Crypto
Crypto’s Split Screen: Washington Tightens the Rules as Markets Wobble and Hackers Strike Again
Article by: CryptoMan
Cryptocurrency had one of those days this week that captures the industry’s entire identity crisis in miniature: regulators in Washington were busy building guardrails for an asset class that keeps proving, hack after hack, why it needs them, while traders shrugged off a nine-figure exchange breach and kept their eyes on bond yields instead.
On Thursday, the Federal Reserve unveiled a long-awaited proposal spelling out capital, redemption and disclosure requirements for stablecoin issuers operating under its supervision — the clearest sign yet that Washington intends to treat dollar-pegged tokens less like speculative curiosities and more like the payment infrastructure they’re becoming. The same day, crypto exchange Bitget confirmed that roughly $351.6 million had been siphoned out of its hot wallets, forcing a temporary halt to withdrawals. Meanwhile, Bitcoin held a shaky line near $84,000 as the 10-year Treasury yield touched levels not seen since 2007, and the Commodity Futures Trading Commission quietly rewrote its own rulebook after Congress once again failed to pass comprehensive crypto legislation.
Taken together, it’s a snapshot of an industry maturing on two tracks at once — one where federal agencies race to fill the vacuum left by a gridlocked Congress, and another where the everyday hazards of running billions of dollars through digital wallets haven’t gone away.
The Fed lays down the law on stablecoins
The Fed’s proposal is its first major step in implementing the GENIUS Act, the law that already requires stablecoin issuers to back their tokens one-to-one with cash, bank deposits or short-term Treasurys. What the Fed added Thursday is the fine print: an operational-risk capital charge scaled to an issuer’s size — 2% on the first $20 billion in stablecoins outstanding, 1.5% on the next $30 billion, and 1% above that — plus additional buffers tied to credit and operational risk. Issuers would generally have to honor redemptions within two business days, and if their reserves ever dip below full backing, they’d be required to notify the Fed immediately and either top up the shortfall or start liquidating and redeeming tokens.
Transparency is baked in too. Issuers would have to publish monthly reports on their outstanding tokens and reserve composition, independently audited and personally certified by their CEO and CFO. A companion proposal would open a formal application pathway for Fed-supervised banks that want to issue stablecoins through subsidiaries.
Fed Governor Michael Barr backed the plan but made clear the job isn’t finished. “Stablecoins will only be stable if they can be reliably and promptly redeemed at par in a range of conditions,” he said, flagging market stress and issuer-specific strain as the real tests of any framework. Barr also pushed for stronger, universal redemption rights in the final rule and warned against language that would limit the Fed’s ability to act on anti-money-laundering failures unless they’re deemed “significant or systemic.”
The proposals now face a 60-day public comment period. The GENIUS Act itself is set to take effect January 18, 2027, or 120 days after final rules are issued — whichever comes first.
Congress stalls, so regulators move on their own
The stablecoin push arrived just days after the Senate failed to advance the Digital Asset Market Clarity Act, the bill meant to finally settle which agency — the SEC or the CFTC — has jurisdiction over which corner of the crypto market. With that effort stalled and few expecting Congress to revisit market-structure legislation before 2027, both regulators are simply proceeding without it.
The CFTC updated its guidance on tokenized assets and blockchain recordkeeping this week, clarifying that registered entities can invest customer funds in tokenized assets as long as those tokens carry legal and economic rights equivalent to the traditional version, and signaling it won’t object to blockchain-based recordkeeping. CFTC Chair Michael Selig framed the move as an effort “to provide regulatory clarity for the crypto industry,” even as he stopped short of tying it directly to the Senate’s failure. The SEC, for its part, has already floated its own rules on crypto investment contracts, with Chair Paul Atkins saying the agency is “ready, willing, and able” to act without Congress.
A reminder that the risks haven’t disappeared
If regulators are trying to make crypto safer on paper, Bitget’s breach was a reminder of how exposed the industry remains in practice. The exchange said its security systems flagged unauthorized transfers from a limited number of hot and warm wallets Thursday evening, prompting an immediate withdrawal freeze. CEO Gracy Chen said cold wallets were untouched, user balances remained accurate, and the entire stolen sum falls within the exchange’s $464 million User Protection Fund — effectively an insurance backstop meant to make customers whole. Bitget said it has flagged the addresses involved to law enforcement and onchain investigators and promised a full incident report within 24 hours, though it has yet to say how the attackers got in.
It’s the kind of incident that, a few years ago, might have sent shockwaves through crypto markets. This time, prices barely flinched — arguably because investors had bigger macro worries on their minds.
Bitcoin caught between yields and yield-chasers
Bitcoin spent Thursday oscillating around $84,000, briefly dipping below $83,000 before clawing back, as the 10-year Treasury yield climbed to 5.18% — its highest since July 2007 — and the 30-year hit 5.46%. Higher yields make government debt more attractive relative to non-yielding assets like Bitcoin, and the pressure was compounded by a weakening Japanese yen edging toward levels that could trigger intervention, which economist Mohamed El-Erian warned could add further strain to an already jittery Treasury market.
Even so, Bitcoin has managed to extend its August rally, defying predictions tied to its traditional four-year boom-bust cycle. Elsewhere in the market, the tokenized real-world-asset project Ondo Finance was a standout gainer, with its token reclaiming the $0.50 level for the first time since December as BlackRock-backed “Ondo Intelligent Portfolios” launched on Ethereum and BNB Chain — another sign that tokenization of traditional financial products keeps advancing even as legislative clarity lags behind.
And on the infrastructure side, a smaller but telling development: DoubleZero rolled out a dedicated fiber market-data feed for the decentralized exchange Hyperliquid, giving professional trading firms the kind of fast, institutional-grade access to order-book data long taken for granted on venues like the CME or Nasdaq. As Hyperion DeFi CEO Hyunsu Jung put it, onchain markets aren’t becoming traditional exchanges so much as adopting their plumbing — a quiet but steady sign of an industry professionalizing in the background, even as its regulatory foundation is still being poured.
Cryptocurrency is gaining ground as a valid payment method. New laws should provide stability and build user trust in stablecoins as an alternative currency.
The altcoin crypto payment space is generating very interesting opportunities and one of those is DAPAhe, a privacy-focused cryptocurrency built on a BlockDAG architecture; see their website for further details.
While Washington targets fiat-backed stablecoins, the broader industry continues to experiment with alternative privacy architectures.
For instance, newer protocols like DAPAhe are utilizing Layer-1 Twisted ElGamal homomorphic encryption to address these exact network anonymity challenges.
Unlike standard blockchains that store transactional details in plain text, DAPA uses an account-based model secured by a layer-1 Twisted ElGamal homomorphic encryption and Zero-Knowledge Proofs.
This structure allows users to instantly check their balances by querying only the most recent block, providing full network anonymity without requiring a complete blockchain sync.
I checked the webwallet DAPA offer, and it’s a good functional wallet with a history of all transactions and a very easy setup. For me, one of its best features is the sync: once done, you don’t need to do it again unless you leave the browser you see;
🔐 Initializing Secure Balance Decryption
Starting cryptographic table initialization…
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
New Crypto Crime Task Force Aims to Freeze Illicit USDT Before It Moves, Weeks After T3 Collapsed
Tron, Tether and blockchain analytics firm Chainalysis have launched a new crypto crime task force, and its central promise is speed: freezing illicit USDT on the Tron network before criminals can move it. The group, called the Digital Crime Task Force (DCTF), was announced on November 12.
The timing is awkward. It arrives only weeks after a near-identical effort, the T3 Financial Crime Unit, reportedly fell apart. T3 was built by Tron, Tether and rival analytics firm TRM Labs.
What the new crypto crime task force says it will do
According to the announcements, the DCTF will combine transaction monitoring, investigative intelligence and closer coordination with law enforcement. Its stated priority is to shrink the gap between spotting a suspicious transaction and acting on it. Stolen or scammed funds often hop between wallets, get swapped into other assets or cross to other blockchains within minutes. Once that happens, recovery gets much harder.
The targets include investment fraud, romance scams, crypto hacks, terrorist financing and North Korean cyber operations. Chainalysis will supply the blockchain intelligence and investigative tools. Tether, as issuer of USDT, holds the power to freeze tokens, and Tron is the network where much of that stablecoin activity takes place.
Tether CEO Paolo Ardoino pointed to the company’s record, saying it has frozen more than $7 billion tied to illicit activity while working with over 360 law enforcement agencies across 73 countries. Tron founder Justin Sun framed the effort as protecting ordinary people who use USDT for payments, business transactions and cross-border transfers.
Why AI scams add urgency
The launch also leans on Chainalysis data about fraud. The firm’s figures show AI-enabled scams were 4.5 times more profitable than conventional schemes in 2025. Impersonation scams rose by more than 1,400% year over year. Tools that generate convincing messages and impersonate trusted people let fraudsters operate at greater scale, which leaves less time to catch the money.
The shadow of T3
The T3 unit launched in September 2024, and Binance later joined. The group said it had helped freeze roughly $250 million in illicit assets. Reports say it nonetheless suffered from slow response times and coordination problems before being discontinued. The sources do not detail exactly what went wrong or why TRM Labs is no longer involved, so the reasons behind the breakup remain unclear.
That history makes the DCTF’s emphasis on speed look like a direct answer to T3’s reported weaknesses. It is also the main test. Identifying suspicious transactions is only one step. The harder part is turning an alert into a freeze, with the right legal and operational sign-offs, before the money moves on.
What to watch
The announcement offers no performance targets, timelines or funding details, and the sources do not say whether other exchanges or companies will join. The partnership also keeps a notable structural feature: a stablecoin issuer, a blockchain’s backers and an analytics vendor working closely together. That gives the group real levers for freezing funds. It also means its success will be judged on results rather than press releases.
For now, this crypto crime task force is a stated intention to be faster and more proactive than its predecessor. Whether it delivers will show in how quickly frozen-fund figures grow, and in whether this alliance lasts longer than the last one.
Explore more on this topic with Vexel Search.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
Tokenized Saudi SME Credit Now Open to Institutions as ZIG Finance Launches zEMS Vault
ZIG Finance has launched a tokenized product that gives eligible institutional investors exposure to Saudi SME credit, a corner of emerging-market lending that large investors have long found difficult to reach. The zEMS Vault is the first product to come out of the company’s partnership with Laser Digital, the digital assets arm of Japanese banking group Nomura.
How the zEMS Vault is built
The vault is a layered structure in which each participant covers a different part of the process. Beehive originates the underlying loans. It describes itself as the first peer-to-peer lending platform in the MENA region regulated by the DFSA, with more than a decade of SME lending experience across the Gulf. Zamanat is the structuring partner and Sharia advisor, while ZIG Markets handles issuance, curation and distribution. Khalij is expected to join as Sharia certification partner, and an independent calculation agent has yet to be appointed.
On the technology side, the vault is tokenized by KAIO, a platform developed by Laser Digital and WebN, and issued on BNB Chain. KAIO handles compliance and the full product lifecycle, including KYC checks at both subscription and redemption. The platform already hosts tokenized funds from managers such as BlackRock, Brevan Howard and Hamilton Lane, and says it has processed more than $500 million in volume.
Why institutions have hesitated on Saudi SME credit
According to ZIG Finance, institutions have held back from emerging-market private credit because of worries about underwriting standards, portfolio construction and risk oversight. The zEMS design tries to answer those worries by bundling local origination, a governance framework and compliant distribution into one product.
ZIG Finance co-founder Abdul Rafay Gadit was frank about the limits of that pitch. The aim, he said, is not to remove credit risk but to make it transparent and manageable. Laser Digital’s role is that of Risk Framework Advisor, helping design the vault’s risk governance and providing tokenization advisory. Its CEO, Jez Mohideen, called the launch an early test of whether private credit can be brought onchain in a form institutions will approve.
The fine print matters
The disclosures are as telling as the announcement. The vault is open only to eligible institutional investors in selected jurisdictions. It does not guarantee returns, is not principal-protected and does not give investors direct ownership of the underlying assets. Credit risk stays with the underlying SME borrowers.
Laser Digital has also made clear that it has not assessed or rated any underlying loan or borrower. Responsibility for credit selection and risk management sits with ZIG Finance and the originator. Despite Nomura’s name recognition, then, the advisory role is not an endorsement of the loan book itself.
A template for other markets
The larger story is the repeatability ZIG Finance is aiming for. The company says more products are in the pipeline, with other regional markets and asset classes under consideration. KAIO’s chief executive, Shrey Rastogi, described the goal as a repeatable model for bringing new markets and credit strategies onchain. Zamanat’s CEO, Umair Tariq, framed it as a steady source of financing for Saudi businesses that could become an established part of global private credit portfolios.
Whether that ambition is met will depend on investor appetite and on how the underlying loans perform, neither of which the launch announcement can show yet. For now, the vault is a concrete test of whether Saudi SME credit can be packaged onchain in a way that institutional compliance teams are willing to sign off on.
Explore more on this topic with Vexel Search.
File photo: Nomura Holdings – NYC (55283758308).jpg by ajay_suresh, CC BY 4.0, via Wikimedia Commons.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
Deutsche Bank’s Crypto Custody Service Is Live: 5 Assets, Europe First, Asia Slated for 2027
Deutsche Bank has switched on its long-awaited crypto custody service, giving European institutional and corporate clients a way to hold digital assets with Germany’s largest lender. The launch, confirmed on Wednesday, November 11, comes about two months after the bank first said it would enter the business.
At launch the service supports five assets: Bitcoin, Ether and three stablecoins. These are Circle’s dollar-backed USDC, Circle’s euro-backed EURC and AllUnity’s EURAU. The bank holds the wallets and private keys on behalf of clients, who can store and transfer the assets through the service.
What clients actually get
The offer is aimed at professional money, not individual savers. Retail customers are excluded from the initial rollout. According to crypto.news, the target client list set out in September includes institutional investors, asset managers, hedge funds, brokers, corporations and sovereign institutions. Customers reach the platform through Deutsche Bank’s Autobahn corporate banking system.
The bank describes the technical setup as hardware-protected private key storage, warm and cold wallets, multiple approval controls and separate storage arrangements for client assets. It has said it uses outside technology providers for selected technical services. Its main partner is Swiss crypto infrastructure firm Taurus, with which it began working in 2023 on custody and tokenization technology, around the time it applied for a digital asset custody license in Germany.
Several details remain unknown. The bank has not named its first customers or published what it charges to hold digital assets, so the commercial appeal is hard to judge from public information.
The regulatory path behind the launch
The timing follows a clear regulatory sequence. Deutsche Bank announced its plans on September 16, subject to clearance. Its entry in the European Union’s Markets in Crypto-Assets Regulation (MiCA) register, covering crypto custody and transfer services, is dated October 12 and names Germany’s financial watchdog BaFin as its regulator. Going live roughly a month after that registration suggests the bank had its technology largely ready and was waiting on the paperwork.
That matters because regulatory uncertainty and the operational risk of managing private keys are often cited as reasons conventional organizations have stayed out of digital assets. A custodian that is a supervised bank operating under MiCA offers those organizations a more familiar structure than a crypto-native platform. Bitcoinist framed the launch as exactly that kind of on-ramp. That is commentary rather than a measured result, and client uptake is the real test.
Beyond storage: tokenization and Asia
Deutsche Bank is presenting custody as a starting point. Alongside the launch it signed a memorandum of understanding with Deutsche Asset Management, its majority-owned asset manager, to explore tokenized money market funds, crypto exchange-traded commodities and stablecoins. An MoU only commits the two sides to explore these ideas, and no products have been announced.
Paul Maley, the bank’s global head of trust and securities services, said the medium-term aim is “a fully integrated, regulated ecosystem that supports the custody, tokenisation, and settlement of digital assets.” Gerald Podobnik, co-head of the corporate bank, told Reuters in October that the bank would start in Germany and then expand to Asian financial centers in 2027. Nothing in the launch coverage suggests that timetable has changed.
The stablecoin lineup is also worth noting. Two of the three are euro-denominated, and one of them, EURAU, comes from AllUnity, a venture that Cointelegraph describes as Deutsche Bank-backed. That points to a bank pairing its custody offer with euro-based digital cash as well as the dollar tokens that dominate the market.
For now, the bank’s crypto custody offering is narrow, limited to professional clients and a handful of assets. But a major European lender has gone from announcement to a regulated, working service within weeks, which sets a reference point for other banks weighing the same move. What remains to be seen is how many clients sign up, and what the pricing looks like.
- Deutsche Bank Goes Live With Crypto Custody After a Five-Year Buildup (Decrypt)
- Deutsche Bank launches crypto custody for companies and institutions (cointelegraph.com)
- Deutsche Bank Launched Institutional Crypto Custody in Europe (bitcoinist.com)
- Deutsche Bank launches crypto custody for Bitcoin, Ethereum, stablecoins (crypto.news)
Explore more on this topic with Vexel Search.
File photo: Deutsche-Bank-Frankfurt-am-Main.jpg by Raimond Spekking, CC BY-SA 4.0, via Wikimedia Commons.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
200 Tokenized Stocks From the UK and EU Hit xStocks, but UK Investors Are Locked Out
Kraken’s parent company, Payward, has pushed deeper into the market for tokenized stocks, adding blockchain-based versions of more than 200 UK and EU-listed companies to its xStocks platform. The catch is that investors in the UK, home to some of the biggest names on the list, cannot buy them.
Payward announced the expansion on Wednesday, November 11. According to the company, eligible users can trade the new tokens on Kraken and on participating platforms in the xStocks Alliance. Reports on the launch say the rollout covers the FTSE 100 and Germany’s DAX 40, with household corporate names such as Shell, HSBC, LVMH, Airbus, SAP and Siemens among the offerings.
What the new tokenized stocks cover
The German slice of the launch is the most complete. Tokens now exist for all 40 companies in the DAX, including SAP, Siemens, Allianz and Deutsche Telekom. Deutsche Börse separately said the tokens can be traded on its affiliated 360X platform, with round-the-clock trading available on select venues. The same platform also lists a tokenized version of Xetra-Gold, an exchange-traded commodity linked to gold.
Payward says each token is backed one-to-one by a share held with a regulated custodian. The company’s partner GTN supplies the execution and custody infrastructure for the underlying shares. The two firms announced that partnership in July, with the aim of taking tokenized equities beyond US markets.
The tokens are designed to move across several blockchains, including Solana, Ethereum, TON, Ink and X Layer. Holders can shift them between compatible wallets and decentralized finance applications. Trading hours depend on the venue. Kraken’s European Economic Area offering runs 24 hours a day, five days a week, while some onchain venues trade continuously.
Exposure, not ownership
Buyers should understand what they are getting. Kraken’s risk disclosure states that xStocks tokens give holders exposure to a share’s price performance, but not voting rights or a legal claim on the underlying stock. For investors who mainly want price exposure and 24/7 access, that may be enough. For those who care about shareholder rights, it is a meaningful difference from owning the shares themselves.
The UK paradox
The most awkward detail is geographic. Reports agree that the new UK-listed tokens remain unavailable to investors in the UK, and one report adds that US investors are also excluded. The product is built around British and European blue chips, yet access is limited to eligible users elsewhere. The sources do not explain the regulatory reasoning, and Payward has not been quoted here on when, or whether, that will change.
Where xStocks stands in the market
Payward says the expansion lifts xStocks past 1,500 tokenized assets, with more than $45 billion in cumulative transaction volume and over 550,000 unique holders. Token Terminal data cited by Cointelegraph put xStocks’ market capitalization at $1.1 billion, about 22% of the $4.9 billion in tokenized stocks the firm tracks. That ranks it third, behind Binance’s bStocks at $1.5 billion and Ondo Finance at $1.4 billion. Another outlet describes the $1.1 billion figure as assets under management, so the exact measure varies by source, but the scale is consistent.
The size of the sector remains small next to traditional equity markets, and competition is tight. Still, widening beyond US shares is a clear attempt to differentiate xStocks from rivals.
Hong Kong next
Payward says it plans to add hundreds of Hong Kong-listed equities in the coming weeks. Mark Greenberg, the company’s chief commercial officer, framed the strategy in broad terms: “A portfolio should not have borders or trading hours,” he said, adding that “tokenizing every other international market is the next step.”
If that plan holds, the UK and EU launch is less a finish line than a template, with the same custody-backed model extended market by market. Whether regulators in excluded jurisdictions, starting with the UK itself, allow local investors to join in will help decide how far these tokenized stocks can really go.
Explore more on this topic with Vexel Search.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
XRP Ledger’s Quantum-Proof Accounts Would Keep Base Fees Unchanged, With a 2028 Target
The XRP Ledger Foundation has sketched out a way to give users quantum-proof accounts without raising the base transaction fee, a design choice that could make migration far easier for ordinary holders. The proposal sits in the Foundation’s 2027 protocol roadmap, updated November 4, and remains a work in progress rather than a finished feature.
Why quantum-proof accounts are on the roadmap
The XRP Ledger currently supports two signature schemes, secp256k1 and Ed25519. Both rely on mathematics that a sufficiently powerful quantum computer could eventually break. The weak point is visibility: every time an account signs a transaction, its public key is recorded on the ledger. A future machine running Shor’s algorithm could, in principle, use that public data to recover the matching private key.
Such computers are not expected imminently, but the exposure is permanent. Any account that has already transacted has a public key on the record, which is why the Foundation is planning ahead instead of waiting.
How the proposed upgrade would work
Under the design, an account owner could attach a new signing key based on ML-DSA-44, a lattice-based algorithm that the US National Institute of Standards and Technology standardized in August 2024 under FIPS 204. The owner would then disable the original master key, so transactions could no longer be authorized with the older credentials. Addresses and balances would stay the same, and no funds would need to move.
XRP Ledger accounts can already rotate their regular signing keys, but swapping one conventional key for another does nothing against a quantum threat. The new method adds a different kind of signature. The Foundation’s study points to exchanges, custodians and institutions with large balances as the likeliest early adopters, and the roadmap also extends post-quantum protection to validators and validator list publishers.
Bigger signatures, same fee
The trade-off is size. According to the reported figures, the new keys and signatures together take up 3,732 bytes, compared with 105 bytes for a standard payment today. Counting history and database overhead, the Foundation estimates roughly 5,331 bytes of storage per protected transaction, against a 1,704-byte baseline.
Despite that, the proposal holds the base fee steady. XRP Ledger fees are destroyed rather than paid out to validators, so the extra storage burden would fall on the operators who run the network instead of on account holders. Other chains weighing post-quantum upgrades have had to grapple with larger signatures pushing costs onto users, so keeping fees flat removes one obvious barrier.
What still has to happen
The work is unfinished. Developers are resolving inconsistencies in which the Python prototype and the server and JavaScript implementations can generate different keys from the same seed. A migration study is scheduled for the first half of 2027, followed by further engineering, reviews and security audits. The Foundation estimates review, auditing and implementation expenses of $215,000 to $255,000, not counting development hours.
Any amendment would also need validator approval before reaching the main network. Ripple has separately targeted a full quantum-resistant transition by 2028, and the proposal is framed as part of that effort, though the timeline depends on testing and sign-off.
The catch: users must act
The scheme is voluntary, and its protection depends on owners disabling their old keys. An account that keeps both methods enabled stays partly exposed. Making the switch at scale will take clear tooling and incentives, especially for exchanges and custodians, which is the question the 2027 migration study is meant to examine.
For now, the plan is one of the more detailed post-quantum roadmaps in public view, pairing a standardized algorithm with a user-controlled migration and an unchanged fee. Whether quantum-proof accounts reach the mainnet on schedule will hinge on the unfinished engineering, the audits and the validators’ vote.
- XRP Ledger Quantum-Proof Accounts: No Extra Fees Planned (bitcoinist.com)
- XRP Ledger proposes quantum-proof accounts without higher fees by 2028 (crypto.news)
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
iOS Flaw Puts Wallet Seed Phrases at Risk, and Apple’s Nov. 9 Patch Doesn’t Mention It
A newly published iOS flaw known as worse_query could let a malicious app read files belonging to other apps on an iPhone, including crypto wallet seed phrases, and Apple has not said whether its newest updates close the hole. Binance raised the alarm on Tuesday, Nov. 10, urging users to check what is installed on their phones.
What the iOS flaw does
The bug is a sandbox escape. iOS normally walls each app into its own container so that one program cannot browse another’s data. A researcher posting as forcequitOS put worse_query on GitHub on Nov. 8, and Cointelegraph reports the researcher credited another researcher, 0xjohnny. The project’s documentation lists reachable locations such as other apps’ data containers and shared app group folders. It says the technique works on iOS 26.0 through 26.7.2 and on iOS 27.2, a wider span than the three versions Binance named: 26.7.1, 27.0.1 and 27.2.
The researcher calls the release a proof of concept for developers and stresses that it is not a jailbreak and is not useful by itself. Someone still has to build it into an app. That has already happened: developer Christoph Kolbicz published a file manager based on it that lets users browse and edit app data on iOS 27 without jailbreaking, which he said he tested on iOS 27.0.1.
How worried should wallet users be?
Binance stressed that this is “an iOS-level issue, not unique to Binance,” and a spokesperson said the exchange has found no confirmed cases of attackers using worse_query to reach wallets or steal funds. The researcher has not reported any thefts either.
Blockchain security firm SlowMist offered a more measured reading. Its chief information security officer wrote that the flaw cannot steal assets on its own. The danger arises when a user installs and runs an untrusted app, such as a sideloaded or manually signed IPA file, and only if a wallet keeps mnemonic phrases, keystores or cached data in plain text on the device. Wallets that avoid writing secrets to readable files are not exposed in the same way, and hardware wallets keep private keys off the phone entirely.
Apple’s update leaves a gap
Apple released iOS 27.2.1 and iOS 26.7.3 on Nov. 9, one day after the code went public. The published security notes mention fixes for AirPlay, Bluetooth pairing, brotli and other components, but they do not name worse_query or describe a sandbox escape like this one. Whether the updated builds block the technique therefore remains unclear. Cointelegraph said it asked Apple for comment and had not heard back by publication.
Until that is settled, Binance’s advice is basic hygiene. Delete apps from untrusted sources, update iOS and every app to the latest official versions, and, if you suspect a compromise, move funds to a new wallet created on a clean device and reset all active login sessions.
The warning lands at a tense moment for the exchange, which Bitcoin Magazine says lost $6.34 billion in an Oct. 29 attack that began with a fake job interview. For ordinary iPhone users, the practical takeaway is narrower than the headline suggests: the risk hinges on installing software from outside the App Store and on how carefully a wallet app stores its secrets.
- Binance Warns iOS Flaw Could Expose Wallet Seed Phrases as Apple’s Latest iPhone Patch Stays Silent (Bitcoin Magazine)
- Binance Warns of Apple iOS Flaw That Could Expose iPhone Users' Private Keys (Decrypt)
- Binance warns iOS flaw could expose crypto wallet keys (cointelegraph.com)
- Binance warns iPhone users of iOS bug that could expose crypto wallet keys (crypto.news)
Explore more on this topic with Vexel Search.
File photo: Apple iPhone Duo.jpg by SimonWaldherr, CC BY 4.0, via Wikimedia Commons.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
6 Firms Back CFTC in Fight Over Stock Perpetual Futures After Judge Doubts Agency’s Authority
Six companies, including Coinbase and Kalshi, have asked a federal court to let them defend the US derivatives regulator in a lawsuit that could decide the future of stock perpetual futures in the United States. The proposed friend-of-the-court brief arrives days after a judge signaled the regulator may have overstepped.
According to the filing shared by a Coinbase legal representative, the group also includes Kraken’s parent company Payward, trading firms DRW Holdings and Jump Trading, and crypto investment firm Paradigm Operations. Their request to submit the brief is still pending.
How the dispute began
The CFTC announced on Nov. 3 that single-stock perpetual futures, often called stock perps, could begin trading on US-regulated exchanges for the first time. According to one report, applications from KalshiEX, Coinbase Derivatives and Bitnomial, which is linked to Payward, were filed in mid-September. The products were treated as approved when a 45-day review window closed on Nov. 2 without objection.
Stock perps let traders bet on the price of an individual company’s shares without owning them. Unlike conventional futures, they never expire. Positions can be held indefinitely, and periodic funding payments keep the contract price close to the underlying stock. The design is a staple of crypto markets, and this is its first approved move onto US-listed equities.
The Capital Markets Alliance Association (CMAA), a newly formed group whose members include Cboe and Citadel Securities, sued the CFTC shortly afterward. Its argument is that a contract with no fixed expiration date is not a security future at all. In its view, the product is a security-based swap, a category the Securities and Exchange Commission primarily oversees and one that carries tighter limits on retail trading.
A judge’s warning, but no halt
US District Judge Valerie Caproni gave the challengers an early boost. She said the CMAA was likely to succeed in arguing that the CFTC exceeded its statutory authority, and that the contracts appear to satisfy the definition of a swap. But she denied a temporary restraining order because the group had not shown imminent, irreparable harm. The CFTC’s approvals therefore remain in place while the case goes on.
That leaves an unusual situation. The products can trade, yet the only judicial view on the merits so far leans against the agency that allowed them. The CMAA is due to file its reply to the CFTC’s opposition to a preliminary injunction, the next major step in the case.
What the six firms argue
The companies in the proposed brief say nothing in the law requires a fixed expiration date for a contract to qualify as a security future. They contend that stock perpetual futures fit within the joint CFTC and SEC framework Congress created in 2000, and need not be moved wholesale into the SEC’s swap regime.
They also have a stake in the outcome. Coinbase and Kalshi are among the exchanges that sought to list the products, and supporters argue that regulated onshore access gives US traders an alternative to offshore venues. Critics from traditional finance, by contrast, point to concerns about market structure, leverage and risk to retail investors.
Why the ruling matters beyond one product
The case is also a test of whether decades-old commodity and securities statutes can absorb instruments built for crypto markets. If the court sides with the CMAA, retail access to stock perps could be curtailed and the onshore market slowed before it gets started. If the CFTC’s reading holds, other hybrid products that pair crypto-style design with traditional underlying assets may find an easier path to approval.
For now, trading continues on the approved platforms, but the legal footing remains uncertain. The judge’s early comments suggest the CFTC faces an uphill argument, and the six firms’ brief is an attempt to shift that balance before a decision on the injunction.
- Coinbase, Kalshi join lawsuit backing CFTC over US stock perp futures (cointelegraph.com)
- Coinbase and Kalshi Back CFTC in Stock Perps Lawsuit (bitcoinist.com)
Explore more on this topic with Vexel Search.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
Binance Hack Launderers Mint Worthless Meme Coins With Musk and Animal Logos to Hide Stolen Crypto, Elliptic Says
Binance hack launderers are turning the internet’s meme-coin craze into a cover for moving stolen money, according to blockchain analytics firm Elliptic. Decrypt reports that the firm says the hackers are minting their own worthless tokens, some with cartoon animal logos and others with Elon Musk branding, and sending stolen funds through liquidity pools to break the trail.
The source material for this story is limited. It consists of a summary and the opening lines of a Decrypt report published November 9, 2026, so several details are not available here. They include how much was stolen, when the Binance incident happened, which tokens were created, and how much money passed through them. This article does not guess at those figures.
How the meme-coin laundering tactic works
Decrypt’s summary says the hackers create tokens that have no real purpose or value, then swap stolen assets for them using liquidity pools. These are the automated trading pools that let people exchange one token for another on decentralized platforms. Decrypt’s opening lines tie the activity to North Korea’s launderers, and the report’s image caption refers to North Korea and hacking. The summary does not make clear whether Elliptic itself attributes the activity to North Korea.
The logic is easy to see. When the people who create a token also control the pool, they can put stolen funds in and take different assets out. On a blockchain ledger, that looks like ordinary trading in a meme coin, a category that already produces huge volumes of speculative activity. Analysts tracing stolen money then have to sort real market activity from deliberate obfuscation.
Why Binance hack launderers are choosing meme coins
Meme coins are a convenient disguise. Thousands of them launch every day, many carry jokey branding, and most vanish quickly. A token with a cartoon animal or a celebrity face attracts little suspicion in that crowd. Binance hack launderers who adopt the same look can hide in plain sight, though that is an inference from the pattern described, not a claim made in the source.
The approach also shows how laundering methods keep changing. Investigators have long watched for stolen funds moving through mixers, bridges and exchanges. Self-made tokens and liquidity pools add another layer. Each swap creates a new on-chain record that has to be linked back to its origin.
What to watch next
The report raises questions that the available text cannot answer. Will Elliptic or exchanges publish the token addresses so others can flag them? Will decentralized platforms act against pools tied to the stolen funds? And how much of the haul has actually been obscured this way? Readers who want those details should consult Elliptic’s findings and the full Decrypt report directly.
For now, the core claim is simple and notable. Binance hack launderers, as described by Elliptic, are not just moving stolen crypto between wallets. They are building fake markets around tokens made for the purpose and using the meme-coin economy as cover.
Explore more on this topic with Vexel Search.
File photo: 5 years birthday Binance cake in Paris – 2022-07-08.jpg by Bretwa, CC BY-SA 4.0, via Wikimedia Commons.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
Formation Plans 24/7 Tokenized Stock Trading on Solana for Early 2027
A newly formed company wants to bring round-the-clock tokenized stock trading to Solana, and it is relying on a fresh SEC carve-out to do it. Formation Securities said on Nov. 9 that it has notified the US Securities and Exchange Commission of plans to open a venue in early 2027. Tokenized shares of Galaxy Digital, Exodus Movement and Forward Industries are expected at launch.
Formation is licensing technology from the decentralized exchange Orca. It intends to operate under the SEC’s temporary Innovation Exemption, announced in September. According to the sources, the exemption lets verified investors trade certain US-listed shares at any hour while keeping voting, dividend and other shareholder rights. One report adds that operators can use it without registering as a traditional securities exchange.
How the Solana venue would work
The design leans on crypto-native plumbing. The venue would use automated market maker technology rather than a traditional order book. Investors could hold tokenized shares in their own wallets and settle trades onchain against stablecoins and other eligible assets. Buyers and sellers would be paid in a single blockchain transaction.
Superstate and Securitize are expected to supply the tokenized shares. Traditional transfer agents would still keep official shareholder records, which preserves each company’s direct relationship with its investors. Formation plans to distribute access through partners including Alpaca, Passage by CoinList, Anchorage Digital Bank, BitGo Bank & Trust, Fireblocks, Solflare and Squads. Participation would be limited to people who pass identity verification and meet eligibility rules.
Issuer consent is the pressure point
Formation is stressing that it will court companies rather than go around them. “Tokenized stocks will succeed only if public companies see the value in them, and we intend to build this market together with issuers,” President Christopher Montagano said. The pitch is a pointed contrast with a rival effort. As of early November, more than 50 companies had objected to having their shares tokenized on OKXICE, a proposed venue backed by OKX and NYSE parent Intercontinental Exchange.
The exemption gives issuers a formal say. Venues must notify companies in writing and wait at least 30 calendar days before listing shares tokenized by unaffiliated third parties. Nasdaq has also cautioned that tokenized stock trading could have unforeseen effects on liquidity, price discovery and long-term shareholder value.
Solana’s place in the tokenized equity race
Solana is already a significant player. RWA.xyz data cited by Cointelegraph put tokenized stock value on the network at about $575 million as of Monday. That trails Ethereum at $747 million and BNB Chain at $1.7 billion. A dedicated venue could help close that gap, though the sources offer no projections.
Plenty remains uncertain. Formation has not started trading, and the proposal stays subject to the exemption’s conditions. The exemption permits conditional trading but does not guarantee that any particular venue will be approved. Whether enough issuers consent beyond the three named companies may decide how far this model gets. For now, the plan shows how quickly the industry is moving to test the SEC’s new framework.
- Formation Securities plans Solana stock trading venue under SEC exemption (cointelegraph.com)
- Formation plans 24/7 stock trading on Solana under SEC rules (crypto.news)
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
Crypto
Solana Tokenized Stock Venue Planned for Early 2027 With Exodus, Forward Industries and Galaxy Shares
Solana is on track to get another tokenized stock venue. Formation Securities has notified the U.S. Securities and Exchange Commission of its plans, according to a Decrypt report published November 9, 2026. The firm intends to operate under the SEC’s “Innovation Exemption” and to list tokenized shares of three companies in early 2027: Exodus, Forward Industries and Galaxy Digital.
The most notable detail is the promise of parity with traditional equity. According to the report, the tokenized shares are meant to carry the same voting and dividend rights as the underlying real stock. That separates this approach from products that give traders only price exposure to a company without the rights of a shareholder. How those rights would be recorded and exercised in practice is not spelled out in the material available.
What the Formation filing signals for tokenized equities
Describing Formation’s plan as “another” Solana venue implies a growing field of platforms putting stock-linked assets on the network. The three initial names are all companies with ties to crypto or digital assets, which suggests the launch will lean on issuers already comfortable with blockchain-based markets rather than a broad slice of the S&P 500. That is an inference from the list, not something the report states.
The reference to an “Innovation Exemption” matters as well. Operating under a formal exemption, and telling the SEC in advance, points to a regulated path to market rather than an offshore or unregistered one. Any such exemption would carry conditions, and the report’s summary does not list them.
What remains unclear
The material available offers only a brief outline, and several key questions are unanswered. It does not say how the tokenized shares will be custodied or settled, who will be eligible to trade them, or what fees the platform will charge. It also does not say whether the three companies have formally agreed to participate. The early-2027 timeline is a plan, not a guarantee, and it could shift depending on how the SEC responds.
For now, the filing is best read as a sign of intent and a test of how far regulators will let on-chain equities go. If Formation delivers shares with full voting and dividend rights, this tokenized stock venue could become a reference point for how tokenized equities are structured in the U.S. Until the launch details are public, much of that remains speculation.
WordUp Morning
Ten stories, both sides of each, in five minutes. Free, every weekday at 7am, plus a Saturday weekend edition.
We'll email you a link to confirm. Unsubscribe any time.
-
Tech & AI4 days agoNvidia investigation into Jensen Huang: board probes alleged Chinese intelligence effort targeting its CEO
-
Tech & AI3 days agoNvidia Shares Drop 8% at One Point, Erasing Over $300 Billion, as Board Probes Jensen Huang Scandal
-
Tech & AI3 days agoNvidia investigation into CEO Jensen Huang: shares fall 6% as board weighs a $4.5 trillion question
-
Business & Hustles3 days agoWhitbread Board Seat Bid Fails With At Least 83% of Votes Against Activist Corvex
-
Fashion6 days agoWomen of the Year 2026: Eleven Honours, From Glenn Close’s Icon Award to Winkleman’s Deadpan Triumph
-
Crypto6 days agoGopax Hacking Threat Freezes Trading and Withdrawals, With No Reopening Date Set
-
Entertainment7 days agoCynthia Erivo Joins Snoop Dogg Biopic as Afeni Shakur, With an August 6, 2027 Release Set
-
Tech & AI7 days agoLeBron James’ Lawyers Send Cease and Desist Letter to Bron AI Over Ad Implying He Bets on NBA Games
-
Fashion6 days agoBalenciaga Creative Director Martine Rose Starts November 16 as First Woman to Lead the House in 109 Years
-
Fashion6 days agoIowa’s Next Governor Walked for Prada in 2002: Inside Rob Sand’s Modeling Career
-
Business & Hustles6 days agoLetterboxd Acquisition Talks: NYT Company Reportedly Offers $330 Million, Over 20x Revenue
-
Tech & AI6 days agoCybertruck Production to Wind Down by Mid-2027, Far Short of Musk’s 250,000-a-Year Goal
-
Crime5 days agoThomas Markle court appearance: 82-year-old tagged and held at home, no plea entered, over child abuse material charge
-
Gaming5 days agoBit Reactor layoffs hit Star Wars Zero Company team a month after rehiring, despite 1 million sales
-
Crypto5 days agoUS Hits 8 Canadian Money Exchange Firms With Iran Sanctions, Cutting Them Off From the Dollar
-
Crypto5 days agoMEXC FinCEN Order Cites $16 Billion in Illicit Flows, With a 30-Day Fuse to Come
-
Entertainment5 days agoJames Bond Screen Tests Reportedly Included Pattinson and Hoult, With a Decision Due by Year’s End
-
Tech & AI6 days agoData Center Protests Hit 15 European Countries as Activists Break Into Microsoft’s Amsterdam Site
-
Business & Hustles6 days agoSalaries in job adverts to become compulsory, with 94% backing the change in consultation
-
Tech & AI5 days agoNew Apple Music Classical Icon Goes Black and White, Signaling Apple Is Sticking With the Look

You must be logged in to post a comment Login