Cointelegraph

The PHP Foundation has acknowledged that indecision and a shortage of resources delayed a fix for a critical security flaw first identified in 2024, calling the stalled response a “structural failure.”
Government agencies and other organizations worldwide took websites offline Wednesday as a precaution while PHP released emergency patches for two related critical vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers without logging in.
PHP is a programming language widely used to power websites and web applications, including content management systems.
In a blog post following the release of the patch, the foundation described how its developers first found signs of the vulnerability in 2024, but struggled to come up with a solution without disrupting the large ecosystem of software built using PHP.
“Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months,” said the foundation.
“We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”
The foundation was pointed to the vulnerability again on August 11, after security firm Calif and OpenAI independently reported the same underlying issue, with Calif demonstrating unconditional remote code execution, which made it a top security priority.
Websites go dark amid PHP security scare
The disruption stretched across the world as developers disconnected websites while preparing to install the emergency fixes.
The Netherlands shut its digital identity service, and the country’s National Cyber Security Center also took its website offline.
Finland’s state IT provider Valtori disconnected government public web services, while France’s Interior Ministry temporarily took prefecture websites offline. Germany’s federal IT provider ITZBund also disabled several websites, according to Reuters.
In Australia, the Australian Signals Directorate acknowledged that its cybersecurity website, cyber.gov.au, was among government sites affected by the PHP issue.
Japanese Prime Minister Sanae Takaichi took to X to urge website operators to prepare to apply the patch as quickly as possible. In a post, she said temporarily suspending website functions could reduce the risk if the patch couldn’t be applied immediately.
The Wikimedia Foundation, which operates Wikipedia, said it took some supporting services offline as a precaution, including Toolforge and Cloud VPS, which host tools and projects used by volunteer developers, leading to parts of Wikipedia going offline on Wednesday.
Intersect, a membership organization supporting the Cardano blockchain’s development and governance, said it had temporarily taken its Members Area offline while it assessed potential exposure. The page is still offline at the time of writing.
Coinbase chief security officer Jeff Lunglhofer said the company found no evidence of any exposed PHP instances.
“Whenever we hear about vulnerabilities like this, we automatically conduct a full sweep to make sure everything is as safe as we can make it. We’re also working with our third party suppliers for extra assurance.”
Digital asset infrastructure company BitGo also said its platform was unaffected by the PHP vulnerability.
Meanwhile, Binance co-founder Changpeng Zhao warned internet users on Wednesday to be “extra careful” visiting any website in the next few days, as some web administrators may not be up-to-date with security patches.
OpenAI has released a Codex skill to help website operators check for potentially vulnerable PHP versions and identify applicable updates, which can be accessed via GitHub.
The PHP security team said it has not identified any functional exploits at the time of its public disclosure.
Magazine: 5 alternatives to Ledger to store your Bitcoin

A lobbying group for US banks has weighed in on the Office of the Comptroller of the Currency’s (OCC’s) recently finalized rules on payment stablecoin issuance and custody, arguing that the regulator’s interpretation went against Congress’ intent.
In a Wednesday notice, the American Bankers Association (ABA) said that while the OCC’s final rules implementing the GENIUS Act included “several positive steps,” the banking group remained critical of provisions related to stablecoin yield. The regulator dropped a provision that would have established a presumption that certain third-party arrangements violated the law’s ban on yield payments.
“The final rule removes the OCC’s originally proposed safeguards that would have addressed indirect arrangements involving affiliates, exchanges and other distribution partners,” said ABA. “As a result, payment stablecoin issuers can provide economically equivalent yield while technically avoiding the statutory prohibition. The OCC also declined to adopt a broader presumption against arrangements designed to circumvent the ban.”
The group added:
“Those gaps risk undermining the distinction Congress drew between payment stablecoins and traditional bank deposits, threatening the funds banks use to make the loans that drive the US economy.”
Stablecoin rewards were one of the key issues lawmakers and interest groups debated before and after GENIUS passed Congress in July 2025, and they continue to face scrutiny amid discussions of the Digital Asset Market Clarity Act, a crypto market structure bill currently in limbo after a failed procedure vote in the Senate last month.
Notably, the Blockchain Association approved of the change to yield prohibition, arguing that the OCC “[brought] the final rule more closely in line with the statutory text.” The Bank Policy Institute, another banking industry advocacy group, largely sided with ABA, saying that “the decision to omit the yield presumption replaces clarity with ambiguity and puts the banking system and its customers at risk of deposit flight.”
The OCC finalized its rules ahead of the GENIUS Act’s implementation in January 2027. Other government departments are expected to release rules on GENIUS related to their agencies’ purview over stablecoins, including the Federal Reserve and Treasury.

After more than $200 million dollars worth of crypto was stolen in recent months from tampered Ledgers, and Coldcards where the seed generated wasn’t truly random, faith in hardware wallets has been shaken to the core.
These Bitcoin and crypto holders did everything right. They bought the products from official sources, correctly stored their seed phrases and they trusted in the phrase “not your keys, not your coins”, but they lost out any way. The thefts suggest that even the most diligent crypto holder using a hardware wallet faces risks beyond their control.
With the number of physical attacks on crypto holders rising — there’s been a $5 wrench attack in France every 2.5 days this year — the drawbacks of storing crypto on a hardware wallet are becoming clearer. And that’s even before you consider how many crypto owners have lost wallets and seed phrases over the years — “boating accidents” for tax purposes excluded.
There are plenty of drawbacks with all of the alternative methods of holding crypto however, so spreading your stack across different addresses and via different methods will at least minimize the damage if any one method is compromised.
Here are five alternatives for storing your crypto.
1. Crypto ETFs: Trusting BlackRock may now be an option
The first and most important caveat to this hardware wallet alternative is that it isn’t technically a way to store crypto at all. Even if you deposit Bitcoin directly, it is exchanged for shares in a financial product that holds crypto assets through a custodian. You end up with a claim on the ETF’s net asset value in dollars, not in Bitcoin. So there are trade offs.
On the one hand, using crypto exchange-traded funds (ETFs) removes many of the headaches associated with direct ownership, like protecting your seed phrase, backing up your wallet or worrying about every knock at the door.
On the other hand, crypto ETFs present their own risks, like trusting a centralized provider, third-party custody arrangements, fees and potential deviations between the share price and the digital asset’s market price.
Crypto ETFs have their own risks. Source: SEC
Ophelia Snyder, co-founder of asset manager 21Shares, tells Magazine that exchange-traded products make more sense “for most people most of the time” due to “tax, estate planning and security reasons.”
However, the “ability to use crypto onchain” and “some risk exposure to the issuer” are among the main trade-offs. She also says that security depends on the provider, and the controls around its wallet infrastructure should be a “major factor” when choosing a product.
Pseudonymous Bitcoin stock-to-flow (S2F) model creator PlanB moved his BTC to ETFs in 2025 and said he was widely criticized for that decision. After the Ledger and Coldcard incidents, however, he said, “Zero regrets of my ETF decision. Peace of mind.”
2. Passkey-based wallets: Move away from seed phrase management
Passkeys let users access accounts with a cryptographic credential stored on a device (typically a phone via Apple or Google passkeys), often protected by a fingerprint, face scan or PIN. Unlike hardware wallets, they don’t require a dedicated device to keep crypto keys offline. Passkeys are more common for chains that have smart contracts.
Some passkey-based options include Coinbase Wallet’s Smart Wallet, Clave and Infinex, with differing designs and recovery options.
While passkeys may provide a smoother user experience, they aren’t a panacea; losing a device or passkey can still create problems, so users should check how backups work and whether recovering access requires trusting a third party.
In June 2024, Adam Back, chief executive of Bitcoin infrastructure provider Blockstream, questioned Coinbase’s Smart Wallet, asking what would happen if a passkey were hacked; “sounds like basically a hosted wallet with a better sales pitch,” he said.
3. Multisig wallets: Split control across multiple keys
As the name implies, a multisignature wallet requires multiple keys to authorize a transaction. In common 2-of-3 setups, three separate signers hold keys, and any two must approve a transaction before funds can move.
Multisig can reduce reliance on a single key or device, but it doesn’t always eliminate the need for a hardware wallet. Casa, for example, offers multisignature custody for individuals and families, with a setup combining a hardware wallet, a mobile phone and a key held by Casa.
PlanB says no regrets moving BTC to an ETF. Source: PlanB
Many of the largest Ethereum ecosystem projects manage their treasuries via Safe wallet (formerly Gnosis Safe) — an on chain smart account multisig with a web based interface.
While that setup can reduce the risk of a single compromised or lost key, multisig arrangements have disadvantages too.
Multiple-person setups, for example, need the signers to remain available, while smart contract wallets can introduce vulnerabilities in their code or configuration, and an attacker who compromises enough signers can still authorize a transaction.
Coordinating approvals can also slow down transfers, which can be unhelpful when time is of the essence, particularly when signers are in different locations and time zones.
Casa chief executive Nick Neuman told Cointelegraph earlier this month that, even with a multisig setup, users should still spread their risk across multiple providers rather than rely on just one.
4. Centralized exchanges: Let someone else handle custody
Keeping crypto on a centralized exchange transfers the responsibility for private key management to a company and removes most of the burden of being responsible for your own security. It’s certainly more convenient for active traders or holders who don’t want to manage backups and recovery phrases.
But the old refrain “not your keys, not your coins” is particularly pertinent here. Crypto’s short history is littered with incidents of exchange hacks and exploits, from owners taking access to user assets with them to their graves to one of the largest BTC hacks in history, with investors still waiting to recover their coins 13 years later.
Of course, centralized exchange operational security has come a long way, and many now publish proof-of-reserves reports or have emergency funds to help cover losses.
Many centralized exchanges publish proof-of-reserves reports. Source: Binance
That said, proof of reserves doesn’t actually establish a company’s full financial health or ability to meet every obligation.
And with the rise in crypto reporting requirements, including through the OECD’s Crypto-Asset Reporting Framework, exchanges require customers to provide identity, residency or tax information, and failure to comply can lead to account restrictions or suspended withdrawals.
5. Paper wallets: Offline but not necessarily safer
A paper wallet traditionally consists of a cryptocurrency address and its corresponding private key printed on paper.
While paper wallets keep key material offline without requiring a dedicated hardware device, generating one safely can be difficult, as a compromised computer, malicious generator or poor source of randomness can expose the key before it is printed.
And of course, paper can also be easily lost or damaged; you definitely don’t want to smoke a celebratory cigar next to this form of crypto storage (stamping the seed onto metal is a good alternative however). Spending funds can also compromise security if the private key is imported into an internet-connected wallet.
So while paper wallets are an alternative to hardware wallets, for most users, they simply aren’t a better one, and are a poor fit compared with more manageable offline-storage options.
At the end of the day, there is no one ideal way to store your crypto, and for every holder, it will come down to their personal circumstances and needs. As Snyder says:
“Self-custody users have a tendency to be in two camps: either long-term crypto natives who have a strong view on their personal security practices and everyone else.”
If you aren’t in the first group, she says, self-custody may generally not be the best fit for you, and having some crypto on a centralized exchange and an ETF can be “a really useful tool as part of a portfolio approach to holding crypto.”
Magazine: ‘Bunker mode’ won’t protect your crypto, critics say

Tether has led a pre-seed funding round in Bolivian fintech Peso, which offers USDT payments through food delivery apps and local banking networks, to support the company’s expansion across Latin America.
In a Wednesday announcement, Tether said the investment will help Peso expand its stablecoin payment infrastructure across Bolivia, Brazil, Colombia and Argentina, including services that connect USDT with local currencies through banking and merchant payment systems.
Peso has integrated USDT payments into Yango’s food delivery service in Bolivia, allowing customers to pay for orders using the stablecoin. The fintech offers QR payments, point-of-sale services for merchants and virtual accounts linked to Bolivia’s banking system through ACH transfers. Tether did not disclose the size of its investment.
Source: Tether
The investment comes as other fintech companies expand USDT-based financial services in Bolivia. On Tuesday, lending platform Tala announced a partnership with El Dorado to offer credit directly through the digital wallet, allowing eligible customers to receive and repay loans in USDT on the Tempo blockchain.
Bolivia turns to stablecoins amid US dollar shortage
Bolivia has increasingly turned to stablecoins since 2025 amid a prolonged US dollar shortage and high inflation, with businesses beginning to accept USDT for purchases as access to foreign currency became more difficult.
In November 2025, the government announced plans to integrate cryptocurrencies and stablecoins into the financial system, including allowing banks to offer digital asset custody and crypto-linked financial products.
The government subsequently began considering a regulatory framework in July 2026 that would recognize USDT for payments, savings and trade alongside the boliviano and US dollar.
The proposal came as Bolivia struggled with a prolonged dollar shortage after abandoning its longstanding currency peg in June, fueling demand for dollar-denominated alternatives such as USDT, as Cointelegraph reported in July.
Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time

US President Donald Trump hosted a roundtable at the White House on cybercrime, even as he and members of his administration face scrutiny from lawmakers and voters over accusations that they used their positions to enrich themselves with digital assets.
Speaking at the roundtable event on Wednesday, Trump said “countless” Americans lost more than $20 billion from cybercrime in 2025 through impersonation schemes, ransomware attacks, scam centers and other methods. The president added that federal officials had frozen $1 billion in “cybercurrency tied to foreign scammers” and prevented $1.6 billion in losses in 2025 from going to criminals engaging in cybercrime following a March executive order.
Secretary of Defense Pete Hegseth (left), President Donald Trump (center) and Attorney General Todd Blanche (right) speaking at the White House on Wednesday. Source: White House
Notably, neither the president nor Attorney General Todd Blanche explicitly used the term “cryptocurrency” or “digital assets” when discussing the scams affecting many Americans, despite reports before the roundtable signaling a crackdown on foreign crypto scams would be the focus of the event. Homeland Security Secretary Markwayne Mullin similarly only referred to “digital extortion.” “Cybercurrency,” the word Trump used, is a dated term for what many people now call cryptocurrency.
The Federal Bureau of Investigation reported that Americans had lost $11 billion from scams in 2025 specifically related to digital assets, including through crypto ATMs. Cointelegraph reached out to the White House for comment on the roundtable but did not receive an immediate response.
The president and his family are tied to several crypto ventures which Trump reported netted him $1.4 billion in 2025, while his alleged “schemes” cost investors about $4.7 billion, according to a Public Citizen report. His family’s crypto company, World Liberty Financial, also faces scrutiny for its USD1 stablecoin being used to settle a $2 billion investment in Binance by an entity tied to Sheikh Tahnoon bin Zayed Al Nahyan in the United Arab Emirates.
Trump’s memecoin project, Official Trump (TRUMP), is hosting another dinner for tokenholders on Nov. 22. Similar events organized by the team behind the memecoin have prompted accusations from lawmakers and interest groups of Trump selling access to the presidency through “pay-to-play” schemes.
Italian police arrest 30 people in crypto money laundering scheme
The White House roundtable followed reports that Italian authorities arrested 30 people for using crypto to launder millions of dollars through a bank allegedly tied to the mafia. According to Bloomberg, Italy’s police were investigating a criminal network that sent money from corporate fraud, crypto investment scams, and drug trafficking to digital wallets.
Magazine: Can the SEC and CFTC’s pro-crypto rules be overturned? Legal opinion

The Cardano Foundation has urged the European Union not to introduce new, standalone regulations for decentralized finance and staking, arguing that existing financial laws should govern such activities based on their functions and risks rather than the technologies they use.
In a Wednesday blog post outlining its 19-page Sept. 30 submission to the European Commission, the foundation called for a distinction between direct participation in decentralized networks and financial services provided by intermediaries, particularly those involving custody or control of users’ assets.
“Regulation should follow the substance of an activity, the functions performed, and the risks created, not the technology through which it is conducted,” the foundation wrote.
The foundation said Cardano users can delegate their native ADA (ADA) tokens to help secure the network without surrendering custody or locking their tokens, arguing that such participation should be treated differently from staking services operated by intermediaries.
The submission also called for clearer distinctions between the EU’s Markets in Crypto Assets Regulation (MiCA) and existing financial laws, warning that overlapping requirements and inconsistent interpretations across member states could create uncertainty for crypto businesses.
The foundation’s position comes as EU regulators consider expanding oversight of crypto services. In September, the European Securities and Markets Authority (ESMA) recommended additional safeguards for staking, lending and borrowing, along with a new regulated service category for firms providing access to DeFi protocols.
The Cardano Foundation has also pushed for greater regulatory clarity across the Atlantic, joining five other blockchain organizations in an Oct. 20 letter urging the US Securities and Exchange Commission to formally recognize digital commodities as non-securities under its proposed crypto framework.
Magazine: Can the SEC and CFTC’s pro-crypto rules be overturned? Legal opinion

The UK’s Financial Conduct Authority (FCA) announced two consultation periods for how companies using decentralized finance can comply with its guidance, and exclusions for certain crypto assets following “recent legislative changes.”
In a Wednesday notice, the FCA opened consultation periods for helping DeFi companies comply with the financial watchdog’s rules on money laundering and financial crime. The agency also announced a consultation for “exclusions from cryptoasset regulation,” citing recent legislation in the country.
Regarding DeFi, the FCA said that the proposed guidance “seeks to clarify existing rules rather than establish new policy.”
“DeFi sits among the most innovative parts of [Financial Services],” said the UK Cryptoasset Business Council in response to the consultations. “The UK can still strike the right balance - clear perimeter rules, expectations that stay proportionate, and a framework that lets responsible innovation take root here instead of migrating elsewhere [...] the FCA needs to get this right.”
The crypto regulation exclusions referred to the FCA’s reveal of a regulatory regime, including stablecoin holding arrangements and reserve assets, expected to be enforced starting in October 2027. The FCA opened applications for crypto entities on Sept. 30, with a Feb. 28, 2027 deadline for companies seeking to be in compliance with the rules.

US Treasury Secretary Scott Bessent has compared the Trump administration’s landmark stablecoin legislation to banking reforms enacted under President Abraham Lincoln, drawing parallels between two efforts to establish a national framework for American currency more than 160 years apart.
In a Wednesday post on X, Bessent hailed the Office of the Comptroller of the Currency’s (OCC) final rule implementing the GENIUS Act, calling the legislation a “watershed moment in American finance.”
Bessent drew a comparison to the National Currency Act of 1863, which established a federal framework for nationally chartered banks to issue currency. He argued that the GENIUS Act serves a similar purpose for payment stablecoins in the digital age.
Bessent said the OCC rule would support “private-sector innovation, competition, and American leadership in digital assets.”
Source: Scott Bessent
As Cointelegraph reported Wednesday, the OCC finalized rules governing stablecoin reserves, redemptions and related services. The rules are scheduled to take effect on Jan. 18, 2027.
Jonathan Gould, comptroller of the currency, described the regulations as a “clear, practical framework for payment stablecoin innovation.”
What the OCC’s stablecoin rules mean for issuers
The GENIUS Act, signed into law in 2025, established a federal regulatory framework for payment stablecoins. The OCC’s final rule sets out how that framework will apply to issuers under its supervision, including requirements for reserves, redemptions and risk management.
Beginning Jan. 18, 2027, companies issuing payment stablecoins in the United States will generally need regulatory approval under the GENIUS Act. Issuing stablecoins without the required authorization could carry penalties.
The OCC said the final rule covers national banks, federal savings associations, federal branches of foreign banks and nonbank companies seeking approval to issue payment stablecoins under federal supervision. It also covers certain foreign payment stablecoin issuers.
The rules come as dollar-denominated stablecoins gain traction for payments and money transfers, even as growth in their overall supply has stalled.

Six major blockchain organizations, including Chainlink Labs and the Cardano Foundation, have urged the US Securities and Exchange Commission (SEC) to formally classify digital commodities as non-securities, as the agency’s public consultation on proposed crypto regulations came to a close Tuesday.
In a joint letter dated Oct. 20, Chainlink Labs, the Cardano Foundation, Hedera, Aptos Labs, Ava Labs and the Stellar Development Foundation called on the SEC to incorporate its digital commodity classification directly into the proposed Regulation Crypto Assets framework, arguing that interpretive guidance alone leaves market participants facing legal uncertainty.
The groups argued that the SEC’s existing interpretation recognizes digital commodities as a distinct category but that the proposed rules fail to explicitly reflect that distinction, potentially leaving developers and other market participants uncertain about which securities regulations apply.
Source: Taylor Barr
The letter also seeks greater clarity on how securities laws apply to secondary-market transactions involving digital assets, as well as the treatment of staking and other activities associated with decentralized blockchain networks.
The SEC’s proposed crypto framework, introduced in August, drew roughly 140 public comments over 60 days, with industry participants and legal scholars offering competing views on proposed exemptions for crypto offerings and a conditional safe harbor for certain tokens.
Magazine: 5 alternatives to Ledger to store your Bitcoin

Bitcoin (BTC) passed $84,000 after Wednesday’s Wall Street open as US stocks added to gains on more strong corporate earnings reports.
Key points:
Bitcoin climbed nearly 2% on Wednesday to return to $84,600 for the first time since Oct. 7.
SpaceX Q3 operating revenue beat expectations by nearly 15%, coming in at $14.6 billion.
BTC price action needs a daily close above $83,400 to shift the focus higher in its trading range, crypto analyst Rekt Capital wrote.
SpaceX Q3 earnings help propel Bitcoin to $84,600
Data from TradingView showed BTC/USD gaining nearly 2% on the day as markets reacted to a significant Q3 earnings beat from SpaceX.
BTC/USD one-day chart. Source: Cointelegraph/TradingView
After the market close on Tuesday, SpaceX reported a Q3 revenue of $14.6 billion, up 161% year-on-year and beating expectations by nearly 15%. The net income of the company was $4.4 billion for the quarter.
“The combination of our launch leadership, recurring Starlink revenue, and the significant expansion of our SI infrastructure continues to drive meaningful operating leverage,” chief financial officer Bret Johnsen commented on the earnings release.
US stocks were green at the start of the US trading session, with the tech-heavy Nasdaq Composite Index 0.7% higher at 26,601 points before retracing some of its gains. Tesla and Meta earnings are due after Wednesday’s market close.
Nasdaq Composite Index one-hour chart. Source: Cointelegraph/TradingView
In a note quoted by CNBC, analysts at Truist Securities suggested that SpaceX’s performance had helped to calm market fears over corporate spending on AI buildouts. Last week, those misgivings resurfaced in a fresh tech sell-off that began in South Korea and spilled over to Asia and the US.
“Despite market concerns relating to financing for AI cloud providers this past week, we believe SpaceX’s third-quarter 2026 represents the first data point during the earnings season to support the bull case for AI cloud providers,” Truist wrote.
South Korea’s KOSPI Composite Index finished Wednesday’s trading session 3.29% higher at 5,735 points.
KOSPI Composite Index one-day chart. Source: Cointelegraph/TradingView
Analyst: BTC needs to reclaim $83,400 at daily close
BTC price action began to clear ask liquidity around $84,000, with total crypto short liquidations nearing $110 million over the past four hours, per data from CoinGlass.
BTC liquidation heatmap. Source: CoinGlass
On four-hour time frames, BTC/USD broke above its 200-period simple moving average (SMA) at $83,878 for the first time since Oct. 14. The $84,000 mark hosted multiple equal highs originally generated between Oct. 11 and Oct. 14, reinforcing its status as a resistance level.
BTC/USD four-hour chart with 200-period SMA. Source: Cointelegraph/TradingView
In analysis on Wednesday, crypto trader and analyst Rekt Capital said that Bitcoin still needed a daily close above $83,400 to revisit the top of its local range.
“Bitcoin needs to avoid rejecting from $83400 (red) because that would once again send price below $82500,” he summarized on X alongside an explanatory chart.
BTC/USD one-day chart. Source: Rekt Capital on X.com

Solana’s first major consensus upgrade, Alpenglow, went live on mainnet around 1:54 pm UTC on Wednesday, according to the Solana Foundation’s Alpenglow dashboard.
Alpenglow seeks to reduce transaction finality by 99%, to roughly 150 milliseconds from about 12.8 seconds, according to the Solana Foundation’s July announcement.
The upgrade’s first phase, Votor, replaces the existing voting and finalization mechanism with direct validator voting and a certificate-based system designed to cut transaction finality to roughly 150 milliseconds. A later phase will introduce Rotor, a new block data-distribution protocol intended to replace Turbine.
Alpenglow is Solana’s first major consensus upgrade, replacing its current consensus model, TowerBFT. The upgrade’s 150-millisecond finality target seeks to introduce near-immediate transaction finality for users, which could mean faster payments, trade settlements and more responsive applications.
Cointelegraph has approached the Solana Foundation for comment on Alpenglow’s finality measurements in testnet environments and its expected performance in real-world applications.
Solana Alpenglow activation dashboard. Source: Solana.com
At press time, the Solana mainnet showed a 6.6-second transaction finality and a throughput of 4,721 transactions per second, according to the Alpenglow dashboard.
Alpenglow marks “biggest change” for Solana’s core protocol: Anza
Alpenglow will introduce the “biggest change to Solana’s core protocol” since genesis, Anza researchers wrote in a May blog post.
A 150-millisecond latency, “Solana can compete with Web2 infrastructure in terms of responsiveness, potentially making blockchain technology viable for entirely new categories of applications,” wrote Anza researchers Quentin Kniep, Kobi Sliwinski and Roger Wattenhofer on May 19.
In August, Solana reduced its slot time for the first time since genesis, as part of the Solana Foundation’s plans to halve slot times to 200ms, arguing that it would improve latency and accelerate confirmations on the blockchain network. It completed the fourth stage of the slot reduction plan in October.
Following Alpenglow, Solana validators are expected to continue working on Agave 4.5, an upgrade that proposes increasing the number of accounts supported by a versioned transaction from 64 to 96. The increase could create better swap routes and execution prices, according to the Solana Foundation. The upgrade is currently in development and planned for December 2026.
SOL/USD, 1-year chart. Source: CoinMarketCap
The Solana (SOL) token’s price rose nearly 3% in the 24 hours leading up to the upgrade, reversing part of its 42% decline seen during the past year, according to CoinMarketCap.
Magazine: Solana’s fee overhaul increases burn and makes resource hogs pay

Cryptocurrency trading bots and exchange applications may remain exposed to the eMudhra certificate security flaw despite emergency fixes from major technology companies, according to blockchain security company CertiK.
By Tuesday, tech giants including Google, Apple and Microsoft had blocked eight vulnerable certificates issued by India’s eMudhra, but the fixes may not protect crypto applications using separate security systems, CertiK’s senior director of digital assets security, Peiyu Wang, told Cointelegraph.
“Major browser blocks substantially reduce the risk for clients that receive and enforce them,” Wang said. “Some applications outside the browser ecosystem do not enforce Certificate Transparency or receive the same revocation protections.”
Wang stressed that crypto services are not inherently more susceptible to the flaw than other industries, but attackers could exploit compromised certificates to impersonate the HTTPS connections used by exchanges, wallet interfaces and APIs.
Attackers could specifically impersonate crypto services and replace deposit addresses or trick users into approving malicious transactions, Wang said. Such attacks would also require intercepting or redirecting users’ internet traffic, while the compromised certificate authority keys alone would not expose wallet private keys.
Wang urged crypto operators to update their software and certificate trust stores and verify that their applications reject the affected certificates.
Felix Ng contributed reporting.

The US Office of the Comptroller of the Currency finalized rules Wednesday for payment stablecoin reserves, redemptions and related custody activities, implementing the GENIUS Act for entities under its jurisdiction.
The final rule states issuers must maintain reserves worth at least as much as their outstanding stablecoins and generally process redemption requests within two business days.
The rule applies to national banks, federal savings associations and federal branches and their subsidiaries, as well as nonbank firms that seek or receive federal qualified issuer status, according to the agency’s announcement. It also covers state-qualified issuers when the OCC has regulatory or enforcement authority over them.
The rule and the GENIUS Act will take effect Jan. 18, 2027.
“We are providing a clear, practical framework for payment stablecoin innovation, with strong standards for reserve backing, redemption, and risk management,” Comptroller of the Currency Jonathan Gould said.
The OCC dropped a proposed presumption that certain arrangements involving affiliates or related third parties violate the law’s yield ban. The final rule retains the ban on issuers paying holders interest or yield solely for holding, using or retaining their stablecoins. The agency said it retains authority to act against attempts to evade that prohibition.
The OCC said it will announce separately when it begins processing issuer applications and waiver requests; the agency and Treasury will address Bank Secrecy Act, anti-money-laundering and sanctions requirements in separate rulemaking.
Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time

Standard Chartered signed definitive agreements to acquire Zodia Custody’s regulated operating entities, subject to regulatory approvals and closing conditions.
The signing advances a transaction announced in May, when Zodia’s shareholders accepted the bank’s non-binding offer.
As part of the deal, Standard Chartered would acquire 100% of Zodia Custody UK Limited, the parent company of Zodia’s regulated operating entities in Singapore, Hong Kong, Australia, Luxembourg and the United Arab Emirates, the bank said in a Wednesday announcement.
The transaction would integrate Zodia’s crypto custody business into Standard Chartered’s existing Securities Services operations. Zodia would also transfer its software and professional-services assets to Zodia Solutions, an independent entity under SC Ventures, which would provide digital asset infrastructure for financial institutions.
The UK-based lender reportedly began considering folding Zodia’s crypto custody business into its corporate and investment banking division in April.
The acquisition forms part of the lender’s broader expansion in crypto services. In September, Standard Chartered launched spot Bitcoin and Ether trading for institutional clients in the United Arab Emirates.

Decentralized exchange PancakeSwap’s total value locked (TVL) grew nearly 19% over the past week, adding about $380 million as the protocol moves toward a major overhaul of how it distributes trading fees to liquidity providers.
According to DefiLlama, PancakeSwap’s TVL climbed to $2.4 billion on Wednesday, up from about $2.02 billion on Oct. 14. The increase was concentrated in its V3 liquidity pools, where TVL more than doubled to about $739 million from $336 million over the same period.
The growth coincided with PancakeSwap opening a governance vote on a proposal called “The Flip,” which would increase liquidity providers’ share of swap fees on V3 and Infinity pools to 88%, up from 66%-68% on most pools.
The proposal would also gradually reduce daily CAKE token emissions by approximately 69%, from 22,500 to 7,000 tokens. Voting opened on Wednesday, Oct. 21, and will run until Oct. 24, with implementation expected to begin in November if approved.
PancakeSwap leads BNB Chain trading as tokenized stocks expand
PancakeSwap accounted for approximately $4.67 billion in decentralized exchange trading volume on BNB Chain over the past seven days, representing about 71% of the network’s total, according to DeFiLlama. The network also hosts most of PancakeSwap’s liquidity, accounting for roughly $2.33 billion of its $2.40 billion in TVL.
The activity comes amid broader growth across BNB Chain’s DeFi ecosystem. That network’s TVL climbed approximately 8.3% over the past seven days to $5.84 billion, according to DeFiLlama. Decentralized exchange trading volume also surged 40.2% to $6.54 billion over the same period, even as its stablecoin market capitalization declined 0.6% to $13.1 billion.
Beyond crypto, BNB Chain has also seen an expansion in tokenized equities, a market in which PancakeSwap has an established presence. The decentralized exchange began supporting Binance’s bStocks in June, allowing users to trade tokenized US stocks onchain.
On Oct. 15, Binance announced that bStocks surpassed $1 billion in assets under management, approximately four months after launching. The company reported more than $40 billion in cumulative trading volume and said 11.2% of bStocks’ value was deployed in DeFi in early October.
Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time

France wants cryptocurrency platforms to face liability for certain decentralized finance (DeFi) incidents if they fail to vet protocols or ignore known security risks.
French authorities published proposals Wednesday to revise the European Union’s Markets in Crypto-Assets Regulation (MiCA). The joint response to a European Commission consultation came from France’s Treasury, the Financial Markets Authority (AMF), the central bank and the Prudential Supervision and Resolution Authority (ACPR).
“CASPs [crypto-asset service providers] should be liable for certain incidents affecting clients where they actively facilitated access,” French authorities said.
MiCA excludes crypto services provided in a fully decentralized manner without intermediaries. France’s proposal would extend investor safeguards by imposing new duties on regulated platforms that connect customers to DeFi protocols.
The Commission is reviewing whether MiCA needs updating as crypto markets develop. Its consultation sought views on activities outside the law’s original scope, including DeFi. The responses will inform a report to EU lawmakers due by June 30, 2027, which could include proposals to amend the law.
DeFi access could come with new obligations
French authorities proposed requiring platforms to vet DeFi protocols before offering access and monitor them for vulnerabilities and suspicious activity. They also backed certification of protocols and smart contracts, along with platform liability for certain incidents.
The requirements would apply fully to significant CASPs, with obligations scaled for smaller providers.
Platforms could still connect customers to uncertified protocols if they conduct their own due diligence and provide enhanced risk disclosures, the authorities said.
The authorities also addressed non-custodial or self-custodial wallets by opposing blanket certification requirements for developers. They favored voluntary certification for more advanced wallets that integrate DeFi services.
France pushes for wider MiCA overhaul
Beyond DeFi, France backed plans to transfer supervision of “significant CASPs” from national regulators to the European Securities and Markets Authority (ESMA).
The authorities also proposed lowering MiCA’s current threshold of 15 million average daily active users in the EU for identifying significant CASPs. They also suggested considering custody assets, business risks and group complexity when deciding which platforms should fall under ESMA supervision.
France also called for a review of MiCA’s asset-referenced token (ART) category, which covers tokens designed to maintain a stable value by referencing assets or combinations of assets. The authorities noted that no ARTs had been authorized under MiCA and proposed adapting the e-money token (EMT) framework to cover multicurrency stablecoins.
Magazine: MiCA is coming for DeFi vaults, but regulation will be difficult

Bitcoin (BTC) investors sitting on unrealized losses are capping price gains at $87,700, while ETF inflows strengthen support at $80,000, analysis reveals.
Key points:
Bitcoin investors who bought BTC in the latter stages of 2025 have an aggregate cost basis of around $87,700, which now functions as resistance per Glassnode analysis.
The area immediately above $87,000 hosts several resistance levels including the 2026 open at $87,490 and the 20-month moving average at $87,165.
Bitcoin price support at $80,000 strengthens as bid liquidity focuses on this psychological level.
Bitcoin 2025 buyers add to $87,000 resistance zone
New research from onchain analytics platform Glassnode reveals that the breakeven point for a cohort of new Bitcoin holders is currently acting as resistance.
Since the start of the year, two groups of holders have kept BTC/USD from moving higher once it challenges their acquisition cost basis.
In November 2025, price lost the cost basis of investors with entries between six and 12 months prior, which sat at $94,000 at the time. When price attempted to break above the trendline at $97,100 in January 2026, it became resistance, triggering a rejection and sending price lower.
A similar resistance trendline is given by the cost basis of investors who bought BTC one to two years prior. This cohort slipped into aggregate loss in February of this year as price lost its cost basis of $76,900. In May, the cost basis halted a price rebound at just above $82,000.
In both cases, underwater buyers looking to exit their positions at breakeven produced a wall of sell-side pressure that new demand could not match. Commenting, Glassnode noted the extent of BTC price retracements after rejections from either cost basis.
“Bitcoin rose to the 6-12 month cost basis in January and then fell by more than a third. It met the 1-2 year cost basis in May and fell by about a quarter,” it said. “The 1-2 year holders also stepped up their selling into the rally at the start of October.”
The cost bases for the six-to-12-month cohort and one-to-two-year cohort are currently $87,700 and $99,500, respectively.
BTC/USD chart with cohort breakeven levels (screenshot). Source: Glassnode
The area above $87,000 also contains the 2026 opening price at $87,490 and the 20-month simple moving average (SMA) for BTC/USD at $87,165, a level that has historically preceded new all-time highs once reclaimed as support.
ETF cost basis hosts new BTC price support
Below current spot price, the cost basis of the US spot Bitcoin exchange-traded funds (ETFs) marks one of several support levels of interest around the $80,000 mark.
Glassnode calculates the spot ETF cost basis at $81,500, while Bitcoin’s true market mean — the cost basis for all BTC acquired on secondary markets — sits at $77,500. Below this, the breakeven point of Bitcoin’s short-term holders — wallet entities holding a given amount of BTC for up to six months without selling — lies at $74,600.
As an important psychological level, $80,000 now forms a magnet for bid liquidity across exchange order books.
“The block sits just under the US Spot ETF Cost Basis, so the zone between $80K and $81.5K is where order-book and on-chain support overlap. A break below it would bring the liquidation cluster just under $80K, and then the True Market Mean near $78K, into play,” Glassnode commented.
BTC/USD chart with cost-basis data, true market mean (screenshot). Source: Glassnode

South Korea’s Shinhan Card announced Wednesday that it signed an agreement with Japan’s SBI VC Trade and SBI XDC Network APAC to test yen stablecoin payments for travelers and cross-border trade settlement.
Under the pact signed Tuesday, the companies will test stablecoin card payments, wallet-to-wallet payments and cross-border trade settlement. They will also assess anti-money-laundering and fraud-detection controls.
Shinhan Card is one of South Korea’s biggest credit card companies. SBI is a Japanese financial heavyweight that runs banks, brokerages, insurers and crypto exchanges.
The latest initiative is intended to support cross-border payments and settlement between the East Asian nations and improve payment convenience for travelers.
Travel between the two countries generated more than 10 million visitor arrivals in the first eight months of 2026, according to official tourism figures from both countries. South Korea was Japan’s largest source of foreign visitors with 7.42 million arrivals. Japan was its neighbor’s second-largest source with 2.7 million arrivals.
Shinhan Card announced in April that it had completed a proof-of-concept testing that covered stablecoin payments and cross-border settlement.
SBI VC Trade registered in March 2025 as Japan’s first electronic payment instruments exchange service provider, enabling it to handle USDC.

Zcash (ZEC) surged about 12% over the past 24 hours, as developers agreed on a mainnet activation block for the network’s NU7 upgrade, expected in early November.
The token traded around $1,270 at last look on Wednesday, according to CoinGecko. The rally coincided with a Tuesday GitHub proposal by Zcash developer Sean Bowe setting the activation at block 3,543,405, expected around Nov. 5.
The value of the privacy-focused cryptocurrency that uses advanced trustless zero-knowledge proofs is up more than 148% year to date.
“Height agreed at ZIP editor meeting,” Bowe wrote, adding that the team still needed to finalize the upgrade specifications before merging the proposal. Two developers approved the changes.
The Zakura NU7 dashboard also lists the upgrade as pending on mainnet at block 3,543,405, with activation expected around Nov. 5.
NU7 aims to reduce Zcash’s target block time by two-thirds to 25 seconds, allowing transactions to receive confirmations more quickly. The upgrade from 75-second block time has been undergoing testing since early October.
Meanwhile, the Zcash Foundation’s NU7 readiness tracker showed six of 12 tasks completed, with remaining work involving Zebra node synchronization issues and mainnet preparations. Developers have not confirmed whether these outstanding issues could affect the planned activation date.

A Drift exploiter-linked wallet transferred 18,800 Ether, worth about $46 million, to Tornado Cash on Wednesday.
The exploiter transferred $61 million in Ether to the crypto mixer on Tuesday, taking its two-day total to 44,510 ETH, or $109 million, as blockchain data tracker Onchain Lens said on X.
The transfers to Tornado Cash make the funds harder to trace and represent nearly 37% of the $295 million stolen from decentralized exchange (DEX) Drift in April. The attack ranks as this year’s third-largest crypto hack, according to DefiLlama.
The Drift exploiter-labelled wallets still held 56,569 Ether, worth roughly $138 million after Wednesday’s flurry of transfers, Arkham data shows.
The Solana-based DEX reported about $295 million in losses from the April 1 hack, which its security consultant Mandiant attributed to a North Korean threat group.
Drift opened claims and redemptions for DFX recovery tokens on Oct. 1, giving affected users a claim on a pool that launched with about $3.1 million and receives exchange revenue and recovered funds.