BNB Chain's new L1 won't issue a token of its own. BNB is bridged from BSC to pay for gas, and staking it mints non-transferable govBNB for voting.

"Multiple chains, one coins." CZ

The chain, first announced in July, is built for trading and AI agents: 200 ms blocks vs 450 ms on BSC and finality under a second.

Pre-confirmations now take about 20 ms, down from the sub-50 ms target set in July. Passkey accounts, gas sponsorship and an opt-in shielded pool that hides sender, recipient and amount are built in, and existing Solidity contracts run unchanged.

A devnet is live. Public testnet is targeted for the end of 2026 and mainnet for early 2027, and the chain still has no name.

Partner Offers | Get Your Instant BTC Cashback | Your Gateway To Crypto | Arcus Private Whitelist

Updated BNB Chain documentation from October 22 describes a high-performance EVM-compatible network provisionally called NewL1, built alongside BSC for latency-sensitive use cases such as high-frequency trading and AI agents.

The targets: 200ms blocks, pre-confirmations in about 20ms, sub-second finality and over 100,000 TPS.

The chain will run an enhanced version of Parlia consensus with parallel execution and plans native account abstraction plus a shielded privacy pool. There is no separate token: CZ affirmed that BNB stays the only asset for gas, staking and governance across BSC and NewL1.

NewL1 currently runs as an internal multi-validator devnet. A public testnet is expected by late 2026, with mainnet projected for early 2027, so the performance numbers remain unproven outside a controlled environment.

Electrum, one of Bitcoin's oldest software wallets, relies on outside servers to fetch transaction histories and broadcast payments. Its developers disclosed a vulnerability on Saturday that some of those servers were already exploiting.

Before the fix, the wallet did not check signatures on pending transactions reported by servers. A malicious server could swap a user's payment for a fake one sending coins to an attacker, and when the user tried to speed it up with Replace-by-Fee, Electrum signed a valid replacement paying the attacker. Spoofed addresses matched the last four characters of the real destination.

Developers received two reports in October, and at least one user confirmed losing funds after raising the fee on a substituted transaction.

Version 4.8.3, released on Oct. 24, adds signature checks for unconfirmed transactions spending the user's own coins. Earlier versions remain vulnerable when connected to malicious servers, while users running only trusted servers, including their own, were not exposed.

Users of Bitcoin hardware wallet maker Foundation received spam emails that appeared to come from the company's official domains. The team traced the incident to one or more compromised Cloudflare API keys and has already revoked all of them.

The malicious domain linked in the emails has been taken down. Foundation says Passport hardware is not compromised and funds stored on Passport devices are safe.

The attack hit email infrastructure, not the wallets themselves, but phishing from a trusted domain remains a direct risk for users who follow the links.

The company is still investigating what happened and plans to publish a full incident report.

Tel Aviv-based Pearl Research Labs, the team behind the Pearl proof-of-useful-work L1, has quietly raised $130M without a public announcement. The round reportedly splits into a $55M equity raise and a $75M GPU infrastructure fund, with Lightspeed, Ribbit Capital and Square Peg among the backers.

Pearl miners run matrix multiplications on Nvidia GPUs, the same math behind AI inference, instead of burning energy on hashing. The network went live in April 2026, based on a cryptography paper by CEO Prof. Omri Weinstein (ex-Nvidia) and CTO Prof. Ilan Komargodski.

The PRL token is up roughly 520% over the past three months.

In May, Pearl signed a deal with Together AI, which offers clients a 25% discount on AI jobs run on an open-weights Google model while mining PRL in parallel. The open question is demand: most network activity still comes from sophisticated miners running idle computations purely to earn the token.

India's largest crypto exchange has now disclosed a 15.99M USDT loss tied to deposit wallets it had retired after its July 2025 breach, which cost the exchange $44M. Unusual activity on that legacy infrastructure was detected on October 21.

The automated service that sweeps funds out of old addresses failed for a period of time, so deposits users kept sending to the deprecated Tron addresses piled up and were drained. CoinDCX says it will absorb the full loss, customer funds sit in segregated cold wallets and active trading systems were not affected.

The admission came days after CEO Sumit Gupta called early breach reports "a possible false alarm" on X.

On-chain investigator ZachXBT disputes the retired-wallet explanation, pointing to an affected deposit address that kept sweeping user funds to the exchange's current hot wallet as recently as April and May 2026.

Perp DEX Extended has named its token XTEN and shared the first allocation figures ahead of a launch planned for November 2026. Claiming is not open yet.

300M XTEN, or 30% of the 1B genesis supply, is reserved for eligible participants in the Extended Points programme.

Eligible users will receive the tokens in a self-hosted Arc wallet, with nothing to pay. The XTEN white paper was prepared under MiCA, has been notified to the competent EU authority and is expected on October 31, with full tokenomics to follow.

The team warned users about fake claim sites and direct messages, pointing to extended.exchange, @extendedapp and its Discord as the only official channels.

Everything that moved crypto today, in one card.

Today's headliners: HSBC, MAS, SEC, Wells Fargo, China, Initia, Tether, Ethereum, Chainlink, Plume

Initia, a layer 1 built to connect a network of app-specific rollups, is reportedly dealing with an exploit on its chain. An attacker infinite-minted several tokens and began selling them, with more funds still in flight.

The attacker has cashed out about $2.6M so far.

The root cause and the full list of affected tokens have not been confirmed yet. Infinite-mint bugs dilute holders of the minted assets and can drain liquidity pools that price them, so the final loss could grow while the stolen funds keep moving.

The joint venue from OKX and Intercontinental Exchange, owner of the New York Stock Exchange, filed to launch under the SEC's new innovation exemption. Under that framework, platforms must notify companies before listing tokenized versions of their shares and stop if the issuer objects. Six more companies, including Wells Fargo, Arm and Intuit, have now objected.

OKXICE planned to tokenize 63 stocks. Objections have now reached 22 issuers, about a third of the list.

Earlier objectors include Microsoft, Alphabet and Goldman Sachs, and the count has grown quickly over the past week. The issuer veto has become the main constraint on tokenized equity venues: 24/7 trading and fast settlement only work with a deep bench of liquid large-cap names.