Zano has rolled back roughly a month of blockchain history after it identified a vulnerability tied to “Gateway Addresses” that, according to the project’s core team, enabled unauthorized ZANO and Freedom Dollar (fUSD) to enter circulation.

In an update shared Sunday, Zano said the network was restarted at block 3,833,000—immediately before Hard Fork 6, which introduced the affected functionality. The recovery now depends on ecosystem participants, including nodes, miners, stakers, exchanges, and other services, upgrading to the revised software.

Key takeaways

• Zano restarted the chain at block 3,833,000, rolling back about a month of activity tied to an exploit linked to Gateway Addresses.
• The rollback removes both legitimate transactions from that window and the unauthorized ZANO and fUSD that entered circulation.
• Payments already completed on other blockchains cannot be undone, limiting how far the recovery can reverse real-world settlement.
• Zano says it will handle remediation for affected parties through a reimbursement and claims process, though details have not yet been published.
• The fix requires coordinated adoption by infrastructure operators and service providers, including exchanges and other third parties that integrate with Zano.

Hard Fork 6 and the Gateway Address vulnerability

Zano has not published a full post-mortem as of publication, but it has confirmed that the problem originated with Gateway Addresses—a feature designed to simplify how external platforms such as bridges, exchanges, and payment services integrate with the Zano network.

According to the project’s explanation, Gateway Addresses enable these services to manage funds using a single “account-style” balance rather than handling payments as scattered transaction outputs.

Before Gateway Addresses existed, Zano wallets operated using separate transaction outputs (UTXOs). For exchanges and similar services, that meant incoming funds required blockchain scanning to identify which outputs belonged to a platform, followed by selecting specific outputs for withdrawals.

The introduced feature changed that workflow by offering a different way to account for funds—one that, in Zano’s view, became the pathway for the vulnerability that allowed unauthorized tokens to be minted or otherwise introduced into circulation.

What the rollback does—and what it cannot fix

Zano’s rollback invalidates the on-chain record of the affected period. The project states that transactions processed during that time will no longer appear on the restored chain. It also says the unauthorized ZANO and fUSD created or introduced through the exploit will be removed from the recovered ledger.

However, Zano cautioned that the rollback cannot reverse payments already settled on other blockchains. That distinction matters for users and service operators: if cross-chain transfers or off-chain settlements were completed before the restart, those transfers may not be recoverable even if the originating chain history is rewritten.

Zano also indicated that it is working to account for losses and will publish a reimbursement and claims process. The project did not provide the mechanics of how losses will be calculated or what documentation will be required within the material available at the time of writing.

Why Zano chose to restart the network

Zano’s head of marketing and growth, Quinten van Welzen, framed the decision as a trade-off between restoring the integrity of the currency supply and accepting a painful loss of history.

In statements shared alongside the rollback announcement, van Welzen argued that “doing nothing” would have allowed unauthorized ZANO and fUSD to remain in circulation without limits—effectively diluting holders and breaking what he described as the basic promise a currency makes: a fixed supply. He also suggested that allowing the attacker to retain value would set a dangerous precedent.

He acknowledged that restarting the chain from before Hard Fork 6 carries costs, including the disappearance of about a month of transaction history. At the same time, van Welzen said the rollback restores the supply that users expected and leaves a path for rebuilding trust.

Gateway Addresses and the risks of integration features

Zano’s broader context helps explain why the exploit mattered. The project launched in May 2019 as a layer-1 blockchain focused on private payments. Standard private transactions are designed to conceal senders, receivers, transferred amounts, and asset types.

Beyond its native token (ZANO), Zano allows users to deploy and mint custom digital assets. Freedom Dollar (fUSD) is one such token operating on the Zano blockchain. The vulnerability therefore wasn’t confined to a single token: unauthorized issuance affected both ZANO and an issued asset tied to the same underlying system.

Gateway Addresses were created to make integrations easier—especially for services that need to handle deposits and withdrawals without scanning UTXOs manually. But Zano’s response underscores a central theme in blockchain security: features that simplify custody and balances for third parties can also concentrate risk if they introduce new assumptions or pathways an attacker can abuse.

In that light, the coordination requirements for the restart carry practical weight. Zano said the recovery requires participating nodes, miners, stakers, exchanges, and other services to adopt the update. Without broad adoption, the network could split between versions, complicating settlement and increasing operational risk for trading venues and custodial providers.

For users, the rollback also highlights a limitation that extends beyond Zano itself: even if the originating chain is corrected, downstream effects—especially those involving cross-chain transfers or already-completed settlement—may remain permanent.

Looking ahead, attention should focus on the reimbursement and claims process Zano said it will publish, as well as how quickly exchanges and infrastructure operators finalize adoption of the restart. The project’s next security communications—whether it eventually releases a deeper technical post-mortem—will also be important for assessing whether Gateway Addresses will be reworked to prevent similar failures.

Zano has rolled back approximately a month of blockchain history after a vulnerability involving Gateway Addresses allowed unauthorized ZANO and Freedom Dollar to enter circulation, according to its core team. 

The Zano blockchain has been restarted at block 3,833,000, immediately before Hard Fork 6, which introduced the affected feature. The recovery requires participating nodes, miners, stakers, exchanges and other services to adopt the update, the team said Sunday. 

The rollback invalidates a month of legitimate transactions along with the unauthorized tokens, meaning transactions made during that period will no longer appear on the recovered chain and may need to be reconciled. It also cannot reverse payments already settled on other blockchains. The team said it is working to account for any losses and will publish a reimbursement and claims process. 

“Doing nothing meant unauthorized ZANO and fUSD in circulation without limit, diluting every holder and breaking the most basic promise a currency makes: a fixed supply,” said Zano’s head of marketing and growth Quinten van Welzen. “It would also tell every future attacker that exploited coins get to keep their value. No project survives that.” 

Zano identifies Gateway Address exploit 

Zano has not released a post-mortem at the time of publication, but confirmed the issue came from Gateway Addresses, a feature developed to make it easier for bridges, exchanges and payment services to integrate with Zano by letting them manage funds through a single account-style balance (similar to other blockchains). 

Before Gateway Addresses, Zano’s ordinary wallets tracked funds as separate transaction outputs (UTXOs), rather than a single account balance. Exchanges and other services had to scan the blockchain to identify incoming payments, track those outputs and select which ones to spend when processing withdrawals.

Zano launched in May 2019 as a layer-1 blockchain focused on private payments. Its standard private transactions conceal senders, receivers, transferred amounts and asset types. While it has a native token, ZANO, the blockchain also allows users to deploy and mint custom digital assets. Freedom Dollar (fUSD) is one such token that operates on the Zano blockchain. 

Related: Bitget CEO suspects North Korea behind $352M hack, citing IP clues 

“Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which we’ll have to earn back,” said van Welzen. 

“But it restores the supply everyone signed up for, and it leaves a path to rebuild. Which is better than 7 years of hard work left to die. We know it hurts. But not doing it would have hurt more.”

Magazine: THORChain under fire over Bitget, ETH evolves beyond blockchain: Hodler’s Digest

Cross-chain custody and censorship resistance collided with a high-profile breach narrative this week after Bitget publicly urged the decentralized liquidity protocol THORChain to block addresses allegedly tied to stolen funds. The dispute has reignited questions about what “decentralization” requires—and what it does not—when theft victims point to on-chain activity they believe is known to be malicious.

The push began after Bitget reported unauthorized transfers that it later revised upward, with the exchange attributing the suspected actor to North Korea based on preliminary investigative signals. In response, THORChain’s stance—whether it can meaningfully blacklist the relevant addresses, and whether it should—has become the center of an argument that is now spilling beyond technical governance and into the broader ethics of permissionless networks.

Key takeaways

• Bitget said unauthorized transfers rose from $351.6 million to $387.5 million, and later pointed to IP clues it believes link the activity to VPN infrastructure used by a North Korean hacking group.
• Bitget CEO Gracy Chen publicly asked THORChain to block addresses tied to the alleged theft connected to the Bybit-linked flow on THORChain.
• THORChain’s compliance position is unclear in practice because its ability to blacklist specific addresses has been questioned, including references to earlier admin-key changes.
• The debate is also exposing an asymmetry: decentralized funds may still be traceable after swaps, but protocols differ in whether they can or should exert address-level controls.
• While governance and security principles are at stake, THORChain has also faced criticism of its operational decentralization compared with networks like Bitcoin and Ethereum.

Bitget’s breach claims and the “block the addresses” demand

Bitget disclosed that it had detected “unauthorized transfers” tied to a security incident on September 25. According to Cointelegraph reporting, the exchange initially put the figure at $351.6 million, before updating it to $387.5 million. Bitget also stated that a preliminary investigation had linked IP addresses involved in the incident to VPN services associated with North Korean hacking operations, though the evidence was described as suggestive rather than definitive.

Bitget CEO Gracy Chen publicly argued that decentralized protocols should not serve as a destination for funds connected to theft. She said decentralization is a design principle, not a shield for facilitating known stolen assets, and urged THORChain to block addresses it believed were tied to the incident.

That framing matters because it reframes a typical “hack victim versus exchange” story into a “hack victim versus liquidity routing” story. If a stolen-flow path crosses a decentralized exchange-like venue, the conversation shifts from incident response alone to the network-level question of whether platforms can limit interaction with suspected addresses.

Why THORChain is at the center of the argument

As Bitget’s criticism spread, the broader context involved a prior major breach attributed to North Korean actors: the Bybit hack, reported by Cointelegraph as a $1.5 billion incident. Cointelegraph coverage also noted that funds from that attack were reportedly swapped on THORChain.

THORChain has often been described as a decentralized liquidity mechanism rather than a privacy mixer, and the general claim in the surrounding debate is that funds are still traceable after being swapped. That traceability is crucial: it gives victims and investigators a basis for arguing that specific on-chain participants should be restricted, even if the destination is a decentralized protocol.

However, what victims want—address-level blocking—may not align with how THORChain is technically or politically structured. The article notes that THORChain previously paused its chain quickly following its own $10.7 million hack in May. That detail highlights that the protocol can react decisively to security events, even as it faces scrutiny over whether it can selectively censor or restrict particular counterparties.

Can THORChain blacklist, and should it?

Whether THORChain can blacklist addresses is described as unclear in the reporting. The text points to a reference from February 2025, when THORChain said it had retired an admin key that would have provided the power to blacklist certain addresses.

This uncertainty is important for readers because it changes the nature of the request from “should a protocol do this?” to “can the protocol do this at all without undermining its own design?” Even if governance messaging supports compliance, protocol capabilities and key management can set hard boundaries on what is feasible.

Meanwhile, critics of address blocking argue that allowing decentralized protocols to respond to coercive demands would create a censorship precedent. The debate also includes an “ethics versus practicality” tension: victims emphasize harm reduction and reducing stolen-fund liquidity, while decentralization advocates emphasize permissionless access as an anti-tyranny safeguard.

At the same time, the article draws attention to concerns about THORChain’s decentralization level compared with Bitcoin or Ethereum. It cites the idea that THORChain does not match the governance model of the most decentralized networks and references past claims around administrative functionality. Those points are used to argue that the protocol’s permissionless claims may be overstated in practice.

For traders and builders, the operational reality is what matters most: if a protocol cannot enforce address-level exclusions, then users may still be exposed to flows they would rather avoid. If it can enforce them, then the network may face governance attacks, reputation risk, and the possibility of politically motivated address targeting. Either way, the outcome affects how participants assess risk and compliance expectations.

Market reaction and what to watch next

The controversy has not only sparked governance debate; it also appears to have attracted market attention. The article states that THORChain’s native token RUNE surged 50% over a week amid the publicity around the dispute.

Looking ahead, the key question is whether THORChain will clarify what address-level controls it can implement—if any—and what governance process would apply if requests from centralized exchanges are escalated. Readers should also watch how the underlying theft narrative evolves: Bitget’s attribution remains tied to preliminary investigation signals, and the strength of the evidence will influence whether future calls for restrictions gain wider traction.

In parallel, this episode underscores a broader industry challenge: even in decentralized systems, “who can stop stolen funds?” will increasingly depend on technical capabilities, governance choices, and the willingness of markets to treat permissionless routing as either a resilience feature or a liability.

ThorChain under fire because it won’t blacklist stolen Bitget funds

Stop me if you’ve heard this before: A centralized exchange with lax security gets hacked by the North Koreans for $387.5 million, and then somehow shifts the blame game onto a decentralized exchange for not blacklisting the addresses.

The drama began on September 25 when the Asian focused exchange Bitget revealed $351.6 million in “unauthorized transfers” but it later upgraded the tally to $387.5 million. It said a preliminary investigation had linked the IP addressees to VPN services used by a North Korean hacking group.

While that isn’t firm proof, CEO Gracy Chen said its investigators had flagged other similarities with previous thefts.

North Korean hackers were believed to be behind the $1.5 billion Bybit exchange hack, and much of the funds from that attack were then swapped on the decentralized exchange THORChain (which is not a mixer and funds can still be traced after being swapped).

Chen then publicly called on THORChain to block the addresses linked to the attack. “Decentralization is a design principle, not a shield for facilitating known stolen funds,” she thundered. Thorchain politely said no chance, which has set off a massive debate over whether they can or should comply with Chen’s request. Decentralization maxis like Joel Valenzuela said doing so would undermine crypto’s cypherpunk ethos. “If we let decentralized protocols to be bullied into setting a censorship precedent, or make it toxic to interact with permissionless protocols, then we lose to tyranny. Full stop,” he said.
But THORChain isn’t as decentralized as Bitcoin or Ethereum, and it coordinated to quickly pause the chain when it got hacked for $10.7 million in May. “Thorchain is like 5 retards in a discord coordinating secret updates in between talking about the stolen funds they’re profiting from and lying about the admin functionality they abuse regularly to rug their users and NO’s,” said cybersecurity expert Tay Vano.

However THORChain’s ability to blacklist particular addresses is unclear. Back in February 2025 it revealed it had retired the admin key which would give it the power to do so.

All publicity is good publicity and THORChain’s native token RUNE has surged 50% in a week.

Where we’re going we won’t NEED blockchain says Vitalik

Ethereum creator Vitalik Buterin has rallied the troops with an inspiring post outlining how Ethereum is being rebuilt from the ground up to integrate zero knowledge proofs, parallel processing, privacy and post quantum technology to genuinely become “the cryptographic world computer.”

“It’s really not just a blockchain anymore. It’s a hybrid architecture that combines together blockchains and modern cryptography, to enable much more powerful properties,” he wrote, describing “an architecture that combines blockchains with cryptographic privacy and verification, and powerful decentralized off-chain components.” The Hegota fork, which is planned for next year, would likely Ethereum’s last “normal” fork he said.

Advertisement

Source: Brian Armstrong

Coinbase founder Brian Armstrong — a man who rarely utters the word “Ethereum” — reposted an analysis of the blog from a small account named “Cryptographic” said the analysis was “interesting.” Cryptographic summed up the thrust of Buterin’s post by saying it changed the whole meaning of “onchain” and meant Ethereum really was becoming a “world computer.”

“Instead of every part of an app having to execute inside a smart contract you can push a huge amount of complexity elsewhere and still inherit Ethereum’s guarantees.”

Aave founder Stani Kulechov made a similar point, arguing: “There are countless of use-cases where Ethereum verifiability would be useful beyond smart contact execution environment for finance to expand what we can actually do in DeFi while minimizing trust. Quite excited for the potential here.”

Crypto Mom retires, suggests ZK proofs for KYC

SEC Commissioner Hester Peirce has submitted her formal resignation from the US Securities and Exchange Commission, effective Oct. 2.

Peirce, affectionately known as “Crypto Mom” amid her advocacy of clear, rules-based regulation of the crypto industry, posted a copy of her resignation letter on her X account Friday.

Cointelegraph reported in May that Peirce planned to join the law school of Regent University in Virginia as an associate professor in November.

On her way out the door she criticized excessive KYC data storage, saying that storing IDs online created large numbers of databases vulnerable to hacks without improving enforcement. Instead, she advocated using zero knowledge proofs, which are able to verify eligibility without sending ID documents through.  “One can prove that you qualify without that counterparty knowing your name, income, or address,” she said.

Magazine covered this very subject earlier this month.  

Open AI called for Australian Senate inquiry following rogue AI hack

The CEOs of OpenAI and Anthropic have reportedly been summoned to appear at an Australian Senate inquiry into AI, just days after news broke that a rogue OpenAI bot had hacked the country’s health data.

The Australian Medicare breach is one of the highest-profile incidents of AI agents accessing external systems outside the US, according to a Sunday Business World report.

Cointelegraph reported last Thursday that the OpenAI research agent had bypassed blocks on the Australian government health data portal and accessed non-public files in June. It somehow didn’t get around telling the Australians until September 10.

Michael Saylor outlines ‘bill of digital rights’

Michael Saylor, co-founder of Strategy, said that an age of digital assets and intelligence needs a “bill of digital rights,” rather than restrictions.

These rights include (1) the freedom to create new digital assets and (2) to issue them to the market to finance business and productivity. They also include (3) the right to hold them or choose a custodian, as well as (4) to transfer them, to move the assets among people, companies, wallets and service providers. Finally, (5) to use them, to spend, invest, earn income and borrow against digital assets.

This week the Strategy board announced it would seek shareholder approval to move its four preferred stocks, including STRC, to daily dividend payments without changing their dividend rates or the total amount paid.

Winners and Losers

At the end of the week, Bitcoin (BTC) is up 3.8% to trade at $84,222, Ethereum (ETH) is up 3.7% to trade at $2,674 and XRP (XRP) is up 7% to $1.50. The total market cap is at $2.88 trillion according to CoinMarketCap.

Among the biggest 100 cryptocurrencies, the top three altcoin winners of the week are Quant (QNT) with a 435% gain, Sei (SEI) on 44%, and Artificial Superintelligence Alliance (FED) on 41%.

The top three altcoin losers of the week are Falcon Finance (FF) which was down 25.3%, MemeCore (M) down 20.3% and Avalanche (AVAX) down 4.5%.

Top Prediction of the Week

Bitwise says NEAR could be headed to $562

Bitwise’s new NEAR ETF is about to launch, and its chief investment officer Matt Houghan has jumped into promotion duties by co-authoring some of the most optimistic predictions you’re likely to see this month. The new fund, called the Bitwise NEAR ETF, is expected to list on NYSE Arca under the ticker NRR.

Bitwise’s 39-page investment report NEAR states the “base case” is a price target of $155 by 2030 while the bull case is $562.  The bearish case suggests a price of $1.63.

Last week Near Protocol’s native token surged 80% to be the top performer in the Top 100. The surge came after Near unveiled private Hyperliquid perps trading.

Top FUD of the Week

Kalshi loses appeal, setting up potential Supreme Court case

Prediction market Kalshi lost on appeal when a court ruled that Ohio and Tennessee can regulate sports-event contracts under their state gambling laws.

The ruling followed a similar finding from the 9th Circuit Court of Appeals last month, which broke from an April decision by the 3rd Circuit Court of Appeals allowing the company to do business in New Jersey as its appeal process proceeds.

The April ruling said Kalshi was likely to succeed with its argument that federal law preempts New Jersey’s regulations, all of which has set up a potential Supreme Court case.

Tether says it had ‘limited’ exposure to bank linked to $84M US seizure

Stablecoin issuer Tether said that it had a very small amount of assets at a bank that had $84 million in assets frozen by US prosecutors.
In response to reports linking Tether and Bitfinex to a Montana-based payments business named in a civil forfeiture complaint, a company spokesperson told Cointelegraph that it had “no knowledge” of any of the alleged conduct. Tether confirmed it was a customer of EQIBank, but the amount held at the bank represented 0.034% of the group’s total assets.

Magic Eden scare puts 3,832 NFTs in whitehat protective custody

A whitehat moved 3,832 non-fungible tokens from hundreds of wallets on Friday amid concerns about a vulnerability involving NFT marketplace Magic Eden. 

NFT community member who goes by Cirrus on X flagged the activity on Friday, saying a single wallet moved 3,832 NFTs from hundreds of wallets. Cirrus said the transactions appeared as sales through Magic Eden and advised NFT holders to revoke permissions as a precaution.

Shortly afterward, Yuga Labs’ pseudonymous vice president of blockchain, 0xQuit, said the transfers were part of a white-hat operation. He said the NFTs held in the receiving wallet are safe and “will be returned once they are no longer at risk.” 

Top Magazine Features of the Week

The SEC has opened a five-year path for tokenized stocks, but only some products and venues fit the model. Will Uniswap, Robinhood, Coinbase or Kraken come out on top?

The IRS can now see your crypto gains, but has no idea about the cost-basis. That’s proving to be a big headache for some cryptocurrency investors.

The APAC region accounts for half of the Global Crypto Adoption Index. Bitget suffers massive $352M loss and OpenAI forgets to mention its agents hacked the Australian Government.

South Korean industry participants have called for liquidity safeguards to form part of future won stablecoin rules after several foreign stablecoins recorded sharp price deviations on domestic exchanges.

News1 reported on Sept. 27 that market participants want regulators to examine initial circulating supply, issuance and redemption channels, market makers and controls for unusual trading. The proposals come as South Korea develops its second-stage digital asset legislation, which is expected to cover stablecoin issuance and circulation.

Recent trading has shown how limited exchange liquidity can push stablecoins far from the currencies they are designed to track. JPYC, PayPal USD and EURC each experienced abnormal price moves on South Korean won markets during September.

JPYC price spike puts stablecoin liquidity under scrutiny

JPY Coin, or JPYC, climbed as high as 37.6 won after Upbit introduced trading on Sept. 17. The yen-linked stablecoin had a reference value close to 8.8 won at the time, placing the exchange price at more than four times that level.

Yonhap reported that JPYC began trading around 12 won before climbing above 37 won as buying demand met limited available supply. Upbit later expanded supported deposit networks beyond Ethereum to include Kaia and Polygon, allowing more JPYC to reach the exchange. The token returned toward the 8-won range the following day.

Before trading started, Upbit had cited a JPYC reference price of 8.81 won. The exchange initially planned to support Ethereum deposits and withdrawals when announcing the listing.

In related coverage, crypto.news reported that Upbit had delayed JPYC trading by three hours on Sept. 17 while keeping the PYUSD schedule unchanged. The listing covered KRW, BTC and USDT markets. JPYC Upbit trading delayed three hours

PayPal USD experienced a smaller but still notable move on the same exchange. Upbit’s data shows PYUSD reached an all-time high of 1,760 won on Sept. 17 before falling toward the 1,360-won area.

News1 attributed the move to constrained supply during the first stage of trading. Unlike JPYC, PYUSD remained much closer to its dollar reference value, but the jump demonstrated how an exchange price can diverge when available sell-side liquidity is thin.

EURC surge adds another example from Bithumb

A separate price distortion appeared in Circle’s euro-backed EURC on Bithumb. EURC reached 7,860 won shortly after midnight on Sept. 14, compared with the previous closing price of 1,513 won. The move represented an increase of more than 400%, while overseas prices remained close to the euro’s converted value.

Bithumb’s official records show EURC had entered its won market on Aug. 28, not Sept. 14. The exchange listed the token with a reference price of 1,609 won and supported deposits and withdrawals through Ethereum.

The Sept. 14 move therefore occurred more than two weeks after the listing. Reports linked the spike to concentrated orders and shallow liquidity instead of a change in the euro backing the token. Approximately 60% of that day’s EURC volume was executed within a 15-minute period, according to reporting based on Bithumb trading data.

USDG experienced another abnormal move during the same period, reaching 3,048 won on Bithumb against a previous close near 1,358 won. The repeated episodes have prompted calls from industry participants for stablecoin market rules to address exchange liquidity separately from issuer reserves.

Won stablecoin rules could cover liquidity and redemption

Current debate over won-denominated stablecoins has focused heavily on who can issue them, minimum capital requirements and the assets used to back outstanding tokens.

Industry participants cited by News1 want the framework to extend into secondary-market trading. Suggested measures include requiring sufficient initial circulating supply before exchange trading begins and maintaining issuance and redemption channels that can respond when market demand changes.

Some participants have proposed requiring market makers or liquidity providers to maintain continuous buy and sell quotations. Other proposals include displaying deviations from a stablecoin’s reference value and restricting certain market orders when prices move unusually far from the underlying currency.

An industry official quoted by News1 said a won-backed token could still experience sharp volatility if demand rises suddenly while circulating supply remains inadequate. The official called for standards covering issuance, redemption, liquidity provision and responses to unusual market conditions.

Reserve requirements address a different part of the structure. Assets held by an issuer can support redemption at the designated value, while exchange prices are determined by available bids, offers and the ability to move tokens between venues or redeem them with the issuer.

South Korea’s Financial Services Commission has not announced final rules covering those proposed liquidity safeguards. The regulator has repeatedly cautioned that major parts of the second-stage digital asset framework remain under discussion.

South Korea targets November review of digital asset law

Work on the legislation is continuing as regulators and lawmakers negotiate rules for stablecoins and other digital assets.

An FSC official said on Sept. 22 that the Digital Asset Framework Act is expected to reach a National Assembly bill review subcommittee in November. Ten digital asset and stablecoin proposals are currently pending, while policymakers continue discussing a consolidated framework.

As crypto.news previously reported, the planned legislation covers digital asset issuance and distribution, including stablecoins, with regulators seeking to advance the second-stage framework during 2026. South Korea targets November review for crypto legislation

One unresolved question concerns the companies allowed to issue won-denominated stablecoins. The Bank of Korea has supported an initial bank-led structure, citing monetary policy, payment-system and financial-stability concerns.

The FSC said earlier this year that reports claiming stablecoin issuer structures had already been finalized were premature. In January, the regulator said discussions with other agencies were continuing and that key provisions had not yet been settled.

Crypto.news reported in July that the central bank continued to favor bank-led consortiums while lawmakers discussed the pending framework. Bank of Korea defends bank-first stablecoin plan

By August, the FSC said work remained underway on a government proposal for the second-stage Digital Asset Act. The regulator again cautioned that specific provisions, including ownership rules affecting crypto exchanges, had not been finalized.

South Korea’s September securities-token roadmap provides another indication that stablecoin policy remains unfinished. The FSC said future on-chain payment infrastructure could eventually connect tokenized securities with stablecoins, but later implementation stages will depend partly on pending stablecoin legislation.

Citi has found that 77% of financial institutions expect to use some form of tokenized collateral during 2026 as banks and market operators move blockchain-based settlement into live environments.

The bank’s Sept. 24 report, Digital Collateral: A Practical Reality, prepared with The ValueExchange, examines tokenized cash, money market funds, government bonds and other assets used for margin and financing. Citi said institutions are moving beyond testing toward practical collateral applications.

The report places the change against a costly problem in traditional markets. Large financial institutions manage substantial pools of collateral spread among custodians, clearing houses and counterparties, but settlement hours and fragmented systems can prevent assets from moving when needed.

Citi’s published findings say as much as $15 billion of collateral can remain idle at an individual institution, contributing to roughly $346 million in annual lost income for large firms. Citi’s Digital Collateral report

Citi sees tokenized collateral moving beyond pilots

According to the report, systemically important financial institutions manage an average of roughly $74 billion in collateral each day through around 65 custody locations.

About 25% of collateral can remain unremunerated or be posted as an extra buffer because existing infrastructure cannot always move assets when markets require them. The resulting idle balance can reach around $15 billion at a large institution.

Citi estimates that inefficient collateral deployment can cost a Tier 1 institution around $346 million annually in lost earnings. Its public report page identifies outdated settlement cutoffs and idle collateral among the main sources of that cost.

Earlier research from Nasdaq and The ValueExchange reached similar conclusions on the size of institutional collateral pools. Their survey placed average collateral under management near $74 billion and found roughly 25% generated no returns for its owner.

The earlier study found 52% of surveyed financial institutions planned to actively manage tokenized collateral by 2026. Citi’s newer report puts the share expecting to use some form of tokenized collateral at 77%, covering a wider set of potential applications.

Cash, government securities and money market funds feature among the main assets institutions are considering for digital collateral arrangements. Citi said tokenization can let firms transfer eligible assets without waiting for conventional settlement windows to reopen.

Tokenized repo is already handling institutional volume

Repurchase agreements have become one of the more developed institutional uses of blockchain-based collateral.

The Citi report estimates that roughly 5% of monthly repo volume is already being transacted in tokenized form. Repo markets allow institutions to obtain short-term funding by exchanging securities for cash while agreeing to reverse the transaction later.

Separate production data shows large transaction values are already moving through distributed-ledger repo systems. Broadridge said its Distributed Ledger Repo platform processed $8 trillion during July, with average daily volume reaching $365 billion.

As crypto.news reported, Broadridge’s platform allows firms to settle repo transactions while moving tokenized collateral without replacing their existing trading systems. Broadridge processed $8 trillion in blockchain repo volume

Citi’s report says tokenized collateral could address another constraint as derivatives and digital asset markets operate beyond normal banking hours. Traditional collateral transfers may depend on local market schedules, custodian availability and settlement cutoffs.

Around 60% of global margin remains in non-yielding cash, according to Citi’s published findings. The bank said tokenized money market funds could combine yield with faster transferability, allowing collateral to remain invested until closer to the point when it must be moved.

Such structures are already reaching regulated products. JPMorgan filed for its OnChain Liquidity-Token Money Market Fund, which uses blockchain technology to let investors submit transaction instructions connected to fund shares. The portfolio primarily consists of cash, short-term U.S. government securities and fully collateralized repurchase agreements.

DTCC prepares tokenized Treasuries for October launch

U.S. Treasury securities form another part of the institutional collateral market moving toward tokenized infrastructure.

The Depository Trust & Clearing Corporation plans to launch its DTC Tokenization Service in October 2026. The service will allow eligible securities held at DTC to be represented in tokenized form while retaining their existing ownership rights and investor protections.

DTCC moved the project into production activity on July 15. Participating firms completed transactions involving U.S. Treasury repo, collateral pledges, securities lending, equity settlement and central counterparty margin workflows.

More than 30 financial and technology companies took part, including BlackRock, Goldman Sachs, JPMorgan, Citadel Securities, Circle, Nasdaq, CME Group and State Street Investment Management.

The tests included tokenized U.S. Treasury assets used in delivery-versus-payment trades and repo transactions. DTCC said the production activity prepared its infrastructure for the scheduled October rollout.

In related coverage, crypto.news reported that the service will cover eligible DTC-custodied U.S. Treasuries, major index ETFs and certain U.S. equities. DTCC moves tokenized assets toward October launch

DTC received regulatory clearance for the project in December 2025 through a U.S. Securities and Exchange Commission no-action letter. DTCC said the authorization applies to specified liquid securities, including U.S. Treasury bills, notes and bonds, Russell 1000 stocks and ETFs linked to major indexes.

Tokenization targets around-the-clock collateral movement

Citi’s report focuses heavily on the ability to move collateral outside conventional market hours.

Global derivatives and digital asset markets can continue moving while banks, custodians and settlement systems in certain regions are closed. Firms may respond by sending excess collateral in advance or maintaining larger liquidity buffers.

Citi said tokenization could support collateral transfers closer to 24 hours a day, seven days a week, reducing reliance on prefunding. The bank pointed to real-time margining and the movement of U.S. Treasuries through different time zones as practical examples already under development.

DTCC is working on a separate Collateral AppChain designed around the same issue. The platform is intended to give collateral providers, receivers, custodians and other market participants shared infrastructure for moving assets between different markets and blockchain networks.

Working with Chainlink, DTCC plans to support automated eligibility checks, valuations, margin calculations, collateral optimization and settlement on the platform. The Collateral AppChain is expected to enter production in the fourth quarter of 2026.

Crypto.news has reported similar institutional demand outside traditional clearing infrastructure. Aave plans an Avalanche-based market where eligible institutions could pledge tokenized financial assets and borrow Tether’s USA₮ stablecoin against them without selling the underlying positions. Aave plans tokenized asset collateral market on Avalanche

Citi acknowledged that legal frameworks, legacy systems and institutional risk controls remain obstacles to adoption. Its Sept. 24 report said financial institutions are increasingly moving from observing tokenized collateral to applying it in live treasury, margin and settlement processes.