Cryptopolitan

On October 22, 2026, Arista Networks fixed a VeloCloud Orchestrator zero-day vulnerability that attackers had already exploited. The vulnerability puts businesses at risk because it affects the system used to handle network connections across multiple sites.
How a read-only account becomes a superuser
Advisory 0199 of Arista identifies the vulnerability as CVE-2026-114625, an SQL-injection vulnerability rated 9.9 under CVSS v3.1. The danger lies in how much control an attacker can gain, even with the lowest level of access.
To take advantage of the vulnerability, an attacker needs access to the web interface and valid login credentials. Once logged-in, the attacker can use the SQL-injection vulnerability to elevate an Enterprise Read Only account, the platform’s lowest-privilege role, to operator privileges and impersonate a superuser. The vulnerability therefore allows someone with read-only access to gain control over the platform. Arista confirmed that attackers have already exploited the vulnerability.
The patches and the forensic checklist
On-premises operators should check their software versions. Affected 5.2.x, 6.1.x and 6.4.x releases require fixed builds 5.2.3.18, 6.1.3.10 and 6.4.2.12, respectively, or later releases in those trains. Hosted and Dedicated deployments are already patched.
Arista VeloCloud Zero-Day: Fixed Builds, CVEs, and Attack IPs
According to Arista, both attacks originated from the following source IPs: 74.82.197.86 and 38.54.50.151. The company advises system administrators to look into suspicious web requests, unexpected outbound connections, and unusual administrator activity. It also recommends limiting management access to trusted networks and preserving relevant logs if case of a suspected breach.
The third VeloCloud flaw since summer
The SQL-injection vulnerability is the third actively exploited flaw reported in VeloCloud Orchestrator within three months.
Arista’s advisory 0144, first issued on July 27, 2026, covered an OS command-injection vulnerability. Another flaw was disclosed on September 22 through advisory 0183. Both involved different methods of attack from the latest vulnerability.
Even though there are differences between the three vulnerabilities, they still affected the same central management platform. Since VeloCloud Orchestrator manages connections across multiple sites, a breach to the platform could compromise several networks.
Patches now land after the exploits
Verizon’s 2026 Data Breach Investigations Report revealed that vulnerability exploitation accounted for 31% of data breaches. It has overtaken stolen credentials as the leading method attackers used to gain access to networks. The results emphasize the need for businesses to fix vulnerabilities before attackers take advantage of them.
However, businesses are usually unable to fix vulnerabilities before attackers take advantage of them. According to the Google M-Trends 2026 report, attackers exploit system vulnerabilities for an average of seven days before a fix is available. The report further mentioned some threats against network devices such as VPNs and routers that do not have a standard endpoint monitoring.
AI could make the situation more dangerous. In a separate investigation, Google researchers documented attackers using AI to plan and execute a large-scale credential-harvesting campaign in under six hours. The operation compromised thousands of third-party credentials.
Although there is no confirmed evidence that AI played a role in the VeloCloud attacks, Google’s findings show how AI-assisted operations can help attackers move faster and potentially cause greater damage before security teams can respond.
Why successive fixes matter for a growing market
Cyberattacks can have serious financial consequences. IBM’s 2026 study estimated the average global cost of a data breach at $4.99 million. Concerns about emerging threats are also growing. The World Economic Forum found that 87% of respondents considered AI-related vulnerabilities the fastest-growing cyber risk during 2025.
The potential impact could grow as more businesses adopt SD-WANs, or software-defined wide-area networks, which connect multiple offices and allow companies to manage network traffic centrally. Dell’Oro Group forecasts 14% annual SD-WAN revenue growth through 2030. As these networks expand, a compromised central controller could disrupt business operations across multiple locations, potentially affecting companies in different countries.
Financial markets face similar concerns about operational disruptions. Cryptopolitan previously reported attempted cyberattacks against major hedge funds, raising questions about possible spillover into crypto markets. Although those incidents were separate from the VeloCloud attacks, they highlight the importance of protecting critical systems. For businesses using VeloCloud, that means applying patches, checking for earlier signs of compromise and securing the systems that connect their branches.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

The Trump administration is cracking down on American investments in China’s AI, military tech, and life sciences sectors. The US Treasury just unveiled regulations under the Comprehensive Outbound Investment National Security Act, which Congress approved in 2025 to tighten checks on investments in China, Russia, Iran, and other ‘countries of concern.’
For some time now, US officials have sought to block rival nations from the financial backing needed to upgrade their armed forces. Much like Trump’s recent policy move, former President Joe Biden had also issued an executive order limiting US capital flowing into China’s AI, semiconductor, and quantum computing sectors. Afterward, the Treasury launched the Outbound Investment Security Program.
The Treasury will still have to hear public feedback before finalizing regulations
For now, the Treasury’s proposed rules target investments in advanced semiconductors, artificial intelligence, selected biotech-related materials and compounds, and technologies such as brain-computer interfaces. They also apply only to investments exceeding $50,000.
Craig Singleton, a senior fellow at the Foundation for Defense of Democracies, noted that with these rules, Washington is signaling to global markets that it keeps tabs on American capital flows and the specific advancements they support. He noted that the added scrutiny reflects an understanding that cash injections can boost military power just as much as a tech transfer can.
“Biotech matters to both Wall Street and Main Street. It shapes the future of medicines and therapeutics, but some of the same technologies can also strengthen China’s military capabilities or deepen US dependence on Chinese supply chains,” he asserted.
The Treasury will review public feedback on the proposal before finalizing the regulations.
Treasury Scott Bessent anticipates that, once finalized, the regulations would reinforce the existing Outbound Investment Security Program and limit adversaries’ ability to use US capital to develop critical technologies that endanger national security. He added that the rules would foster an ‘open investment environment’.
Similarly, former US trade official Ryan Majerus, now a partner at the King & Spalding law firm, contended, “It’s just the first step in a fairly long process to get to changes which presumably will be more enforcement-minded, to put more teeth behind the outbound investment program.”
US investors face greater scrutiny when funding sensitive technologies
The proposal could also influence how American investors evaluate opportunities in Chinese technology. In the case of deals involving artificial intelligence, advanced computing, or biotechnology, firms might need to conduct more due diligence to ensure their investments comply with Treasury’s rules. That could raise compliance costs and make some transactions take longer.
For Washington, the goal is to limit access to American funds that could be used in developing technologies with military applications.
But there will be a sense that the exact outcome will be determined by the final regulations as to the scope, reporting requirements, and enforcement process. Investors will be closely watching the Treasury’s review process to gauge how the restrictions will work if transactions are subject to specific conditions.
The Treasury Department fined Amidi LLC for violations of OISP rules
Earlier this July, the Treasury Department levied a $200,000 penalty against an American company after one of its subsidiaries failed to report its $92,500 in backing for a Chinese AI and robotics firm.
Amidi LLC did not disclose its 2025 investment in Shanghai Qiongche Intelligent Technology Co., (Noematrix), a Chinese technology company working in artificial intelligence, robotics, and embodied intelligence.
At the time, Assistant Secretary of the Treasury for Investment Security Christopher Pilkerton contended that the OISP was preventing rival nations from using American money to develop dangerous technologies.
In a more recent disclosure, the Treasury stated that Bank of America failed to file reports on upwards of $5 billion in suspicious transactions with the Financial Crimes Enforcement Network.
A portion of these transactions was tied to Chinese laundering networks active along the US-Mexico border, and the bank was further accused of breaching global sanctions programs linked to Iran, Russia, terrorism, and drugs.
Overall, since Trump first took office, the US and China have been locked in a prolonged battle for economic and technological influence. Both sides have limited exports of critical materials and technologies, with China restricting rare earth minerals and the US controlling exports of advanced chips.
They have also introduced tariffs on each other’s products. Currently, both sides have agreed to slash or eliminate duties on $60 billion in products, with an even $30 billion split between American exports to China and Chinese exports to the United States.
The cuts offer relief across a range of merchandise, including fishing tackle, live horses, and camels. The Chinese Commerce Ministry even stated that around 90% of goods on both ledgers will slide back to variable most-favored-nation baseline rates.
If you're reading this, you’re already ahead. Stay there with our newsletter.

German publisher Axel Springer has expressed its eagerness to be involved in the potential deal involving the operations of Tiktok in Europe. However, contrary to the news, no such deal exists. Tiktok parent company ByteDance claims that the deal is “a total fabrication.”
The issue results in a significant question for crypto advertisers: does the change in ownership affect the approval process for ads by TikTok and its dealings with financial content? This is still unclear. What is definite is that any new owner would still have to adhere to regulations that are already in place in Europe.
Döpfner’s reported January pitch, and ByteDance’s denial
Financial Times reported that Mathias Döpfner, the CEO of Axel Springer, has indicated that they might take part in a TikTok deal in Europe during a meeting in January 2026 with Charles Kushner, the US ambassador to France. The publishing company further stated that Döpfner was in favor of working on a similar arrangement that TikTok engaged in in the US and that the company “would have welcomed the opportunity” to participate.
However, ByteDance dismissed the report claiming it was “a total fabrication and not even worth dignifying with a comment.”
How crypto reaches users on TikTok today
TikTok decides what cryptocurrency ads can be placed on its platform. According to its September 2026 policy, it allows ads for licensed exchanges and custodial wallets in France, Germany and Austria, provided they have the consent of TikTok and target the adult audience. Direct advertising of cryptos including Bitcoin and Ethereum is prohibited in those markets.
A European owner might apply a different approach to advertiser approval, which would influence their access and costs. However, there is no indication that TikTok aims to change its policy.
The rulebook a new owner could not touch
Under MiCA Article 7, promotions for covered crypto-assets must be clearly recognizable as marketing material. Their content must also be fair, clear and not misleading. They must also align with the published crypto-asset white paper and include the required disclosure information where necessary.
Regulators are also focusing on people promoting financial products on online platforms. ESMA’s finfluencer guidance highlights transparency and accountability. As Cryptopolitan reported, Italy’s CONSOB warned that adding “this is not investment advice” does not shield influencers from legal responsibility.
A change in TikTok’s ownership could affect how the platform handles crypto promotions. However, it would not remove these legal requirements or regulatory expectations.
Why the exposure is large
TikTok says it reaches 189 million people monthly in the EU. In the first half of 2026, it removed about 104 million pieces of violating content; 94.1% were actioned automatically.
The 2026 ADAN–Ipsos survey found crypto ownership among 11% of French adults, 17% in Germany and 20% in the Netherlands.
Quality is another concern. Queen Mary University research found nearly nine in ten sampled finfluencer posts had more negative than positive quality indicators. Just 3.9% of sampled TikTok posts stated the creator’s expertise.
TikTok Europe: Crypto Ownership Rates and EU Advertising Regulations
Transparency commitments and the GDPR shadow
On December 5, 2025, the European Commission accepted binding commitments from TikTok to make its advertising records searchable, disclose targeting details and update its ad repository within 24 hours.
TikTok has also come under fire for its treatment of user data. On May 2, 2025, Ireland’s Data Protection Commission announced that TikTok had been fined nearly €530 million for breaches of GDPR regarding the transfer of European user data to China. The Commission has also mandated TikTok to ensure compliance with data processing regulations within six months.
For crypto advertisers worldwide, a change in ownership could affect how they reach European customers. But it would not remove their responsibility to market crypto products lawfully or TikTok’s obligations to protect user data.
The smartest crypto minds already read our newsletter. Want in? Join them.

Apple has reportedly told assembler Foxconn and its component makers to raise the 12-month shipment target for the iPhone Duo by 44%. This would take the production figures from 9.7 million to 14 million units, just one day before the $1,999 foldable reaches stores. Apple has, however, not confirmed the figures.
Preorders emptied in minutes
Apple opened preorders for the Duo on October 16, but it sold out in record time. Within minutes, delivery estimates had gone past the October 23 launch date to as far back as late January, according to CBS News reports.
Max Weinbach of the research firm Creativestrat wrote on X that the device sold out at every store near New York and Connecticut inside three minutes.
To curb potential resale tactics, Apple capped orders at two per customer. This has done little to stop the resellers, though.
Yahoo Finance found eBay listings for the Duo, including unfulfilled preorders, at prices of over $4,000. This is about twice the $1,999 starting price for the 256 GB model.
A 44% bump in production amid multiple forecasts
DigiTimes reported on October 22 that Apple had asked Foxconn and its other component suppliers to increase production by 44% to 14 million units over the next 12 months, citing supply-chain sources.
9to5Mac corroborated the report, noting that Apple had described preorder demand as “extraordinary,” a term often used around iPhone launches.
Other estimates sit well below 14 million. JPMorgan analysts expect Apple to sell between 8 million to 9 million Duos in 2026, according to CNBC. China’s Securities Times reported that supply would remain below 10 million units till the end of the year, despite an earlier 30% increase in orders.
Dan Ives, a partner at Yorkville Ives, made a sales prediction of about 10 million units over the next few quarters, going as high as 25 million in 2027.
Limited walk-in stock, and reviewers’ reservations
Buyers without a preorder may struggle to get a phone. An Apple spokesperson said stores would have limited stock of the Duo for walk-in customers and added that the phones were expected to sell out quickly.
Customers in Macau, where the Duo is set to be sold only in stores, started a queue hours before sales opened, according to Reuters.
Early reviews praised the Duo’s hinge and hardware while stating a few drawbacks. These included the lack of a telephoto camera and third-party apps that were not as well adapted to the larger screen. They also mentioned a particular inconvenience when using the phone for quick tasks in a folded position.
In its review, 9to5Mac flagged app support as a key issue while adding that Apple is already testing a second-generation Duo with Face ID.
Why November 2 matters more than the launch
The new Duo device marks Apple’s biggest iPhone redesign since the device launched in 2007. This comes with major implications for its business. Apple’s iPhone generated $209.58 billion of the company’s $416.16 billion in fiscal 2025 revenue, while Services brought in only $109.15 billion, according to Yahoo Finance.
The Duo’s launch will not affect Apple’s fiscal Q4 results which are due November 2, since the September quarter ended before the phone went on sale. Its sales will instead count toward the December quarter.
Loop Capital recently lowered its rating on Apple to Hold from Buy. The brokerage firm’s reason is that the company would not recover the sales lost from planned iPhone production cuts in the second half of the year. Apple shares closed at $348.30 on October 22, up 1.25%.
IDC, however, expects the tech giant to capture 44% of the foldable phone market’s value in 2026, despite accounting for 31% of unit sales. The tech research firm also expects the company to lead the market by 2027.
The smartest crypto minds already read our newsletter. Want in? Join them.

Intel’s appeal for a waiver from the Federal Communications Commission (FCC) to continue to use foreign-made robots inside its US semiconductor plants has been granted. The decision spares the machines from a July import ban that the chipmaker had warned had the potential to stall its domestic manufacturing.
The order covers robotics that Intel claims are critical to its semiconductor manufacturing operations in the US.
Intel’s request to the FCC
Intel’s fleet of automated guided vehicles (AGVs), which move silicon wafers and other materials around chip factories, is the basis of the chipmaker’s request. The company told regulators that it was unsure whether routine upgrades to these vehicles would fall under the new rules. According to Quartz, the company then asked for a temporary exemption to be safe.
Intel’s argument was based on supply. It claimed no U.S. supplier offers a tested replacement that meets its needs, and replacing the existing vehicles would take years. The company also warned the FCC that any disruption is bound to affect its ability to make chips in the United States almost immediately.
Intel CEO Lip-Bu Tan added that keeping the AGVs running was “crucial” to national security, according to a filing summary on TradingView. Routine maintenance is not expected to create new cybersecurity risks, which Intel claims are the main reason for the restrictions.
The July ban that triggered the petition
In July, the FCC added advanced robots made overseas to its Covered List. This was after a White House review found that they posed unacceptable national security risks.
The rules prevent companies from changing the hardware, software, or firmware of affected devices already on the market, Bloomberg reported. Manufacturers can apply for an exemption, while companies using the equipment, such as Intel, can request a waiver.
Japanese firms Murata Machinery and Daifuku are part of the leading AGV suppliers, with companies in South Korea and Taiwan also after a foothold in the market. There is also a precedent for an exemption. Netgear was allowed to continue selling its routers in April after the Department of Defense found they posed no security risk.
Intel may not be the only U.S. chipmaker that would end up requesting a waiver. Taiwan Semiconductor Manufacturing Co., Micron (MU), GlobalFoundries, Samsung Electronics, and Texas Instruments (TXN) also operate their own chip factories and may face similar issues.
A regulator leaning into enforcement
The FCC has tightened its restrictions on other products recently. On Thursday, the agency blocked a dashboard camera and a wireless video transmitter from being sold in the U.S. because they used chips made by HiSilicon, a Huawei subsidiary on the FCC’s Covered List, according to the agency. HiSilicon had marketed the chip for surveillance, claiming it included built-in face detection.
This enforcement action was the very first under rules introduced by the FCC earlier this month. The rules block the approval of devices containing smart components from companies on its Covered List. FCC Chairman Brendan Carr stated in the announcement that the agency would continue working to protect U.S. national security.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

SK Hynix’s plans to launch its US memory unit Solidigm on an American exchange at a listing projected to be worth $15 billion have been called off. The decision was made due to shareholder pushback, in addition to warnings from South Korean regulators that the deal could dilute minority investors.
The filing and what was scrapped
A regulatory filing dated October 23 held details of the filing. SK Hynix has also scrapped a separate fundraising round that was running alongside its planned public offering. Reuters reported in September that the private round was expected to raise about 5 trillion won ($3.8 billion), and had a Nasdaq listing lined up for as early as 2027.
Solidigm had already appointed Goldman Sachs and Morgan Stanley to lead the planned sale. The unit makes NAND flash memory and solid-state drives (SSDs), which provide high-capacity storage for servers and AI data centers.
Solidigm was established after SK Hynix acquired Intel’s NAND and SSD business in a deal worth about $9 billion, announced in 2020 and completed in 2021. SK Hynix owns the unit through a U.S. holding company called AI Company.
Why Seoul’s regulators got involved
Most of the pressure came from South Korean regulators. They had concerns that listing Solidigm separately could amount to a “duplicate listing.” This happens when a company lists a subsidiary on its own, which could potentially reduce the value of existing shareholders’ stakes in the parent company.
Financial watchdog chief Lee Chan-jin told lawmakers that both his agency and the Financial Services Commission considered Solidigm subject to rules restricting such listings. FSC chairman Kim Byoung-hwan said the same rules would apply even if Solidigm listed overseas while speaking to a parliamentary audit.
SK Hynix stock already sliding
SK Hynix shares were already in the red just before the news. Seoul-listed stock dropped 4.2% to 1,172,000 won in early trading on October 23, according to Yahoo Finance.
SK Hynix shares have fallen 58% from their June high as investors worry about weaker memory demand and sell shares across the chip sector, the Business Times reported.
Scrapping the listing did little to help SK Hynix shares. Concerns regarding AI spending continued to weigh on markets. On October 22, the Nasdaq Composite had seen a 2.6%, drop, while the Philadelphia Semiconductor Index dipped by 6.7%.
Meta’s rising AI spending and credit default swap costs hitting a record high also added to investor concerns.
What SK Hynix says next
SK Hynix said the decision was about timing, and does not change its plans for Solidigm in the long run. “This decision does not reflect any change in Solidigm’s growth prospects or investment needs,” the company said in a statement quoted by the Business Times.
The company added that it would continue to review how much to invest in Solidigm’s U.S. expansion and when to make those investments. It also stated that new production capacity would still be required to meet the growing demand for memory used in AI systems.
Investors will be watching how SK Hynix funds Solidigm’s U.S. expansion without an IPO. They would also be interested in whether South Korea’s rules affect plans by other major companies to list their overseas subsidiaries.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Meta has discovered a way for Mark Zuckerberg to sell a portion of his ownership while maintaining significant control over the firm. The creation of a new class of share with no voting rights may also support the company’s increasing AI initiatives.
According to reports from Reuters on October 22, the deal comes in the wake of Zuckerberg’s concerns regarding a forthcoming tax on wealthy residents of California. As for investors, it brings to the surface the age-old dilemma of how much authority founders must keep hold of as their companies expand.
Non-voting shares, same votes
According to Meta’s SEC filing, shareholders will receive one non-voting Class C share for every Class A or Class B share they own. The arrangement effectively doubles their shares without changing their voting power. The new stock structure is set to take effect on January 19, 2027.
Zuckerberg can immediately sell 20% of his Class C shares, worth roughly 10% of his economic stake. Restrictions on the rest ease over eight years if he continues serving Meta. He also agreed to remain a resident of California, or wherever Meta is headquartered, subject to exceptions.
The independent committee explained why it supported the arrangement:
“critically important to keep Mr. Zuckerberg in a leadership position with our Company”
The tax bill behind the deal
California’s Proposition 40 proposes a one-time 5% wealth tax on qualifying billionaires who lived in the state on January 1, 2026. Voters will decide on November 3. Most proceeds would fund public health care.
Zuckerberg had considered leaving California over concerns that the tax could force him to sell voting shares.
As of October 1, he had ownership of 60.6% of Meta’s voting rights, while his stake in the company’s financial assets was only 13.4%. Class C share sales would provide him with funds while retaining ownership of the voting stake. The proposed tax hasn’t been passed yet as a law.
Financing an AI buildout
It is projected that Meta will require hundreds of billions of dollars in financing in the coming years. Class C shares would give the company another way to raise money, make acquisitions, and pay employees without losing voting power.
Meta’s most recent quarterly earnings reveal its vast expenditure. The company made $64.60 billion in revenue and earned a net income of $9.86 billion. The company spent $34.91 billion on capital expenditures, while free cash flow came in at negative $2.12 billion. Overall, the company expects its yearly capital expenditures to be between $135 billion and $145 billion.
Meta is part of a larger race for overall AI expenditure. As Cryptopolitan reported, total capex among five top US cloud players has increased from $485 billion in January to around $730 billion in July. The biggest challenge lies in generating enough revenue to justify such spending. Bain estimates that the AI business sector will have to generate $6 trillion in annual revenue by 2031 in order to support the construction. This is a revenue target, rather than a construction cost estimate.
Meta AI Spending Hits $135–145B as Zuckerberg Retains 60.6% Voting Control
Where the discount risk sits
Meta acknowledges that Class C shares could trade below voting Class A shares. If that happens, raising the same amount of money could require issuing more stock, diluting existing shareholders’ economic interests.
The concern goes beyond Meta. A Columbia Law analysis cites Lucian Bebchuk and Kobi Kastiel, who warned in their research:
“the potential advantages of dual-class structures … tend to recede, and the potential costs tend to rise”
An OECD report similarly calls for safeguards around unequal voting rights.
Meta is betting that its AI investments will reward shareholders. Whether those returns justify Zuckerberg’s continued control remains an open question.
The smartest crypto minds already read our newsletter. Want in? Join them.

October 22, 2026, saw millions of hackers attempt to take advantage of two major vulnerabilities in PHP. Governments and businesses had to take down some online systems while expert teams hurried to put in place emergency patches. This shows how little time have now been given to cybersecurity specialists to counter serious vulnerabilities.
Two 9.2-rated bugs that can hand over a server
The vulnerabilities, known together as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a critical severity score of 9.2 out of 10. On October 21, 2026, PHP released four fixes for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The UK’s NCSC says the bugs can corrupt PHP’s internal memory. Under certain conditions, an attacker could run code without logging in. Wiz also showed how sensitive data, including passwords and API keys, could leak from memory.
PHP powers 69.3% of websites with an identifiable server-side language, according to W3Techs. That shows how widespread PHP is, not how many sites were compromised.
The window between patch and exploit is closing
Frontier AI helped researchers piece together exploits for vulnerabilities buried in PHP for years. Cryptopolitan reported that the patches arrived a day ahead of schedule after technical details leaked.
Signs of the attack were visible before any attacks were reported. On October 17, 2026, four days before the disclosure, AWS identified the attempt in its MadPot honeypot logs. It is not known whether the attack was successful. AWS security chief CJ Moses warned threats could be created in hours or even minutes after the disclosure by attackers using AI.
Thousands of probes became millions in a day
Matthew Prince, CEO of Cloudflare, revealed that thousands of attempts were made in the 10 hours leading up to the disclosure on October 21. It did not take more than 45 minutes after that for the attempts to escalate to tens of thousands. In just two hours after that, the attempts crossed the hundreds of thousands mark. And soon after that, there were millions of attempts made. These were attempts, not confirmed breaches.
Cloudflare had already deployed firewall protection, but that was no substitute for patching.
On October 22, Reuters reported precautionary service suspensions at Nomura, Mitsubishi UFJ, ANA, East Japan Railway and Orange. Government websites also went temporarily offline in Finland, the Netherlands and France.
PHP2Shell Attack Timeline: Millions of Exploit Attempts, PHP Patches and AI Spending
Finding every copy of PHP is the hard part
PHP can hide inside equipment that administrators rarely think to check. The Dutch NCSC’s inventory includes third-party products under review, among them Fortinet offerings. Searchlight Cyber released a scanner to identify vulnerable hosts. It deliberately tests memory exhaustion, so using it requires care.
PHP Foundation executive director Elizabeth Barron told WIRED:
To our knowledge, there has been no successful attempt at remote code execution.
Where the security spend is already heading
Gartner’s September 16 forecast puts global AI cybersecurity spending at $51.3 billion in 2026 and nearly $86 billion in 2027. It projects $2.7 trillion for worldwide AI spending in 2026.
PHP2Shell was not responsible for that forecasted expenses. Rather, this case is a great illustration of how important it is for firms to be aware of the software they run, to quickly patch vulnerabilities, and to detect threats long before their damaging effect is felt.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Tesla’s Megapack batteries are almost sold out till 2027 and Elon Musk says that the manufacturer is working to increase their production. There is an upward trend in demand as utility companies and AI data centers look for more stable energy.
“As much as possible”
On October 22, 2026, Musk posted on X:
We are increasing production of Megapacks as much as possible.
He stated that Tesla was nearly running out of its supply for 2027, even before that year had started.
He made the remarks a day after Tesla announced its quarterly financial results. The results showed that the firm has set a record for energy-storage orders and backlog, despite a decline in revenue from the division.
Megapack allows utilities to deal with fluctuations in electricity demand and supply. It acts as battery storage systems that allow utilities to store extra electricity and deliver it to the grid during times of high demand or insufficient renewable energy supply. According to Cryptopolitan, Tesla signed a deal worth $556 million related to energy storage in Shanghai in June 2025 to help the city manage its electricity supply.
Energy revenue slipped even as deployments held
Tesla’s energy sector made $2.881 billion in revenue during the third quarter of 2026, a decrease of 16% compared to last year. However, storage deployments increased by 10% to 13.7 GWh.
Tesla has begun the production of its Megapacks in Texas, which has a listing annual production capacity of 50 GWh. Its California plant has 40 GWh capacity and its Shanghai plant 20 GWh.
Those numbers refer to installed capacity and not batteries produced. Equipment downtime and lack of components can impede production.
Tesla also delivered its first Megapacks using lithium iron phosphate cells from its manufacturing facility in Nevada, which will help the company secure its battery supply domestically.
Tesla Megapack Q3 2026 Financial Results and Global Factory Capacity
What’s driving the orders
According to Tesla, storage technology can rapidly provide power to grids. The company coined the term in its October 21 press release as:
“critical to data center uptime.”
Evidence suggests that the necessity is increasing. International Energy Agency (IEA) forecasts that ready-to-use electricity consumed by data centers will rise from 485 TWh in 2025 to 950 TWh in 2030.
The IEA has also reported that in 2025, 108 GW of storage batteries installations worldwide, which is a rise of 40%. The number of solar and wind energy plants leads to an increased demand for energy storage.
Cheaper than gas, but China leads
On October 8, 2026, Wood Mackenzie reported that in the 43 markets that were evaluated, the cost of a four-hour battery was less expensive than that of an open-cycle gas turbine.
This fact serves as an incentive for utilities to invest more. However, it should be noted that Tesla is facing tough competition. According to Wood Mackenzie’s research published on June 29, 2026, Chinese companies have captured 76% of global shipments of battery storage systems in 2025.
Demand doesn’t guarantee profit
Tesla’s overall Q3 revenue was nearly unchanged at $28.046 billion. GAAP net income attributable to common stockholders fell 43% to $787 million. Operating expenses rose 39% to $4.776 billion, while operating income dropped 56% to $718 million. Higher research spending and weaker regulatory-credit revenue weighed on results.
The orders are there. Tesla’s challenge is building enough Megapacks to meet them while protecting its margins.
The smartest crypto minds already read our newsletter. Want in? Join them.

A fresh initiative by Underdog is making it much easier for customers to fund their prediction market accounts even outside banking hours.
On October 22, the company announced its collaboration with Zerohash to give qualified customers the ability to deposit stablecoins and other cryptocurrencies. The announcement was made at the NEXTPredict NYC Summit and is expected to be launched before the year comes to an end. Customers will be able to deposit funds into their accounts directly through the Underdog app no matter if it is evening or weekend.
“Stablecoins and onchain assets unlock greater choice and speed,” said Underdog payments head Arthik Adla. Zerohash revenue chief Adam Tesan also stressed the ability to move money globally, around the clock.
There is already an audience for it. According to IG Group’s October 2026 acquisition presentation, 46% of Underdog customers had traded crypto before. Another 42% said they liked funding Underdog wallets with crypto. Meanwhile, 58% had traded individual stocks.
The commercial case for crypto funding
IG decided to buy Underdog on July 30, 2026, for a total enterprise value of $1.1 billion, including an earnout of about $200 million. The crossover between sports fans and retail traders is one of the reasons for the deal.
From Underdog’s public dashboard, they achieved $7.88 billion in cumulative notional volume in prediction markets and 49.86 million trades until October 21, 2026. In total, the company reported $70.72 million in trades for October 20. These numbers are reported by the company.
Where this fits in a crowded market
Prediction markets have grown quickly. TRM Labs put monthly volume at roughly $1.2 billion in early 2025 and above $20 billion in January 2026. More than 800,000 unique wallets were active monthly.
A snapshot of Artemis data on October 23, 2026 showed that prediction market trading volume totaled around $400 billion in the past year. Sports contracts constituted 42.7% of the recorded volume, whereas crypto contracts accounted for 14.6%.
According to Cryptopolitan, Underdog had previously provided sports contracts by making use of Crypto.com’s CFTC-approved derivatives arm. But it launched its own prediction market platform on July 18, 2026.
Underdog–Zerohash Crypto Funding: Prediction Market Growth and Key Statistics in 2026
Stablecoin demand and the caveats
Smaller transactions in cryptocurrencies are on the rise. According to Chainalysis, transfers of less than $100 into crypto services increased by 78.4% in the period July 2025-June 2026 compared to the previous year. However, the statistics are representative of cryptocurrencies in general rather than stablecoins or deposits in prediction markets.
Zerohash has already brought crypto funding to prediction markets. In July 2026, it introduced crypto and stablecoin deposits for ProphetX. Its partnership with Underdog would extend that option to another platform, giving existing crypto holders more opportunities to use their digital assets.
There are limitations, however. According to Zerohash’s disclosures, some services may be unavailable in New York. Crypto and stablecoin holdings in its accounts also lack FDIC and SIPC protection. Meanwhile, the regulatory treatment of event contracts continues to evolve. On October 9, 2026, the CFTC proposed explicitly including event contracts within its definition of swaps.
Underdog’s funding feature has yet to launch. The partnership could give cryptocurrencies a wider role in funding prediction-market accounts, but there is no evidence yet that it will attract new crypto users, increase token demand, or drive up prices.
If you're reading this, you’re already ahead. Stay there with our newsletter.

A home invasion occurred in Mont-de-Marsan on Thursday morning. A couple in their 60s were tied up by three masked men who broke into their home and demanded cryptocurrency.
The masked men carted away a laptop and phone. This would be the second attack of this nature in France’s Landes region since August.
What happened inside the Mont-de-Marsan Residence?
Based on reports, the burglars invaded in the early hours of Thursday, around 3 am. The intruders woke the couple from their sleep, tied them up using adhesive tape and plastic zip ties, before forcing them to hand over their crypto.
When the intruders were reportedly getting frustrated with their captives, one of them struck the 63-year-old husband on the back of the head using an adjustable wrench.
The invaders ended up fleeing with a laptop and a mobile phone.
After the invaders departed, the couple phoned the police and were rushed to the hospital for checks by firefighters. Police officers recovered the tools used in the assault, but the three invaders are still at large.
Why investigators believe the son was the target
Authorities believe the intended target was the son of the couple. They arrived at this conclusion after their investigations revealed the nature of the son’s work. He works in the crypto sector but lives at a separate address. He has been placed under police protection.
It is quite unusual for burglars to steal a laptop. However, a laptop or phone can be used to store crypto wallets or private keys, making them quite valuable. The wallet will be worth very little if it is encrypted.
This is not the first incident of this kind in the region. A similar incident happened in August, involving a couple in Rion-des-Landes who were kidnapped in their home after their captors demanded access to their bitcoin.
Later on, the husband was found naked and injured in Solférino, while his wife was found in a vehicle close by. Two suspects were arrested, and the Bordeaux interregional jurisdiction took charge of the case.
France’s wrench attack problem keeps growing
Wrench attacks have been on the rise in France lately. Wrench attacks are incidents where criminals make use of physical violence to coerce victims into surrendering their digital assets.
The number of crypto-related crimes in the country went up in the first half of 2026, with 77 recorded cases of kidnapping, extortion, or attempted extortion, and about 200 arrests. The Interior Minister Laurent Nuñez made the announcement.
Up to 33 of the 52 wrench attacks that have occurred in the first half of the year have happened in France, according to CertiK, a blockchain security firm.
CertiK believes the blame lies on the size of France’s crypto sector, public display of wealth, and a run of data leaks that give criminals important information on targets. The tax authority in France fell victim to one of the data leaks sometime this year, and it exposed the records of 678,000 taxpayers, including their names, addresses, and income figures.
Prosecutions are mounting, but the pace of the attacks has not eased. France has carried the “crypto kidnapping capital“ label since early in the year.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

The Central Bank of Ireland has fined Coinbase’s Irish e-money arm €3,252,618 for failing to protect customer money and for leaning too heavily on its US parent to run those controls.
This is the second penalty that Ireland has imposed on Coinbase’s European operations in under one year.
Five years of safeguarding gaps
The regulator stated that the breaches ran from November 1, 2020, to August 19, 2025, and they fall under the Electronic Money Regulations 2011.
Coinbase Ireland Limited issues e-money that customers swap for fiat. The customers can then use these funds to trade across the platform. The exchange found itself in hot water as a result of the rules that touch on keeping those funds segregated.
The Central Bank listed the problems it had with Coinbase Ireland operations, stating that it lacked an adequate outsourcing framework and depended on the US-based Coinbase Group to run safeguarding controls built for Irish and EU rules.
The apex bank also stated that the exchange did not keep enough in-house expertise to supervise that work. It also said that it found that Coinbase Ireland’s designated safeguarding account was underfunded for long stretches because of weak system design and thin control testing.
Internal escalation was also insufficient to flag material changes to the Central Bank.
Coinbase Ireland admitted to the contraventions and agreed to the facts that the Central Bank levied. The initial penalty that was imposed on it was €4,646,597, but it was later cut by 30% under the settlement scheme, landing at €3.25 million.
The penalty also came with a reprimand. However, the sanctions are yet to take effect, as they still need High Court confirmation.
What is the regulator saying about the penalty?
The settlement itself was reached a day before the announcement. Karen O’Leary, the Central Bank’s Director of Enforcement, said payment and e-money firms have a “fundamental obligation to fully safeguard customers’ funds.”
O’Leary said that they have “no tolerance for weaknesses in safeguarding arrangements.”
Since the announcement, Coinbase’s share price (NASDAQ: COIN) has dropped by over 3.8%, trading around $170.
How did the funds get mixed?
According to Coinbase’s own account, five historical issues brought it to the point of being fined, and it says that it has now fixed those issues.
It said that during the 2023 US banking stress around Silvergate Bank, it directed 30 customers to deposit into a Coinbase Inc. account at another US bank. It said this action caused the mixing of Irish customer money with funds tied to a different Coinbase entity.
A similar mixing happened after a post-Brexit migration, when some customers kept sending money to old UK accounts. Euro withdrawals for US and UK customers of other Coinbase units were also paid out of the Irish safeguarding account for liquidity reasons.
The fourth issue was a coding error in the dashboard used to size the daily safeguarding requirement. That left the account short by roughly 0.54% on average across 2023 and the first half of 2024, the company said. The fifth shortcoming was a failure to tell the Central Bank about changes to its safeguarding setup.
The exchange said that no customer funds were lost, nor were the customers unable to access their funds. It also stated that it flagged many of the items to the regulator in January 2024.
Its spokesperson said the problems “largely arose in the context of Coinbase taking steps to protect customers during periods of significant disruption.”
What has Coinbase changed?
The company says it has added a €25 million guarantee bond and hired a dedicated head of safeguarding before the Central Bank made the role an industry requirement.
It also says that its new safeguarding process has been through two third-party validations since January 2025, with nothing left outstanding. Coinbase has also moved its European headquarters to Luxembourg.
This is familiar ground for the regulator. In November 2025, it fined Coinbase Europe €21.5 million over transaction-monitoring gaps that left more than 30 million transactions unchecked for money-laundering risk, a penalty that was called the fourth-largest ever imposed by the Irish financial regulator.
Cryptopolitan reported that the settlement was $24.7 million at the time.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Fireblocks has denied an Axios Pro report stating that Visa is in advanced talks to buy the crypto custody company for roughly $2.5 billion.
The company clarified that the news was “not true at present time,” suggesting that a deal could be reached later.
Is Fireblocks going to be acquired by Visa?
Axios Pro, citing multiple sources, reported that Visa is in advanced talks to buy the crypto custody company Fireblocks. The outlet framed the purchase as what would be Visa’s first acquisition in the crypto space. Mastercard, its larger payments rival, already owns a stablecoin company.
A Fireblocks spokesperson cleared up the rumor, saying that the acquisition news is “not true at present time.” Visa’s spokesperson simply said that the company does not “comment on rumors or speculation.”
In a separate incident, Fortune reported that Mastercard was in advanced talks to buy Zerohash. The firm responded by flatly saying it was “not entertaining an acquisition by Mastercard.” Zerohash stayed independent, and Mastercard bought BVNK in March for up to $1.8 billion, including $300 million in contingent payments. The deal was closed in August.
Visa has expanded its stablecoin business without buying any companies. In August, it teamed with Zerohash to handle stablecoin funding and payouts through Visa Direct, and it later reported that its stablecoin settlement volume had crossed a $20 billion annualized run rate, recording a more than 15-fold increase from the level it was a year earlier.
Visa itself had looked at BVNK, according to an early investor in that company, before deciding not to pursue it. Mastercard and BVNK have since launched a joint Global Money Platform.
Would Fireblocks be a good buy for Visa?
Fireblocks, founded in 2018, provides institutional custody and infrastructure for digital assets. The company was last valued at $8 billion in January 2022, when it raised $550 million in a Series E round.
A $2.5 billion price would land well under that figure, but still a deal of that size would be one of the bigger crypto acquisitions on record, just behind Coinbase’s $2.9 billion purchase of derivatives exchange Deribit in 2025 and Naver Financial’s pending $10.3 billion all-stock deal for Upbit parent Dunamu.
Notably, in September 2025, Fireblocks launched a stablecoin network that signed up more than 40 participants, including Circle, Bridge, Zerohash, and Yellow Card.
The smartest crypto minds already read our newsletter. Want in? Join them.

Andreessen Horowitz’s crypto (a16z crypto) arm has told limited partners it will rename itself a16z Frontier and invest beyond crypto.
The move comes five months after the firm called its $2.2 billion fifth fund “100% dedicated to investing in crypto entrepreneurs.”
Will a16z invest in AI?
When a16z crypto closed Fund 5 in May, a spokesperson for the company clarified that the $2.2 billion fund is “100% dedicated to investing in crypto entrepreneurs.” The company’s communications partner Paul Cafiero also said the money was “100% dedicated to investing in crypto entrepreneurs across all stages.”
Now, Andreessen Horowitz crypto arm has announced that it will be changing its name to a16z Frontier to accommodate a broader market.
Even before the announcement, a16z crypto was backing companies that aren’t related to the blockchain, including the prediction market Kalshi and Ornn, an AI compute marketplace.
a16z crypto is the biggest name in crypto venture capital. It has pulled in close to $10 billion across five funds since launching its first $350 million vehicle in 2018. The company’s fourth fund, which raised $4.5 billion during the 2022 bull market, is still the largest single crypto fund ever recorded.
What other crypto companies are pivoting?
a16z is not the first large crypto fund to expand into other sectors. Paradigm launched a $1.2 billion fund that invests in AI and robotics. Back in 2023, Paradigm quietly took out the crypto and Web3 language from its homepage, and its co-founder Matt Huang spent weeks insisting the firm had not dropped crypto. Meanwhile, reports of the company reaching into AI, robotics and other frontier technologies kept coming.
Haun Ventures, which was run by former a16z crypto general partner Katie Haun, raised $1 billion in May and said it would also back financial startups outside crypto.
a16z’s decision might partly be due to fading enthusiasm for crypto startups. DefiLlama data shows that venture funding into crypto startups fell to about $5 billion in the first quarter of 2026, down from roughly $6 billion a year earlier.
Notably, the company’s general partner Ali Yahya has told some investors he is leaving to build his own startup. He joined a16z in 2017 as the crypto team’s first full-time hire and was promoted to general partner in 2021.
The smartest crypto minds already read our newsletter. Want in? Join them.

AI cloud company Nebius Group has secured a $3.5 billion loan from Citi to build more data centers and buy GPUs. The company announced the deal in a press release and confirmed it on its official X account. Nebius trades on Nasdaq under the ticker NBIS.
Where the money goes and what it costs
Nebius will use the money to build data centers and buy GPUs, with some funds reserved for other business needs.
The loan has a 364-day term, meaning Nebius must repay or refinance it within a year. It will initially carry an annual interest rate of Term SOFR plus 2.75%. This rate can increase to as high as 3.50% and is subject to further adjustments, the company added. Citi will be the mandated lead arranger, agent and security agent.
Nebius Chief Operating Officer Ophir Nave said the loan is one part of a plan set into phases, aimed at raising funds and managing borrowing costs over time. He added that the company still has several ways to raise capital. These include loans backed by assets and over $40 billion in long-term contracts with multiple customers.
We’ve secured a $3.5 billion financing facility from Citi to support our global growth.
The facility provides capital at attractive rates, diversifies our capital structure, and gives us greater flexibility over when and how we raise long-term financing.
Full release:… pic.twitter.com/iXDLF6mbF5
— Nebius (@nebiusai) October 22, 2026
Nebius’ second large raise in two months
The Citi loan comes about two months after Nebius raised $5.75 billion by selling convertible notes, according to Dealroom.
Dealroom said the Citi loan was the largest of 69 debt deals by AI companies in the Netherlands since they went public, ranking it in the top 1% of such deals.
The firm also noted that Nebius is now worth more on the stock market than its U.S. rival CoreWeave.
Why the short maturity matters
The size and rate of borrowing show that AI cloud providers are using debt even more to meet the growing demand for computing power. That approach carries risk. Nebius will be under pressure to deliver on its plans, as the 364-day loan must be repaid or refinanced within a year.
Dealroom said funding challenges remain in the sector, citing a recent Reuters report on investor concerns about CoreWeave’s growing debt. Nebius could use its more than $40 billion in customer contracts to get more loans backed by its assets, but it must deliver on its expansion plans to do so.
Investors will be watching how Nebius uses the loan and whether it raises more money to fund its growth in 2027 and beyond, as Nave outlined.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Several large US banks have found multiple unvetted third-party AI agents operating within customer accounts, with some of these agents performing actions that seem independent of the user’s requests, Axios reported. The discovery is of importance for users who link their bank accounts to AI assistants, as banks are now blocking this access to protect the customers’ money.
Agents logging in to US banks with real customer credentials
The core problem, according to Axios, is that AI agents are gaining access to these US banks using login details the customer themselves gave up. This action is against the rules at most of these banks, which require account holders to sign in by themselves.
Even when a user grants permission to the agents, executives fear the exact capabilities of these agents. A customer giving an agent the authority to buy things or transfer money could lead to an error or a rogue instruction that drains or misdirects funds.
Banks have also reported AI agents calling customer service lines. In some cases, they appeared to act of their own volition without a direct request from users. One banking official stated that the industry is deeply concerned about AI agents accessing accounts and making decisions that could affect customers’ money.
Morgan Stanley starts blocking, others follow
Morgan Stanley is now blocking third-party agents from its platforms, sources told Axios. JPMorgan, Bank of America and Citi have joined to tighten agent access. Wells Fargo is also one of the banks working to contain this new risk.
Banks have responded in different ways. Chase warned customers never to share their login details with anyone. Morgan Stanley said it had not seen any cases of AI agents accessing its systems without permission.
Banks are changing their rules and limiting outside tools that automate tasks as they try to tell whether an AI agent is following a user’s request or acting on its own.
Read-only access seen as middle ground
Most of these US banks are gravitating toward pure read-only access. This allows AI agents to view account balances and transaction history without the capacity to make changes or transfer money. This is similar to how banks work with budgeting apps such as Quicken.
Banking executives told Axios they expect more customers to use AI assistants, so banks do not plan to block them forever. For now, they believe giving these tools full access is too risky.
One problem is that banks often cannot tell whether they are dealing with a person or a bot. They also struggle to tell whether an AI agent has the account holder’s permission or is accessing the account without approval.
Why this reads as a policy gap, and not a breach
The issue is mainly about how US banks manage risk and follow their rules, rather than its impact on earnings. A security breach could lead to direct financial losses and legal claims. But when a legitimate AI tool misuses login details, the problem becomes more focused on gaps in bank policies.
Past bank security scares have often followed a similar pattern. There is an initial news report, after which banks explain their security measures. Then regulators look at whether existing rules cover how AI agents access accounts and verify their identity.
Sources have told Axios that US banks are investing in security measures and emergency plans that can help to quickly block or restore customer access if an incident involving an AI agent gets worse.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Wall Street is crashing: The Nasdaq fell 2.1%, the S&P 500 lost 1.3%, and the Dow dropped 279 points.
AI stocks are getting hammered: Meta, AMD, Nvidia, Micron, and CoreWeave fell as investors questioned massive AI spending.
Oil is surging: Brent topped $112, while US crude neared $100 as Trump warned something could happen soon with Iran.
Investors are playing defense: Treasury yields and major currencies fell, while Lockheed Martin gained 3% on strong earnings.

Crypto money is flowing away from altcoins to Bitcoin as spot ETF demand wanes and other cryptocurrencies experience a sell-off, according to market maker Wintermute and the market overview from Phemex. The message for those holding altcoins couldn’t be clearer – there will be no broader uptrend without Bitcoin’s leading move.
Wintermute reportedly estimated that the $82,500 mark is a new key level for Bitcoin’s short-term movement. The line that was considered a barrier turned into a price that the bulls are trying to defend after Bitcoin fell marginally over the week.
According to the firm, there are only two ways forward now – either a breakthrough through $87,000, thus opening the way to higher prices, or falling below $82,500, sending the price towards testing the $70,000 mark again.
But Bitcoin has already faced one stress test. In its latest weekly report, Wintermute pointed out the drop to $80,400 was caused by $679 million of net outflows from spot Bitcoin ETFs, which was nevertheless defended by the buyers. Wintermute believes the token is “holding up better than the macro tape would suggest,” citing the 3.5-point lead over the Nasdaq.
Inflation data put the squeeze on risk assets
Pressure can be traced back to the macro level. US inflation reached 3.7%, whereas the core rate increased by 0.3%, indicating that higher energy prices were passed through into the core prices.
The response was quick. The Nasdaq index fell 5.5%, but investors went for safer bets – Brent oil rallied 5.0%, and US government bonds increased 2.65%. It is the return of the relationship between conventional markets and crypto that messed up the crypto market, according to Wintermute.
Bitcoin price dipped by more than 2% over the last 24 hours. BTC is trading at $81,726 at press time. Ether price took a drop of almost 3% over the last day. ETH is trading at $2,401 at press time. However, the cumulative crypto market cap is down by 2% over the last day to stand at $2.84 trillion.
Altcoins bleed as money concentrates in majors
The sell-off took a toll on the broader market. The altcoin industry fell by 5.69% in the past week. The trading desk at Wintermute noted that the flow of altcoins is becoming one-sided apart from a select few high-quality large-cap alts as traders take money out and keep it in the two largest cryptocurrencies. For anyone seeking profits in other places, Wintermute concluded that “the risk/reward ratio favors majors over altcoins now,” and Bitcoin “needs to be up for altcoins to have any hope of resuming a rally.”
According to Phemex, the rotation could be seen in the form of 60% dominance of Bitcoin as altcoins performed poorly. In addition, a whale liquidated after losing 121.33 BTC, worth about $9.9 million, due to the sell-off, along with plummeting stocks in Asia and China entering a bear market.
Why October 28 is the date to watch
Wintermute is sure that the present narrow price range won’t hold through the future event calendar. It cited the October 28 FOMC meeting as the most probable catalyst for an upcoming breakout, noting that “it cuts both ways.”
A hawkish outlook from the Fed should drag the Nasdaq down along with Bitcoin. On the other hand, a dovish sentiment combined with robust corporate results can be enough for bulls to drive prices higher.
If you're reading this, you’re already ahead. Stay there with our newsletter.

A Coldcard customer has launched a class-action lawsuit in Ontario against the hardware wallet maker Coinkite Inc. and its co-founders.
The allegation is that the co-founders of Coinkite knew that there was a problem with its seed-generation system as early as May 2025 and did nothing about it.
Why is Coldcard getting sued?
Amir Reza Naderi filed a statement of claim in the Ontario Superior Court of Justice. Coinkite Inc., Rodolfo Novak and Peter D. Gray are named in the lawsuit as defendants. The court file, CV-26-00018158, was issued electronically on September 11, 2026. In it, Novak and Gray are described as co-founders, directors or officers who took part in managing Coinkite and its Coldcard products.
Naderi says he lost 1.22940052 BTC, roughly $79,800, on August 6 and accuses the defendants of being aware of the vulnerability in their system from May 2025 onward yet failing to warn customers. He asks the court to rule that Coinkite broke Ontario’s Consumer Protection Act.
Naderi wants the court to approve the case as a class action. If it succeeds, he is asking for both compensatory and punitive damages, and for a litigation trust to distribute whatever money is awarded.
Coldcard is a Canadian-made hardware wallet. Its job is to generate a recovery phrase, the series of words that gives access to a user’s bitcoin, and it was designed to do this with a special chip built for creating random numbers. In March 2021, a firmware update quietly moved that task from hardware over to software.
Coldcard’s settings had the chip’s built-in random number generator switched off, since Coinkite used its own. A backup tool called Yasmarang, which relies on the chip’s serial number and a timer to generate its numbers, was used to create each new seed and some Coldcard wallets ended up with recovery phrases that were much easier to guess than they should have been.
There were reportedly only about 40 bits of real randomness on the Mk2 and Mk3, far below the 128 bits that the BIP-39 standard assumes.
How much was stolen from Coldcard’s users?
The theft started on July 30, 2026. An attacker reportedly stole roughly 594 bitcoin, about $38 million, from around 500 wallets in a 25-minute window. Reports from early August put losses above $88 million and more than 1,300 BTC.
A joint analysis by WeirFoulds LLP and Edmonds Marshall McMahon, published on Mondaq on August 7, estimated $116 million lost across more than 5,200 victims. The cumulative losses are estimated to be past $140 million.
Much of the stolen bitcoin has since been gathered into a few addresses that haven’t recorded any activity.
Coinkite has denied the allegations that it knew about the vulnerability in May 2025, writing in its technical backgrounder published July 30, 2026, that it was “unaware of the bug until today” and suggested an outside party may have used AI to review its open-source firmware and find the flaw first.
The company said its own AI-assisted code review weeks earlier had missed it.
Coinkite has released fixed firmware for all affected models, but it urged Coldcard owners to create new seeds and move their funds to them.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.