Crypto Transaction Weekly News Review - October 5 - 11, 2026

Security and Incidents: The Drain Came Through the Retail Channel

1. The Ledger Reseller Drain: $93.2M Across Six Chains, TRON Hit Hardest

Event date: October 9, 2026 (Bitquery reconstruction October 10)

Source: Ledger Support statement, October 9; Ledger investigation update, October 10; Bitquery on-chain analysis; TokenPost and BigGo Finance reporting, October 9 - 10.

Summary: Ledger Support said on October 9 it was investigating fund losses among Southeast Asian users who bought hardware wallets through CryptoBilis, a Malaysia-based reseller listed on Ledger's official page for Indonesia, Malaysia and the Philippines, and asked the reseller to pause all sales and shipments. Bitquery's reconstruction traced about $93.2M drained from 315 wallets across six networks - TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana - with TRON bearing roughly $70.5M (about 76% of the total, mostly USDT), Bitcoin $16.8M (203.8 BTC) and Ethereum $3.7M. Tether froze $10M in USDT across 20 linked wallets; attackers routed funds through Tornado Cash while swapping stablecoins to evade further freezes. Ledger said its own systems, infrastructure and direct sales channels were not compromised.

My take: The week's biggest transfer-security story is not a smart-contract bug or an exchange key leak - it is the retail channel. TRON tops the loss table for an unflattering reason: it is where Southeast Asian users actually keep and move USDT, so devices compromised at purchase drained TRON balances first. The security perimeter for stablecoin transfers now extends to the box the signing device shipped in.

2. The Implant: Karpeles's Teardown, CZ's Assessment and Ledger's Confirmation

Event date: October 8 - 10, 2026

Source: Mark Karpeles on X, October 8; CZ on X, October 9; Ledger confirmation, October 10; BigGo Finance synthesis, October 10.

Summary: The tampered-hardware theory gained physical evidence. Mark Karpeles disclosed a Ledger device bought in Malaysia with intact shrink wrap that contained a concealed implant: an LTE module with a data eSIM and a microcontroller able to recognize the Ledger font on the 128x64 display, spot the setup screen and transmit the recovery phrase as text over LTE - all while passing Ledger's Genuine Check, because the implant only listens when the screen refreshes. CZ assessed the case as appearing localized to a supply chain attack with one vendor. On October 10, Ledger confirmed that one device linked to CryptoBilis contained an unauthorized hardware implant, described the number of impacted devices as limited, and advised buyers from the past 90 days not to initialize unopened units and active users to migrate assets to a new device with a freshly generated seed. A wallet-level reconstruction found more than eight in ten victim wallets were first funded from June onward, suggesting the exposure window may reach back about four months.

My take: Genuine Check verifies firmware and the originality of the secure element - it cannot see an added component that only listens during screen refreshes. Three hypotheses remain open (counterfeit units, physical tampering, pre-seeded recovery phrases), and Ledger has confirmed the implant in one device without yet saying it explains every theft. Until the forensic report lands, treat purchase channel - not device brand - as the control that matters.

3. 79thVault's Hot Wallet Drains $12.5M on BNB Chain

Event date: October 7, 2026 (on-chain drain; disclosed October 8)

Source: Defimon Alerts monitoring flash, October 8; CertiK incident note.

Summary: A hot wallet operated by 79thVault, issuer of the gold-linked 79AU token on BNB Chain, lost about $12.5M in a suspected private-key compromise. Seven transfers pulled 2.01M 79AU from the trading pool in escalating clips, roughly 95 subsequent swaps drained the pool's USDT reserve from $15.2M to $3.9M, and the attacker cashed out 16,249 BNB. The wallet was normally used only for small transfers to the rewards pool.

My take: The operating pattern - a treasury-operations wallet doing one job - is exactly what makes hot-key compromises so expensive: the key's permissions are broader than its routine. For issuers, the fix is boring and known: scope the hot wallet to the transfer it exists to make, and keep the rest cold.

4. A Quiet DeFi Week: Keeper Bots and Rounding Errors

Event date: October 6 - 7, 2026

Source: DefiLlama incident database prints.

Summary: DefiLlama's incident database logged three small DeFi exploits in the window: a MakerDAO ETH-A liquidation keeper-bot exploit of roughly $538K through improper access control (October 6), a $22K rounding-error exploit on Set Protocol (October 6), and an $18K exploit on Arbitrum's Locus Finance (October 7). None reached systemic scale, and none involved the week's dominant loss vector.

My take: The contrast with the hardware story is the point: on-chain protocol losses stayed in the six figures while off-chain compromise of the signing layer produced a nine-figure week. The DeFi exploit era has not ended - it has just stopped being where the money is.

Stablecoins and Payments: USDC Goes to the Phone, TRON Goes to the Stack

5. Coinbase and Samsung Bring USDC to Samsung Wallet for 82 Million Users

Event date: October 7, 2026

Source: Samsung Electronics America newsroom statement, October 7; Coinbase blog post by Alec Lovett, October 7; The Block reporting, October 7.

Summary: Coinbase and Samsung announced that USDC is coming to Samsung Wallet for more than 82 million eligible US Galaxy users, with rollout beginning the last week of October. USDC becomes the first stablecoin natively supported in the wallet: transfers to compatible external wallets run over Solana and Sui infrastructure, payouts reach bank accounts in more than 60 countries with recipients receiving local currency, and Samsung charges no fee on external wallet transfers. Coinbase Prime, working with licensed stablecoin custodian Bastion, holds the wallet's USDC, and users can pick a recipient inside the wallet rather than typing addresses.

My take: A week after Open USD put stablecoins behind the checkout, the phone OEM channel opens. The distribution race is now: card networks, commerce platforms, and the default wallet on 82 million handsets. What none of them changed is the on-chain hop - every one of these products still settles on the same energy and gas markets this site tracks.

6. Circle and Tereina Embed USDC and EURC in SAP Enterprise Payments

Event date: October 7, 2026

Source: Circle and Tereina announcement, October 7; CryptosEyes research note, October 8.

Summary: Circle and Tereina announced an integration bringing USDC and EURC into Tereina's payments infrastructure starting with SAP Cloud ERP through SAP Pay - USDC as the preferred token for dollar-denominated workflows, EURC for euro. Circle claims the SAP ecosystem generates 84% of global commerce; Tereina claims up to 25% payment-cost reduction. The integration runs over Circle's Arc blockchain, whose stablecoin-payments mainnet launched recently. No participating customers, volumes or full commercial deployment dates were disclosed.

My take: The enterprise-ERP route is the slowest-burning but stickiest distribution channel: once treasury workflows settle on a rail, the switching cost is organizational, not technical. The 84% and 25% figures are the companies' own claims, not measurements - but the direction needs no embellishment.

7. Polygon's Open Money Stack Adds TRON, Connecting Bank Money to the Biggest USDT Network

Event date: October 7, 2026

Source: Polygon Labs announcement via TRON DAO, October 7.

Summary: Polygon Labs announced that its Open Money Stack now supports TRON, giving fintechs, remittance providers and payment platforms one integration for regulated dollar access (fiat ramps across 48 US states via money-transmitter licenses), programmable TRON wallets, and single-flow routing of USDT between TRON and EVM networks. Polygon cited TRON's more than $94B in circulating USDT and over $30T in cumulative transfer volume, and said its own rails have processed more than $3T in payments volume as of September 21. Polygon CEO Marc Boiron called TRON one of the deepest USDT liquidity pools; Justin Sun framed it as bridging on-chain liquidity with traditional financial rails.

My take: For TRON this is a distribution deal, not a protocol change: the chain's USDT economy gets a regulated on-ramp pipe into US banking rails without TRON changing anything. The fee table does not move - but the population that can fund a TRON wallet from a bank account just got bigger.

8. Tether Signs a Nonbinding Tenge Stablecoin MoU in Kazakhstan

Event date: October 7, 2026

Source: Tether, National Bank of Kazakhstan and Alatau City Authority announcements; DigitalWaehrung digest, October 8.

Summary: Tether signed a nonbinding memorandum with Kazakhstan's National Bank and the Alatau City Authority to study a tenge-pegged stablecoin, covering issuance models, reserve structures and tokenization, plus an Alatau City pilot using Tether's Hadron platform and workshops on issuance and reserve management. No issuer, blockchain, launch date or reserve assets were confirmed.

My take: Sovereign-adjacent stablecoin exploration keeps widening beyond the dollar - Kazakhstan follows earlier central-bank conversations elsewhere, and a tenge token would be a remittance-corridor instrument more than a reserve asset. Nonbinding means everything; the pilot geography (a purpose-built crypto city) tells you the audience.

9. OSL's Six-Currency Stablecoin Exit: Fresh Detail on a September Expansion

Event date: October 9, 2026 (executive interview; expansion first announced September 15)

Source: OSL and Banking Circle joint announcement, September 15; TechNode Global interview with OSL's Siwei Gong, October 9.

Summary: A date note first: the six-currency expansion itself was announced on September 15, when OSL said Banking Circle's rails now cover Australian dollars, euros, British pounds, Hong Kong dollars, Singapore dollars and US dollars. What landed in this window is the October 9 executive interview, in which OSL's global head of financial-institution partnerships said the corridor has moved past pilots into recurring cross-border B2B and corporate-treasury volume, combining OSL's licensed digital-asset conversion with Banking Circle's multi-currency banking access, compliance screening, liquidity and reconciliation, settling 365 days a year.

My take: The institutional exit leg is quietly maturing: issuance gets the headlines, but multi-currency same-day fiat exit is what lets a treasury actually hold a stablecoin position. Six currencies across Asian and European banking hours is a real coverage map - and the honest framing is that this is a September buildout whose operating detail surfaced this week, not a new deal.

10. Visa Frames Stablecoins as Operational Settlement at $20B a Year

Event date: October 8, 2026 (reporting)

Source: DigitalWaehrung digest, October 8.

Summary: Visa has disclosed that its stablecoin settlement activity has passed a $20B annualized run rate - the company's own framing, first disclosed in September and repeated in an October 1 business-payments update - and reporting this week linked the capability to enterprise and consumer use cases, including the SAP Pay integration and an extended OpenTable dining partnership, framing stablecoins as an operational layer for corporate treasury, invoice payments and everyday spending rather than a standalone crypto product. Analysts quoted in the digest noted adoption still depends on regulatory clarity and consumer acceptance, and that competing account-to-account rails could cap the fee opportunity.

My take: $20B a year is small against Visa's settlement totals, but the framing matters more than the number: the card network is treating stablecoin settlement as plumbing to attach to existing products, not a business to build separately. That is how adoption actually compounds.

Regulation and Policy: A Retail Framework, a Withdrawal, a Tax Update and a Deadline

11. The CFTC Opens Its Retail Crypto-Asset Framework for Comment

Event date: October 5, 2026

Source: CFTC advance notice of proposed rulemaking; Lowenstein Sandler Crypto Brief, October 8; Chinese-language press summaries, October 7.

Summary: The CFTC issued an advance notice of proposed rulemaking covering leveraged, margined or financed retail transactions in crypto assets, previewing two regulations: Regulation Crypto Asset Transactions (CTX), setting out when such transactions fall under Commodity Exchange Act section 2(c)(2)(D), and Regulation Crypto Asset Markets (CAM), a new designated-contract-market registration subcategory for exchanges listing only covered crypto transactions. Chairman Michael Selig framed the action as keeping America the world's crypto capital, and the ANPRM explicitly positions the CFTC's work as a complement to the SEC's Regulation Crypto Assets proposal released August 18.

My take: After the Clarity Act stalled in the Senate, the CFTC is building the market-structure layer from existing authority. For transfer platforms the consequential part is the registration subcategory: a bespoke CAM license is a cheaper path to a US retail venue than a full DCM, and venues will reorganize around whichever definition finalizes.

12. ESMA Gives EU Firms a January 8, 2027 Exit Deadline on Non-Compliant Stablecoins

Event date: October 8, 2026

Source: ESMA opinion; Lowenstein Sandler Crypto Brief, October 8; DigitalWaehrung digest, October 9.

Summary: ESMA published an opinion clarifying that MiCA-authorized crypto-asset service providers must stop letting EU clients acquire or increase exposure to non-compliant stablecoins - including unauthorized asset-referenced tokens and e-money tokens - and must implement technical, contractual and organizational controls covering trading, custody, transfers, advice and portfolio management. Existing positions must be resolved within three months of the opinion, by January 8, 2027, though national regulators may permit temporary, supervised services for orderly exits such as liquidation, conversion, withdrawal or safekeeping. No tokens are named in the opinion itself; reporting cited USDT and PYUSD as unauthorized while USDC holds a French MiCA license.

My take: This is the first hard calendar any regulator has put on non-compliant stablecoin exposure. The practical effect lands in venue listings and EU-user flows well before January - expect EEA-fronting platforms to restrict new USDT positions regionally while the token's global supply barely notices.

13. FinCEN Withdraws Its Proposed Crypto Mixing Rule

Event date: October 6, 2026

Source: FinCEN notice; Lowenstein Sandler Crypto Brief, October 8.

Summary: FinCEN issued a notice withdrawing its finding that international convertible-virtual-currency mixing is a class of transactions of primary money laundering concern under section 311 of the USA PATRIOT Act - the 2023 proposal would have required covered institutions to report transactions they suspected involved mixing outside the United States, capturing amounts, wallet addresses, transaction hashes and IP addresses. FinCEN said commenters' concerns informed the decision: the broad definition could chill legitimate activity and place heavy reporting burdens on financial institutions.

My take: A withdrawal is not a pardon - OFAC designations and enforcement still reach mixers, as this same week's A7-network actions showed. What changes is the reporting perimeter for ordinary institutions. For tracing work, the attacker in this week's Ledger drain used Tornado Cash anyway; the surveillance question and the laundering question are only partly the same question.

14. Treasury and the IRS Update the Staking Safe Harbor for ETP Trusts

Event date: October 6, 2026

Source: Treasury and IRS revenue procedure; Lowenstein Sandler Crypto Brief, October 8.

Summary: Treasury and the IRS issued a revenue procedure clarifying, modifying and superseding the prior safe harbor for trusts qualifying as investment trusts and grantor trusts in connection with digital-asset staking. The update responds to industry requests on which proof-of-stake protocols are covered, the use of multiple custodians, required slashing protection, unstaking ahead of distributions, consistent staking-reward treatment and digital-asset borrowings. Qualifying trusts must trade on a national securities exchange, disclose staking in an effective SEC registration statement, hold only cash and a single proof-of-stake asset, and stake through unrelated providers on arm's-length terms.

My take: This is a direct input for the staked-ETF wrapper genre - TRON's TRXS included. Cleaner tax mechanics lower the operational cost of running a staking program inside a fund, which makes the passive staked-TRX demand leg we flagged last week slightly more durable.

15. The SEC Custody Proposal Reaches the Federal Register

Event date: October 6, 2026 (proposal announced October 2)

Source: Federal Register, 91 FR 63870, October 6; SEC release documents via Deloitte DART, October 2.

Summary: The SEC's proposed custody framework for registered investment advisers and regulated funds - announced October 2 - was published in the Federal Register on October 6, starting the comment clock on how qualified custodians must hold digital assets, including stablecoin positions managed for clients. (A date note on our own coverage: our September 28 - October 4 review dated the announcement October 1; the release documents say October 2.)

My take: Custody remains the quiet constraint under every institutional stablecoin product launched this quarter - Open USD's Bridge charter, the Samsung Wallet custody stack, and the ERP integrations all route through arrangements this proposal would govern. The comment period is where the on-chain attestation question gets settled.

Markets and Flows: The Worst ETF Week Since June

16. Crypto ETFs Shed $1.29B in Their Worst Week Since Late June

Event date: October 5 - 9, 2026 (trading week)

Source: Farside Investors daily tables via Bitcoin Mastery, CoinCentral and BitcoinInsider, October 9 - 11.

Summary: US spot Bitcoin ETFs posted their worst week since late June: -$678.9M across five sessions (-$89.8M Monday, +$118.8M Tuesday, -$484.9M Wednesday, -$244.1M Thursday, +$21.1M Friday), with Wednesday's -$484.9M the largest single-day outflow since June 25. Fidelity's FBTC lost the most of any fund ($380.3M for the week) and ARK 21Shares followed (-$207.2M), while BlackRock's IBIT finished the week slightly positive at +$1.1M. Ether ETFs lost $542.2M for the week, extending their streak to nine straight sessions (-$697.4M since September 29, the sum of the daily Farside prints); Wednesday alone took -$160.9M, and ETHA's 1-for-3 reverse share split took effect October 6, the Tuesday when ETHA's $201.9M outflow accounted for the entire category total. Solana funds shed about $25M - their first negative week, ending a 14-week inflow streak - with ZEC funds at -$30.8M and Hyperliquid funds at -$9.4M, for roughly $1.29B of combined weekly outflows.

My take: The composition inside the Bitcoin column is the real signal: one issuer stayed in inflows all week while another bled $380M, so the weekly total is a redistribution story, not a uniform exit. Friday's +$21.1M bounce offsets about 3% of the two-day drawdown - a pause, not a reversal.

17. Bitcoin Slides Below $83,000 as $487M of Longs Liquidate

Event date: October 7 - 9, 2026

Source: CoinMarketCap market reporting, October 9 - 10; Coinbase prints via BitcoinInsider, October 10.

Summary: Bitcoin slid below $84,000 on October 7, printing a $82,776 intraday low, as long liquidations hit $487M and broke a four-week consolidation; it bottomed near $81,700 on our 00:00 UTC series before stabilizing near $82,900 over the weekend. On our 00:00 UTC closing series the week ran $84,743 to $82,918, about -2.2%, with Ethereum's $2,687-to-$2,504 slide (-6.8%) the deeper move. The sell-off produced no visible congestion on any major chain.

My take: The macro reattachment cuts both ways, exactly as flagged here two weeks ago: the same channel that made a weak jobs number bullish transmitted an oil-and-yields tape into a $487M liquidation cascade. The fee floors absorbed all of it - block-space demand, not price, sets the cost of moving money.

18. Chainalysis: Chinese P2P Stablecoin Wallets Up 43-Fold, Korea Leads East Asia

Event date: October 9, 2026

Source: Chainalysis 2026 Geography of Cryptocurrency reporting via DigitalWaehrung, October 9.

Summary: Chainalysis reported that the number of unique Chinese wallets sending peer-to-peer stablecoin transactions increased 43-fold, recording $104.1B in transfers, and valued China's crypto economy at at least $176B despite domestic exchange-activity constraints. South Korea remained East Asia's largest crypto economy at $449.1B even as exchange operating profits fell 78%, and the report noted Securitize's partnership with LG CNS for Korean tokenized assets.

My take: The 43-fold P2P figure is the stablecoin story in one number: where direct on-ramps are closed, transfer volume moves to wallet-to-wallet rails - which is precisely the corridor where TRON's USDT float is the settlement layer. Compliance posture, not technology, decides which venues capture it.

Infrastructure and Data: Two Testnets and a Quantum Testbed

19. Testnet Week: Glamsterdam Live on Sepolia, Solana's 200ms Final Step

Event date: October 6 and October 9, 2026

Source: Ethereum client team activation reports; CoinDesk, October 9.

Summary: Ethereum's Glamsterdam upgrade activated on the Sepolia testnet on October 6, giving block-processing and gas-accounting changes their first live-traffic test with mainnet timing still unscheduled. Solana moved to the final step of its staged block-time reduction: the 200-millisecond target is scheduled at epoch 1053 on Friday, October 9, after recent epochs averaged 266-269ms against the prior 250ms step, and the same SIMD-0525 proposal caps compute per block at 30M units, down from 37.5M - blocks arrive more often without raising theoretical capacity. Validators face more frequent voting and a shorter window for offline signatures.

My take: These are the only two protocol paths that can move a fee table we track: Ethereum's gas accounting and Solana's slot cadence. Neither touches the current numbers - but Glamsterdam's Sepolia run is the first testable step toward the first mainnet cost change in months, and Solana's slot cadence is a throughput bet that matters for payment-adjacent flow.

20. TRON's Post-Quantum Push: Nile Testnet Live Since July, Mainnet Awaiting Governance

Event date: October 10, 2026 (Sun's X post; Nile activation July 2)

Source: Cointelegraph, October 10; Crypto Briefing, October 10; TRON core-developer Nile build documentation (GreatVoyage-v4.8.2-PQ1-build1, Committee Proposal No. 20628).

Summary: Justin Sun said on October 10 that TRON is ready to bring quantum resistance to mainnet at any time - the week's framing of a capability that has actually been live on the Nile testnet since July 2, activated through Committee Proposal No. 20628 and the GreatVoyage-v4.8.2-PQ1-build1 release. The testnet build carries two NIST-derived signature schemes: FN-DSA-512 (Falcon-512, the default) and ML-DSA-44 (Dilithium), covering transaction signing, block production, node handshakes and TVM smart-contract verification. Mainnet activation still requires separate governance approval, and TRON's own mainnet target has slipped from Q3 to the end of 2026. The post-quantum schemes also carry real trade-offs: Falcon signatures run to roughly 667 bytes versus 64 for today's ECDSA, and testnet wallets using them cannot yet use gas-free transfers, seed-phrase recovery or Ledger devices. Context metrics in TRON's October reporting: more than $94B in circulating USDT, over 407M accounts and roughly $28B TVL.

My take: A quantum-safe migration path is cheap insurance for a chain whose value proposition is holding $94B of dollar tokens for decades. The honest caveat: testnet activation is a claim about code, governance approval and mainnet migration - including wallet compatibility - are the actual milestones, and neither has a date.

What I'm Watching Next Week

• Ledger's forensic findings: whether the implant explains all 315 wallets, the final loss tally, and how much of Tether's $10M freeze converts into recoveries.
• Samsung Wallet's USDC rollout in the last week of October - the first phone-OEM stablecoin integration at scale, and the first Solana-and-Sui-backed one.
• Solana's epoch 1053 confirmation - whether the 200ms slot target holds on mainnet after the 250ms step ran 266-269ms.
• The CFTC comment clock on Regulation CTX/CAM, and the first venue signals about the CAM registration subcategory.
• Open USD's first measurable supply print in the issuer tables, two weeks after launch.
• Whether USDC's slide extends - a third consecutive weekly decline would make October the issuer's deepest two-week loss in our series.

Glossary