Fifteen of this autumn's new tokens carry about $2.99B in combined fully diluted value. MarsCat leads at $626M, ahead of Quantus ($456M) and FastX ($357M).

Ritual, trading since Oct 28, enters at $231M. The bottom five all sit under $90M, with Canopy ($48M) and LAPTOP ($45M) closing the list.

An automated LLM scan run under Project Loupe, a tool built by Elias Rohrer at Spiral, surfaced the bugs. Bitcoin Core developer Gregory Sanders validated the findings, and the team published the disclosure of the most serious issue on October 28.

The main flaw, rated medium severity, lets a malicious peer send TCP urgent data to bypass per-peer read limits and queue unbounded data. In practice, it can trivially crash any Windows, macOS or BSD node it is connected to. Linux nodes use a different socket backend and are not affected.

The other two issues are a medium-severity slow memory leak tied to paused pre-BIP31 peers and a low-severity undo file overflow that requires impractical reorg conditions. Fixes shipped in versions 29.5, 30.4, 31.2 and 32.1, and no CVE numbers were assigned.

The gap was tight: the scan flagged the main bug on October 23, and a patched release was out four days later.

A key-generation error at Indian certificate authority eMudhra left eight of its intermediate certificates with recoverable private keys, and two Ethereum clients have now shipped fixes. The intermediates were revoked on Oct. 18, but Java does not check revocation by default, so Java-based nodes kept trusting them.

Teku 26.10.3 and Besu 26.10.2 stop their Docker images from trusting four affected certificate roots. Operators running binary installs must check and fix their own Java runtime separately, since updating the client alone does not change it.

On an unpatched setup, an attacker who intercepts an HTTPS connection could impersonate a remote beacon node and redirect validator proposal fees, or cause missed duties.

Default mainnet nodes without HTTPS endpoints or TLS options are not affected, and both teams say no exploitation has been reported. Besu flags nodes that accept CA-signed RPC clients as the highest-risk case, as they can be accessed with no interception at all.

BNB Smart Chain has moved its next protocol upgrade to the Chapel testnet, with the Jenner hard fork bundling three BEPs aimed at payments, compliant assets and contract timing. Mainnet activation is planned for late November 2026.

BEP-703 reserves a governable 5% of every block's gas as a Payment Lane for bare BNB transfers and governance-listed payment contracts.

The lane is meant to keep payments includable even when general traffic congests the network. BEP-702 adds CAS20, a protocol-native token standard for stablecoins and tokenized real-world assets with built-in allow/blocklists, pause, mint, burn and seizure roles. BEP-706 exposes millisecond-precision block timestamps to smart contracts.

All BSC nodes must upgrade to the hard fork release before activation on each network, and the exact mainnet time is still to be announced.

The onchain data platform, which counts Visa, KPMG, Coinbase and more than 30 of the Fortune Crypto 100 among its users, confirmed unauthorized access to certain internal systems after detecting the incident on October 25.

Allium restricted access, notified affected customers directly and brought in an independent cybersecurity firm to investigate. The company has not disclosed which systems were reached or what data, if any, was exposed.

The core platform, including the Allium App, Explorer and Explorer APIs, is back online, while some features remain unavailable as recovery continues.

Allium plans to publish a summary of its findings after the investigation and says it is strengthening authentication and monitoring controls. Teams relying on its APIs for dashboards and reporting may face gaps until full service returns.

P2P crypto platform Peer opened a beta that lets users buy and sell USDC for Chinese yuan via Alipay. Buyers pay sellers in CNY through Alipay, while the USDC sits in an onchain escrow contract and is released once the payment is verified.

Peer said 45 buyers have completed 107 such orders since August 21, with a combined volume of about $7,094.

Alipay responded that it does not support virtual currency trading or related services. It called third-party claims of Alipay support for crypto purchases false and unauthorized, and warned users to protect their funds and accounts.

China keeps a ban on crypto trading, so the dispute puts the P2P fiat on-ramp model under direct pressure from the country's largest payment app.

The state's attorney general built the case on an undercover account: an investigator posing as a Utah resident placed a dozen sports bets on Kalshi over 11 days in September, on NFL, MLB and local college games.

Kalshi and co-founders Tarek Mansour and Luana Lopes Lara face one second-degree felony count of pattern of unlawful activity, 12 third-degree felony counts of online gambling promotion and one misdemeanor. A parallel civil suit claims Kalshi earned between $30.5M and $61.1M from Utah accounts since February.

Utah is the second state to criminally charge a CFTC-registered prediction market, after Arizona in March.

On the same day, the CFTC sued Utah, arguing federal law gives it exclusive jurisdiction over event contracts and preempts state gambling bans. Kalshi called the charges political overreach; a federal judge had already blocked Arizona's prosecution, which the state is appealing.

Nasdaq-listed Datavault AI has been trying since June to move its Bitcoin off the Biconomy exchange, and the company now says it has been unable to complete the withdrawal. The Form 8-K filed on Oct. 26 does not explain what is holding it up. Shares fell 49.55% to $0.067 on Oct. 27.

The coins came from a September 2025 deal in which Scilex Holding paid $150 million in Bitcoin for Datavault stock. Scilex credited 1,309.04 BTC to Datavault's Biconomy account through off-chain balance changes, and Datavault later sold 491.431 BTC back to Scilex for about $40.5 million in cash.

Datavault will restate four financial reports, cutting reported total assets by up to $92.2 million.

The company concluded the Bitcoin never qualified as its own digital asset and will book it as a subscription receivable instead. Because it had counted the BTC as a source of liquidity, management is reassessing its going-concern status and says collection of the amounts Scilex owes is uncertain.

Everything that moved crypto today, in one card.

Today's headliners: DTCC, Google, Ripple, Itaú, CFTC, Robinhood, Pump.fun, Predict.fun, Bithumb, Strategy

After a quiet web rollout in mid-October, the Solana memecoin launchpad has officially switched on perpetual futures in the Pumpfun app, with trading routed to Hyperliquid's order books.

Users can long or short 300+ Hyperliquid markets across crypto, stocks and commodities, funded straight from their USDC balance with no bridging.

The integration runs through Hyperliquid's builder codes: HyperCore handles matching, margin, funding and liquidations, while Pump.fun keeps the user and a share of fees. Early reports put max leverage at 40x on BTC and 25x on ETH, and the product is unavailable in the U.S. and Ontario.

The launch pairs perps with Pump.fun's social layer, letting traders call out positions for rewards. It also turns a recent rival into a partner: Pump.fun briefly out-earned Hyperliquid on weekly revenue in late September.