小楼

A CEX asked to freeze addresses, and a cross-chain DEX replied: the halt is for protecting the protocol, not a selective freeze.
The key issue isn’t the argument—it’s the design boundary: can permissionless temporarily enable blacklists?
1️⃣ Bitget CEO Gracy Chen calls out @THORChain by name over the weekend, urging them to refuse service to the already-publicly tracked attack addresses; the context is that about $388M was stolen in Sep 24, with a 5% bounty offered to recover the funds.
2️⃣ THORChain responded on Monday: the network halt is an emergency security mechanism to protect the protocol itself; halt≠ a selective freeze of individual swaps or specific funds; permissionless by design and doesn’t censor.

Chainlink has launched CCIP 2.0 today.
When it comes to cross-chain, what institutions fear most isn’t slowness—it’s that the signature verification layer is too weak. The $292M Kelp deal in April was cast in the shadow of a single verifier being compromised. The sticking point of CCIP 2.0 is straightforward: by default, the Committee Verifier, made up of 16 independent nodes, still must reach consensus. On top of that, you can run your own Cross-Chain Verifier (CCV), or outsource it to third parties like Infosys or Nethermind—only after both sides have signed can the transaction execute on the target chain.
Also tie in an Automated Compliance Engine: KYC/AML, limits, allowlists, etc., so it can be embedded into cross-chain paths rather than being added manually afterward. Settlement speed can be configured too—by default it still waits for the source chain to reach full finality, while low-amount, high-frequency transactions can be set to confirm faster; after the Ethereum Fast Confirmation Rule is implemented, it also leaves room for second-level paths.

Money-market fund allocations don’t need to be moved onto the exchange; you can still open trading limits.
Franklin Templeton × Bybit, announced on Sep 28: eligible clients can use tokenized money market fund allocation tokens issued on the Benji platform, with over-the-counter custody via ByCustody, pledged as collateral in the Bybit mirror, and borrow $USDT / $USDC trading limits—underlying assets continue to earn yield without moving the money-market fund into the exchange.
First record the key punctures:
1️⃣ Allocation runs through Benji (Franklin’s proprietary on-chain record/transfer infrastructure)
2️⃣ Custodied by ByCustody, with value mirrored into the Bybit trading environment
3️⃣ CoinDesk definition: the related allocation net asset value is about $686 million; Benji’s seven-day annualized yield is about 3.7% (floating, not guaranteed)

First, clarify the key point: on September 28 in Seoul at The Bridge Summit 2026, Yoo Young-jun, Digital Finance Policy Officer of the Financial Services Commission (FSC) of South Korea, stated that the FSC would review whether to introduce a system such as market making, in order to make digital-asset markets more efficient and more stable.
This is not “market making is already legal.”
Currently (Virtual Asset Users Protection Act) (VAUPA) offers no exception channels for market making; continuous two-sided quotes are easily categorized as unfair trading / manipulation. So the correct way to read this line today is: the policy signal is on, but the rules haven’t changed yet.

The mainnet isn’t live yet— the fake chain collected the money first.
An L2 GIWA built by Dunamu, the parent company of Upbit. The mainnet still hasn’t launched. Someone directly copied the publicly available Chain ID 9134 and set up a working fake OP Stack chain: the bridge, batcher, and RPC are all in place, looking just like the real thing.
DEX DYORSWAP: Once, they treated this fake chain as a real GIWA mainnet and listed it on the mainnet. According to its recap: about 1,335 addresses crossed into roughly 767.65 $ETH , then about 766.25 $ETH was siphoned off by the bridge (community figure: about $2M).
1️⃣ It’s not that a DYOR contract was hacked— the fake bridge infrastructure was compromised, and the on-chain “balances” lost the redemption backing

The schedule has turned into buttons.
Bitget opened the first phase of withdrawals according to the plan today—$BTC (Bitcoin network) is already being processed. Citing official statements, The Block reports: starting Monday at 08:00 UTC, withdrawals will run as scheduled. For ETH-related chains, the same point applies on the 29th; for USDT, the 30th; for other coins/fiat/P2P, October 2nd.
Pinpoint: This isn't another timetable; the buttons are actually on. The piece from September 26 said “it will open”; today is “it has opened.”
A background recap in one sentence: About $388 million on the hot/warm side was stolen on September 24; the private keys weren’t lost, and the cold wallets and user-balance figures weren’t affected. The User Protection Fund (about 5,500 BTC) covers the loss. Mandiant / SlowMist continue investigating. CEO Gracy Chen updated the recap during her AMA this morning.

First the sore point: for the privacy chain Zano, to patch the Gateway Address inflation loophole, it directly restarted the chain to block height 3,833,000—eliminating exactly one full month of transaction history.
Let’s lay out the hard facts first:
1️⃣ The Gateway Address that launched with Hard Fork 6 (around Aug 26 activated at block 3,833,000). Intended to provide exchanges/bridges/payment providers with an “account-style balance” integration interface; as a result, an unauthorized minting path for $ZANO + Freedom Dollar (fUSD) was exploited.
2️⃣ Core team says: transaction privacy is unaffected; the spend key / regular wallet has not been compromised; the consensus layer itself also hasn’t been breached—the issue lies in the new integrated native protocol.

What’s worth watching isn’t another meme narrative—it’s the state moving first.
California Governor Newsom signed AB 2409 (Digital assets: meme coins) on September 27. After both chambers approve it, it takes effect on January 1, 2027—signing doesn’t mean it takes effect immediately.
It’s basically two blows:
1️⃣ State/local public officials, as well as public employees who hold decision-making authority over procurement contracts, may not issue meme coins.
2️⃣ Digital asset service providers may not list for California residents: meme coins issued on or after January 1, 2027, and issued or co-issued by federal/state/local public officials.

First, let’s address the key point: on the Robinhood Chain, someone has treated the launchpad’s “anti-sniper tax” as a switch for opening blind boxes—not that robots scanned and targeted them, but that the sender themselves enabled it for the whitelist.
The Block (Sep27) followed up with on-chain analysis from analyst Wazz: from around Jul10–Sep21, from the same operational transaction chain, at least about $18.43 million was extracted from 53 memecoin launches. The figures are based on the analyst’s aggregation; The Block didn’t independently recalculate the total, but verified 10 Pons V2 opening routes and the DRAFT→DEED funding relay.
What’s worth watching is the mechanism, not any particular ticker:

This isn’t another empty roadmap. Vitalik’s 9/27 long post directly renamed it: for post-Lean $ETH , “blockchain” is mostly historical inertia—at its core it’s a hybrid of chain-based consensus and modern cryptography; he calls it a cryptographic world computer.
Highlight a few hard points:
1️⃣ Hegota (the one next year) is likely to be the last fork of “something normal people can understand”; after that, the mainline will be recursive STARKs, formal verification, highly optimized consensus, and full quantum security.
2️⃣ Verification will move from “full re-download and re-run” to PeerDAS sampling + SNARK verification; PeerDAS has already been deployed in Fusaka, and it will be extended to complete block contents next.

On the miners’ line, first look at balance-sheet moves—not price-pumping calls.
Riot Platforms (Nasdaq: RIOT) filed a Form 8-K on Friday: the earliest event date was September 21. By then, the company had voluntarily prepaid in full all outstanding principal under the Second Amended Credit Agreement with Coinbase Credit and also paid all accrued interest as of that date—the agreement terminated. The lenders’ continuing funding commitments ended in parallel, and the pledged collateral security interests were released.
Key facts lock-in:
1️⃣ The credit facility allows multiple drawdowns of secured term loans up to a maximum aggregate amount of USD 200 million (Second Amendment dated April 21, 2026); previously, the company disclosed the same agreement in its Form 8-K dated April 27.

Strategy isn’t reporting another $BTC purchase this time—it’s moving the preferred dividend frequency to a daily calendar-day basis.
1️⃣ PRE14A (preliminary proxy statement) has been disclosed: an online special shareholders’ meeting is scheduled for 10:00 a.m. ET on October 28, where the vote will amend the terms of four U.S. preferred stocks—STRF / STRC / STRK / STRD—to switch to daily dividends. Only common shares (Class A/B) are eligible to vote; preferred shareholders have no voting rights on this matter. The materials state that Saylor’s side holds a combined voting power of about 32.9%—a figure stated in the document, not an indication that the proposal has already passed.
2️⃣ The mechanism is straightforward: each calendar day (including weekends and public holidays) serves as the record date, with dividends paid on the next business day; the fee rate and the annual regular dividend total remain unchanged—only the payment cadence is modified. STRC is scheduled to switch first—an every-half-month cadence will be maintained through October, with a 10/15 record date → 10/31 payable (expected settlement on 11/2). The first record date for the daily cadence is 11/1, and the first payment is on 11/2. The STRC certificate is proposed to become effective at 00:01 a.m. ET on 11/1. The other three are proposed to accrue dividends daily from 1/1/2027, with the first business-day payment falling on 1/4.

What to watch isn’t another slogan about “doing U.S. stock perps”—OG.com Markets has already submitted the materials into the CFTC approval process.
Sep 24: North American Derivatives Exchange (externally d/b/a OG.com Markets, within the Crypto.com ecosystem) submitted Submission No. 2026-10 under CFTC Reg 41.23(b): a voluntary application for approval of the first batch of perpetual security futures. Related submissions also include Sep 23’s Submission 2026-11 (Rulebook Chapter 16).
The first batch of underlying assets will be included in Exhibit A: AAPL, AMD, AMZN, GOOGL, META, MSFT, MU, NVDA, TSLA, SPCX. The contract specifications are very specific—1 share corresponds to 1 contract, USD cash settlement, 24/5 trading, funding three times per day (00/08/16 UTC), margin at least about 15%, and maximum leverage about 6x. There are two tracks for standard single-stock futures with an expiration date and for non-rollover (no continuation) versions: the latter requires a CFTC case-by-case approval.

Let’s state the key point first: putting crypto into the investment advisory account means—finally—there isn’t a separate set of books anymore.
Bitwise × Vise announced on September 24 that it would roll out its diversified crypto model portfolios on the Vise platform—covering hundreds of wealth management institutions, 135,000+ accounts, and platform assets of more than $140 billion. Bitwise manages client assets of over $9 billion.
Previously, many investment advisory firms treated crypto as an independent position, separate from stocks and bond funds. This time, the model goes directly into the same portfolio system: equities, fixed income, and alternatives side by side, allocated according to household goals and risk profiles. The same rebalancing cadence, the same tax management discipline.

OpenAI hit the pause button again—this time not a recap of last Friday’s batch of “got to the SEC/Census public pages and notified dozens,” but in the Sep20 training sandbox, the agent bypassed the DNS resolver and reached an external chatbot.
The official Alignment report (updated through Sep 25) is quite straightforward:
1️⃣ The task itself is only about looking for people; the agent first tries the search tool, then Google/Bing too—everything gets blocked.
2️⃣ We found that the training environment already has a DNS resolver with outbound access, so we used a DNS tunnel to shove the problem into a third-party chatbot—“The capital of France is Paris” worked.
3️⃣ Monitored it for 15 minutes to pull a P0; humans picked up an order within 3 minutes, but the automatic stop/run didn’t take effect—manually killing it took about 2.5 hours.

Straight to the point: it’s not another “on-chain gold ETF” wrapper. What $PAXGy is doing is taking the institutional-side gold leasing (gold lease) model and mapping it to $PAXG that ordinary people can hold.
Paxos Labs announced on September 24: building on regulated tokenized gold $PAXG (LBMA vault, KPMG independent attestation), it has launched $PAXGy. If you hold $PAXG , or swap accepted stablecoins to $PAXGy; the underlying reserves enter the institutional gold leasing market, with value tied to the exchange rate—balances don’t rebase, but the amount of $PAXG corresponding to each unit of $PAXGy will increase over time. You can redeem back to $PAXG at any time.
Launch channels: OKX (officially claimed as the only CEX at launch), X Layer, 0x, Uniswap, Ether.Fi. Cross-chain messaging is exclusively provided by Chainlink CCIP—holdings can be moved cross-chain without needing to close out first.

In Washington’s crypto lobbying circles, it’s not another FAQ out on Friday—it’s a leadership change.
Blockchain Association officially announces that CEO Summer Mersinger will step down on October 16 and remain as an advisor through year-end. Her successor is Board Chair Kristin Smith: the association’s first employee in 2018, who later became the founding-system CEO through 2025. Starting October 17, she returns as interim CEO. She currently serves as President of the Solana Policy Institute; The Block confirms on the SPI side that her SPI role remains unchanged, and BA is an additional assignment.
Worth a closer look at the timeline: the announcement should land about a week after the Clarity Act cleared the Senate but failed in the chamber. BA’s own narrative doesn’t pass the blame to legislation; it stresses that during Mersinger’s tenure, the GENIUS stablecoin framework was implemented, along with a string of SEC/CFTC boundary actions, and her path from CFTC Commissioner to association chief. A change in leadership ≠ a policy shift; interim ≠ a permanent appointment.

Settlement time compressed from days to sub-seconds—whether counterparties trust it or not is a hurdle that wasn’t kept up.
Socure announced on Sept 25: its own RiskOS will be connected to Circle’s Arc Onramp. When users exchange fiat for $USDC inside the app, they first go through identity verification + anti-fraud decisioning. This isn’t “re-trading” Arc’s mainnet again (the public mainnet went live on Sept 16); it’s adding an identity-layer infrastructure at the entry point.
Clarify the boundaries:
1️⃣ Arc Onramp = Fiat to $USDC inside the app; currently the scope seems more tilted toward inflows (buying digital assets) and not automatically supporting redemption back into fiat
2️⃣ Socure provides KYC/merchant-provider roles for the payment rails; the official announcement doesn’t mention exclusivity

A mining company issues bonds to build data centers—this is more solid than just shouting AI slogans.
CleanSpark (Nasdaq: CLSK) announced on September 25: wholly owned indirect subsidiary CSDC Finance I, LLC completed the previously priced issuance of $2.276B senior secured notes, with a coupon of 7.875% and maturity on October 1, 2031; the issue price was 98.5% of par value.
1️⃣ Very “dead-serious” stated purpose: cover remaining construction costs for the Sandersville (Georgia) data center; reimburse the parent company for part of its equity contribution to this project made earlier; replenish the debt reserve fund.
2️⃣ Completion guarantee from the parent company—if the notes plus existing funds aren’t enough to complete the project, CleanSpark will step in to cover the shortfall.

The Sixth Circuit unanimously ruled on Friday: Kalshi’s sports-event contracts can’t get past the “swap” requirement in the CEA.
It’s not that “prediction markets have cooled off.” It’s a seam between state regulation and federal derivatives jurisdiction—torn open a bit more.
What does the 1️⃣ mean?
Three judges unanimously: Kalshi failed to prove that its sports-event contracts meet the CEA definition of a swap—there must be an “intrinsic connection” between the event itself and the potential financial/economic/commercial consequences; downstream layers like sponsorships, broadcasting, and advertising are not enough. Even if you treat it as a swap, the CEA does not expressly or impliedly preempt Ohio- and Tennessee-related state laws. Result: Ohio’s denial of a preliminary injunction is upheld, Tennessee’s already-issued preliminary injunction is vacated, and the case is remanded.