Crypto News: Binance Hack, DTCC Tokenization & Ripple Bank Approval

Crypto News: Binance Hack, DTCC Tokenization & Ripple Bank Approval Binance's $6.3B hack, DTCC tokenization, Ripple's bank approval, HSBC's stablecoin launch and Ethereum's delayed…

This weekly digest covers the past seven days, and one event towered over everything else: the biggest theft in crypto history, at the world's largest exchange, which was paying customers out again by Sunday. Wall Street's main securities depository began issuing tokens, Ripple secured a federal trust bank, and regulated perpetual futures reached US traders. Here is what happened and what it means.

Binance Reopens Withdrawals After the Largest Crypto Hack Ever

Attackers drained about $6.3 billion from Binance hot wallets on October 29, starting at around 20:05 UTC. Most of the funds left across ten blockchains in roughly 20 minutes, with about $3.79 billion taken on Ethereum and 18,270 BTC on Bitcoin. TRM Labs puts the loss at $6.36 billion, about four times the $1.5 billion Bybit hack of February 2025. The FBI has since confirmed that North Korea's TraderTraitor group, a Lazarus subunit, was behind it and asked DeFi services, node operators and instant exchanges to block more than 600 flagged Ethereum addresses. Chainalysis described unusual automated laundering that cycles funds through fresh addresses.

Binance said a DevOps engineer's laptop was compromised, giving the attacker access to a service container that submitted unauthorized withdrawals. Co-CEO Richard Teng later said further breach points were found. Around $3 billion was frozen with help from Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council, but one address still holds 195,460 ETH that no issuer can freeze, worth over $440 million.

Withdrawals reopened in phases from 06:00 UTC on November 1. The first phase covers 15 networks ranked by the past week's user demand, including Bitcoin, Ethereum, BNB Smart Chain, Solana, Tron, the XRP Ledger and TON, and other networks will follow once security checks are complete. Binance has replaced about 95% of the stolen assets with its own money, up from 80% on October 30 and 90% a day later, helped by 7,499 BTC moved out of its SAFU fund. It says balances in its ten main coins, including BTC, ETH, USDT and USDC, are fully backed, while the missing 5% are less liquid tokens still being bought.

Users will not bear any losses, the exchange has repeated. A full proof-of-reserves report is due on November 3, with a post-incident report to follow. Abu Dhabi's FSRA, which has supervised Binance.com since January, said it is monitoring the situation closely but has not announced any measures. Markets sold off on Friday: Bitcoin fell about 2.8% to near $78,490, ether lost 3.8% and BNB 3.5%, while Hyperliquid's HYPE jumped about 17%.

DTCC Goes Live With Tokenized Securities

The Depository Trust & Clearing Corporation launched its Tokenization Service on October 28. It lets eligible participants mint blockchain-based "digital twins" of securities held at its Depository Trust Company, which safekeeps more than $114 trillion in assets. The tokens are delivered to wallets registered with DTC, can move 24/7, and can be burned to return to the traditional record.

Twenty firms have signed up, including Bank of America, Citi, J.P. Morgan, Morgan Stanley, Fidelity, State Street, UBS and Citadel Securities. The service runs under an SEC no-action letter from December 2025 that covers Russell 1000 stocks, major index ETFs and US Treasuries, and it starts with a subset of those. At launch it connects to the Canton Network and DTCC's private Hyperledger Besu network, with more chains planned for 2027. A July production test with over 30 firms used tokenized assets for repo, securities lending, collateral pledges and margin.

Ripple Gets a Federal Trust Bank as RLUSD Reaches Coinbase and Robinhood

Ripple said at its Swell conference in New York that it has received final approval from the Office of the Comptroller of the Currency to establish Ripple National Trust Bank. The company expects to exit 2026 at about $900 million in annualized product revenue. It counts more than 1,700 institutional clients, and its RLUSD stablecoin has grown to roughly $2.6 billion.

Distribution widened in the same week. Coinbase is adding RLUSD to Prime, its exchange and its retail app across the XRP Ledger, Base and Ethereum. Robinhood will use RLUSD in retail and institutional operations and integrate Ripple's treasury software. BNY, already the reserve custodian, is adding XRP and RLUSD custody. The OCC also conditionally approved trust charters for Bastion, Catena and Agora, which cannot open until final requirements are met.

Crypto.com Brings Regulated Perpetual Futures to US Traders

Crypto.com and OG.com have launched regulated crypto perpetual futures for eligible US customers. The contracts have no expiry date, allow long or short positions with up to 5x leverage, and trade around the clock with take-profit and stop-loss orders. Retail users reach them through the Crypto.com App and advanced traders through the Crypto.com Exchange, after the company registered as an Introducing Broker with the National Futures Association.

The launch follows a May CFTC policy statement on perpetual contracts and June no-action relief letting designated contract markets offer true perpetuals. Coinbase and Kraken already offer US perpetual exposure, and the 5x cap is far below typical offshore limits. Onchain venues are following: Kraken parent Payward aims to become the first CFTC-regulated deployer on Hyperliquid's HIP-3 markets, with Bitnomial clearing trades, though approval and a launch date are still pending.

HSBC Brings a Hong Kong Dollar Stablecoin to 3.3 Million App Users

HSBC has started rolling out RedCoin, its first stablecoin, inside the PayMe app. The token, ticker RCHKD, is issued under a Hong Kong Monetary Authority licence, is redeemable one-for-one for Hong Kong dollars and is backed by segregated liquid reserves held in trust. More than 3.3 million PayMe users can activate a wallet to send money to friends or pay at over 100,000 merchants. HSBC plans to add the wallet to its main banking app and let customers use RedCoin to buy tokenized products, including a new share class of its HKD money market fund.

The rival venture is moving more slowly. Anchorpoint, the Standard Chartered and Animoca Brands joint venture that launched an institutional HKD stablecoin in August, declined to confirm its earlier end-2026 target for retail access, with CEO Dominic Maffei promising a "prudent" approach.

Hardware Wallet Makers Face a Key Leak and a Class Action

Keystone has confirmed that its web shop was breached, exposing customers' names, contact details, delivery addresses and order details. Seed phrases, private keys and payment data were not affected. The attackers also obtained a device-authentication key, which could let counterfeit Keystone devices pass authenticity checks. Buyers should be wary of "replacement device" offers and of hardware from anywhere other than official channels.

Coldcard maker Coinkite faces a proposed class action in Ontario alleging that a March 2021 firmware build made seed phrases predictable, with thefts put at more than $140 million. The claim has not been certified. Seeds created on affected firmware stay at risk until they are regenerated and funds are moved.

UK Regulator Sets Out How DeFi Fits Its New Crypto Rules

The Financial Conduct Authority is consulting on guidance (GC26/7) for regulated firms that use decentralized finance. It does not create a separate DeFi regime. Instead, it explains how existing operational-resilience, financial-crime and anti-money-laundering duties apply when part of a service runs through smart contracts. A parallel perimeter consultation makes clear that decentralization alone does not take an activity outside regulation, while proposing exclusions for purely technical services.

Firms can apply for authorisation under the UK crypto regime between September 30, 2026 and February 28, 2027, and the rules take effect on October 25, 2027. Existing registrations will not convert automatically. The new perimeter covers operating trading platforms, safeguarding cryptoassets, arranging deals and certain staking activities. Firms using DeFi are expected to assess their own exposure and apply proportionate controls, which may increase demand for wallet screening and onchain monitoring.

Ethereum Scraps Final Glamsterdam Testnet Over Gas Changes

Ethereum developers cancelled the second and final testnet for the Glamsterdam hard fork after auditor ChainSecurity found problems in two gas-scaling proposals, EIP-8037 and EIP-8038. The changes could break contracts that rely on how calls behave when they run out of gas, affecting at least 13 DeFi contracts and potentially opening them to exploits. The Hoodi rehearsal will not be rescheduled until developers have worked through the fork's second-order effects.

The search for breakages leaned on AI. Researchers from Eth Labs and the Ethereum Foundation ran separate agents to scan contracts and coordinated them through a shared GitHub message board. A second board is already examining EIP-8198, "Quick Slots," proposed for the later Hegota fork.

Strive Buys 6,182 Bitcoin While Strategy Pauses

Strive bought 6,182 BTC for about $511 million between October 17 and 23, at an average of roughly $82,732, lifting its holdings to 43,000 BTC from 28,000 at the end of September. Its total cost of about $3.8 billion sits above a fair value of roughly $3.5 billion. The company also announced a $1 billion at-the-market program for its 15% Series A perpetual preferred stock to fund further purchases.

Strategy went the other way. Its October 26 filing showed no Bitcoin bought or sold in the week to October 25, ending a five-week buying streak and leaving it with 848,517 BTC acquired at an average of about $75,446. Instead, it spent $204.9 million in cash repurchasing its STRC preferred shares.

Initia Traces $2.7 Million Exploit to a MoveVM Bug

Initia, which halted its Layer 1 and rollups on October 23, has identified the root cause. A flaw in the script caching of its MoveVM implementation let the attacker bypass checks and credit itself unbacked WETH, AUSD0 and USDC. About $2.7 million was bridged out through LayerZero, Noble and Circle's CCTP and swapped into roughly 1,135 ETH. The native INIT supply was not affected. A fix is under review by security partners, and the network stays halted until it is cleared.

Because the bug sat in the execution environment rather than in a single application, Initia stopped the whole network. That prevented further damage but could not claw back assets that had already left for Ethereum.

Asset Managers Put More Funds on Stellar and the XRP Ledger

Janus Henderson launched JQQQ, described as the first tokenized fund officially licensed to track the Nasdaq-100. It is built on Centrifuge infrastructure on Stellar and is open to professional investors outside the US with a $100,000 minimum. At the Meridian conference in Lisbon, Securitize, whose clients include BlackRock and Apollo, announced an integration with Stellar, which its CEO called the fourth-largest ecosystem for tokenized real-world assets.

In London, Aviva Investors and Ripple launched a tokenised share class of the £22 billion Sterling Liquidity Fund on the XRP Ledger. Aviva put £50 million into it, while BNY Mellon keeps custody of the underlying assets.

Third-Party Incidents Hit Solflare Stakers and Coinbase Users

Solflare paused staking rewards after its external staking provider reported a compromise of the keys used to run the Solflare validator. Delegated SOL stays in users' own stake accounts and cannot be moved by the validator. The wallet is setting up a new node, an app update will guide users through migration, and it is preparing compensation for lost yield.

Coinbase said a security incident at analytics vendor Amplitude exposed contact details of a small subset of its customers. It found no access to its own systems, but the data can make phishing attempts more convincing.

SEC Puts Custody and Tokenized Securities at the Center of Its Crypto Agenda

The SEC is sharpening its focus on how crypto assets are held and how tokenized securities are traded. Comments on its proposed crypto custody rules are due by December 7, 2026. On October 23 the agency named tokenized securities an examination priority for fiscal 2027. Its September Innovation Exemption already covers venues trading tokenized securities, while at least 22 companies have objected to a proposal by OKX and ICE to tokenize shares. Its proposed Regulation Crypto Assets would add two fundraising exemptions: up to $5 million over four years, and up to $75 million within 12 months.

Make sure to follow StealthEX on Medium, X, Telegram, YouTube, and Publish0x to stay updated about the latest news on StealthEX and the rest of the crypto world.