Securitize, the NYSE-listed tokenization platform behind BlackRock's BUIDL fund, has signed a definitive agreement to acquire River One, a New York startup that builds warehouse financing for loan originators. Terms were not disclosed.

River One was founded in 2025 and incubated by Framework Ventures, with backing from Framework and Maple Finance. Its platform handles AI-based underwriting, facility setup, collateral monitoring and funding operations, and is built to connect stablecoin capital with traditional lending markets.

The deal moves Securitize, which held about $5B in tokenized AUM as of September, from issuing and servicing tokenized assets into asset-backed lending, a $6T private market that KKR expects to reach $9.2T by 2029.

The acquisition is expected to close in Q4 2026, subject to customary conditions.

Bitcoin's price did most of the work this quarter: MARA's Q3 2026 results include an $885.3M gain on the fair value of digital assets, lifting net income to $632.1M from $123.1M a year earlier while revenue fell 35% to $164.2M.

After the quarter closed, the miner sold 13,597 BTC at around $81,039 for roughly $1.1B. It used $750M to fully repay its bitcoin-collateralized term loans, which returned 17,477 BTC that had been pledged as collateral.

MARA held 34,012 BTC at the end of Q3 and has cut total debt by $1.4B (37%) since the start of the year.

The board also approved a buyback of up to $500M. The company says the remaining proceeds give it room for AI and HPC infrastructure and for puts on convertible notes that become exercisable next year, and that the move is not a pivot away from bitcoin.

Everything that moved crypto in the last 3 days, in one card.

Headliners: FinCEN, Charles Schwab, US Labor Dept, CFTC, Sen. Blumenthal, Coinbase, Binance, Solana, Aave Labs, Telegram

A threat actor used Ethersphere's own GitHub release automation to publish a malicious bee-js 13.3.0 to npm and a trojanized Swarm Desktop 0.56.2. Both builds carry a loader that pulls remote code built to steal the wallet key a Swarm Desktop node keeps, together with the stored password that unlocks it, and to install a backdoor.

The npm package shipped through Ethersphere's legitimate trusted-publishing workflow with valid provenance, and npm removed it about 75 minutes after publication. The Swarm Desktop release stayed up for roughly eight and a half hours: the macOS build was signed and notarized, and the app's auto-updater offered it to Apple Silicon and Windows x64 users.

The later stages read their command server address from an Ethereum contract tied to the earlier SleepyDuck / EtherDuck campaign on Open VSX.

bee-js is the JavaScript client for Bee, the node software of the Swarm decentralized storage network, and averaged about 470 npm downloads a day in early November. Users who installed either version should remove it and rotate their node wallet keys.

An unsealed search warrant shows a former senior Binance financial crime investigator told the IRS in May that company management ignored internal calls to examine accounts suspected of being used by people in Iran.

The case covers about 2,000 accounts with roughly $1.2B in fund flows.

The investigator was suspended along with several colleagues after probing two accounts suspected of sending funds to Iran in breach of US sanctions, and later left the company. He has since been subpoenaed to testify before a federal grand jury in Washington, D.C.

Binance denies violating Iran sanctions and says the investigators were fired for breaching its data privacy policies, that the account review was never closed and that it will cooperate with law enforcement. No charges have been filed in the investigation so far.

Cupsey, a former Fortnite player who became one of the best-known Solana memecoin traders in 2024-2025, is at the center of an on-chain investigation by Bubblemaps. The analytics firm found 30 wallets connected to his public pump.fun wallets that have traded more than 27,000 tokens since May 7, routing about 3,000 of them through a side-wallet scheme.

The pattern described is consistent: four operational wallets buy and distribute tokens to 12 side wallets, Cupsey's public wallet buys, copy traders follow, and the side wallets start selling, often right after his public buy and while callouts were being posted.

The side-wallet operation reportedly made $1.74M across roughly 3,000 tokens, on top of $331K Cupsey earned in callout rewards.

Bubblemaps also links Cupsey on-chain to serial deployer 3z4vj, which launched and rugged thousands of tokens including $CUPSEY and booked $1.3M in trading profits. Cupsey's side wallets sniped more than 400 of those launches. The findings are allegations based on wallet clustering, and Cupsey has not publicly responded in the thread.

Ethereum treasury firm Sharplink (Nasdaq: SBET) has released its third quarter 2026 results, showing a sharp jump in profit compared with the $104.3M it earned a year earlier.

Net income reached $751.4M, or $3.45 per diluted share, with $676.7M coming from unrealized gains on crypto assets and $75.2M from realized gains.

Revenue rose 24% to $13.5M, almost entirely from staking ($13.1M), while SG&A fell 8% to $11.0M. The company held about 892,708 ETH at the end of September and 895,117 ETH as of November 2, after staking $200M of ETH through Lido and starting deployments via the Galaxy Sharplink Onchain Yield Fund.

Unrealized gains reflect ETH price moves rather than cash or extra tokens, so the headline profit can reverse in a weaker quarter. Cash stood at $47.9M.

In February the Ethereum Foundation circulated a draft of its new mandate to staff, including a "Source Seppuku License" pledge to take one's own life upon breaking its terms. A lawsuit filed by former Protocol Support lead Kayleen Fulton against Stiftung Ethereum, Vitalik Buterin and others claims she was fired after disclosing a cancer diagnosis and organizing opposition to that clause.

The complaint says 79 employees voted to remove the section and Buterin allegedly promised "significant changes". The published mandate kept the clause, and the EF recorded it permanently on the Ethereum blockchain.

Fulton and colleague Trent Van Epps sent the EF board a letter signed by 53 Protocol cluster members who declined to affirm the mandate under coercion, after Co-Executive Director Bastian Aue said staff who did not commit would be treated as having resigned.

Fulton's employment was terminated after the letter. The EF did not immediately respond to a request for comment.

This week's six have Solana Labs, Paradigm, Coinbase Ventures, YZi Labs, Jane Street and dao5 money behind them. All open right now:

• Leap: Trading App · Solana Labs' new app, early access in waves

• Vana: AI Data · free XP, weekly rewards Store

• ZetaChain × Kaito: Creator Campaign · ZETA moves to Solana, Phase 1 until Nov 20

• 42: Prediction Markets · weekly points, AI agents next

• Hermes by Nous: AI Agent · mobile beta waitlist, $20K hackathon ends Nov 11

• Spicenet: Points Campaign · 3 swaps of $5+, ends Nov 11

Full step-by-step breakdown for each 👇

cryptodiffer.com/feed/project-updates/we-filtered-the-noise-6-crypto-activities-worth-your-time-step-by-step-nov-9

Not financial advice.

The laundering of the $6.4B Binance theft has picked up a new layer: throwaway meme tokens created solely to move stolen funds through DEX liquidity pools. The technique has appeared on Tron and NEAR, with a close variant on Solana, and was first seen in the laundering of the 2025 Bybit hack.

Between November 5 and 7, the launderers created at least six tokens on NEAR, including FUK, SINU and one branded "Elon 2028 President", each paired with NEAR in its own pool. One set of wallets bought the tokens with stolen NEAR, a second set sold them back and withdrew the real asset, so funds never moved directly between the two.

About 117,000 NEAR (around $430,000) passed through the six tokens, while roughly 11.8M NEAR ($43.7M) from the theft has not moved yet.

Each token cost about $90 to create, was traded only by wallets in the laundering network and was abandoned within days. The trail remains visible on-chain, but every extra hop slows investigators, and funds arriving from a liquidity pool can sit just two swaps away from stolen assets.