Cryptopolitan

US president Donald Trump says he could order another round of American attacks on Iran whenever he wants, but he is still weighing whether to hit Tehran or negotiate an agreement.
The president made the threat during a Fox News interview on Sunday, with US military forces building up across the Middle East and tensions spreading into Saudi Arabia.
His latest warning comes as diplomats try to prevent more fighting, while oil markets are already dealing with the fallout from months of regional conflict.
Trump weighs another attack on Iran as Qatar pushes for a diplomatic deal
“Do I finish it off, which would be very easy to do, or do I make a deal? It’s getting to be decision time,” Trump said.
The president’s comments came as Qatari mediators visited Tehran on Sunday, Reuters reported. Qatar has been trying to bring Washington and Iran back to the negotiating table, although neither side has announced a breakthrough.
The US last carried out confirmed strikes against Iran on September 1. Trump later indicated that American attacks would remain on hold until after the November 3 midterm elections.
However, Iran has been gearing up for another showdown, with Tehran officials warning that any new American attack will be met with military retaliation.
Another possible target for America could be Pickaxe Mountain, a highly guarded underground base linked to Iran’s nuclear program.
President Trump has indicated that the Americans are fully aware of what goes on in the underground base because three other Iranian nuclear bases have been wiped out.
“We can read the badge on somebody’s shirt from space, okay? We know exactly what’s going on at Pickaxe Mountain. We know the other three [nuclear sites] are obliterated,” Trump said.
The president also repeated his position that Washington controls the Strait of Hormuz, pointing to the recovery in crude shipments through the waterway.
However, things at sea are quite a bit more difficult. Though the oil cargoes have been restored to their pre-war volumes, other cargo traffic continues to suffer significant disruption.
Both the US and Iran have laid claim to this passage way that plays host to a sizable portion of the world’s energy cargo trade.
Just a few days ago, a Singapore registered container ship foundered in the strait following an attack by an unknown projectile resulting in a fire.
Iranian naval commander Ali Ozmaei said his forces were “counting the moments” until they could sink US warships.
Saudi Arabia seeks talks with Iran as Houthi attacks threaten oil supplies
The confrontation is also putting Saudi Arabia under pressure, with Houthi militants launching fresh attacks against the kingdom over the weekend.
On Saturday, the Iran-backed group said it had targeted Riyadh’s main airport and several oil facilities.
Saudi authorities announced Sunday that air defenses had stopped additional missiles and drones. Airport operations also partially resumed that day, despite damage from previous attacks.
The Houthis have threatened to keep striking Saudi targets.
Riyadh is now pursuing another diplomatic channel to prevent the fighting from spreading further.
Saudi Defense Minister Prince Khalid bin Salman is scheduled to meet Iranian President Masoud Pezeshkian and national security chief Mohsen Rezaei on Monday.
Pakistan’s army chief Asim Munir and Turkish intelligence chief Ibrahim Kalin are also participating. Their countries are members of a defense pact with Saudi Arabia.
For energy traders, the biggest concern is what happens if the attacks reach infrastructure that Saudi Arabia needs to produce, process and transport crude.
A serious strike against the kingdom’s East-West pipeline could interrupt shipments and push international prices sharply higher.
Damage to additional refining facilities would create another problem because replacing lost fuel-processing capacity could take considerably longer than restoring oil production.
There is also a limit to how much expensive crude consumers can absorb.
If Brent rises above $120 per barrel, weaker demand could become a bigger factor as households and businesses cut fuel purchases.
Energy costs are already elevated because of supply disruptions and limited global refining capacity, putting further pressure on consumer prices.
Saudi Arabia is also working to protect its Asian supply network. Energy ministers from both countries said Riyadh plans to begin storing crude in Singapore during the second half of 2027.
Meanwhile, the US Energy Department authorized the release of up to 400,000 barrels from the Strategic Petroleum Reserve on Friday to address a supply interruption at a Louisiana refinery.
American producers are not rushing to increase output either, with companies reluctant to spend heavily on new projects while oil prices remain unpredictable and geopolitical risks continue growing.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Strategy (NASDAQ: MSTR) did not buy any Bitcoin during the week between October 19 and 25, according to its October 26 filing with the US Securities and Exchange Commission (SEC).
Instead, 100% of the money spent by the firm, led by founder and executive chairman Michael Saylor, last week went to buying back $204.9 million of its STRC preferred shares.
With the firm skipping on buying Bitcoin for the second time this month, Strategy’s Bitcoin stack remains unchanged at 848,517 BTC. It did not sell any stock through its at-the-market program, either.
$205 million on STRC, nothing on BTC
According to Strategy’s SEC filing, the firm repurchased 2,068,459 shares of the Variable Rate Series A Perpetual Stretch Preferred Stock (STRC) for $204.9 million. Saylor summarized the transaction as “$205M of $STRC” in his early morning X post on October 26.
The firm’s Bitcoin reserve, on the other hand, remained unchanged at 848,517 BTC. The firm’s dollar-per-Bitcoin basis remains at $75,446 for a $64.02 billion total on the stack.
Last week’s preferred stock-to-Bitcoin purchase ratio extends a pattern that has held through the month. During the October 12 to 18 week, Strategy spent $193.1 million buying back STRC compared to $22.1 million for 267 BTC. It was $192.4 million on STRC to $21.5 million on BTC the week before, as Cryptopolitan reported at the time.
Strategy capital deployment, Sep 28 – Oct 25, 2026. Source: SEC 8-K filings
Why is Strategy buying its own shares?
Strategy’s president Phong Le has explained the logic behind Strategy’s STRC repurchases before.
“At prices below $100 per share, STRC repurchases represent an attractive allocation of capital because they can reduce future preferred dividend requirements at a discount.”
Each share bought back below face value is a share the company no longer pays dividends on. Strategy’s board doubled the digital credit securities repurchase program to $2 billion in September, then raised it again to $3 billion on October 19.
The latest STRC buyback round leaves $956.8 million of the approved allocation to be deployed. It has not had to dip into the separate $1 billion program for MSTR common stock its board approved.
Strategy funded the buyback entirely from the USD Cash bucket it keeps specifically for general purposes, including buying Bitcoin. That account now holds $242.4 million, down from $640.5 million two weeks before.
The USD Reserve, a separate bucket earmarked for preferred dividends and debt interest, still holds $4.83 billion. Together, the two “USD Assets” pools come to roughly $5.1 billion.
In a second post, Saylor pegged the company’s USD duration at 3.4 years and STRC’s Bitcoin credit at 54 basis points, based on assumptions of 10% annual Bitcoin returns, 40% volatility and an $81,200 Bitcoin price.
Big decisions are ahead for Strategy
MSTR common stockholders are set to vote on October 28 on switching STRC and Strategy’s other preferreds to daily dividends. If it passes, the first daily record date would fall on November 1 and the first payment on November 2, with the annual rate unchanged, per the company’s investor materials.
Another decision that could affect the firm is outside its control, with MSCI set to release a November 11 list confirming the firms unaffected by new rules that could strip Strategy and other digital-asset treasury firms from its indexes.
Saylor and Le have criticized the “discriminatory” approach even though Strategy argued in a September letter that exclusion “would have no meaningful impact on Strategy’s business.”
The smartest crypto minds already read our newsletter. Want in? Join them.

According to Elon Musk, SpaceX has completed a deal for $40 billion in debt financing to purchase Nvidia graphics chips. The transaction proves the strongest AI buyers can still raise money even though Musk warned that weaker companies are being increasingly denied access to the credit markets.
Callable debt for GPUs drops in early 2027
Musk confirmed the financing in a post on X on Sunday. He announced that SpaceX had wrapped up $40 billion in debt to fund purchases of GPUs.
In a follow-up post, Musk described the money as mostly callable debt. This means SpaceX can redeem the debt early. The chips the debt is set to pay for are due in the first and second quarters of 2027, and are not seen as a major point this quarter, according to Musk.
The loan terms remain unclear. Reuters reported that it was uncertain whether lenders had agreed to the deal. Musk also did not name any banks or disclose interest rates or repayment dates.
The planned raise had already been reported. Yahoo Finance said on October 6 that the $40 billion deal would include about $10 billion in bank loans and $30 billion in investment-grade debt. Apollo Global Management was also expected to lead the financing.
Bloomberg later reported that the borrowing would be done via a separate entity, keeping it off SpaceX’s balance sheet and helping to protect the company’s credit rating.
Pretty much.
As of the past few weeks, debt markets have almost entirely shut off access to money for any company that doesn’t have substantial revenue independent of AI data centers.
SpaceX closed $40B of debt for GPUs, but we’re investment grade and have Starlink & launch revenue.
That means the 200+ neoclouds are going to see guppy-level death and consolidation. Some will make it through, but not many.
— Elon Musk (@elonmusk) October 25, 2026
Investment grade and Starlink revenue did the heavy lifting
Musk said SpaceX’s investment-grade status and revenue from Starlink and rocket launches helped in securing the funding.
SpaceX’s third-quarter revenue rose 161% from a year earlier to $14.58 billion, according to Reuters. Quartz reported that the company’s AI unit generated $7.56 billion in the three months to September 30, up from $813 million a year earlier. Starlink’s connectivity business also recorded $2.37 billion in operating income for the quarter, according to Yahoo Finance.
SpaceX has raised large sums through debt before. In June, the company raised $25 billion in its first bond sale, attracting nearly $90 billion in orders. The proceeds from the bond sale were used to repay a bridge loan.
200-plus neoclouds facing ‘death and consolidation’
The second half of Musk’s message carried a warning for the rest of the industry. He stated that debt markets have “almost entirely shut off access to money” over the last few weeks, especially for any company lacking substantial revenue outside AI data centers.
He singled out neoclouds, firms that rent out computing power built for AI customers. He claimed more than 200 such firms exist, but only a few are likely to survive as the industry consolidates.
“That means the 200+ neoclouds are going to see guppy-level death and consolidation,” Musk wrote. “Some will make it through, but not many.”
Buying the companies was also not an available option, according to Musk, an idea he referred to as “pointless”. CoreWeave and Nebius are examples of neoclouds that rent out Nvidia GPUs and rely on debt to expand.
Investors are also betting heavily against U.S. data center and neocloud stocks amid concerns that companies are borrowing heavily to fund growth they may not be able to sustain.
What the SpaceX balance sheet shows
The numbers explain the appetite for cash. SpaceX ended September with $51.3 billion in cash and $38.6 billion in marketable securities, against a total debt figure of $38.8 billion, Yahoo Finance reported. In the event that the full $40 billion is secured, total debt would roughly double to about $79 billion.
SpaceX is spending far more than it brings in from its operations. In the third quarter, it generated $9.6 billion in cash but spent $19.6 billion on investments. In the first nine months of the year, spending reached $48.1 billion, while cash from operations was just $13.1 billion in total.
Chief Financial Officer Bret Johnsen expects the company to spend another $35 billion to $40 billion in the fourth quarter alone. At that rate, the new loan would cover about a quarter of its spending.
Last week, Musk also said a merger between Tesla and SpaceX would be “a good idea.” He added that both companies had formed independent committees to consider the deal but laid emphasis on the fact no decision had been made at the time.
If you're reading this, you’re already ahead. Stay there with our newsletter.

A security researcher was able to exploit an intentionally unpatched PHP server and claim its Bitcoin bounty in just over 19 hours.
The public stunt was a test to see if the recent PHP2Shell flaws are as dangerous as they are said to be.
Stealmybitcoin.com logged the win at 15:47 UTC on October 25
Stealmybitcoin.com, the site where the game was hosted, verified the bounty had been claimed. Its results page shows the Bitcoin was taken after 19.28 hours, with the win being logged at 15:47 UTC on Sunday, October 25.
The prize pot was 0.02511679 BTC, worth $2,021.22 at that time. The page reads: “For now, there are no bitcoin on this server,” adding that more challenges may follow.
The results page at stealmybitcoin.com recorded the win after 19.28 hours on October 25, 2026, with the prize pot at 0.02511679 BTC ($2,021.22).
The winner, who goes by the handle KillaBoi, posted a proof-of-concept write-up to GitHub. The target was running PHP 8.4.26.
The write-up says that the one private key it recovered did not derive the prize address shown on the homepage. It calls this a mistake by the creator, acknowledged via email, and the site still lists the challenge as won.
The contest was also seen by more people through the @hackerfantastic account, which is connected to the company hacker.house. In a post on October 25, the account explained how the challenge worked.
The win follows emergency PHP2Shell fixes on October 21
The experiment came days after a scramble over two critical bugs in PHP. Details of the vulnerabilities leaked online, prompting PHP’s maintainers to ship emergency fixes on October 21, a day ahead of schedule, as Cryptopolitan reported.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, both received a severity score of 9.2 out of 10 and enable remote code execution on unpatched servers.
PHP is used by about 70% of sites that have a known server-side language, and many sites shut down as a precaution. Finland, the Netherlands and France all temporarily pulled government websites offline.
Cloudflare said it saw millions of what it called exploitation attempts in the hours after the bugs were made public.
Two months were given to a coalition that included OpenAI to make fixes. OpenAI said that the same AI tools that found the flaws could also help attackers quickly make exploits.
The operator of the site has promised a separate write-up of the experience of hosting it.
The smartest crypto minds already read our newsletter. Want in? Join them.

Anthropic is officially preparing to go public, and Wall Street is about to get another major AI stock to trade.
The five-year-old company behind Claude has published its IPO paperwork after secretly filing with the SEC in June. It plans to list on the Nasdaq under ANT, although its debut still isn’t guaranteed.
AI stocks rally despite growing fears over industry spending
CEO Dario Amodei founded Anthropic in 2021 with researchers who left OpenAI. Since then, businesses have spent heavily on Claude, hoping AI can cut costs and generate revenue.
Growth accelerated this year through Claude Code and models including Fable 5 and Mythos 5. But competition from OpenAI and Google is fierce.
The company has also faced criticism over AI safety, regulation and national security, including two disputes with Washington.
Its listing will be after the record-breaking $85.7 billion IPO of SpaceX. Elon Musk’s company has been struggling to stabilize its trading performance, ending last week lower than its June initial price.
Investors are questioning whether AI revenue can justify trillions in infrastructure costs.
CoreWeave and Nebius have each lost over 30% this October as borrowing risks trouble data center companies.
However, there were signs of strength in Monday’s pre-market session as the prices of crude oil moved lower.
Futures contracts for the Dow Jones Industrial Average increased by 209 points or 0.4%, those for S&P 500 were up 0.4%, and those for Nasdaq-100 went higher by 0.7%.
As far as chip stocks were concerned, Nvidia was up 1.4%, Micron went up 2.3%, Broadcom increased by 1.5%, and AMD climbed 1.3%.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Group CEO Masatoshi Kumagai wrote on Oct. 26 that GMO Internet spurned a $50 million demand from hackers who broke into its Onamae.com Desktop Cloud service.
As many as 26,739 servers may be affected and some customers said they saw unauthorized trades made through their brokerage accounts.
Up to 26,739 Onamae.com servers may be affected
Onamae.com Desktop Cloud runs brokerage software like MetaTrader 4 and MetaTrader 5 on customer servers. GMO said an attacker exploited a security flaw, planted malware in some customer environments and took customer data.
The issue was first reported by a customer question on October 19. The following day, malware was detected and GMO began to shut down all plans from 19:00 UTC on October 20.
The figure of 26,739 is a count of potentially impacted servers, not verified breaches. Some customers reported trades placed without permission via tools running on the service.
In-house white-hat hackers had flagged security issues with the service in advance. The response was lacking in depth and speed, Kumagai wrote, and the attacker passed through the gap.
GMO Internet Group shares shed almost 16% to a four-month low Monday. The company said it could not yet quantify the impact on earnings of the goodwill payments and compensation for losses.
Attacker threatened accounts at over 70 securities and FX firms
Kumagai’s blog post, first published Oct. 25 and updated a day later, lists what the attacker threatened. The list begins with more fraudulent orders on customer accounts at more than 70 securities and foreign-exchange firms in Japan and abroad.
The attacker also threatened to leak data from customer PCs that were connected, use ransomware and publish internal details of GMO’s systems. Those were threats, not confirmed activity at all 70-plus firms.
A document stamped 11:57 on October 21 demanded $50 million, about 8 billion yen. None of the demands were met by GMO and nothing was paid, Kumagai wrote.
The note asked for payment in Bitcoin or Ether by 5 p.m. Japan time that day and said GMO’s crypto exchange subsidiary could pay immediately.
Part of the attacker’s demand, as published by GMO Internet Group CEO Masatoshi Kumagai on his blog on October 26, 2026.
GMO stated that paying would not guarantee the stolen data would not be misused. It is working with police and other authorities on the matter.
Kumagai dismissed criticism that a flat 5,000 yen goodwill payment to all customers was an attempt to close the issue. It was the first step, he said.
GMO Internet will verify and compensate for fraudulent trade losses related to the breach. If an exchange refuses a refund, it pays the full amount of eligible losses itself.
The group also pledged a six-month free replacement environment, a reconstruction of its system base and an outside review of the root cause. GMO Cyber Security by Ierae and GMO Flatt Security are involved in defense and log analysis with approximately 200 security staff, including former Interpol personnel.
GMO has also begun court disclosure requests to track down the attackers.
Kumagai called the attack a symbol of an “AI cyber saturation attack,” with inexpensive AI tools that enable attackers to overpower defenders. GMO Cyber Security by Ierae found the autonomous AI penetration-testing tool ARTEX, built for defense, misused in attacks on some 20 Japanese companies.
He also mentioned the recent PHP flaws where automated attack attempts ran to millions in hours. According to Cryptopolitan, the two PHP2Shell bugs have a severity score of 9.2 out of 10 and PHP shipped fixes on October 21.
GMO has not connected its own breach to the PHP flaws.
On Oct. 24, Kumagai asked Tokyo to apply Japan’s law on active cyber defense, which went into effect Oct. 1. GMO is not a designated critical-infrastructure operator under the law, and he acknowledged that the decision lies with the government.
Prime Minister Sanae Takaichi said Monday evening the government plans an emergency package of cybersecurity safeguards by sometime next week.
If you're reading this, you’re already ahead. Stay there with our newsletter.

As of Oct. 25, Circle’s USDC made up around 80% of the net 30-day drop among the 13 largest stablecoins, according to monthly DeFiLlama figures.
Circle’s token lost $4.69 billion in the month.
The 13 tokens lost $5.82 billion in net value. USDC’s market cap was $71.743 billion, down $878.72 million just in the last week.
Tether gives up $1.29 billion and keeps a 60.74% share
The total stablecoin market declined to $300.36 billion on Oct. 25. DeFiLlama data shows it has lost $12.73 billion since May 22.
Tether’s USDT fell less over the month. It had a market cap of $182.423 billion, down $1.29 billion in 30 days, down $990.43 million in 7 days and still possesses 60.74% of the market.
The seven-day shrinkage across the 15 largest stablecoins was about $1.90 billion.
Ethena’s USDe fell $305.61 million over the month. World Liberty Financial’s USD1 declined $444.67 million, or 10.10%.
Falcon’s USDf added $511.16 million, a 42.32% increase, while PayPal’s PYUSD added $239.53 million in the same 30-day period.
Tokenized Treasuries shed $1.55 billion since August
Minting stablecoins generally increases supply, while redeeming them for fiat diminishes it, potentially pulling money that might otherwise have gone into buying Bitcoin or Ether.
Supply grew during the 2020-2021 bull market and shrank after Terra’s collapse in 2022, which just so happened to coincide with a protracted crypto bear market. Bitcoin is trading near $80,000, far off its October 2025 record of around $126,000.
Tokenized U.S. Treasury products like BlackRock’s BUIDL and Ondo’s USDY also shrank, declining from $16.2 billion on Aug. 12 to $14.65 billion on Oct. 25, according to data from rwa.xyz.
Those who hold the Treasury tokens can redeem them to buy stablecoins or risk assets or shift cash back into bank accounts. The combined fall was $1.55 billion.
Standard Chartered postponed its prediction of a $2 trillion stablecoin market from 2028 to 2030. The stall in supply growth is cyclical and tied to weak crypto markets, said Geoffrey Kendrick, the bank’s head of digital assets research, who noted supply has been stuck between $300 billion and $320 billion over the past year.
Circle is also defending the economics of USDC. Cryptopolitan reports that Circle’s October 16 blog post disclosed that ~$819 million, or about 59 cents on the dollar, of the company’s ~$1.4 billion revenue in the first half of 2026 went to firms distributing USDC and to transaction costs.
The post was seen as a reaction to Open USD, a rival token launched June 30 that promises free minting and redemption. The consortium behind Open USD says partners can keep all the interest its reserves earn, minus a small management fee.
The smartest crypto minds already read our newsletter. Want in? Join them.

New York’s Gaming Commission has asked a state court to force the largest prediction market platform, Kalshi, to hand over documents that it had first asked three months ago. The regulator filed a verified petition in New York County Supreme Court naming Kalshi Inc. and KalshiEX LLC as respondents. The court logged it on October 22 and the news became public the following day when sports betting attorney Daniel Wallach posted a thread on the filing on his X.
BREAKING: The NYS Gaming Commission has sued Kalshi in NY County Supreme Court to force compliance with subpoenas seeking records on its sports-event contracts, offerings to NY’ers under 21, ads describing its products as wagers or bets, and ownership and corporate structure. pic.twitter.com/17Iiy3b0aV
— Daniel Wallach (@WALLACHLEGAL) October 23, 2026
There are no new violations within the petition. What it does ask for is that the court enforces investigative subpoenas that the Commission issued on July 31 under section 104(7) of the state’s Racing Law. The Commission says the prediction market platform has refused key requests and gave insufficient answers to others. There’s been no public response from Kalshi as of yet.
New York Wants Four Sets of Records
The subpoenas cover Kalshi’s sports-event contracts, its offerings to New Yorkers under 21, advertising that describes its products as wagers or bets, and its ownership and corporate structure. The Commission says it needs them to decide whether to fine the prediction market “and others”, and by how much. The petition alleges Kalshi has run a sports wagering business in New York for at least 18 months without the license the Racing Law requires.
Kalshi’s Defense Rests on the Derivatives Label
Kalshi has always stated that its event contracts are financial products overseen by the Commodity Futures Trading Commission and that therefore state gambling laws do not reach them. If its own ads describe those event-based contracts as bets, New York can point to Kalshi’s marketing as evidence that even the company sees them as wagers.
The under-21 request carries a very similar risk as well. Licensed sportsbooks in New York can only serve customers 21 and older and the attorney general’s July lawsuit alleged that 18 to 20 year olds can trade on the platform.
Kalshi is also headquartered in New York City, so ignoring a state court order would risk contempt at home. The CFTC’s August 11 emergency order keeps Kalshi trading in the state, though it’s unclear whether that shields it from a state investigative subpoena.
The Petition Opens a Third Front
Attorney General Letitia James and Gov. Kathy Hochul sued Kalshi on July 31, seeking forfeiture, restitution and triple fines, with claimed damages of at least $36 billion. Kalshi moved that case to federal court the same day.
The case that matters most is Kalshi’s own. On July 7, Judge Torres denied its request for a preliminary injunction, finding federal commodities law likely doesn’t preempt New York gambling law for sports contracts. The Second Circuit turned down Kalshi’s emergency request on July 29, and its appeal is still pending. That ruling decides whether New York can regulate Kalshi at all. The subpoena fight shows the Commission building its penalty file in the meantime.
Appeals Courts Have Split on State Authority
Kalshi is fighting the same question in courts across the country: can states apply their gambling laws to its sports contracts, or does federal commodities law override them? Each case goes to the federal appeals court that covers that state, and so far they disagree.
The Third Circuit, which covers New Jersey, sided with Kalshi 2-1 in April. The Ninth Circuit ruled 3-0 against it in Nevada in August. On September 25, the Sixth Circuit did the same in Ohio and Tennessee. That leaves Kalshi with one win and two losses at the appeals level. Its New York appeal will decide which side the Second Circuit lands on.
States aren’t waiting. Utah sued Kalshi last week, seeking a geofence that would block its users there and up to $61.2 million in fees. Ohio has given its licensed gaming operators until October 30 to cut ties with prediction market platforms. The CFTC is pushing back, suing New York, Arizona, Connecticut and Illinois for a ruling that event contracts fall under federal authority alone.
No hearing date has been reported in the Manhattan case. Kalshi could still try to move the petition to federal court, as it did with the attorney general’s lawsuit.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Hardware wallet maker Keystone said an intruder broke into its Shopify-powered online store and walked off with customer names, contact details, shipping addresses and order records, though not payment data, recovery phrases or private keys.
Breach spotted October 20, confirmed October 23
The Hong Kong-based firm apologized on X on Saturday, October 24, saying it spotted unauthorized access to its official website on Oct. 20 and, after checking API activity with Shopify, confirmed on Oct. 23 that a third party had obtained customer shipping data.
“You trusted us with those details, and we’re sorry we didn’t keep them safe,” Keystone wrote.
Keystone’s breach statement, posted by @KeystoneWallet on X on October 24, 2026.
The stolen records cover names, contact details, addresses and order information such as items bought and what they cost, while recovery phrases, private keys, wallet passwords and card and bank details stayed out of reach, Keystone said.
The company said it had shut off access, patched the vulnerability, launched an investigation and begun emailing affected customers. It has given no victim count, no entry point and no word on the attacker, though it said a detailed report is coming soon.
Keystone warned buyers that imposters could call, text, email or mail them with offers of refunds, new devices or “fixes” for an order or address. It also told buyers not to enter a recovery phrase on a device they hadn’t ordered and to type the keyst.one address themselves.
Before Keystone went public, X user @PEPE_Whale69 reported a possible leak on Friday evening. They said they got a call from someone spoofing a Montreal police number, who asked if Amazon, eBay or Keystone meant anything.
The post said that the details of the caller tallied with the user’s 2024 Keystone order. Keystone responded at 1:08 a.m. ET Saturday, saying it had “initiated an urgent investigation into this matter.”
Customers say orders past 180 days leaked
Keystone has touted data deletion as a selling point. On January 5, the day that Ledger customers were notified of a leak at e-commerce partner Global-e, Keystone posted that “180 days after your order, your shipping data is permanently deleted.”
“Other hardware wallets keep your data forever. We delete your shipping info in 180 days max,” Keystone wrote in March.
On Saturday, @trintaetres_33 said the breach email reached them even though they bought a device more than two years ago. @BlockchainBarmy said that 214 days had passed between their last order and the breach.
The 2024 order linked to the spoofed call is also more than 180 days old, but Keystone hasn’t said in public if it followed its own policy, and none of the customer claims have been checked out.
On its Privacy Promise page, Keystone says that all shipping information is deleted automatically 180 days after an order. But in its privacy policy, which was last changed in May 2021, it says that order data is deleted only for customers who haven’t placed an order in the last 180 days.
A help center article says that records of the city and country are kept even when buyers ask for deletion, and that Shopify does the final deletion.
In August, Trezor said a breach at shipping partner ShipMonk exposed nearly 14,000 customers, and it later added roughly 67,000 more U.S. customers to the tally.
A few days after Trezor’s first disclosure, SafePal said that a bug in its system for keeping track of orders had exposed almost 40,000 customers.
Cryptopolitan reported earlier this month that Ledger confirmed that hidden chips inside wallets sold by CryptoBilis were reading 24-word recovery phrases during setup and sending them out via LTE. On-chain researchers put the losses at more than $86 million.
Because of this, Trezor will stop selling to some resellers from January 1, 2027.
Keystone wallets use QR codes to sign transactions, so they don’t need a USB, Bluetooth or Wi-Fi connection. The hack affected the company’s Shopify store.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Canada has moved to give Canadian banks a prominent role in its latest draft stablecoin regulations, backing the banks’ push for bans on stablecoin yields, while mandating non-bank issuers to park their reserves inside those same banks.
The document published in the Canada Gazette landed barely three days after the Office of the Comptroller of the Currency (OCC), the top bank regulator in the United States, drew objections from the banking industry after allowing crypto platforms to continue to pay rewards on stablecoins.
The 60-day consultation has now opened on the Friday, October 24, 2026 draft.
Canada and the US go different routes with stablecoin yields
According to the regulations published in the Canada Gazette, the bar on stablecoin issuers in the country offering token holders interests applies across a wide spectrum of “direct and indirect” yield routes. For example, the platform-activity rewards carve-out that Coinbase is allowed to offer in the US counts as yields in Canada.
The Canadian Bankers Association raised the familiar argument about yields pulling deposits out of banks and squeezing lending, according to The Logic, confirming its firm support of the ban.
The ban “is intended to ensure payment stablecoins do not function like bank deposits or investment products,” said Finance Canada spokesperson Marie-France Faucher.
Stablecorp CEO Kesem Frank has argued Canada should copy the US and allow some rewards, warning that without yield there is little reason to hold a Canadian-dollar coin over a US-dollar one.
How Canada’s stablecoin regulation regime looks
The latest stablecoin regulations draft contained other proposals that prohibit stablecoin issuers from presenting their fiat-pegged tokens as legal tender, bank deposits, or publicly insured products.
Per the stipulations in the draft, stablecoin issuers are required:
to register with the Bank of Canada
back every coin at least one-to-one with high-quality liquid assets in the reference currency
redeem at par
keep policies covering governance, risk, data security, and recovery
keep reserve assets in banks
The Minister of Finance and the Bank of Canada also get roles screening applicants for national security risk and enforcing penalties on defaulters, respectively.
Canadian banks have a built-in advantage
The SCA only regulates non-financial issuers. Banks, trust, loan and insurance companies, credit unions, and foreign financial institutions are excluded because they are already prudentially regulated, the Gazette states.
So, while banks are not stablecoin issuers, the firms issuing these tokens still have to rely on them for reserve custody. For example, VersaBank is the custodian of Stablecorp’s QCAD, Canada’s first regulatory-compliant Canadian-dollar stablecoin. The bank earns a custody fee plus a spread on the deposits. Tetra’s CADD, launched with National Bank, Shopify, and Wealthsimple behind it, keeps all reserves at Canadian institutions, including tier-one banks.
Another advantage codified in the regulation proposal allows banks to pay interest and even carry deposit insurance on tokenized deposits. Stablecoin issuers, on the other hand. cannot access the same levers despite both running on the same ledger technology.
The 60-day consultation runs before the rules are finalized. Finance Canada expects the framework in force in 2027, though senior deputy governor Carolyn Rogers told the Senate in May 2026 that regulations could realistically land in mid- or late 2027.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

On October 25, 2026, CoinDCX confirmed that it lost 15.99 million USDT from retired wallets. Before that, on October 22, CEO Sumit Gupta had dismissed the breach warnings as just a possible “false alarm.” The turnaround brings into doubt how the exchange kept track of those wallets and conveyed information to its customers.
A sweeping failure the exchange says it absorbed
In a post, CoinDCX said that customers were still sending deposits to wallets that were retired due to the hack in July 2025. The platform’s automated sweeping service was supposed to transfer those deposits into active wallets. However, according to the exchange, it “had failed for a particular period.”
The exchange claimed to have compensated all deposits and taken the hit. Trading and withdrawals proceeded as normal. CoinDCX has committed to keeping a better eye on its old systems.
From ‘false alarm’ to admission
The controversy began on October 22, when researcher Darcy flagged suspicious TRON transfers. Gupta thinks that hackers have been reusing wallets that were compromised in 2025. CoinDCX claimed that certain reports were found to be misleading.
The explanation was questioned by investigator ZachXBT, who pointed out that the allegedly retired wallets were used to transfer deposits recently in April and May 2026. Cryptopolitan reported on the denial.
What the chain shows versus what CoinDCX says
On October 21, Bitquery found out that 15.99 million USDT was transferred from a number of 40 wallets associated with CoinDCX. One of those wallets controlled $15.82 million, which came from 88 transactions.
The last regular transfer was made at 12:14 UTC, while the first move of the thief happened at 12:19 UTC. Bitquery also discovered 276 fee top-ups since August and sweeping activity after the theft. The information contradicts the statement that the wallets were inactive.
Approximately $9.63 million has been transferred using six intermediate wallets to OKX, Binance and Gate within a time frame of 18 hours. Tether has frozen $2.21 million in nine wallets on October 22. At least $30,000 still exists in the thief’s wallets, according to Bitquery’s snapshot taken on October 23. The blockchain is unable to provide information about how the perpetrator accessed the wallets.
SEO title: CoinDCX $16M USDT Drain: Wallet Timeline, Exchange Transfers and Tether Freeze
A small exchange with a troubled year
On October 26, DefiLlama listed CoinDCX’s reserves at $173.3 million and its 24-hour spot trading volume at $1.47 million. The numbers stand for different things: reserves indicate reported assets, while trading volume reflects market activity. Neither reveals how much CoinDCX owes customers, making it impossible to know from these numbers alone whether customer deposits are fully backed.
CoinDCX’s September report recorded 23.1 million registered users and a ₹57.07 crore Crypto Investor Protection Fund. The fund provides an additional safeguard, but it does not guarantee coverage for every loss. That distinction matters because CoinDCX had already lost roughly $44 million in a July 2025 hack, before the latest $16 million incident.
Why the governance questions travel
CoinDCX’s case reflects a wider weakness in crypto security. TRM Labs found that infrastructure and operational compromises caused roughly 76% of crypto hack losses in the first half of 2026, despite accounting for just 15% of incidents. Such failures may be relatively uncommon, but their financial consequences can be severe.
The questions surrounding CoinDCX’s response also extend beyond its customers. Coinbase invested in the exchange in October 2025 as part of its expansion into India and the Middle East. Chainalysis ranks India sixth globally for grassroots crypto adoption. With growing interest in the region, CoinDCX’s handling of the incident matters. Covering the loss was necessary, but restoring trust requires something more: explaining why it initially dismissed an active wallet drain as a “false alarm.”
The smartest crypto minds already read our newsletter. Want in? Join them.

There have been scam emails sent from Foundation’s domains. The company that made the Passport Bitcoin hardware wallet has traced them to at least one leaked Cloudflare API key.
It revoked all API keys late on October 25 and said that Passport devices and the Bitcoin they hold are safe.
Passport funds are safe, the company said at 11:47 p.m. ET
At 11:47 p.m. ET, Foundation put the warning on X. Spam that seemed to come from official Foundation domains had already been going around, and the bad domain it contained was shut down.
Foundation’s warning about the spam emails, posted by @FoundationHQ on X on October 26, 2026.
Software can use an API key to access an account without a password. With just one leak, whoever has it can get in.
“Funds stored on Passport are safe and Passport hardware is not compromised,” the company said. It said it was working round the clock to get to the bottom of exactly what happened and would publish a report.
Foundation’s setup guide says that Passport Core is an offline device used to store keys and sign transactions. Each transaction is built by a paired software wallet, and the device approves it.
Passport buyers say the messages carried their names and addresses
X user @crisisdot said at 11:29 p.m. ET that they received a message from hello@foundation.xyz “saying my Passport funds are at risk and asking me to move to a new recovery phrase.”
The same user said a site at incident.foundation.xyz was also live and that Foundation’s “email and DNS are compromised.” Three posts from recipients came in between 11:29 p.m. ET and 11:44 p.m. ET.
All of them were before Foundation spoke.
One customer said the message was about a purchase in the middle of 2025 and got through spam filters.
The same buyer said it looked like the con artists had a shipping address, name, email address and purchase information. Another recipient said that their name, address and email were in the email.
Foundation has not said if order information from customers was accessed or where the senders got the information. Its privacy policy states Foundation cannot retrieve lost seed phrases or private keys and “will never ask you to disclose them.”
Trezor took a similar hit in September. The wallet maker warned users of a phony “Critical Security Alert” sent through its third-party email provider on September 9, Cryptopolitan reported.
One recipient reported that the message passed DKIM, SPF and DMARC checks. Trezor took down the domain used to send it.
Casa CEO Nick Neuman said BitBox users seemed to be receiving similar emails and that a shared marketing email provider may have been compromised.
A list of Trezor’s buyers had been leaked weeks before. Because of the breach at shipping partner ShipMonk, the names, addresses, phone numbers, emails and order data of around 80,700 users were exposed.
Trezor said that no devices, private keys or wallet backups were compromised.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

China’s carmakers have officially outsold their Japanese rivals in Europe over an entire quarter for the first time, and the numbers show just how quickly the market is changing.
BYD and Chery, among others, are winning customers in a place where companies such as Toyota and Nissan have been operating for many years to date.
Dataforce reported that Chinese brand sales have almost doubled in September from last year, accounting for 12.7% of all car sales in Europe, against 11.9% for Japanese brands. The sales increase was largely due to hybrid vehicles; however, Volkswagen, Renault, and other European brands dominate the market.
China’s automakers are winning European customers faster than expected
Five years ago, Chinese brands barely accounted for 1% of European vehicle sales. Today, they’re challenging manufacturers that have been around for generations.
Toyota started selling cars in Europe in 1963 and now operates factories across the continent. Nissan has manufactured vehicles at its Sunderland plant in Britain since 1986.
The UK has become a particularly important market for Chinese companies. Chery’s Jaecoo 7 SUV was Britain’s best-selling model in both March and September.
The figures measure new vehicle registrations rather than factory production, making them an indication of what European customers are actually buying.
Meanwhile, things aren’t going particularly well for foreign automakers back in China.
Drivers in China are shunning Volkswagen and BMW cars to favor their local counterparts. The reason is that local carmakers are designing and selling new cars at a faster rate and more cheaply than their competitors.
The falling demand among the locals has forced manufacturers to look for foreign markets.
In the recent car show held in Paris, Chinese car brands such as Chery, BYD and Geely Zeekr unveiled various cars designed specifically for Europeans.
BYD Dolphin G DM-i was one of those cars that the Chinese carmaker revealed at the Paris auto show.
It was designed specifically for European drivers as it was an inexpensive plug-in hybrid car made by BYD.
Europe moves to restrict Chinese imports as BYD faces higher costs
The European Union is trying to slow the expansion, partly because Chinese manufacturers benefit from government subsidies.
Brussels has already introduced additional tariffs on battery-electric vehicles manufactured in China.
This month, European officials also reached a preliminary agreement to restrict Chinese hybrid imports to 350,000 vehicles annually.
But shipments of hybrids have actually accelerated as manufacturers prepare for possible additional restrictions.
The EU is considering another approach that would make locally manufactured vehicles eligible for certain subsidies and incentives.
One proposal would connect company-car tax benefits to European production. That could matter considerably in Germany, where businesses and fleet operators account for substantial vehicle purchases.
China is also introducing changes that could hurt its own exporters.
On October 12, Beijing announced that the VAT rebate on new-energy vehicle exports will fall from 13% to 9% starting April 1, 2027.
JPMorgan warned in a note on Tuesday that the smaller rebate, combined with the reinstated battery consumption tax, could damage industry profitability faster than previously expected.
BYD executive Liu said the company’s existing factories in Southeast Asia should limit the effect of the rebate reduction on regional sales.
Liu also expects BYD to expand its international manufacturing operations as the global oil shock strengthens demand for electric vehicles.
However, he said BYD has not decided whether to raise overseas selling prices to recover the additional tax costs, especially as competition between manufacturers becomes more aggressive.
Morgan Stanley estimated in an October 13 research note that BYD’s planned manufacturing capacity outside mainland China had reached one million electric vehicles, with Europe accounting for just 30%.
The expansion comes while the company faces considerable financial pressure at home.
BYD’s first-half net profit dropped more than 20% from a year earlier to 12.3 billion yuan ($1.84 billion), weighed down by declining domestic demand.
Chinese manufacturers are already preparing to build more vehicles directly inside Europe, potentially reducing their dependence on imported cars.
Chery is preparing manufacturing operations in Barcelona, while BYD is approaching completion of its new factory in Hungary.
Meanwhile, Zhejiang Leapmotor has started producing its B10 SUV at Stellantis’ Zaragoza factory in Spain, under a joint venture between the two companies.
If you're reading this, you’re already ahead. Stay there with our newsletter.

Moonshot AI has apologized to Kimi K3.1 Pro users after their paid service was interrupted by a cap on its use and wasted quota. They have reset their counters and given users back 25% of their monthly quotas. The incident reveals a serious challenge in the area of autonomous AI agents: the responsibility of operating them is becoming costly.
On Sunday, October 25, 2026 (UTC), Moonshot stated that the problems happened due to the company’s fault and noted it “should have fixed them sooner.” All active users received a one-off restoration equal to 25% of the monthly quota regardless of what tier they are on. Users whose allowances were smaller than 25% got their counters reset.
Moonshot also cut unnecessary subagent calls as well as long responses that consumed allowances. The matter of GPU shortage was not mentioned in its October apology.
A capable model that is slow and verbose
Kimi K3.1 Pro was launched on October 23, 2026. It is the most powerful model in the 3T category of Moonshot, featuring a million-token context window. It is available on Kimi.ai, Kimi Work, Kimi Code, and the API. Its Highspeed version works around two to three times faster than the normal one. Its complete model weights are expected to become available on November 4, 2026.
We’re sorry for the rate limits and unnecessary quota consumption on the K3.1 Pro subscription plan. These were our issues, and we should have fixed them sooner. Today, every subscriber on every plan gets a one-time usage reset, restoring 25% of their monthly quota (usage below 25% resets to zero), equal to one week of usage. Your usage bar will reflect this adjustment by end of day PST. We’ve also adjusted the plan’s parameters and are reducing unnecessary subagent calls and output length, so your quota goes further. Thank you for your patience while we put this right.
— Kimi.ai (@Kimi_Moonshot) October 25, 2026
According to Moonshot, the score of Kimi K3.1 Pro on Terminal-Bench 4.0 is 65.7%, outperforming the results of GPT-6 Astra (58.2%) and coming very close to that of Claude Opus 5.5 (66.4%).
Moonshot AI has apologized to Kimi K3.1 Pro users after their paid service was interrupted by a cap on its use and wasted quota. They have reset their counters and given users back 25% of their monthly quotas. The incident reveals a serious challenge in the area of autonomous AI agents: the responsibility of operating them is becoming costly.
Why autonomous agents drain quotas
When tasks are assigned through one AI agent to another, token utilization can get even bigger. According to Anthropic’s research released in 2025, agents require four times more tokens than regular chat usage, while multi-agent systems require around 15 times more tokens. The contribution of tokens to the performance of the system was about 80% in one experiment conducted by the researchers.
The research did not involve Kimi, but it helps explain why Moonshot cut unnecessary subagent calls. A separate 2026 study from Harbin Institute of Technology explored another way to control costs. By assigning less expensive models to simpler tasks, its framework reduced token-weighted deployment costs by 85.2% compared with its baseline.
Kimi K3.1 Pro Quota Reset: 25% Restoration and AI Agent Token Costs
GPU strain in July, and a wider US–China contest
Moonshot faced a different capacity problem on July 19, 2026, when it reported that overwhelming Kimi K3 demand had strained its GPUs, forcing a temporary halt to new subscriptions. It has not connected that shortage to October’s quota problems.
Meanwhile, Cryptopolitan has reported Moonshot’s pending open-weight release, reduced cyber capabilities and a roughly $700 million shareholder arbitration claim.
The stakes extend beyond Moonshot. BCG’s June 2026 analysis finds cost-efficient AI as a Chinese strength, while the US leads in frontier models, talent and capital.
K3.1 Pro’s benchmarks and pricing show that Moonshot can compete on capability and cost. But subscribers also need reliability. A powerful, affordable model offers little value if users exhaust their allowances before their agents finish the job.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

House of Doge and its U.S. subsidiary have until Dec. 31, 2026, to remove “Doge” from their corporate names.
The deadline is part of the price of unwinding an exclusive trademark deal with the Dogecoin Foundation, as outlined in a Form 8-K filed with the SEC on October 23.
A new license covers only three 21Shares products until 2029
On October 19, the exclusive license was mutually terminated by both sides. It canceled the exclusivity, sub-licensing rights and partnership titles.
Neither company can any longer refer to itself as the Foundation’s “Official Corporate Arm” or “Official Commercial Partner.” Each must also scrub the marks from the names of its controlled subsidiaries.
House of Doge Inc. is the parent company, and trades on Nasdaq under HODO. Its Texas subsidiary, House of Doge (U.S.) Inc., was previously known as House of Doge Inc.
The company is contemplating a corporate rebrand, the filing says. It also plans to seek shareholder approval for a reverse stock split at its annual meeting.
CEO Marco Margiotta and CFO Charles Park resigned October 22. McQueen Labs chief executive Curt Hopkins took on both jobs on an interim basis.
On October 21, Dogecoin Labs was launched as the Foundation’s official commercial partner under CEO Jordan Jefferson.
The Dogecoin Foundation and MadeUpNumbers Ltd. grant the subsidiary a non-exclusive license to use the DOGECOIN and DOGE marks on only three products, as they existed on October 19, 2026.
They are the 21Shares Dogecoin ETF (TDOG), 21Shares Dogecoin ETP (DOGE) and 21Shares 2x Long Dogecoin ETF (TXXD). Any other product needs written approval from the Foundation, one product at a time.
Marks may not be used in corporate names, goods, payment products and unrelated financial products. New approved products pay the Foundation a percentage of net revenue, on a product-by-product basis, paid quarterly, with no minimum royalty and no up-front fee.
License expires October 19, 2029, with no automatic renewal. The 21Shares Dogecoin ETP has been trading in euros on Xetra and Gettex since April 8, 2025, with assets of around $9.49 million.
An unpaid $400,000 exit fee puts the new license at risk
The subsidiary agreed to pay the Foundation $400,000 to terminate the old deal, when it has enough money. Payment can be in cash, HODO shares, or both.
If a missed payment is not received within ten business days of notice, the Foundation may terminate the new license.
Accrued claims under the old license persist until the full $400,000 is collected.
Item 1.02 of House of Doge’s Form 8-K filed with the SEC on October 23, 2026, setting the name-change deadline and the $400,000 termination payment.
Separately, the subsidiary is moving Such App’s software, source code, domains and cloud infrastructure to Dogecoin Labs. In return, it obtains $4 million worth of Labs stock, valued at a $120 million fully diluted pre-money valuation.
Dogecoin Labs does not assume any of the subsidiary’s liabilities or contracts. Closing requires consents and lien releases from secured lenders, and either side can walk if nothing closes within 30 days of October 19, which is November 18.
The same filing also included a binding letter of intent to purchase McQueen Labs’ MCQ Markets token platform for $15 million, plus its microlending business. The LOI shall expire automatically if no definitive agreement is executed by December 15, 2026.
House of Doge built its identity on the brand Dogecoin. It went public on Nasdaq through a reverse merger with Brag House Holdings, a deal that received backing from 98% of votes cast by Brag House shareholders in April 2026.
House of Doge partnered with Paxos, the firm that manages crypto backends for PayPal, Venmo and Interactive Brokers, in June, according to Cryptopolitan. As of October 2025, it held more than 837 million DOGE with 21Shares.
Dogecoin Labs plans to merge DogeOS application infrastructure with the MyDoge wallet and Such App.
On October 25, DOGE shed 1.2% over 24 hours to about $0.077. U.S. Dogecoin funds saw net outflows of around $538,000 that week.
The smartest crypto minds already read our newsletter. Want in? Join them.

Bitcoin and gold are having the kind of year their biggest supporters usually warn everyone else about. Both are sitting at the bottom of the major investment rankings for 2026, while cash parked in short-term US Treasury bills is actually making money.
Creative Planning strategist Charlie Bilello puts Bitcoin’s loss at 7.3% and gold’s at 7.5% through October 25. He says his records have never shown the two ranking together in last place during any calendar year.
Bitcoin and gold are losing while stocks and commodities climb
The comparison gets worse when you look at what else investors could have owned. A broad commodities basket has jumped 52.5% this year. Large US stocks have gained 12.3%, and short-term Treasury bills have returned 2.9%.
That last number is particularly painful for anyone who bought Bitcoin or bullion to escape the problems of ordinary money.
Bilello tracks 21 asset classes going back to 2011. Only 57% are showing positive returns in 2026, so it hasn’t been an easy year across the board. Still, the two assets often sold as protection against inflation and economic chaos have ended up trailing even conservative investments.
Source: Charlie Bilello/X
Gold’s reversal has been especially sharp. It surged 63.7% in 2025, the strongest year in Bilello’s table, then climbed above $5,400 an ounce early in 2026. By Friday, spot prices had dropped to $3,995.81, slipping under $4,000 for the first time since July.
Bullion recovered slightly on Monday. Spot gold rose 0.3% to $4,008.70 by 0755 GMT, while US gold futures for December delivery advanced 0.3% to $4,021.90. That came after a 4% weekly decline, the steepest since June, and a move to the lowest spot price since mid-July.
Bitcoin hasn’t offered much comfort either. The crypto is priced at $80,472, around 35% below its record above $126,000 last October. If its losses hold, 2026 will become its second consecutive negative year, following a 6.3% decline in 2025.
That doesn’t erase its longer history. Since 2011, Bilello calculates an average yearly return of 120.6% for Bitcoin, compared with 6.3% for gold. But historical averages don’t pay this year’s bills.
Oil prices and Fed expectations are making things harder
This is the challenge facing both assets, since neither earns interest. When US interest rates are expected to go higher, bonds along with all other interest-earning investments become more attractive. Holding on to either gold or Bitcoin therefore becomes even more costly.
And there’s also oil putting additional pressure on inflation expectations. Brent crude reached $116 per barrel on Friday as tensions escalated between the US and Iran. High energy prices could increase consumer prices and give the Fed another reason to maintain tight monetary policy.
ING analysts said the precious metal couldn’t even benefit from a selloff in technology shares. Instead, they said the market:
“…appears more focused on higher oil prices and what it could mean for inflation.”
There are efforts to cool the situation. Qatari mediators were in Tehran on Sunday, coordinating with the United States to ease regional tensions.
The October 27-28 FOMC meeting is another important event to look out for. Investors expect interest rates to remain unchanged for now; however, expectations for an increase in December have increased significantly: according to one CME FedWatch estimate, the probability is currently 68%, whereas another one is as high as 79%.
Another event to keep an eye on is the PCE inflation data release scheduled for Thursday, which is one of the indicators used by the Fed in its efforts to reach 2% inflation rate target.
There is another wrinkle in Bitcoin’s story. Despite Wall Street’s growing involvement, researchers still cannot identify the owners of most coins. Galaxy’s October snapshot classified 11.1 million BTC, roughly 55% of total supply, as unattributed.
Galaxy research head Alex Thorn wrote on X:
“More than half of all BTC supply is sitting in addresses with no known attribution despite all the institutionalization and centralized ownership over the years, still a ton of bitcoin (maybe even most) is held by individuals in self-custody.”
This number is not conclusive evidence that every unknown wallet is owned by individuals. This could be institutional accounts that were unidentified by Galaxy, and also coins whose private keys were lost by their owners.
In other metals trading, silver climbed by 0.2% to reach $54, platinum declined by 0.3% to $1,546.18 and palladium declined by 0.5% to $1,038.85. There are only two months left before the end of 2026.
The smartest crypto minds already read our newsletter. Want in? Join them.

Grok Imagine dropped the first seven minutes of an AI-generated “Odyssey” on Friday, three months after Elon Musk vowed a full-length feature of Homer’s epic.
The account brands the clip as “Episode 1 of our Odyssey series.”
Wonder Studios and director Dev Walker share credit on the 4K release
In July, Musk wrote on X, “Before this year ends, Grok Imagine will make a full-length movie of The Odyssey that is historically accurate and true to the art of Homer.” In his post he quoted a short dialogue scene built with the tool.
The release was uploaded in 4K on Oct. 23 and is just over seven minutes long. Wonder Studios and director Dev Walker are credited as creative collaborators by SpaceXSI’s image and video generator Grok Imagine.
That night Musk shared the episode with a four-word caption: “Odyssey with Grok Imagine.”
Wonder Studios, which makes films and commercials, reposted the clip. “Homer didn’t have Grok… we do,” the studio wrote.
In the comments, Grok Imagine asked viewers if they wanted “a full breakdown of how it was done.”
The post for Episode 1 had picked up more than 19,000 likes and 2,100 reposts and some 6 million views by Monday.
Watch Episode 1 of our Odyssey series made with Grok Imagine.
Let us know in the comments if you’d like a full breakdown of how it was done!
Creative collaboration with @WonderStudiosX and director Dev Walker @glumlot_ https://t.co/xpgpkqSCpq
— Grok Imagine (@imagine) October 23, 2026
Reviewer Anthony Ha finds no artistry in the AI footage
Musk had denounced Christopher Nolan’s take on “The Odyssey” for casting transgender and nonwhite actors. Nolan said he had never seen a technology “so completely rejected by the public” before AI.
Nolan’s movie was released in July, after filming in six countries, mostly with practical effects. IMAX tickets were sold out for months and the film is a favorite to win at the next Academy Awards.
Anthony Ha, a reviewer, said some of Grok’s shots could look like real actors on a real sea. “What the footage really lacks is any sense of artistry, inspiration, or human interest,” Ha wrote.
Nolan’s movie is about three hours long and he took it in without a hitch. He glanced at his watch before it was halfway through with Grok’s clip.
He also took a shot at the cast being all one color, and the narrator having a British accent.
The Odyssey series is within a bigger push for Grok. SpaceXSI set up a partner network last week to bring Grok to big business.
A Tesla engineer said Grok helped tune the Cybertruck’s new rear-view camera view.
Grok Imagine is also under the legal gun. As Cryptopolitan reported in September, a federal judge upheld Minnesota’s ban on AI nudification tools and denied xAI’s request to block it.
Minnesota Attorney General Keith Ellison said the law prevents products such as Grok Imagine from producing sexualized images. Musk wants the full feature ready by the end of 2026.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

The Securities and Futures Commission (SFC) of Hong Kong has granted approval for its inaugural secondary market trading involving tokenized public funds on October 26, 2026. Two ChinaAMC money-market funds can now trade on a licensed exchange, allowing investors greater flexibility in managing their investments. The focus now remains on whether extended trading hours will really provide liquidity.
From an April rulebook to a working market
In its circular dated April 20, 2026, the SFC extended the application of its November 2023 tokenization guidelines beyond primary subscriptions and redemptions. As per lawyers at King & Wood Mallesons, the applied framework has its roots in the rules governing ETFs.
SFC chief executive Julia Leung explained the goal:
“This initiative allows a traditional securities product, once tokenised, to be traded in the evening and on weekends”
— Julia Leung, in an April 20 statement.
Two ChinaAMC funds live on PantherTrade
As reported by PantherTrade, CUMFU-USD and CAMFF-HKD began trading on October 15, 2026, at 17:00 HKT. Both tokens are categorized as suitable for individual as well as institutional investors.
Each token represents a full or fractional share in ChinaAMC’s USD or HKD Digital Money Market Fund. Ownership is officially recorded off-chain, while PantherTrade does not allow users to deposit or withdraw the tokens.
Based on HKEX’s website, ChinaAMC’s fund in USD has reportedly been valued at US$564.33 million while that in HKD has US$98.40 million, yielding a total of US$662.73 million for both funds. However, this total refers to the whole funds rather than their tokenized share classes or trading on PantherTrade.
What secondary trading actually changes
In the primary market, investors subscribe to or redeem shares directly with the funds. These transactions generally take place during weekday dealing windows and use the next calculated NAV.
In the secondary market, investors buy and sell tokenized shares through PantherTrade. Trading can continue outside regular dealing windows. However, prices depend on market demand and may differ from NAV.
Trading volume and order-book depth for both pairs could not be independently verified. Without these figures, it remains difficult to assess how much trading activity and liquidity the funds have attracted.
Market makers, NAV alerts, and kill switches
Under the SFC’s rules, fund providers must make every effort to arrange at least one market maker for each product. At least one must give three months’ notice before leaving.
In order to avoid price exploitation of investors, platforms need to show indicative NAV values at least every 15 seconds. If a proposed trade deviates considerably from the indicative NAV, alerts are generated. Alerts are not generated every 15 seconds.
There are other safeguards including trade bands, cooling-off periods and risk disclosures.
Hong Kong’s Tokenized Fund Trading Test: ChinaAMC on PantherTrade
Why global asset managers are watching
Investor interest motivates asset managers to pay close attention to the tokenized fund industry in Hong Kong. An October 2025 survey by BCG/Aptos indicated that out of the respondents, 61% planned to increase their fund allocation because of the benefits of tokenization. However, interest alone is not sufficient to guarantee that trading will take place.
Hong Kong has been working on the infrastructure necessary for this market. The HKMA’s pilot in October 2025 investigated the use of digital currency for settlement of tokenized funds. According to Cryptopolitan, the HKMA revealed its intention to apply round-the-clock on-chain settlement on September 23, 2026. Also, Standard Chartered decided to use HKDAP for the settlement of tokenized money market funds in the last quarter of 2026. The question for global asset managers is whether these innovations will create real liquidity out of investors’ interest.
24/7 does not mean instant liquidity
Round-the-clock trading gives investors more opportunities to buy and sell, but it cannot guarantee that buyers will be available. Market makers help provide liquidity, although they can leave after giving notice. Trading can also be halted, while PantherTrade’s restrictions on token deposits and withdrawals limit investors’ flexibility.
Hong Kong’s real test is whether these markets can attract enough trading activity to provide reliable liquidity, particularly outside regular market hours.
The smartest crypto minds already read our newsletter. Want in? Join them.

Tokenized stocks deposited in DeFi protocols have crossed $300 million, according to the latest data from Token Terminal. Last month, we covered the year to date growth here and, at the time, this number stood at $262 million. Tokenized equities being put to work in DeFi have now grown by 2,451.5% from a year ago, when deposits were at around $11.8 million. For months, the growth in this space was gradual until August came along.
Deposits are now spread across 20 issuers and 10 chains. That said, the market is concentrated amongst a handful of names. The growth in tokenized equity holders pledging their assets as collateral, supplying them to liquidity pools and putting them to work for yield is no longer a speculative trend.
Most of the Growth Came After July
Tokenized stock total value locked (TVL) did not move much throughout the first half of 2026. It was only until August when there was a sharp climb in activity. At the start of Q3, it stood at $80.1 million and by September 30, this number had grown to $265 million. That’s an increase of around 230% in that quarter alone.
The timing lines up with two big launches beginning to gain traction. Binance enabled bStocks in June and Robinhood Chain’s public blockchain went live in July. Since then, Robinhood Chain has become the second largest chain for tokenized stock deposits in about three months, a clear sign of how quickly brokerage-scale distribution can reshape onchain market share.
Solana and xStocks Hold the Top Spots
In terms of Tokenized Stocks DeFi TVL by chain, Solana leads the pack with $102.6 million, or 34.2% market share. In second and third place are Robinhood Chain and Ethereum respectively. With BNB chain at $42.8 million and Base at $24.3 million, the top five chains make up about 96% of all deposits.
The issuer side is just heavily concentrated. xStocks holds over 39% of the market with $102.6 million ahead of Robinhood at $70.8 million and Binance’s bStocks at $38.4 million. Ondo Finance, one of the better known names in tokenized equities, accounts for just $3.4 million.
xStocks got there early. Its tokens are issued natively on Solana and have been plugged into lending markets like Kamino since July 2025, alongside liquidity pools on AMMs like Raydium. bStocks has grown past $1 billion in assets, yet only about $38 million of it sits in DeFi. Most bStocks are minted inside Binance accounts and appear to stay there, and the exchange now accepts them as margin for futures trading, none of which shows up in DeFi data.
Only 6.8% of Tokenized Stocks Are Being Put to Work
The total tokenized stock market is worth $4.4 billion, up 254.3% over the past 180 days and spread over 13,411 stocks from 36 issuers on 18 different chains. DeFi deposits make up only about 6.8% of that. If utilization climbs even modestly, DeFi deposits could grow faster than issuance itself.
The race for this collateral is turning into a contest between distribution models. Solana brings crypto-native liquidity and Robinhood Chain has a retail brokerage base behind it. BNB Chain leans on Binance’s exchange users, while Base has Coinbase.
There’s also a use case brokerages can’t offer. Stocks that trade around the clock and plug into lending protocols mean someone could borrow against NVDA on a Sunday or LP TSLA while Wall Street is closed. For now, only a small slice of the market is doing that.
If you're reading this, you’re already ahead. Stay there with our newsletter.