unveiled an innovation exemption for tokenized stocks last month. How the two agencies’ frameworks fit together is not yet known.

Illinois has agreed to push the start of its 0.2% Digital Asset Tax from Jan. 1, 2027 to July 1, 2027, under a joint filing with industry groups that still needs a judge’s approval.
The Digital Chamber announced the agreement in a post on X on Oct. 1. The stipulated motion was filed in Sangamon County Circuit Court by state officials and The Digital Chamber and the Illinois Blockchain Association, which sued the state’s Department of Revenue Director David Harris and Attorney General Kwame Raoul over the tax. Both sides asked the court for the same outcome, but the delay does not take effect until the judge signs off on it.
The filing said the six-month pause will “permit orderly briefing and adjudication of the underlying legal questions” without prejudicing either side’s claims.
What the delay buys businesses
Gov. JB Pritzker signed the Digital Asset Tax Act in June 2026 as part of the state’s 2027 budget. The law imposes a 0.2% levy on crypto activity by firms with more than $100,000 in receipts, collected by digital asset brokers. Lawmakers projected it would raise as much as $60 million in 2027, an estimate rather than booked revenue.
Under the act as written, brokers would have had to impose the tax starting Jan. 1 or face potential fines and prison time. The six-month delay removes that deadline for now, but it does not remove the obligation: if the court allows the tax to stand, the 0.2% levy still starts July 1, 2027.
A pause, not an end
The agreement does not settle the litigation. Industry groups argue the tax is unconstitutional, invalid under state law and preempted by the federal Internet Tax Freedom Act, and separate challenges from the Blockchain Association and Crypto Council for Innovation remain pending.
Digital Chamber CEO Cody Carbone called the delay a major win but said the fight continues. “A delay is not a repeal,” he said.

The average US spot Bitcoin ETF investor is back in profit for the first time since January, after Bitcoin climbed above the average holder’s estimated ETF cost basis of $81,722 per coin, according to Bloomberg Intelligence analyst James Seyffart, who said in a post on X the funds’ holders were “back above water” as the rally lifted Bitcoin past that level.
The milestone arrived alongside the funds’ strongest day of the year. US spot Bitcoin ETFs took in $998.95 million in net inflows on Monday, their biggest single-day haul since October 2025, led by BlackRock’s IBIT at $381.37 million. Ark and 21Shares’ ARKB added $289.12 million and Fidelity’s FBTC $238.84 million. Bitcoin traded around $86,300 on Tuesday, roughly 5% above the estimated cost basis, after a gain of nearly 13% over seven days.
The size of the underwater cohort matters for how the market trades. David Wachsman, president of Hawkeye Digital, said holders sitting on losses “often sell the first chance they get to break even,” so much of this year’s demand had to absorb that supply. With the average holder above water, that break-even selling pressure eases.
One caveat tempers the headline number. Bloomberg Intelligence analyst Eric Balchunas said the reported Monday flows most likely reflect Friday’s buying rather than Monday’s, so the funds’ response to Monday’s price move may still be ahead.
The inflow day marked a sharp turnaround. The week ending September 18 brought just $6.2 million of net inflows, the smallest weekly total across 141 weeks of trading. The funds have now drawn $56.16 billion cumulatively since launch and hold about $110.14 billion in assets, equal to 6.3% of Bitcoin’s market capitalization.

Bitget CEO sees little chance of recovering most of the $388 million stolen from the exchange
Bitget CEO Gracy Chen said she is not very optimistic about freezing or recovering the $388 million in crypto stolen from the exchange in a breach late last week.
Chen made the remarks in an interview published Tuesday, pointing to the February 2025 hack of Bybit as a reference point. Attackers took about $1.5 billion in Ether from Bybit, and the exchange has frozen and recovered a combined $80 million in the year since, about 3.5% of the stolen funds.
“I’m actually not very optimistic because after a year or so of Bybit’s hack, they’ve only [been able to freeze] about 3.5% of the total stolen funds,” Chen said. She added that freezing is not the same as recovery: “That’s only the freezing. It’s not about recovery yet.”
Bitget first reported a loss of $352 million after the Thursday attack, then raised the figure to $388 million after a more complete accounting of transfers. The exchange suspended withdrawals and has resumed them in stages, starting with Bitcoin on Monday and Ether on Tuesday.
In a post on X announcing the exchange’s Recovery Bounty Program, Chen said 5% of attacker funds frozen and 5% of funds recovered goes to whoever helps, with exchanges, security researchers and onchain investigators eligible. A trace explorer for the program is live at trace.bgblockchain.xyz. She also thanked Tether and Circle for blacklisting a wallet tied to the exploit, which froze $318,013 in USDT and USDC.
The NEAR Intents team said Monday it had blocked more than $50 million in assets tied to the attack and frozen about $500,000. Blocked assets are held from moving, which is not the same as frozen or returned.
Chen said a DPRK-linked group may have been responsible, citing IP addresses that match the VPN choices of such a group, and stressed the attribution is preliminary. She said preliminary investigation results ruled out an inside job, while noting Bitget had not totally ruled the possibility out.
The breach is among the largest crypto attacks of 2026, following a $320 million exploit of the Liquid Network in September.

A two-member SEC is proposing crypto custody rules
The Securities and Exchange Commission on Thursday proposed rules for how investment advisers and regulated funds custody crypto assets, announced while the agency prepares to operate with two commissioners. Chairman Paul S. Atkins announced the proposal in a press release that says the framework would give advisers and funds “a compliant pathway where none existed before” for holding crypto.
Under the draft rules, advisers could hold client crypto themselves, but only when no permitted custodian is available for the asset. The adviser would have to reassess that determination every quarter and move the assets out as soon as a custodian becomes available, and at least two authorized individuals would need to approve any transfer. Regulated funds could hold crypto through their adviser under the same conditions, with the fund’s board overseeing the arrangement.
The proposal would also let state trust companies serve as crypto custodians, provided they are authorized by their state, have safeguards against loss and theft, keep audited financial statements and segregate client holdings from their own assets. A public comment period of 60 days opens once the proposal is published in the Federal Register, so nothing is final yet.
The governance backdrop is unusual. Commissioner Hester Peirce, who leads the agency’s crypto task force, reportedly departs on Friday to take a professorship in Virginia, leaving two commissioners. Earlier in the week the agency reportedly cut the quorum requirement from three commissioners to two, and if one of the remaining two is recused or conflicted, a single commissioner can act. Peirce said in her statement that advisers have been “gritting their teeth and holding on for dear life” waiting for workable custody rules.
Commissioner Mark Uyeda, the other remaining member, said in his own statement that the proposal recognizes adviser custody creates “an inherent conflict of interest,” and that fiduciary duties would continue to apply when advisers hold clients’ crypto.

The Treasury Department and IRS issued a notice on September 28 flagging tax-motivated investment strategies involving digital assets. It is not a ban: the notice, Notice 2026-62, requests information on the practice and leaves open what action, if any, will follow.
What the notice actually says
The agencies identified digital assets as one area where fund managers may be stretching tax provisions beyond their intended purpose. The notice points to in-kind redemption strategies used by regulated investment companies, funds that must derive at least 90% of annual gross income from qualifying sources to keep their favorable tax treatment. Regulators could respond with new regulations, additional rulings or other guidance, and could designate certain arrangements as transactions of interest or listed transactions, classifications that carry heightened reporting requirements.
Any action could be prospective or, where legal authority allows, retroactive to transactions completed before guidance is issued. The IRS also warned that it can challenge an abusive investment-fund strategy during an examination under existing law, without waiting for a new rule.
A ruling already rejects one strategy
A companion Revenue Ruling 2026-20 rejects prearranged Section 351 transactions in which investors contribute appreciated securities to an ETF and quickly redeem, emerging with a different portfolio without recognizing the embedded gain. Treasury Secretary Scott Bessent announced both documents in a post on X, writing that the agencies were “serious about cracking down on transactions designed to dodge taxes or exploit our federal tax code” and that the Section 351 conversions “don’t work under existing law.”
The $7.22 billion backdrop
The warning lands as in-kind ETF plumbing has grown quickly. BlackRock’s quarterly filings show its IBIT (iShares Bitcoin Trust ETF) distributed about $5.49 billion of Bitcoin through in-kind redemptions in the first six months of 2026, roughly $3.85 billion of it in the second quarter, and received about $9.36 billion in kind. Its ETHA (iShares Ethereum Trust ETF) distributed another $1.72 billion of Ethereum, taking the two products to about $7.22 billion combined over the period.
Those trusts sit outside the specific test the notice targets. IBIT and ETHA are grantor trusts for federal income-tax purposes, so gains and losses pass through to shareholders rather than being subject to the RIC income test at the center of the notice. The filing figures show the scale of the infrastructure, not use of any flagged strategy, and no fund has been identified as using it.