On 31 October Binance said it had replaced 90% of the roughly $6.3bn stolen from its hot wallets two days earlier. Its customers still could not withdraw. That gap between what a company reports and what customers can do runs through the month.
October gave some users new ways to fund payments and move securities. Visa put stablecoin funding into production, HSBC began rolling out its own stablecoin, and DTCC opened a tokenisation service to eligible firms. The next questions are who uses those services, what they cost, and what happens when a custodian or operator stops serving them.
Custody and the Binance recovery#
On 29 October attackers moved about $6.36bn out of Binance's hot wallets across ten blockchains, according to TRM Labs' estimate01 of gross unauthorised movements. TRM's analysis points to compromised signing infrastructure, using pre-signed EIP-7702 authorisations on Ethereum. On 31 October the FBI attributed the theft to North Korea02, identifying the operation as TraderTraitor.
Four milestones tell different parts of the recovery.
- Frozen. In TRM’s early 30 October snapshot, issuers and Arbitrum’s Security Council had frozen about $2.7bn. The attackers still controlled about $2.4bn in ETH and BTC, plus smaller amounts on other chains.
- Replenished. On 31 October Binance said it had covered 90% of the impacted amount04 using its own resources and said users would not bear the loss.
- Reserve proof. On 2 November Binance said it had generated a proof05 for a 31 October snapshot of ten tokens. The proof lets customers verify their balances for those ten tokens at that snapshot. Its scope ends there.
- Withdrawable. Withdrawals were suspended through month-end and reopened in phases, by asset and network, from 1 November06.
November update, through 5 November. In its preliminary account on 3 November03, Binance said the attackers used stolen credentials to reach its internal signing service. On 4 November it reported about 98% replenishment07 and a new snapshot covering 44 tokens, with the proof still being generated at the time of that update. On 5 November it announced another phase of reopening08. Availability still depended on the asset and network.
Hardware wallets had a bad month too. Ledger's security team confirmed that devices sold by CryptoBilis, a Southeast Asian reseller, contained unauthorised LTE implants that captured the 24-word recovery phrase during setup and sent it out over a provisioned eSIM09. Ledger says its secure chip and software were untouched, and that loss estimates circulating online are unverified. On 30 October Trezor said it was treating as credible an unverified report of a similar implant in a Trezor Safe 5 bought from CryptoBilis, until October an official Trezor reseller10. It told anyone who bought a Trezor there since March to move funds to a new wallet with a new recovery phrase.
Keystone's problem had a different cause. An intrusion through its website exposed buyer records and the factory-written key its devices use to prove they are genuine, Keystone disclosed11. That key cannot be rewritten, so Keystone says it will destroy 18,835 unsold devices. It says the key plays no part in recovery phrases or signing. Keystone says devices delivered before 20 October can be considered genuine if they pass its authenticity check. Devices received later that carry the old key need extra verification through Keystone support, even if they pass.
The reseller was the weak point in Ledger’s case. Keystone’s breach exposed a different dependency: even a device bought through the usual channels could need a second authenticity check.
Stablecoin payments in production#
On 15 October Visa said Inyo Global had become the first partner to take USDC prefunding for Visa Direct into commercial production12. Businesses that send cross-border payouts through Visa Direct have to fund them in advance. Eligible clients can now do that in USDC in near real time, rather than relying only on traditional funding windows. Availability varies by eligibility and geography, and Visa has published no volumes.
On 23 October HSBC launched RedCoin, its Hong Kong dollar stablecoin, in its PayMe app, with wallets activating in phases14. Users can send it to each other and pay at more than 100,000 merchant locations. According to HSBC's FAQ13, it runs on HSBC's own DLT network and can't be moved between the PayMe and HSBC HK App wallets. The wallets are not bank accounts, and RedCoin is not covered by Hong Kong's Deposit Protection Scheme. PayMe’s 3.3 million-plus users show how widely HSBC could distribute RedCoin. On 2 November HSBC’s CEO said it had attracted 50,000 users15. That gives us an early uptake figure. Repeat use and any advantage over paying from an ordinary PayMe balance are still open questions.
For measured activity, the best October evidence came from Allium16. It classified $482bn of stablecoin transfers in January to September as payments, a figure it says is up 45%. Supply ended September at $305bn, just 0.4% above where it started the year, so payment use grew while the amount of stablecoins in circulation barely moved. Allium estimates payments by classifying transfers. Its full methodology sits behind a sign-up form and we reviewed the public summary.
Allium's agent-payment category puts a number on the AI-agent story. It recorded 68.3m agent payments in the third quarter, worth $3.7m: about five cents each on average, by our calculation. The count doubled while the value slipped. Mastercard opened early access to Agent Pay for Machines on 20 October, after a demo in which a person approved a single budget and an AI agent then made nine purchases within it, rather than asking for approval each time17. Mastercard's own page18 still describes it as a pilot that isn't commercially available. Within the category Allium measures, agent payments are real and so far tiny.
Whether stablecoin routes are cheaper depends on the comparison. Orbital, a stablecoin payments firm with an obvious commercial interest, published a study of 27,057 indicative USDT quotes19 across 52 currencies at $100,000 per transfer. Against the cheaper of two fintech providers, the stablecoin route was cheaper in 30 of 32 corridor-directions. Against institutional FX pricing, measured on a smaller subset over a shorter period, it won six of 22, and the other 16 came within five basis points. The study compares quotes, not completed transfers, and excludes slippage, failed quotes, onchain fees and the cost of holding USDT. It says nothing directly about Visa's USDC route. In Orbital's sample, most of the advantage disappeared against institutional pricing, so the useful comparison is with the route you already use.
Tokenised securities and what holders own#
On 28 October DTCC launched20 its tokenisation service. Eligible participants of the Depository Trust Company can convert securities entitlements between traditional and tokenised forms and deliver them to digital wallets of their choice. DTCC says the tokens keep the ownership rights, investor protections and economic entitlements of their traditional equivalents. The service runs on the Canton Network and DTCC's private Besu network, with more networks planned for 2027. Twenty participants, including Barclays, Citi and J.P. Morgan, have signed agreements to use it. That establishes onboarding; DTCC has published no balances.
The IMF's October Global Financial Stability Report21 offers early evidence of how tokenised shares are used. It studied five of the most liquid tokenised US equity exposures from two issuers, across 11 venues over 365 trading days. More than half of trading volume took place outside US market hours, and about 80% of individual trades were for less than one share. The tokens were considerably less liquid than the underlying shares, especially on decentralised exchanges. These are existing products, not DTCC's service, and the IMF stresses the market is young.
OKX and ICE plan a venue for tokenised US shares under the SEC's temporary exemption, but it had not opened by month-end; its website22 still says it is "coming". Each token would represent a security entitlement to one share held by a broker-dealer. Under the SEC’s order25, an issuer has 30 calendar days from receiving notice to object. A timely objection bars the relevant third-party token from that venue. By 30 October, 50 companies, including Microsoft, Alphabet and JPMorgan Chase, had objected, according to the venue’s 30 October notice23. Its 4 November notice24 listed 62.
DTCC’s model keeps securities entitlements inside the existing central custody chain. OKXICE’s proposed third-party model puts a tokeniser and broker-dealer between the token holder and the underlying share. The legal claim and who can hold it matter as much as the token itself.
What remains when operators leave#
On 2 October Blast said it would wind down its Ethereum layer 2 because the economics of running the chain no longer made sense26. It drew more than $2bn in deposits before its February 2024 mainnet launch. By October the value locked on the chain was about $32m. Blast set 26 October as the last day for withdrawals through its interface and directed users to its Ethereum bridge contracts after that.
Blur, once the dominant Ethereum NFT marketplace with about $1.43bn of monthly volume at its March 2023 peak, said its website will close27 on 12 November while its contracts stay live. Blur gave no specific reason. The contracts keep running, but users lose the interface most of them know.
Igloo, the company behind Pudgy Penguins, said on 6 October it would close its Abstract chain by 15 December after losing tens of millions of dollars29 over two years; its chief executive cited reduced appetite and insufficient liquidity. In onchain gaming, Meta Racing announced on 28 October that it is closing; players have until 15 November30 to withdraw their assets.
Not every exit was a retreat. DATA Network, formerly Story, said on 12 October it would retire its own blockchain and rebuild as a protocol on Sui, backed by $30m from the Sui Foundation28. Its token is due to convert one-for-one, and no migration date has been set.
Only Blast and Igloo gave economic reasons. What users keep when an operator leaves varies: a bridge route for Blast, live contracts without the website for Blur, a deadline for Abstract and Meta Racing, and a planned token conversion for DATA.
A live upgrade, a delay and an emergency fix#
On 21 October Solana activated Votor, the first part of its Alpenglow upgrade, replacing the TowerBFT system its validators used to reach agreement31. Solana's documentation notes that validator votes are no longer transactions, so they no longer appear in blocks. Transaction counts and throughput figures that used to include votes dropped sharply for that reason, not because activity fell, and before-and-after comparisons need re-basing. Solana's target is finality in about 150 milliseconds, down from 12.8 seconds; it calls that an expectation, and we have not seen sustained post-activation measurements. The separate cut in slot time to 200 milliseconds finished in October, programs and fees are unchanged, and the second half of Alpenglow, Rotor, has no date.
Ethereum’s core developers postponed the Hoodi testnet upgrade on 22 October to investigate how EIP-8037 interacts with mainnet contracts32. The announcement set no replacement date.
The XRP Ledger disclosed a payment-engine flaw in October that could have let a transaction create XRP from nothing33. A fix shipped in September, three days after the report. ForkLog reported that more than 80% of validators on the default recommended list installed it the same day, without the usual amendment vote34. Developers found no evidence of exploitation on public networks.
What to watch next#
- Repeat use. Watch for RedCoin merchant payments, balances on DTCC’s service and payout funding volume on Visa’s USDC route. Early users and signed agreements establish who has come through the door. The next test is what they do there.
- Working withdrawals. Watch for restored access across Binance’s affected assets and networks, alongside the expanded proof and an independent account of the breach. Those checks answer different questions about the recovery.
- Usable exits. Look for evidence that people recovered their assets after an app or chain closed. A published contract address tells us where an exit might be. Completed withdrawals tell us whether people could use it.
Rules can close off access too. On 27 October HTX gave the High Court undertakings on unlawful promotions to UK consumers. It has stopped taking UK deposits and sign-ups, and the FCA points existing customers to the arrangements for withdrawing residual assets35. Two dates to watch are 12 November, when the EBA takes over specified supervision of EU-issued USDC36, and 18 January 2027, when the OCC’s payment stablecoin rule37 takes effect.
