Ripple CEO Brad Garlinghouse has said XRP is not necessarily the best asset for every payment use case, acknowledging that stablecoins can solve some customer problems more effectively.

Faena Rose’s January 22 program, titled The Transformative Power of Crypto Assets, featured Garlinghouse discussing cross-border payments, stablecoins, financial inclusion and digital financial infrastructure. Clips from the interview resurfaced on social media on September 24, more than eight months after the conversation originally took place.

The timing matters because the remarks are not a new Ripple policy announcement made this week. They show how Garlinghouse described the roles of XRP and stablecoins earlier in 2026, while Ripple’s current product documents now show a payments platform built to use several settlement assets.

Why XRP may not be the answer for every Ripple payment

During the discussion, Garlinghouse used cross-border transfers as an example of how the choice of asset can depend on the payment itself. He said “XRP is the best bridge asset” could be the answer for one transaction, while another could work better through a stablecoin.

His qualification was explicit. Garlinghouse said “a stablecoin is going to solve that problem better” in some cases, putting the customer’s payment requirement ahead of using one specific cryptocurrency. The statement was conditional and did not say stablecoins are universally better than XRP.

Garlinghouse separately rejected the label of an XRP maximalist, saying he is bullish on several cryptocurrencies for different reasons. His comments framed utility as the test for choosing technology instead of loyalty to a single token.

That approach extended to his criticism of parts of the crypto market. Garlinghouse questioned the value created during the NFT boom and said he did not understand much of the meme-coin craze. He argued that a token or technology should solve an identifiable problem if it is going to provide useful value.

For XRP, cross-border liquidity remains one of the use cases Ripple has promoted for years. The company’s current stablecoin documentation describes XRP as the native cryptocurrency of the XRP Ledger and says it was designed to operate as a bridge asset for fast, low-cost cross-border transactions.

Ripple Payments now works without dependence on one asset

Ripple’s current payment infrastructure supports the flexibility Garlinghouse described in January.

The company’s official Ripple Payments page says businesses can settle transactions using RLUSD, USDC, USDT or fiat, depending on their requirements. Ripple states that its settlement layer is “decoupled from any single issuer’s token,” allowing new stablecoins to be added without rebuilding the payment infrastructure.

The platform handles collections, digital-asset conversion and payouts across more than 60 markets. Ripple says the underlying network has processed more than $100 billion in payment volume and operates through a group holding more than 75 licenses globally.

Ripple USD has become another part of that infrastructure. Ripple describes RLUSD as a dollar-backed asset designed for payments, remittances, treasury flows and settlement. In certain jurisdictions, the company has integrated the stablecoin directly into Ripple Payments.

XRP and RLUSD therefore have different structures. XRP trades freely and has no issuer fixing its market price. RLUSD is issued against reserves and designed to maintain a value of one U.S. dollar, according to Ripple’s documentation.

As crypto.news previously reported on RLUSD’s payment role, Ripple CTO Emeritus David Schwartz described the stablecoin as capable of acting as a bridge in some transactions while distinguishing its centralized controls from XRP’s neutral asset structure.

Ripple has since expanded the stablecoin side of its payment network. In June, the company announced that Bitso’s Mexican peso-backed MXNB would join the XRP Ledger and its payment infrastructure alongside RLUSD for U.S.–Mexico settlement flows.

In related coverage, crypto.news reported on the Bitso integration, which gave enterprise clients another stablecoin option for transactions involving the Mexican peso.

Does Garlinghouse’s comment mean Ripple is moving away from XRP?

Garlinghouse did not say Ripple was abandoning XRP or replacing it with RLUSD. His statement concerned which asset can best solve a specific payment requirement.

Ripple’s own documentation continues to identify XRP as a bridge asset. At the same time, its payment product now gives customers several choices, including fiat and three dollar stablecoins.

Crypto.news previously explained how Ripple uses XRP for On-Demand Liquidity, where the source currency can be converted into XRP, transferred between markets and exchanged into the destination currency without maintaining pre-funded accounts.

RLUSD serves a different requirement because its value is intended to remain tied to the dollar. Ripple says each token is backed one-to-one by cash deposits, U.S. Treasuries and cash equivalents and can be redeemed for U.S. dollars.

Ripple’s current product strategy does not require the two assets to perform identical jobs. Its XRP Ledger AI Starter Kit, launched in June, supports X402 payments using both XRP and RLUSD, allowing developers to choose either asset for machine-to-machine payments.

The distinction has surfaced before. In related coverage, crypto.news examined the relationship between XRP and stablecoins after XRP Ledger community figures argued that the assets can occupy different parts of the same payment infrastructure.

Resurfaced comments predate the CLARITY Act setback

Garlinghouse’s Faena Rose appearance took place on January 22, months before the latest U.S. battle over the Digital Asset Market Clarity Act reached the Senate floor.

His comments about Coinbase therefore predate the September 15 procedural defeat. During the interview, Garlinghouse praised Coinbase and CEO Brian Armstrong despite policy disagreements within the U.S. crypto industry, calling Coinbase one of the country’s few large and consequential crypto companies.

The political context developed further after the interview. On September 15, the Senate rejected cloture on the motion to proceed to H.R. 3633 by 49 votes to 50, falling short of the 60 votes required to advance the measure. The vote was procedural and was not a final vote on passage.

Ripple responded the same day by calling the result a missed opportunity and saying it would continue working with federal policymakers. The company said the failed vote did not change its position on XRP’s U.S. regulatory status and pointed to the SEC and CFTC’s March 2026 interpretation identifying XRP as a digital commodity.

As crypto.news reported after the Senate vote, Garlinghouse said crypto adoption could continue despite the legislative defeat while maintaining support for federal market-structure legislation.

Coinbase CEO Brian Armstrong took a similar position on the ability of regulators to proceed without Congress, arguing that the SEC and CFTC could continue developing digital-asset rules through their existing authority. Crypto.news reported his position before the vote.

The official Senate record continues to list cloture on H.R. 3633 as failed, and no new floor vote date appears in the Senate materials reviewed for this report.

An iPhone Safari attack behind recent security warnings hasn’t yet been linked to a confirmed cryptocurrency theft in SlowMist’s investigation.

Multiple reports surfaced this week urging iPhone users to update their devices immediately and warning that malicious Safari pages could expose crypto private keys and seed phrases, with some citing a range from iOS 13 through iOS 26.5.

SlowMist told Cointelegraph that it has not independently confirmed a victim compromised by the specific Safari attack sample it analyzed, while its strongest technical evidence covers iOS 18.4 through 18.6.2.

The company said the “iOS 13 to 26.5” range should be treated as preliminary. “We therefore prefer to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence,” it said.

The Safari attack reuses techniques from a previously disclosed DarkSword exploit chain and is separate from FomoPeek, another SlowMist investigation involving malicious components embedded in an App Store app.

SlowMist finds DarkSword reuse

Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain that had been used by multiple threat actors since at least November 2025.

SlowMist said MistEye, a threat intelligence team led by its chief information security officer, 23pds, first identified the relevant activity in early May.

SlowMist published its analysis of the WYINCC Safari campaign on Sept. 4, identifying a malicious webpage advertising a free virtual private server service.

SlowMist said the page loaded the exploit code when opened on an iPhone using Safari, without necessarily requiring another click from the user.

The vulnerabilities used in the chain had already been disclosed and patched by Apple, SlowMist said.

What the Safari attack was designed to access

SlowMist found that the malicious Safari sample it analyzed included a component designed to access Apple’s Keychain and retrieve and decrypt information stored there. The code could also access app files and shared app data, potentially exposing information stored by crypto wallet applications.

“The sample demonstrates the collection capability and the intended targets; it does not by itself prove successful extraction from every targeted wallet,” SlowMist said.

Related: EU watchdogs warn quantum computers could pick crypto’s locks

“We did not execute the full chain on a real victim device, so we cannot identify a specific victim whose device we independently confirmed was successfully compromised by this exact sample,” SlowMist added.

SlowMist still recommends updating iOS

Despite the limits of the available evidence, SlowMist advised iPhone users to install the latest iOS security updates available for their devices and avoid suspicious links.

For users who cannot update immediately or face elevated risks, SlowMist recommended considering Apple’s Lockdown Mode as an additional defense, while cautioning that it has not confirmed the feature completely blocks this specific Safari attack.

SlowMist also urged users who believe a wallet key or seed phrase may have been exposed to move their assets to a newly generated wallet on a clean device rather than continue using potentially compromised credentials.

Magazine: Asia dominates Crypto Adoption Index, Bitget’s $352M hack: Asia Express

Security warnings circulating this week about a malicious iPhone Safari attack have prompted renewed calls for iOS updates—particularly over fears that the exploit could be used to steal crypto wallet secrets. However, SlowMist says it has not yet confirmed a real victim whose device was compromised by the specific Safari sample it analyzed, and it cautions that the initially reported iOS versions affected may be wider than what is technically proven.

In an investigation shared with Cointelegraph, SlowMist said the strongest evidence it has supports impact on iOS 18.4 through iOS 18.6.2, while an oft-cited “iOS 13 to 26.5” range should be treated as preliminary until reproducible proof is available. The firm also highlighted that the Safari campaign reuses techniques from the previously disclosed DarkSword iOS exploit chain, and that it is separate from another SlowMist case involving a malicious component embedded in an App Store application tied to the FomoPeek investigation.

Key takeaways

• SlowMist has not independently confirmed a crypto theft or a specific confirmed victim tied to the exact Safari sample it examined.
• The firm’s strongest technical evidence points to iOS versions 18.4 through 18.6.2; broader iOS coverage reported elsewhere is not yet proven.
• The malicious webpage was designed to trigger an exploit via Safari and, once accessed, target Apple Keychain data and other app storage.
• SlowMist links the Safari techniques to DarkSword reuse, while emphasizing this Safari campaign is distinct from its earlier FomoPeek App Store-related investigation.
• SlowMist continues to recommend installing the latest iOS security updates and taking additional precautions such as Apple’s Lockdown Mode and rotating wallet credentials on suspected exposure.

Why the Safari warning is still urgent

The core claim behind the current wave of warnings is that a malicious Safari page could expose crypto private keys and seed phrases. While SlowMist’s analysis supports that the sample includes functionality aimed at collecting sensitive information, it draws a clear line between “capability” and “confirmed success against a particular wallet on a real device.”

SlowMist told Cointelegraph that it has not independently confirmed a victim compromise tied specifically to the Safari attack sample it studied. The company further noted that its investigation did not execute the full exploit chain on a real victim device, limiting the ability to identify an actual endpoint where secrets were successfully extracted.

That distinction matters for both users and defenders: even without confirmed theft, the presence of a plausible collection mechanism is enough to justify immediate defensive steps—especially because seed phrases and private keys are once-off secrets that can’t be safely “partially” exposed.

DarkSword techniques reused in a WYINCC Safari campaign

SlowMist’s write-up ties the Safari attack’s underlying approach to DarkSword, an iOS exploit chain that was disclosed earlier by Google Threat Intelligence Group (GTIG) in March. According to GTIG, DarkSword had been used by multiple threat actors since at least November 2025.

Google’s disclosure described DarkSword as an iOS exploit chain, and SlowMist said its own threat intelligence team—led by its chief information security officer, 23pds—first identified relevant activity in early May. SlowMist then published its analysis of the WYINCC Safari campaign on Sept. 4.

In this campaign, SlowMist said the malicious webpage appeared to advertise a free virtual private server service. When opened on an iPhone using Safari, the page loaded exploit code. SlowMist’s description indicates that the page could trigger the malicious code without requiring an additional click beyond visiting the page.

Importantly for risk assessment, SlowMist said the vulnerabilities employed in the chain had already been disclosed and patched by Apple. That aligns with the practical takeaway for users: applying the latest iOS updates is the most reliable way to reduce exposure to known, patched weaknesses.

What the sample was built to target

Beyond the delivery mechanism, SlowMist focused on what the malicious Safari sample attempted to access. The firm said the sample included a component designed to interact with Apple’s Keychain and retrieve and decrypt information stored there.

SlowMist also said the code could access app files and shared app data—capabilities that may overlap with information stored by cryptocurrency wallet applications. At the same time, SlowMist stressed that this demonstrates collection capability and intended targets, but does not itself prove successful extraction from every targeted wallet.

In other words, the technical evidence suggests a route to sensitive data. But it doesn’t automatically establish that the exploit would work on every device running the affected versions, nor does it prove that any specific wallet compromise occurred in the wild for this exact sample.

SlowMist also cautioned that it did not run the complete chain on a real victim device, which prevented it from independently identifying a specific confirmed victim whose device was compromised by the exact Safari sample.

How SlowMist frames iOS version risk and what to do next

The most sensitive aspect of the reporting has been the breadth of iOS versions claimed to be affected. Some warnings circulating this week cited a wide range from iOS 13 through iOS 26.5. SlowMist told Cointelegraph it views that range as preliminary and prefers to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence.

SlowMist said its strongest technical evidence covers iOS 18.4 through iOS 18.6.2. For users, the practical implication is straightforward even if the exact upper or lower bounds remain uncertain: anyone on an older iOS version should prioritize upgrading to the latest available security release.

SlowMist still recommended updating iOS and avoiding suspicious links. For users unable to update immediately—or those facing higher exposure risk—it pointed to Apple’s Lockdown Mode as an added defense, while also noting it has not confirmed that Lockdown Mode fully blocks this particular Safari attack.

Finally, SlowMist urged users who suspect their wallet key or seed phrase may have been exposed to move assets to a newly generated wallet created on a clean device, rather than continuing to rely on potentially compromised credentials.

With the iOS version scope still being refined and no confirmed victim tied to the exact sample yet established by SlowMist, the next phase to watch is whether further independent technical validation narrows the affected ranges and whether defenders see confirmed real-world compromises tied to the WYINCC Safari campaign.

Bitget CEO Gracy Chen has acknowledged that North Korea was likely responsible for the crypto exchange’s latest hack that stole roughly $352 million.

Substantial withdrawals were spotted from addresses labelled as Bitget hot and cold wallets yesterday, setting off alarm bells across the community.

Crypto investigator Specter Analyst linked the attack to North Korean hacking collective Lazarus Group.

Since then, Chen has confirmed in a livestream that the attack displays the signs of a North Korean operation.

Read more: How 4,000 BTC walked out of Blockstream’s Liquid Network

Chen also revealed that various chains have frozen addresses associated with the hack, and that the Bitget wallet, separate from the exchange, wasn’t affected.

She also ruled out the possibility of a private key compromise, and claimed hackers were able to breach the wallet services backend system, forge transfer details, and authorize their own signing processes.

Bitget’s cold wallets reportedly remained secure while their hot wallets and warm wallet layers were targeted.

Bitget CEO says users funds are covered

Chen claimed user funds were safe, with the majority of the loss covered by Bitget’s User Protection Fund, “which currently holds over $464 million.”

Bitget is now working with independent investigators Mandiant and SlowMist to fully determine what happened. It announced this morning that withdrawels are still temporarily paused.

The Bitget hack was initially expected to involve significantly lower losses, and unfortunately for Bitget, it took place as the exchange celebrated its eighth birthday.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

DoubleZero has launched a dedicated market data feed for Hyperliquid, aiming to give professional trading firms a more reliable and complete view of the decentralized exchange’s order book. The service delivers Hyperliquid’s market data over fiber, rather than relying on the exchange’s public APIs.

According to DoubleZero, the feed provides an ordered, continuous stream of order book data for market makers, quantitative traders, and proprietary trading firms that depend on consistent update frequency and depth.

Key takeaways

• DoubleZero’s Hyperliquid feed distributes full order book data via a dedicated fiber network instead of public APIs.
• The service supports Hyperliquid’s native perpetual futures and also markets run through trade[XYZ], a venue using Hyperliquid infrastructure for asset-linked perpetuals.
• DoubleZero says public API changes have reduced both the frequency and the depth of order book updates available to external consumers.
• The initiative broadens DoubleZero’s “Edge” market-data offering, which already includes Solana and the prediction market Kalshi.

A fiber-based order book for professional traders

For firms that need a full and timely order book, pulling liquidity data from a public interface can introduce inconsistency. DoubleZero’s new feed is designed to address that by providing market data as a continuous stream, with ordering guarantees intended to help automated systems interpret changes quickly and predictably.

DoubleZero positioned the launch around a practical problem: before this release, companies seeking a complete view of Hyperliquid’s order book typically had to reconstruct it themselves from public API responses or run their own Hyperliquid nodes. DoubleZero now offers a third path—an outsourced, purpose-built distribution layer.

The company also attributes the need for a dedicated feed to changes in Hyperliquid’s public APIs. DoubleZero said those updates have lowered the cadence and reduced the depth of information available through the public routes, making it harder for data consumers that require more frequent, comprehensive updates.

What’s included: native perps and Hyperliquid-powered markets

DoubleZero said the feed covers Hyperliquid’s native perpetual futures markets, alongside markets operated by trade[XYZ]. In this structure, trade[XYZ] provides perpetual contracts linked to assets including oil, gold, and silver, using Hyperliquid’s underlying infrastructure.

DoubleZero added that the feed was developed in collaboration with validator operators and ecosystem partners, including Hyperion DeFi, MAVAN, and Kinetiq. That matters because fiber-based delivery depends not just on software integration but also on reliable distribution pathways across network participants.

Why this matters: convergence with traditional exchange data workflows

The launch also highlights a broader trend in onchain market infrastructure: professional trading firms are increasingly looking for data distribution patterns similar to those used by large traditional exchanges.

Hyperion DeFi CEO Hyunsu Jung told Cointelegraph that major exchanges such as CME and Nasdaq distribute professional market data over dedicated networks. The point is to deliver a consistent stream of ordered information at high speeds to automated trading systems.

Jung argued that Hyperliquid’s market data can now be consumed through a similar model. In his words, the approach is effectively “publish once, distribute simultaneously over dedicated fiber,” echoing the logic behind how institutional infrastructure treats market data as a specialized distribution problem.

That said, Jung emphasized there are meaningful differences. Traditional exchanges allow firms to reduce latency further by placing trading infrastructure close to the venue’s execution systems. Hyperliquid, by contrast, executes trades onchain, which changes where latency is incurred and how it can be optimized.

He also noted that physical geography still matters. A firm based in Tokyo, for example, will maintain a speed advantage over one in New York regardless of how the data is delivered—an important reminder that fiber distribution can improve consistency and reduce certain bottlenecks, but it does not eliminate real-world network and distance effects.

Jung summarized the relationship as not a claim that Hyperliquid is becoming “CME,” but rather that onchain markets are borrowing the market-data infrastructure layer that professional firms already rely on in conventional finance.

Expanding “Edge” market data beyond crypto venues

DoubleZero’s Hyperliquid feed is the third venue available through its Edge market-data service. The company previously deployed similar services for Solana and for Kalshi, a prediction market. With this expansion, DoubleZero is effectively positioning Edge as a cross-venue distribution platform aimed at professional-grade data consumption.

For market makers and quantitative firms, the practical value of an Edge-style service is straightforward: fewer gaps in update streams, less reliance on reconstructing order books from partial public feeds, and a single distribution layer designed for automation.

For the broader Hyperliquid ecosystem, it may also signal a shift toward treating market data as critical infrastructure in its own right. Instead of forcing each data-heavy firm to build bespoke ingestion and normalization systems, venues can increasingly support dedicated distribution pipelines that align with how trading desks already operate.

Investors and traders will likely watch next how widely institutions adopt the feed and whether other onchain venues respond with similar dedicated distribution layers, particularly as more market participants push for predictable, ordered depth updates beyond what public APIs can provide.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.