Tomas RADA

The Depository Trust & Clearing Corporation (DTCC) is the invisible plumbing of the American financial system. Most people never interact with it, but it holds $114 trillion in securities under custody through its subsidiaries [1]. On Wednesday, October 28, 2026, this giant officially went live with its tokenization service, moving a massive portion of the $30 trillion U.S. securities market toward blockchain infrastructure [1].
This is not a small experiment by a startup. This is the central clearinghouse for U.S. stocks and bonds creating a bridge. The DTCC Tokenization Service (DTS) allows eligible firms to convert traditional securities into tokens. These tokens are backed one-for-one by the actual assets held at the Depository Trust Company (DTC) [1]. Unlike synthetic tokens that just track a price, these represent real ownership, preserving the same investor protections and rights as the original shares [2].
The rollout follows a pilot program from July 2026 and a demonstration earlier this year [2]. It rests on a regulatory foundation from December 2025, when the SEC issued a no-action letter essentially giving the green light for this specific tokenization program [2].
Institutional adoption
Twenty major financial firms have already signed agreements to use the service. The list includes names like JPMorgan, Citi, Morgan Stanley, Bank of America, UBS, and Fidelity Investments [1]. Other participants include Citadel Securities, State Street, Barclays, and Alpaca [2].
These firms can now convert securities into tokens during standard business hours. The DTCC is targeting a processing time of 15 minutes or less for these conversions [1]. Once the assets are in token form, they can move between registered blockchain wallets 24/7 [1]. This effectively breaks the traditional "9-to-5" constraint of the stock market for these specific assets, allowing for around-the-clock transfers and collateral management.
Analysts at Citi have projected that tokenized securities could become a $5.5 trillion market by 2030 [1]. The DTCC's move is a step toward making that projection a reality by providing the standardized infrastructure that big banks require before they commit serious capital to a new technology.
Network infrastructure
The service is currently live on two specific networks: the Canton Network and a private version of Ethereum called Besu [1]. These are permissioned environments, meaning they aren't open to the public like a standard DeFi protocol. They are designed to meet the strict compliance and privacy needs of Wall Street.
However, the road map is expanding. The DTCC plans to integrate with the Stellar network and Arc in 2027 [1]. This suggests a move toward broader interoperability over time. The goal is to make blockchain technology a part of the mainstream market infrastructure rather than a separate, siloed system [1].
The infrastructure also aims to solve the "cash leg" of the transaction. In 2027, the DTCC plans to add tools for settling these transactions using digital cash and using the tokenized securities themselves as collateral [1]. This would allow a bank to move a stock token and receive a digital payment token simultaneously, reducing the risk that one side of the trade fails.
Corporate treasury shifts
While the DTCC builds the rails for stocks and bonds, large corporations are already moving toward tokenized money. A survey by DBS and EY of 422 finance leaders at companies with over $500 million in revenue found that 88% are either using or piloting tokenized money [3].
Stablecoins are the most popular instrument in this category, with 63% of these large businesses using or planning to use them [3]. Tokenized deposits follow at 53%, and tokenized money market funds at 52% [3]. The primary drivers here are speed and traceability. About 71% of these leaders expect real-time cross-border payments within two years [3].
Some of this is already happening at scale. Citi reported that hundreds of its clients move nearly $1 billion daily through its own token services to manage liquidity [3]. In September, DBS and Citi completed a dollar payment between Singapore and New York using tokenized deposits that settled in minutes over a weekend [3]. This type of efficiency is what the DTCC is now trying to bring to the much larger world of equities and treasuries.
Future market structure
The DTCC is not the only legacy player moving in this direction. Nasdaq and the New York Stock Exchange (NYSE) are also developing their own tokenized securities infrastructure [1]. The Intercontinental Exchange (ICE), which owns the NYSE, is working on a blockchain-based trading venue under an SEC innovation exemption in partnership with the exchange OKX [1].
The shift toward "issuer-sponsored" models is also gaining traction. In these models, the token itself is the share, which preserves full rights and control for the company issuing the stock [1]. This removes the need for a separate digital representation of a paper asset.
As more assets move onchain, the distinction between "crypto" and "traditional finance" continues to blur. The DTCC’s current system handles clearing and settlement for a massive portion of global trading. By moving these functions to a distributed ledger, they are betting that the future of the $114 trillion in assets they hold will eventually be digital. The next major milestone for this project is the planned expansion to additional blockchain networks like Stellar in 2027 [1].
Sources
1. CoinDesk, Wall Street backbone DTCC brings $30 trillion securities closer to blockchain with major banks, https://www.coindesk.com/business/2026/10/28/wall-street-backbone-dtcc-brings-usd30-trillion-securities-closer-to-blockchain-with-major-banks
2. Cointelegraph, DTCC unit launches tokenization services, https://cointelegraph.com/news/dtcc-subsidiary-launches-tokenization-services
3. CoinDesk, Nearly 90% of large businesses are embracing tokenized cash to speed up payments: DBS, https://www.coindesk.com/business/2026/10/28/nearly-90-of-large-businesses-are-embracing-tokenized-cash-to-speed-up-payments-dbs
Charts and the full source list: https://medium.com/@tomasrada8080/wall-streets-30-trillion-leap-dtcc-launches-tokenization-rails-5bd1c13350c4

National trust charter
Ripple has received final approval from the Office of the Comptroller of the Currency (OCC) to launch the Ripple National Trust Bank (RNTB). This move transitions the company from a state-regulated fintech into a federally supervised banking entity. The application process began in July 2025, followed by conditional approval in December 2025. With this final sign-off, Ripple joins a small group of crypto firms, including Circle and BitGo, that have successfully brought their operations under the direct oversight of the primary regulator for U.S. national banks.
The bank is not a full-service commercial institution; it does not take deposits or issue loans. Instead, it operates under a specialized national trust charter focused on fiduciary activities. Its primary mandate is to manage the reserves for Ripple’s stablecoin, RLUSD, and provide digital asset custody for institutional clients. This structure creates a split regulatory model where the New York-regulated unit, Standard Custody & Trust Company, continues to issue the stablecoin, while the federal bank manages the assets backing it.
Federal oversight of reserves
The launch of RNTB places the management of RLUSD reserves under the scrutiny of the OCC. Since its debut in December 2024, RLUSD has grown to a market capitalization of approximately $2.5 billion. It currently ranks among the top 50 stablecoins globally. The asset is backed by a mix of U.S. dollar deposits, U.S. government securities, and other cash-like instruments. BNY currently holds the majority of these reserves.
By moving reserve management to a national trust bank, Ripple is attempting to satisfy the requirements of large-scale institutions that demand federal-level accountability. The bank will act as a trustee, meaning it has a legal obligation to manage the collateral specifically for the benefit of RLUSD holders. This setup is intended to provide a layer of protection that mirrors traditional financial trust structures. This oversight arrives as the U.S. prepares to implement new stablecoin regulations under the GENIUS Act, which Ripple has indicated it will follow in coordination with the OCC and New York regulators.
Institutional custody and payments
Beyond stablecoin reserves, the new bank is authorized to provide fiduciary custody services. This allows the bank to hold digital assets for large corporations and financial institutions engaged in trading, treasury management, and payments. Ripple’s existing business model relies heavily on its payments infrastructure and Ripple Prime, where RLUSD is used as collateral. The company also continues to use $XRP , the fifth-largest digital asset by market cap, to facilitate cross-border transactions.
The goal of the national charter is to bridge the gap between blockchain-native assets and the traditional financial system. For years, the argument from leadership has been that for crypto to scale, it must reside within a regulated framework that banks can trust. The RNTB provides that framework by offering a federally regulated entry point for institutions that were previously hesitant to interact with state-chartered or unregulated entities.
Tokenization on the XRP Ledger
While Ripple secures its banking infrastructure in the U.S., its technology is being applied to traditional fund management in the UK. Aviva Investors recently launched a tokenized share class of its £22 billion ($29.4 billion) Sterling Liquidity Fund on the XRP Ledger. This follows a similar launch of a U.S. dollar liquidity fund share class in July. Aviva has invested £50 million ($66.7 million) into this new sterling offering, bringing its total investment across tokenized money market funds to over £86 million ($114.8 million).
The fund uses a digital twin model. The actual fund operations remain offchain, but investors' holdings are represented on the XRP Ledger. This project involves several traditional and crypto-native partners, with BNY holding the fund’s assets and Komainu and Licuido providing infrastructure support. The tokenized shares maintain the same risk profile and regulatory protections as the traditional fund, which has been active since 2002. This integration shows how the underlying ledger is being used for real-world asset (RWA) tokenization alongside the development of Ripple’s new banking entity.
Political and regulatory friction
The expansion of national trust charters to crypto firms has not been without pushback. Some lawmakers, including Senator Elizabeth Warren, have criticized the OCC for granting these approvals, suggesting they might violate the National Bank Act. Critics argue that allowing crypto firms into the federal banking system poses risks to financial stability. Conversely, industry groups like The Digital Chamber have defended the move, noting that these charters are limited in scope and that firms are voluntarily choosing to submit to stricter federal supervision rather than avoiding it.
In other regions, the intersection of crypto and state policy is even more contentious. In Israel, the central bank recently rejected a suggestion by Prime Minister Benjamin Netanyahu to use blockchain networks to bypass potential international sanctions. The Bank of Israel stated that digital currencies cannot be used to circumvent sanctions because public blockchains are transparent and traceable. This highlights the ongoing tension between the perceived anonymity of crypto and the reality of public ledger forensics, which Israel itself has used to seize 24 million shekels from sanctioned wallets.
Sources
1. CoinDesk, Ripple gets a final go-ahead to launch its own U.S. national trust bank, https://www.coindesk.com/markets/2026/10/27/ripple-gets-a-final-go-ahead-to-launch-its-own-u-s-national-trust-bank
2. The Block, Ripple gains final OCC approval to launch national trust bank and bring RLUSD under federal oversight, https://www.theblock.co/news/regulation/2026-10-26-ripple-gains-final-occ-approval-rlusd-431810
3. The Block, Aviva Investors, Ripple launch tokenized share class of $29 billion sterling fund on XRP Ledger, https://www.theblock.co/news/business/2026-10-26-aviva-investors-ripple-tokenized-share-class-sterling-fund-xrp-ledger-431712
4. Decrypt, Israel's central bank rebukes Netanyahu plan to use crypto to dodge sanctions, https://decrypt.co/381789/israels-central-bank-rebukes-netanyahu-plan-to-use-crypto-to-dodge-sanctions
Does having a federal bank charter make you more likely to trust a stablecoin over one that is only state-regulated?
Charts and the full source list: https://medium.com/@tomasrada8080/ripples-federal-leap-the-launch-of-a-u-s-national-trust-bank-3b022eef1674

The promise of privacy in the hardware wallet industry often hits a wall when it meets the reality of e-commerce. Keystone, a manufacturer known for its air-gapped security, recently confirmed a breach that exposes the gap between marketing claims and data retention practices. On October 20, the company detected suspicious activity on its website. By October 23, after reviewing API activity with Shopify, it confirmed that an unauthorized third party had accessed customer names, contact details, shipping addresses, and order specifics [1][2].
Keystone has not yet disclosed the total number of affected customers [1]. While the company maintains that private keys, recovery phrases, and payment card details remain safe, the leak of physical addresses creates a specific type of vulnerability for crypto holders. When an attacker knows exactly where a person lives and what specific security hardware they purchased, the threat shifts from digital phishing to physical confrontation.
The 180 Day Promise
For nearly two years, Keystone used its data retention policy as a competitive advantage. In January 2024, the company posted on X that shipping data is permanently deleted 180 days after an order [2]. They doubled down on this in March and August, claiming they delete info in "180 days max" while other manufacturers keep it forever [2]. The company's Privacy Promise page even states that this deletion is automatic [2].
The breach has revealed that this automation might not be as absolute as advertised. Since the news broke, several customers have reported receiving breach notifications despite their orders being significantly older than the 180-day window. One user, trintaetres, noted they received a notification for a device purchased over two years ago [1]. Another customer, BlockchainBarmy, pointed out that 214 days had passed since their last order [2].
The discrepancy suggests a failure in the data purging process. Keystone’s own help center articles note that while they intend to delete data, the final process is handled by Shopify, and records of a customer's city and country are explicitly not deleted [2]. This technical nuance means that even if a full street address is removed, a database of crypto-heavy households by city still exists.
Physical Security and Wrench Attacks
The primary concern for the security community isn't just a leaked email address. It is the "wrench attack," a term for physical violence or threats used to force a holder to surrender their assets. CertiK recorded 52 verified wrench attacks globally in the first half of 2024, which is a 33% increase from the 39 attacks recorded during the same period in 2023 [1].
When shipping data leaks, it essentially provides a map for these types of crimes. Scammers are already using the Keystone data to build credibility. One user, OG DEGEN, reported receiving a call from someone posing as law enforcement investigating fraud [1]. The caller had specific details from a 2024 Keystone order, which they used to try and convince the user that their private keys were exposed, likely as a lead-in to a phishing link [1].
Another user reported a call from a spoofed Montreal police number [2]. The caller specifically asked if the names "Amazon, eBay or Keystone" meant anything to the victim [2]. This suggests that attackers are cross-referencing the leaked Keystone data with other databases to create a highly personalized profile for social engineering.
Patterns of Failure
Keystone is not an isolated case. The hardware wallet industry has struggled with e-commerce security throughout 2024. In August, Trezor disclosed that a breach at its shipping partner, ShipMonk, exposed data for nearly 14,000 customers [2]. Later, that number jumped by another 67,000 U.S. customers after it was discovered that ShipMonk had given written assurances of data deletion that were not actually followed [2].
SafePal also faced a similar issue in August when a flaw in its order-tracking system exposed the personal information of approximately 40,000 customers [2]. Even Ledger, which faced a massive data leak years ago, was in the news recently because resellers were found selling devices with hardware implants designed to capture recovery phrases [2].
The recurring theme is that while the hardware itself might be air-gapped and secure, the business of selling that hardware relies on centralized, third-party platforms like Shopify or Global-e. These platforms are built for convenience and tracking, which is the exact opposite of the privacy many crypto users expect. Keystone’s privacy policy, last updated in May 2021, states it erases order info for customers who haven't ordered in 180 days, but the reality of the Shopify API suggests that "deletion" is a complicated term in a SaaS environment [2].
Technical Vulnerabilities and Disclosure
Keystone has blocked the unauthorized access and fixed the vulnerability that allowed the third party in [1]. However, the company has not yet explained how the attacker bypassed their systems or why the data was still there to be stolen in the first place. They have promised a detailed report in the coming days [2].
In the meantime, the advice for affected users is to be on high alert for physical mail, texts, and calls. Scammers may offer "replacement" devices or "fixes" for the breach, which are almost certainly attempts to get users to enter their recovery phrases into compromised hardware [2].
The industry is currently grappling with the fact that shipping a physical product requires a physical address, creating a permanent paper trail. Some users have suggested using PO boxes or office addresses to mitigate this, but for the thousands already in the Keystone database, that ship has sailed. The company confirmed the breach on October 23, 2024 [2].
Sources
1. Cointelegraph, Keystone says website breach exposed hardware wallet buyers’ addresses, https://cointelegraph.com/news/keystone-says-website-breach-exposed-hardware-wallet-buyers-addresses
2. The Block, Keystone customers say breach exposed data the hardware wallet maker promised to delete, https://www.theblock.co/news/business/2026-10-25-keystone-customers-say-breach-exposed-data-the-hardware-wallet-maker-promised-to-delete-431613
Charts and the full source list: https://medium.com/@tomasrada8080/the-keystone-breach-when-deleted-data-reappears-5a562aad577f

HSBC launched its Hong Kong dollar stablecoin, RedCoin, on Friday. This move brings a blockchain-based asset directly into the PayMe app, which serves more than 3.3 million users [1]. While the crypto world is used to names like Tether and Circle, this is a bank-issued token operating under a specific regulatory framework. The bank plans to allow users to activate these wallets over the coming days, enabling payments at more than 100,000 merchants [1].
This is not a pilot project or a restricted test. It is a production-level integration into a retail payment system. The ticker for the token is RCHKD, and it is pegged one-to-one with the Hong Kong dollar [1]. For the average person in Hong Kong, this means they can use blockchain money for daily expenses like lunch without interacting with a crypto exchange. The bank issued the token under a license from the Hong Kong Monetary Authority (HKMA) which it received in April [1].
Technical architecture and reserves
RedCoin does not live on a public blockchain like Ethereum or BNB Chain. Instead, it runs on HSBC’s own private ledger [1]. This choice gives the bank total control over the network but limits the portability of the tokens. Currently, balances cannot even move between the PayMe app and HSBC’s main banking app [1]. This siloed approach is a stark contrast to the interoperability of centralized stablecoins like USDT, which move across dozens of different public networks.
The scale of the launch is relatively small when compared to the broader stablecoin market. Shortly after the launch, HSBC’s reserve tracker showed roughly $10.2 million in RedCoin in circulation [1]. These tokens are backed by $10.4 million held entirely in cash [1]. While Tether manages a market worth more than $300 billion, HSBC is starting with what amounts to pocket change for a global bank [1].
The regulatory backing is a key part of the story. HSBC beat a field of at least 36 companies that were competing for similar status by September 2025 [1]. The regime under which they operate took effect in August 2025 [1]. This structure provides a level of oversight that many crypto-native stablecoins lack, though it comes with trade-offs regarding how the money can be moved and used.
Consumer protection and legal status
There is a common misconception that money held in a bank app is always a bank deposit. RedCoin is not a bank deposit [1]. This is a critical distinction for users to understand. Because it is a tokenized asset and not a traditional deposit, it is not covered by Hong Kong’s Deposit Protection Scheme [1]. That statutory insurance usually protects savings accounts if a bank fails, but it does not apply to this stablecoin.
The protection for RedCoin comes from the 100 percent cash reserve requirement and the HKMA oversight. To prove the money is actually there, HSBC will provide independent attestations. These are reports from outside auditors confirming the cash reserves. The first of these reports for RedCoin is expected after the fourth quarter of 2026 [1].
This model shifts the risk from the bank’s general balance sheet to the specific assets backing the token. In the current crypto market, most stablecoins are used for trading on platforms. HSBC is pushing the technology into the corner noodle shop [1]. By using a private ledger, the bank manages the "know your customer" (KYC) requirements directly, ensuring that every wallet holder is a verified bank customer.
Expansion and tokenized funds
The current retail focus is only the first phase for RedCoin. John O'Neill, the bank’s managing director of digital assets and currencies, noted that the bank intends to expand into wholesale corporate and institutional use cases [1]. Later this year, the bank plans to integrate the token into its HK Mobile Banking app [1].
Once that integration happens, the utility of the token changes. Customers will be able to use RedCoin to buy into a tokenized share class of HSBC’s Hong Kong dollar money market fund [1]. This fund typically invests in short-term debt and is considered a low-risk way to park cash. Tokenization means the ownership of these fund shares is recorded on a digital ledger rather than a traditional registry [1].
This creates a closed-loop ecosystem where a user can hold a stablecoin, spend it at a merchant, or move it into a yield-bearing investment, all within the bank’s digital infrastructure. It removes the friction of moving money between "traditional" fiat accounts and "crypto" investment accounts.
Competition in bank-issued tokens
HSBC is not the only major financial institution moving into this space. The shift from crypto-native companies to traditional lenders is accelerating. In September, a group of 21 lenders including Goldman Sachs and Bank of America announced they are planning a joint dollar stablecoin [1]. Their target launch for that project is the first half of 2027 [1].
The competition is no longer just about who has the most liquidity on an exchange. It is about who can integrate blockchain technology into existing payment habits. HSBC has a head start in Hong Kong because of its existing 3.3 million PayMe users and its network of 100,000 merchants [1]. While the initial circulation of $10.2 million is small, the infrastructure is now in place to scale as more users activate their wallets.
The bank is moving toward a future where "blockchain-based money" is just another feature of a standard bank account. The next major milestone for the project will be the release of the first independent reserve attestation following the end of 2026 [1].
Sources
1. Decrypt, "HSBC Integrates HKD Stablecoin into PayMe for 3 Million Users," https://decrypt.co/381760/hong-kong-bank-hsbc-stablecoin-3-million-wallets
Would you prefer using a bank-issued stablecoin over a traditional bank transfer if it meant instant settlement at a local shop?
Charts and the full source list: https://medium.com/@tomasrada8080/hsbc-integrates-hkd-stablecoin-into-payme-for-3-million-users-f11570a355db