On October 29 the Binance hacker drained the exchange's hot wallets at 20:24 UTC and started a race against the freezes. Stolen USDT can be blocked by Tether at any moment, ETH cannot. So between 20:34 and 20:49 UTC the hacker sold 325M USDT in 9 orders through UniswapX and 1inch Fusion and got 122,316 ETH, at an average of $2,657. Binance was trading near $2,300. The last order went through 8 minutes before the first freeze of the night. Speed cost the hacker about $45M on this one swap.

ETH at $3,487, for one block

At 21:09 UTC, ETH in Uniswap's main ETH/USDT pool hit $3,487 while Binance showed $2,266. In the same block, USDT itself traded at $0.798 against USDC on Uniswap. Part of the spike was USDT breaking down, not ETH flying: in USDC pools ETH peaked around $2,780. Either way, the on-chain premium stayed above 10% for about 45 minutes.

Who got the money

• Block builders and validators: ~7,200 ETH (~$16.5M). That is what they collected in tips in the hour from 20:30 UTC. The same hour a day earlier paid 4.55 ETH. Titan built 191 of the 298 blocks, and a single transaction paid beaverbuild 1,070 ETH (~$2.4M).
• Arbitrage bots. The best one borrowed 11,701 ETH on Aave in 18 loans, sold it on-chain near $2,595 and bought it back near $2,221, clearing about $4.4M. Another wallet pulled 4,175 ETH from Kraken and sold it on-chain 72 seconds later for $11.24M, about $1.8M above the Binance price.
• A 1inch resolver that kept the stolen USDT. Instead of buying ETH on the market, it posted 28.6M of the hacker's USDT as collateral on Compound, borrowed 10,041 ETH and handed the hacker 9,566. The position is still open, worth about $6M, and the stolen USDT is still sitting there.
• The biggest filler, with the smallest cut. A resolver registered on 1inch as Kipseli handled 145M USDT, 45% of the volume. It kept about 149 ETH (~$337K) and paid builders 1,221 ETH, eight times more.

Then came the altcoins

After ETH, the hacker dumped dozens of tokens at a discount, and the bots were waiting. jaredfromsubway sandwiched about 25 of the hacker's 29 ONDO sales. 7M UNI went for an average of $5.69 while Binance showed $6.41. On Tron the attacker swapped 234M USDT into TRX at $0.367 against $0.334 on Binance, another ~$21M given away. Across all legs, our on-chain estimate puts the hacker's total overpayment at about $90M.

Why market makers did not take it all

The trade was open to anyone: buy ETH on a centralized exchange, sell it on-chain for 10% more. The catch was having ETH outside Binance, where withdrawals were frozen, and beating bots that hand most of the spread to builders just to land first. Most fillers bought the hacker's ETH on Uniswap in the same transaction, so the spread leaked to pools, arbitrageurs and block builders.

Every dollar the hacker paid for speed ended up with someone who was faster.

Figures are on-chain estimates against Binance prices in the same minute. Builder tips are paid out of the arbitrage spreads, so the groups overlap. Sources: Ethereum and Tron on-chain data, Binance 1-minute prices, TRM Labs.

Between February 2025 and October 2026, attacks publicly tied to TraderTraitor, the North Korean unit inside Lazarus, took about $8.57B from crypto exchanges and bridges. Binance accounts for 74% of that sum. About 33% of the total is frozen, but almost all of it comes from one case.

Bybit, Feb 2025: $1.46B

A Safe{Wallet} developer's computer was hacked and malicious JavaScript was injected into the interface. Bybit's signers saw a normal-looking transaction and approved the drain of a cold wallet. About 3% was frozen. Within a month 86% of the ETH had been converted to BTC, most of it through THORChain. This is the only attack in the list with formal FBI attribution.

BtcTurk, Aug 2025: $48M

Hot wallets were breached, most likely through a stolen key. There is no data on frozen funds. Part of the stolen ETH later helped fund the Kelp attack.

Kelp DAO, Apr 2026: $292M

The attackers hacked two internal RPC nodes and DDoSed the external ones. The LayerZero bridge relied on a single verifier, which confirmed a fake burn. The Arbitrum Security Council froze about $71-75M (~25%). Around $220M has been laundered through THORChain, Wasabi, Tornado and Umbra.

AFX Trade, Jul 2026: $24.15M

A fake recruiter spent two weeks working with the team. A malicious git config gave the attackers the bridge validator keys. The stolen USDC became 12,467 ETH. Nothing has been recovered.

Bitget, Sep 2026: $387.5M

A zero-day in a third-party security product let the attackers forge withdrawal commands in the wallet system and wipe the logs. Every stablecoin was swapped within 41 minutes, so only $0.84M (0.2%) was frozen. $269M went through THORChain.

Binance, Oct 2026: $6.36B

A DevOps engineer's laptop led to a service container and then to signing access in the hot-wallet system across 10 chains. On Ethereum the attackers used 50 pre-signed EIP-7702 authorizations, after 36 hours of staging and test runs. About $2.7B (42%) is frozen: Tether ~$1.77B, Circle ~$825M, Ripple $40.5M, WLFI $27.8M, Arbitrum ~$30M. Roughly $2.4B in ETH and BTC is out of reach.

What the six have in common

• People, not code. None of the attacks used a smart contract bug. The way in was always a person or a piece of infrastructure.
• Stablecoins are the only thing that gets frozen. Binance's 42% exists because issuers caught about $2.66B in stables in time. Without Binance, about $117M of $2.21B was frozen, roughly 5%.
• THORChain is the exit. Loot from Bybit, Kelp, Bitget and Binance was moved to BTC through it.
• Weeks of preparation. Operator wallets funded through Tornado ahead of time, two weeks of social engineering at AFX, 36 hours of staging at Binance.

How solid is the link

Only Bybit has formal FBI attribution. The rest comes from analysts: TRM Labs, Elliptic and others. So far the link between the hacks rests on on-chain tracing: ZachXBT matched Binance and Bitget funds at one THORChain address. A shared laundering address points to one network, but it is not proof of one team.

Also linked: Phemex (~$85M, January 2025) sits just outside the window. MistTrack traced Binance funds to a wallet the Phemex hacker used before. With Phemex, the total is about $8.66B in 21 months.

Excluded: Drift ($285M, April 2026). TRM ties it to a different North Korean group.

Sums are at the time of each attack. Sources: TRM Labs, ZachXBT, Elliptic, BlockSec, MistTrack.

Nine early-stage projects that hit our radar, real products rather than memecoins. The theme: guardrails. Most crypto horror stories start the same way: a wick liquidates you, a public address shows the world your balance, or money moves that nobody really approved. This week's names are built around exactly those failure points. Options with up to 100x and no liquidations, wallets that give every payment a fresh or encrypted address, AI that can score work but cannot release the money, and agents that watch your positions and wait for your signature. Follower counts are small on purpose, you are seeing these early. With a link to each.

1/ Isometric (Options)

Plenty of leveraged traders are right on direction and still get wiped out by a wick. Isometric sells options that trade like perps: pick a direction, leverage from 5x to 100x and a term of 1, 3, 7 or 30 days. Only the price at settlement counts, so there is no liquidation and no funding. One USDG pool per market takes the other side, and its LPs earn the premiums. Live on Arbitrum's Sepolia testnet since October 20 with a mainnet waitlist, launching on Arbitrum and Robinhood Chain, built by a public team that came from Liquidium.

2/ Treasures (Tokenized Stocks)

The same stock can now exist as several different tokens from different issuers, on different chains, at different prices. Treasures quotes them side by side, six issuers including Ondo, xStocks, Backpack and Coinbase across Solana, Ethereum, Robinhood Chain, Base and Arbitrum, and routes each USDC order to wherever it buys the most shares, for a flat 0.1% fee. It covers 2,000+ tokenized stocks, ETFs and commodities, runs copytrade baskets from Buffett to Citrini, and sells the same routing as an API to apps and AI agents. Eight products are already building on it.

3/ Cloaked (Private Wallets)

Every Ethereum address is a public bank statement. Cloaked is a self-custody wallet where each incoming payment lands at a fresh address, while you still see one balance and share one name, yourname.clkd.eth. Private sends route through Privacy Pools, and you pay gas in the token you are sending. Its browser extension went live on October 21 and connects every app with a fresh address. Live on Ethereum, Base and OP Mainnet, with $1.5M+ moved through it by mid-September.

4/ Alcove (Private Payments)

Stablecoin payments are fast, but every transfer is public. Alcove is a mobile wallet for dollars on Aleo, where USDCx is backed 1:1 by USDC and the sender, receiver and amount are encrypted by default. You can shield USDC in from other chains, and you need neither an ID nor a seed phrase. Live on iPhone and Android, and it supported Circle's Arc from day one.

5/ Signo (DeFi Agents)

DeFi positions do not sleep, and neither does the risk. Signo runs AI agents that watch your positions on Aave, Morpho, Pendle, Uniswap and Aero around the clock, then send a Telegram alert with a ready transaction that you sign yourself. In early access, agents can also act on their own, but only within limits you sign onchain, on Arbitrum and X Layer. It never holds your keys. Signo went live at OKX Dev Day in Singapore on October 20 and took first place in one track and second in another.

6/ SprintOS (Milestone Escrow)

When an AI checks your work, who decides you get paid? On SprintOS a sponsor locks USDC for each milestone on Stellar, the builder submits proof, and an AI scores it against requirements hashed into the contract. The AI cannot move a cent: only the named human reviewer's wallet can release the escrow, even after a perfect score. The first real mainnet payments went through on October 6, and so far it is backed only by Stellar grants.

7/ Yieldy (Stablecoin Yield)

Stablecoin yield looks safe right up until the protocol behind it breaks. Yieldy grades each opportunity on 54 signals across 9 risk areas, builds a strategy for your goal, and its Copilot rebalances or pulls you out when the risk rises. Non-custodial, starting with USDC on Ethereum. It took 1st place at Ownership Roadshow #5 on October 14. Early access is not open yet, so for now it is a waitlist.

8/ Lifted (Stablecoin Looping)

Looping stablecoins can multiply yield, until borrow rates spike and eat it. Lifted is a USDC vault on Solana that loops across RWA-backed and onchain stablecoins on Kamino, chases the best spread between them, rebalances only when it is worth the cost and is built to protect against negative rate spikes. Live since October 20, from a team of Superteam Kazakhstan builders. At launch it showed 13% APY over the previous 30 days. Looping is still leverage, so the risk is higher than a plain deposit.

9/ WhereDidTheyBridge (Onchain Forensics)

Follow money onchain and the trail usually breaks at a bridge. Paste a wallet or a transaction into WhereDidTheyBridge and you get every bridge it used in one timeline, across deBridge, Across, Wormhole, CCTP, Relay, Mayan and more on 100+ chains. Since October 18 it follows NEAR Intents swaps to where the money actually landed, and an MCP server lets Claude or Cursor query it. Free without sign-up, no token, built by an independent developer.

The pattern this week: guardrails are turning into the product. Options that cannot be liquidated, wallets that do not leak your balance, AI that can score work but not pay it out, agents that wait for your signature, and yield that comes with an exit plan. In most of crypto these were footnotes in the docs. Here each one is the whole pitch. These are early-stage projects, several still on testnet or a waitlist, so higher upside comes with higher risk. Do your own research, nothing here is financial advice.

Which one are you watching?

Between January 1 and October 28 we counted 30 hardware wallet incidents across 11 vendors. Known losses add up to about $530M. Not one dollar of it left through a cracked secure chip. The money went out through buggy code, tampered retail units, leaked customer lists and owners who were talked out of their seed.

Where the $530M went

- People tricked: ~$295M (56%)

- Code bugs: ~$117M (22%)

- Tampered retail units: ~$102M (19%)

- A vendor's software wallet: ~$16M (3%)

- Cracked secure chips: $0

Several of these are third-party estimates. Ledger has not confirmed a total for its implant case, and D'CENT has published no figure at all.

1. Code bugs: weak seeds shipped years ago

The biggest technical failure of the year was Coldcard. A firmware build setting introduced in March 2021 made the device skip its hardware random number generator. Seeds came from a software generator fed by the chip ID and timers, which left roughly 40 bits of entropy on Mk2/Mk3 and about 72 on Mk4/Q/Mk5. That is guessable. From July 30 attackers brute-forced seeds remotely, without ever touching a device, and swept 1,789 BTC from 8,865 addresses: $114.7M at time-of-theft prices, per Galaxy. Coinkite patched the firmware but offers no compensation, and its postmortem is still unpublished. Coinkite's own take: "we have to assume that someone used AI to review previous versions of our firmware."

A firmware update does not fix a seed that was already weak. Affected users have to create a new seed and move their funds.

Ledger's Zilliqa app had a similar flaw since 2019. The top 64 bits of every signing nonce were fixed at zero, so a private key could be recovered from 4 or more signatures. Between March and July, 683M ZIL (about $1.9M) was taken from 51 accounts, and 6,772 accounts were exposed. Ledger merged a patch on July 27, which does not protect keys that already signed.

Other bugs were found and fixed before anyone lost money:

- Ledger Monero app (fixed March 20): a compromised computer could pull Monero secret keys without on-screen confirmation.

- BitBox02 (July 8 and August 17 updates): an out-of-bounds write, display spoofing, memory corruption that allowed code from a malicious host on unset Multi-edition devices, and a Silent Payments bug that could lock funds to the wrong address.

- Ledger Ethereum app (August): a race condition let a malicious host swap a transaction during signing. Ledger found it internally and fixed it before TestMachine went public on August 22. Safe version: 1.22.3.

D'CENT is a separate case. On September 15 and 16 funds were drained from its App Wallet, the software mode, for addresses that had signed with app versions below 8.1.0. On-chain trackers count about 12.4M XRP from 7,000+ wallets, roughly $16M. D'CENT has disclosed neither a cause nor a figure. Its hardware wallets are not affected unless the seed was typed into the app.

2. The retail chain: implants, swapped chips and a stolen factory key

On October 9 wallets tied to Ledgers sold by Southeast Asian reseller CryptoBilis were emptied on 6 chains in 47 minutes. The devices were genuine but had been opened and fitted with an LTE implant (microcontroller, modem, eSIM, antenna) that read the recovery phrase off the screen and sent it out. The secure element was untouched, so Ledger's Genuine Check passed. Bitquery estimates ~$102M from 335 wallets, and Tether froze $10M in USDT. Ledger calls the number of affected devices "limited", has not confirmed a total and offers no recall or reimbursement. It halted sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, and at MediaMarkt Saturn. OneKey cut ties with CryptoBilis and offers free replacements to its buyers.

On October 13 hardware hacker Joe Grand showed a Trezor One bought on TikTok Shop and a Model T from Facebook Marketplace whose microcontroller had been replaced to generate pre-set seeds. No losses were reported. Trezor will end all reseller authorizations on January 1, 2027.

Then came Keystone. Between October 20 and 26 an attacker got into its website through a third-party monitoring tool and took buyer data plus the WebAuth key: the key written into devices at the factory to prove they are genuine. With it, counterfeits could pass Keystone's authentication check. Keystone will destroy 18,835 unsold units, has stopped shipping web orders and moved to preorders with a new key. No funds have been lost. Devices delivered before October 20 are fine. If you received one after that date, contact Keystone support before using it, even if it passes the check.

The lesson from all three: a genuine check proves the chip, not the whole box.

3. Leaks and hijacked vendor channels

Vendors and their suppliers leaked buyer data six times this year, almost always through a third party:

- Ledger via payment partner Global-e (January 5): names, addresses, emails, phones and order details. Count not disclosed.

- Trezor via shipper ShipMonk (August 13, widened September 4): 80,689 customers, including ~67,000 US records from 2019 to 2021 that Trezor had been told were deleted.

- SafePal (August 16): a flaw in an order-tracking plugin exposed 39,798 customers.

- Trezor and BitBox via email provider Brevo (September 9 and 10): 347,149 Trezor contacts were exported and sent a fake "STM32 Entropy Vulnerability" alert. 2,500 people clicked in the ~20 minutes before takedown.

- Keystone (October): 25,964 buyer records plus 12,873 unpaid checkouts, part of it data that a broken erasure job should have deleted.

- Foundation (October 25 and 26): attackers with compromised Cloudflare API keys sent 23,000+ fake "recall" emails from official domains. ~5,600 mailing addresses and ~5,200 phone numbers were potentially exposed.

That is ~165K records with names and shipping details, not counting Ledger's. These lists feed the paper letters and calls described below.

Phishing also came from vendors' real channels:

- NGRAVE (October 17): attackers hijacked the push-notification provider of its LIQUID app and sent a fake "Pixel 9, Moscow" login alert linking to a seed-phishing page. At least $2.56M was stolen from ~70 addresses. The CEO: "we have absolutely and utterly failed."

- SecuX (October 16 to 19): the banner inside the SecuX App was modified to link to fake SecuX sites.

- Coldcard (October 11): its official X account published a phishing "migration" post.

"Check the sender" no longer protects you.

4. People and fake apps

The largest single theft of 2026 was not a device failure. On January 10 one hardware wallet owner lost $282M+ in LTC and BTC (2.05M LTC and 1,459 BTC) to social engineering, per ZachXBT. The funds were swapped to Monero and bridged via THORChain.

The rest of the list:

- February: paper letters to Trezor owners demanded a fake "Authentication Check" by QR code.

- April 7 to 13: a fake "Ledger Live" app in Apple's App Store asked for recovery phrases and took $9.5M from 50+ victims. Apple removed it.

- May: letters signed in the name of Ledger CTO Charles Guillemet about "Quantum Resistance", again with a QR code to a seed-phishing site.

- June: a group posing as wallet and exchange support drained $1.2M from a Trezor owner after a spoofed BitcoinIRA email (ZachXBT).

- July: Kaspersky found OkoBot malware ("SeedHunter") that overlays a fake recovery screen on Ledger Live and Trezor Suite. Hundreds of victims in 25+ countries.

- August: a phishing site on sites.google.com was the top sponsored Google result for "Trezor wallet". Rapid7's "Operation ASTERIX" paired phone scams with fake Trezor Suite, Ledger Live and Exodus apps.

- October 16: fake "Ledger firmware update" emails rode the CryptoBilis panic.

In none of these did the hardware fail. The user typed the seed into something else.

5. The chip held

Two lab attacks on secure chips worked this year, and both cost users $0. Ledger's Donjon team used laser fault injection to bypass the firmware-signature check of the TROPIC01 chip in the Trezor Safe 7, and to reset the password on Tangem cards. Both need physical access and a lab. The Tangem setup costs around $250,000. Neither can be patched with firmware, and neither has led to a reported theft.

In court

- Kim v. Ledger SAS (S.D.N.Y., August 27): a proposed class action over the 2023 Connect Kit incident and later impersonation scams, seeking at least $500M.

- Naderi v. Coinkite (Ontario, September 11): a proposed class action over the Coldcard seed bug, alleging more than $140M in losses.

What to do

- Buy only from the vendor, not from resellers or marketplaces.

- Generate the seed on the device. If your Coldcard seed was made on affected firmware, create a new one and move your funds.

- Never type a seed into a website, app, letter, QR page or support chat. No vendor will ever ask for it, and there are no "recalls".

- Treat any urgent security alert as phishing, even if it comes from an official email, app or X account.

- If you bought from Trezor, SafePal, Keystone, Ledger or Foundation, assume your name and address are already out there.

Sources: Coinkite, Galaxy, Zilliqa, Ledger, Bitquery, Keystone, Trezor, NGRAVE, D'CENT, Ledger Donjon, ZachXBT, Rapid7, Kaspersky, court filings, CryptoDiffer research.

Microsoft, Alphabet, Goldman Sachs and 19 other US companies have formally objected to their shares trading as tokens on OKXICE, the planned on-chain stock venue from NYSE owner ICE and OKX. That is 19 of the 62 companies on the venue's launch list, plus three that weren't even on it.

How the veto works. In September the SEC opened a five-year "Innovation Exemption" that lets tokenized versions of US-listed stocks trade on-chain, 24/7. The tokens must be backed 1:1 by real shares and pass through dividends and votes. If the token is issued by a third party rather than the company itself, the venue has to notify the company and wait 30 days. A written objection in that window keeps the token off that venue. It doesn't stop other venues.

Who said no. OKXICE published its launch list of 63 tickers on October 4. By October 23 its public notice listed 22 objectors: Cerebras, AppLovin, Applied Digital, Rocket Lab, CoreWeave, Verizon, Applied Optoelectronics, Broadcom, UnitedHealth, Goldman Sachs, Microsoft, Qualcomm, Caterpillar, McDonald's, Western Digital, Alphabet, Arm, Wells Fargo, Moderna, Cisco, Intuit and Marvell. Sixteen are Nasdaq-listed, six trade on the NYSE. Ten are chip or AI-infrastructure companies.

Why. The objection notices give no reasons, but the logic is easy to piece together.

- No upside. The company raises no money and earns nothing. Fees go to the venue and the tokenizer, while any price gap or blowup lands on the company's name. One analyst summed it up: the revenue goes to the tokenizers, the risk goes to the companies. Applied Optoelectronics, the only objector to comment on the record, said it sees no "clear benefit to AOI or our shareholders that justifies these uncertainties."

- Weaker plumbing. These venues sit outside the national market system: no consolidated tape, no real-time best-price display, trade reports can lag up to 10 minutes. Nasdaq opted its own stock out for exactly these reasons.

- No more quiet hours. Companies usually drop earnings and big news while markets are closed. A 24/7 token market removes that pause.

- Messy shareholder mechanics. Who holds the shares behind the token, how votes and dividends reach holders, what the transfer agent sees: none of it is standard yet.

- Saying no is free. Legal teams get 30 days to judge a brand-new market. Silence counts as consent, an objection costs nothing.

- The venue's own fine print. OKXICE's notice says it isn't SEC-registered, isn't subject to Reg NMS, and can upgrade its smart contracts with no timelock or advance notice.

Who stayed quiet. 43 listed companies haven't objected, including Nvidia, Apple, Tesla, Amazon, JPMorgan and Walmart. Every crypto-linked name on the list (Coinbase, Robinhood, Circle, Strategy, Securitize, BitGo, SoFi) is in that group, and Securitize and BitGo have said they won't object. The 30-day windows for the first batch close in early November, so the count can still grow.

What it means. This is a vote against one venue's third-party model, not against tokenization itself. Nasdaq, which opted out, is building its own tokenized-stock framework. Trading on OKXICE is also capped at 0.25% of each large-cap stock's average daily volume. But the message from corporate America is clear: if you want to put our stock on-chain, ask us first, and show us what's in it for us.

Sources: OKXICE public notices (Oct 4, 19, 23), SEC TSV Exemption order, CoinDesk, Fortune, Decrypt, Markets Media, Covington.

October was busy, so we kept only products you can use today, shipped this month by teams that were already established. Eight made the cut, and seven of them live onchain. The pattern is hard to miss. Bets got shorter, simpler and stranger: 1,000x calls that a 0.1% move can end, 15-minute BTC options, odds on the next DeFi exploit. Wall Street assets kept moving onchain, from Nvidia shares with dividends to pre-IPO OpenAI tokens. Underneath, DeFi rebuilt its plumbing: a market for the gap between funding rates, and two of the biggest DEXs merging into one. And OKX built a new front door, a dollar account for emerging markets. Each product gets a mini-review and one honest catch.

1/ OKX Money (Stablecoin App)

OKX Money is a standalone app, launched October 6, that turns more than 50 local currencies into digital dollars: USDG, USDC or USDT. It is rolling out in parts of Latin America, Africa, South Asia and the Middle East, with a virtual or physical Mastercard that charges zero FX fees abroad. Eligible USDG balances earn up to 10% APY with no lockup, paid weekly, and the top rate depends on your 30-day balance, 30-day card spend or OKX VIP level. The catch: OKX has not said what funds the yield, and the app is not offered in the US or EU.

2/ Jupiter YOLO (Leverage Bets)

Pick up or down on SOL, BTC or ETH at 500 to 1,000x leverage, starting from $10. There is no order book: every trade goes against a House pool that collects losing stakes and pays out winners, and the only trading fee is 2% of winning profit. Live in beta since October 15, YOLO generated about $42K in fees in its first week (DefiLlama, Oct 21). The catch: at 1,000x a 0.1% move against you wipes the stake, the code is unaudited, and if the House runs dry, profits wait in a queue with no payout date.

3/ Lighter Binary Options (Binary Options)

Since October 19, Lighter runs 15-minute up/down markets on BTC and ETH. A share costs between $0.01 and $0.99, which reads as the market's odds, and pays 1 USDC if you are right and nothing if you are not. Positions are paid in full in USDC, so there is no leverage, no funding and no liquidation, and every window settles on Chainlink prices. The catch: Lighter has not published any volume yet, it is closed to US users, and at even odds the taker fee means you have to win a little more than half the time just to break even.

4/ Pump.fun PreStocks (Pre-IPO Tokens)

Since October 19, Pump.fun lists PreStocks tokens for eight private companies: OpenAI, Anthropic, Anduril, Neuralink, Figure AI, Kalshi, Polymarket and Oura. You can trade them directly or launch a memecoin priced in one of them, and coins paired with the OpenAI and Anthropic tokens were trading within a day. The tokens are issued by PreStocks against SPV exposure and are closed to US persons. The catch: holders get no ownership, votes or dividends, OpenAI and Anthropic have warned that share transfers to SPVs without their approval can be void, and liquidity is thin: the deepest Anthropic pool held about $2.2M and the biggest memecoin pairs under $30K (GeckoTerminal, Oct 21).

5/ Securitize Stocks (Tokenized Stocks)

Since October 8, Securitize sells 12 US stocks on Solana, including Apple, Nvidia, Tesla and SpaceX, each backed 1:1 by a real share. Holders get dividends and shareholder votes, buy with USDC, and Jump Trading provides liquidity. Unlike most tokenized stocks, these are open to eligible investors in the US and EU after identity checks, through Securitize's SEC-registered broker-dealer. The catch: the tokens only move between approved wallets, trading is 24/5 for now with 24/7 still "coming soon", and Securitize has not published any early trading numbers.

6/ DefiLlama x Trueo (Prediction Markets)

DefiLlama now hosts Trueo prediction markets that settle on DefiLlama's own data. Live examples: will Hyperliquid's October revenue top $60M, will Robinhood Chain DEX volume pass $40B in October, will Aave suffer bad debt or an exploit this month. Trueo's TVL rose to about $1.5M from $1.07M a day earlier (DefiLlama, Oct 21). The catch: the markets are tiny, and on exploit markets the people most likely to know first are the ones who found the bug.

7/ Pendle Boros Spread Markets (Funding Rates)

The same BTC perp pays different funding on different exchanges, and Boros now lets you trade that gap as one position. The first two spread markets pit Hyperliquid against Gate on BTC and ETH, maturing November 27, so arbitrageurs can lock in a fixed spread and others can bet on where it goes. Together they carry about $9.4M in notional open interest (Boros API, Oct 21). The catch: this is a tool for pros, Boros as a whole holds only about $7.5M (DefiLlama, Oct 21), and funding gaps can flip fast.

8/ Aero (DEX)

Aerodrome on Base and Velodrome on Optimism merged into one protocol called Aero, live since 00:00 UTC on October 22. One AERO token now runs across seven chains, Base, Ethereum, OP Mainnet, Arbitrum, Ink, Arc and Robinhood Chain, and swaps route across all of them. Weekly ve(3,3) voting is replaced by Predictive Allocation: sAERO holders direct rewards to pools on any Aero chain and earn exchange revenue from the pools they pick. The two DEXs held about $416M combined going into the switch (DefiLlama, Oct 21). The catch: nothing converts automatically, so holders have to move their AERO and VELO through the upgrade portal themselves, at 1 new AERO per AERO and about 0.044 per VELO.

The pattern this month: products got simpler on the surface and riskier underneath. A $10 up/down button, a 15-minute coin flip, a memecoin priced in OpenAI. Several of the newest bets and pre-IPO tokens are closed to US users, while the one product built inside US securities rules, Securitize Stocks, is open to them.

DYOR: nothing here is financial advice. Betas, unaudited code and thin liquidity are flagged above for a reason.

Which one would you actually use?

Nine early-stage projects that hit our radar, real products rather than memecoins. The theme: trading is turning into a game, and the plumbing underneath is growing up. On one side, sports bets with XP and card packs, trading competitions against AI agents and token baskets you copy in one click. On the other, best-price routing, stablecoin yield for fintechs, risk scores for DeFi vaults and private transfers for Bitcoin. Follower counts are small on purpose, you are seeing these early. With a link to each.

1/ Daybreak (Tokenized Stocks)

You can buy Google, but you cannot buy Waymo. Daybreak splits a tokenized stock into partials that track each business segment, so you back only the part you believe in. One xStocks share mints a full set and a full set redeems the share, which keeps prices anchored. Launched October 1 on Solana with SpaceX and Alphabet, part of Alliance's ALL15 cohort.

2/ PolyStation (Social Betting)

Sports betting rebuilt as a social game. A live match screen with bets and mini-games, a feed where you can follow, copy or fade any Polymarket wallet, and XP, levels and daily card packs, so even a losing bet counts toward progress. The founder says invites to the private beta start rolling out this week, earliest supporters first.

3/ RIFT (Execution API)

Enter any swap, bridge or vault deposit and RIFT checks 20+ venues, from Uniswap to Across and NEAR Intents, then executes at the best quote in one click. It adds zero fees and only earns when its own liquidity beats every other venue. Relaunched as an onchain API on October 1, backed by Paradigm.

4/ [alloc] init (Bitcoin Privacy)

A cryptography research team working on what Bitcoin can do without a soft fork. Its Shielded Bitcoin paper describes Zcash-style private transfers on Bitcoin L1 using witness encryption and zero-knowledge proofs, and the announcement drew 1.5M views. Still research, not a product: a private transaction would cost roughly 4x a normal fee.

5/ Ground (Stablecoin Yield)

One API that lets neobanks, fintechs and payment companies put idle stablecoin balances to work in tokenized T-bills, credit funds and lending vaults, with a risk engine that can exit a position automatically when liquidity dries up. Founded by Superstate co-founder Reid Cuming, with a $3.6M pre-seed co-led by Bain Capital Crypto and ParaFi.

6/ Philidor (DeFi Risk)

Independent risk scores for DeFi vaults on Aave, Morpho, Maple, Kamino and more: every vault gets a 0 to 10 score under an open methodology, plus live incident alerts. Its dashboard covers 900+ vaults and $57B+ in TVL, and it recently flagged a $6M vault drain on Base.

7/ Voltrade (Trading Competitions)

Runs trading competitions for venues like dYdX, Lighter and Derive: you keep trading where you already trade, Voltrade tracks the leaderboard and pays the prizes. Its site shows $900M+ in competition volume from 2.1K traders. Its newest game, Double Top, pits humans against AI agents in 3-minute Bitcoin rounds on the same chart.

8/ Indexify (Social Investing)

A self-custody app where creators build Stacks, onchain token baskets on Solana that followers buy in one click while the creator earns a small fee. The same wallet also trades Hyperliquid perps and tops up by card through MoonPay.

9/ ComfyFun (Agent Launchpad)

A token launchpad on 0G: one transaction, no bonding curve, and gas covered for accounts linked to X. Creators earn a fee on every trade and can route part of it to AI compute, with an agent marketplace coming next. Since going live on September 28 it has processed 7.7M 0G across 260+ launches.

The pattern this week: the front end of crypto is turning into a game. Bets come with XP, competitions put humans against AI, portfolios are copied in a click and launches cost nothing. Underneath, the plumbing gets more serious: best-price routing, yield rails for fintechs, independent risk scores and private transfers for Bitcoin. These are early-stage projects, several pre-token, in beta or still in research, so higher upside comes with higher risk. Do your own research, nothing here is financial advice.

Which one are you watching?

Most "early" plays in your feed have no funding and no product. We filtered for one signal: real capital behind the project. This week that means Robinhood, Coinbase Ventures, Ribbit Capital, Susquehanna, GSR and The Sandbox founders. Six live activities, with links and steps.

Arcus · Perp DEX

A DEX on Robinhood Chain for stock tokens, spot and perps, built by the team behind dYdX. Points went live on October 1, after $5B+ in volume during private beta.

Backers: Robinhood Crypto (strategic investment) · incubated by dYdX Labs

How to join:

1. Sign up via our Arcus invite link and connect your wallet. Private beta users already got Season 0 points.

2. Trade. Stock tokens and other RWAs earn more, and so do RWA perps traded outside US market hours. Swaps in Robinhood Wallet routed through Arcus are boosted too.

3. Season 1 pays a fixed 250K points per week, updated Wednesdays at 3PM ET. The program ends no later than H1 2027.

Elysium · Hyperliquid Network

A new network from Kinetiq, the team behind kHYPE, a liquid-staking token for HYPE. It's built to take Hyperliquid DeFi and spot trading past current throughput limits, and the testnet is open.

Backers: Maven 11, Susquehanna, IMC, Flowdesk, Chorus One (Kinetiq seed) · $1.75M

How to join:

1. Open elysium.kinetiq.xyz/testnet-bridge and connect your wallet.

2. Claim test tokens, add the Elysium network and bridge to HyperEVM.

3. Make a few different transactions over several days, not just one. No rewards have been announced, so use test funds only.

Reya · Perp DEX

A perp DEX that just moved to a new v2 orderbook. v2 is in private beta and opens in phases, starting with Season 1 traders and market makers.

Backers: Coinbase Ventures, Framework Ventures, Wintermute, Brevan Howard Digital, Robot Ventures · $10M

How to join:

1. Open app.reya.xyz and join the v2 queue.

2. Once you're in, trade on the new orderbook. ETH, BTC, SOL, HYPE and XRP are among the first markets.

3. Season 2 pays in $REYA: 3% of total supply. The season is short and the pool is fixed, so getting in early means fewer people splitting it.

Entropy · Pre-IPO Perps

Perps on stocks, commodities and pre-IPO companies, built on Hyperliquid by ex-Citadel Securities, Optiver and Polymarket traders. It's now also live inside Trust Wallet.

Backers: Ribbit Capital (seed lead) · $14M seed

How to join:

1. Trade at entropy.io. Tencent ($HK700) was just listed with 10x leverage.

2. If you post about markets, apply to the Entropy Partners program through the application form. The team reviews every application.

3. Keep posting: the first affiliate badges went out on October 2 to people already creating content about Entropy.

dare market · SocialFi

A Solana platform where people post public challenges with bounties and others complete them with proof. v2 went live on October 1: every dare can now launch its own token.

Backers: Karatage, Paper Ventures (co-leads), GSR, Axia8, Ansem · $2M

How to join:

1. Open app.dare.market and sign in.

2. Launch a token for your dare (SOL or USDC), or trade existing ones. Trading fees fill the dare's bounty pool.

3. Or complete dares yourself. The daily Dare of the Day has been paying $1,000 bounties.

Hollywood Hills · Fan Investing

A cosmic-horror feature film from The Sandbox founders, built around the real Dead & Famous bus tour in LA. Fans can invest in the film, share its revenue and hunt for clues that can change the story.

Backers: Arthur Madrid and Sebastien Borget (lead investors) · $1M fan campaign

How to join:

1. Join the waitlist at hollywoodhills.cc.

2. The investment window opens October 8 through Republic (18+, limited allocation, first come first served).

3. Investors get one of 3,000 Villa collectibles, each hiding a piece of the mystery. This is a paid investment, not a free mint.

Not financial advice. Points and testnets don't guarantee a token.

Twelve rounds, $1.57B combined. Polymarket alone took $1B of it, almost two thirds. Take Polymarket out and the quarter has one clear theme: 8 of the other 11 rounds went to stablecoin payments and banking rails. The rest went to tokenization, and a lot of the money came from traditional finance: Nasdaq, US banks, Bain Capital, M&G. With a link to each project.

1/ Polymarket (Prediction Markets), $1B

The onchain prediction market raised $1B at a $21B valuation, led by 1789 Capital, the firm where Donald Trump Jr. is a partner. In April it was valued at about $15B, so the price went up 1.4x in five months. The round was reported by Bloomberg and the WSJ and confirmed by a 1789 Capital spokesperson, but Polymarket has not announced it itself.

2/ Jeeves (Stablecoin Banking), $110M

A banking platform for companies that operate in several countries, now built around stablecoins. The round was led by CoinFund, with a16z, Coinbase Ventures and AllianceBernstein. The money goes to its own USDC/USDT wallet with payouts to 190 countries and to growing its card from 25 to 35 countries. Jeeves has raised more than $570M in equity and debt since 2019.

3/ Circle (Stablecoins), $100M

The USDC issuer sold $100M of its stock to Binance at $80.84 a share, below the market price. Binance cannot sell the shares for 2 years. The investment comes with a 5-year deal: Binance promotes and integrates USDC, and Circle pays it a monthly fee based on the USDC held through Circle's wallet infrastructure. The deal is disclosed in Circle's SEC filing from September 22.

4/ Payward (Exchange), $100M

Nasdaq invested $100M in the parent company of Kraken at a $21B valuation. The deal expands their tokenized stocks partnership: Kraken will distribute tokenized Nasdaq-listed shares with voting rights, with Nasdaq Equity Tokens due in Q2 2027. Kraken had 6.6M funded accounts in Q2, up 42% year on year. Reports say its IPO is now planned for Q2 2027 at the earliest.

5/ RQD Clearing (Clearing), $74M

A US clearing firm that clears about 2.4% of US listed-stock trading. Bain Capital led a $74M strategic investment, joined by ABN AMRO Clearing Bank and Nyca Partners. The money goes to digital asset custody, tokenization and expansion into Asia and the Middle East. In March RQD also partnered with Blue Ocean to build clearing for tokenized US stocks.

6/ HIFI (Payments), $37M

Stablecoin payment rails for businesses, with more than $7B in annual volume across 87 countries. Usage among existing customers grew more than 4x in six months. Left Lane Capital led the $37M Series A. HIFI took part in DTCC's tokenized asset trades alongside BlackRock and Goldman Sachs in July and now plans to add cards and tokenized capital markets.

7/ Latitude (Payments), $35M

One API that turns stablecoins into local payments over each country's own rails, such as Pix in Brazil, UPI in India and mobile money in Kenya, in more than 50 countries. Oak HC/FT led the $35M Series A, with NEA, Coinbase Ventures and Lightspeed Faction. The team is only 15 people, but it already holds 39 US money transmitter licenses.

8/ Cari (Tokenized Deposits), $32.5M

A network for tokenized deposits, built and funded by US banks. All $32.5M came from banks, including Huntington, KeyBank, M&T and First Horizon. More than 30 banks have joined and 40 more are in talks, together over $10T in combined assets. The founder is Gene Ludwig, a former US Comptroller of the Currency.

9/ OpenReserve (Crypto Bank), $25M

A new national bank that just got preliminary, conditional approval for a charter from the OCC, the US federal bank regulator. a16z crypto led the $25M seed, with Coinbase Ventures, Jump and Wintermute. It plans tokenized deposits, crypto custody, lending and its own stablecoin, rUSD, which still needs a separate OCC approval. Before it can open, the regulator requires at least $210M in capital.

10/ Fin.com (Payments), $20M

Money transfers that settle in USDC/USDT, mostly in under an hour, offered as an API or as a white-label app. It covers more than 30 countries and 40 currencies. The $20M seed was led by Expa, the fund of Uber co-founder Garrett Camp. Coinbase Ventures also joined. Fin came out of stealth with this round and says its annual recurring revenue grew more than 50x this year.

11/ Limited (Stablecoin Banking), $18.5M

Business accounts in the US, EU, UK, LatAm and Africa without opening a local company, with Visa cards and payouts on stablecoin rails. It expanded its seed round to $18.5M with Third Prime, North Island Ventures, ParaFi and DCG. The money goes to new payment routes in LatAm, Asia and the Middle East.

12/ Hivemind (Tokenization), $17M

An asset manager founded by Matt Zhang, Citi's former global head of structured products trading, with about $1B in client assets. M&G Investments led a $17M strategic round, and an M&G executive joins Hivemind's board. FalconX and ZA Bank also took part. The money goes to tokenization infrastructure and new institutional partnerships.

The pattern this quarter: the money moved to stablecoin plumbing. Eight of the twelve rounds fund the same thing in different forms: business bank accounts, payouts, deposits and a full bank, all running on stablecoins. The other theme is traditional finance buying in directly. Nasdaq bought into Kraken, US banks funded their own deposit network, and Bain Capital and M&G backed tokenization. Nothing here is financial advice, do your own research.

Which round surprised you the most?

Nine early-stage projects that hit our radar this week, real products rather than memecoins. The theme is markets for things that never had one: people, internet trends, pre-IPO shares, private credit before maturity and trading cards, plus the tools and plumbing around them. Follower counts are small on purpose, you are seeing these early. With a link to each.

1/ Perp City (Real-World Perps)

Perpetual futures on indices built from live internet data: news trends, city rents, company revenue, internet traffic, new grad jobs. Live on Arbitrum One with up to 10x leverage and USDC margin, and you can sign in with just an email. Backed by a16z CSX.

2/ Things (People Markets)

A market for backing people before they make it. Builders and creators list themselves for free, show their work and get funded by backers who then push their launches and test their products. Launched its new builder and creator market on Solana on September 24.

3/ Augment (Pre-IPO)

A self-serve trading venue for private tech companies. Investors buy units of a fund that holds the underlying shares, then can place sell orders on the same network later instead of hunting for a new buyer deal by deal. Open to eligible participants.

4/ Tenka (Private Credit)

A marketplace for asset-backed private credit where capital can exit before maturity. A senior vault targets 8-9% APY with weekly liquidity, deal vaults give exposure to single facilities, and backstop LPs buy positions from investors who want out. Permissioned, KYC required, launching in Q4 2026. Raised a $2M pre-seed led by Maven 11.

5/ Raflux (Collectibles)

A platform for real-world collectibles, mostly trading cards: rip "Super Gacha" packs online, with the randomness of every pull verified onchain via MagicBlock VRF. Timely, as Coinbase just teased ripping packs on your phone backed by physical cards.

6/ ParlayX (Prediction Market Infra)

Prediction markets are built for one person on one account. ParlayX lets hedge funds, market makers and sportsbooks trade them as a team: separate books of capital per strategy, per-trader permissions, and one screen for Polymarket, Kalshi, Limitless and Predict.fun. Non-custodial. Closed a $1.25M pre-seed led by Dreamcraft Ventures in September.

7/ Tacticalls (Social Options)

A social app for options trading on Derive: trade in one tap, follow top traders, and copy their positions. You can also hedge your wallet positions in one click. Went live on September 24.

8/ Kurate (Euro Credit)

Euros are less than 1% of stablecoin supply, and there is almost no credit market for them. Kurate runs curated lending markets for EURC on Solana, including borrowing EURC against yield-bearing collateral like syrupUSDC and JitoSOL. Live since September 24 with low deposit caps for now, and building in the Colosseum hackathon.

9/ Intercepta (Onchain Compliance)

Real-time sanctions screening, risk monitoring and fund-flow tracing across 17+ networks, from Ethereum to Canton. Built by PixelPlex and already integrated into Canton's CC View explorer and Console Wallet, according to the Canton Foundation.

The pattern this week: things that were never liquid are getting a market. People, internet trends, private company shares, private credit and trading cards are all turning into positions you can enter and exit, while the tooling around them grows up: team desks for prediction markets, copy trading for options, euro credit and real-time compliance. These are early-stage projects, several pre-token or pre-launch, so higher upside comes with higher risk. Do your own research, nothing here is financial advice.

Which one are you watching?