The crypto market closed the week under pressure, with Bitcoin holding around $83,000 after pulling back from $87,000, Ether near $2,500 and XRP around $1.40. Spot ETFs recorded their steepest weekly net outflows in months, while two major security revelations dominated the news cycle.
Geopolitical risk and macro uncertainty added to the cautious tone. Markets were already bracing for the U.S. September consumer price index due on October 14 when reports of an attack on Riyadh's airport raised the prospect of a broader Middle East escalation. Against that backdrop, self-custody trust took a direct hit.
Ledger Confirms a Hardware Implant as Losses Mount
Ledger confirmed that at least one device sold through the South Asian reseller CryptoBilis contained an unauthorized hardware implant. The company has not yet established how many devices were affected or whether the implant caused all of the thefts under investigation. CryptoBilis has suspended sales of all hardware wallets pending the probe.
Independent estimates of the losses diverge. Specter pegged them at more than $86 million, while Bitquery estimated roughly $92.9 million across 311 wallets on Bitcoin, Ethereum, TRON, BNB Chain and Polygon. Ledger has said its own infrastructure, systems and services were not compromised.
Reports of tampering then appeared to spread geographically, with an unconfirmed claim of a possible implant in a device bought at a MediaMarkt store in Europe — a claim other users disputed. A fake-website warning also surfaced amid the theft investigation.
The episode strikes at the core promise of hardware wallets. Compromise of a device supply chain undermines baseline trust in self-custody and could push the market to rethink device verification practices.
Sources: Cointelegraph, U.Today, CryptoPotato, Crypto.News.
XRP Ledger Discloses a Decade-Old Bug That Could Have Minted Trillions
The XRP Ledger revealed an integer overflow in its payment engine that had existed since 2015 and could have created 18.45 trillion XRP in a single transaction — more than 184 times the original supply. The AI agent Veria Labs identified the flaw on September 21, and RippleX shipped an emergency patch, xrpld 3.4.1, on September 25.
The fix bypassed the network's usual two-week validator voting process for the first time in a decade. Veria received a record $250,000 through the bug bounty program. No signs of exploitation have been found on the public network, and no funds were affected.
A separate patch closed a vulnerability in the Batch mechanism (XLS-56). The fact that the source code for the fixes was initially withheld drew criticism, and the near-miss has intensified debate about vulnerability disclosure and the centralization of network governance.
Sources: U.Today, The Defiant.
Wallet and Protocol Vulnerabilities Pile Up
Security concerns were not confined to Ledger. The official X account of Bitcoin wallet maker Coldcard was compromised on October 11, when a fraudulent post carrying a phishing link appeared. The post falsely claimed a critical firmware vulnerability affecting the Mk4, Mk5 and Q models and urged users to move funds to a supposed safe wallet.
Coldcard removed the post, warned users and reminded them that its only official site is coldcard.com. The company said it found no traces of a breach of its own systems and that credentials and offline 2FA remained secure. There have been no reports of Bitcoin actually stolen through the phishing attempt.
The incident shows that phishing through official social channels has become a distinct attack vector against Bitcoin holders. Separately, the Lightning Development Kit patched a reconnection vulnerability in releases v0.2.7 and v0.1.13 that could have let a malicious peer steal the value of a forwarded payment, and which also involved a flawed just-in-time payment flow. Applications that do not incorporate the patched code remain exposed.
Elsewhere, Liquid Bitcoin redemptions remained frozen with reserves covering only 85.8% and a shortfall of about 603 BTC. Liquid said resuming peg-outs requires full collateralization and completed security reviews — a reminder of depeg and under-collateralization risk in bridged Bitcoin assets.
Sources: Cointelegraph, The Defiant, CryptoSlate, The Defiant.
ETF Outflows Add to Downward Pressure
Spot Bitcoin and Ethereum ETFs suffered heavy weekly net outflows. Bitcoin funds lost about $681 million — their largest weekly drawdown since late June — while Ethereum funds shed roughly $542 million, extending their losing streak to nine days. Solana ETFs lost about $24.8 million, with outflows running for a fifth straight session.
Wednesday was particularly brutal for Bitcoin ETFs, with $484.9 million in outflows, the worst single day since June. Cumulative net inflows into Bitcoin ETFs since launch slipped from $57.79 billion to $57.11 billion. Ether fell to $2,400 midweek, and Bitcoin touched a two-week low of $80,400.
Sustained capital withdrawal weakens the main institutional inflow channel and amplifies pressure on the two largest assets. Even so, not every corner of the market bled: XRP ETFs extended their streak of weekly inflows to 13, drawing $11.31 million and lifting cumulative net inflows to a record $1.8 billion, even as XRP weakened to a three-week low of $1.32 before trading near $1.40.
Sources: Decrypt, CryptoPotato, CryptoPotato.
Whales Buy the Dip as Signals Flash
On-chain and market analytics pointed to accumulation during the sell-off. Bitcoin fell from $87,000 to below $81,000, its lowest in more than two weeks, yet larger participants added more than $1.2 billion in BTC over 72 hours, according to Ali Martinez. Ether dropped from above $2,700 to $2,400 while whales increased holdings by 0.64%, roughly 166,000 tokens, and XRP whales bought more than 45 million tokens worth about $63 million.
TD Sequential buy signals fired on four-hour charts for all three assets — a pattern that, while technical, can signal the formation of a local floor.
Source: CryptoPotato.
Strategy Teases Another Buy as Corporate Treasuries Expand
Michael Saylor publicly hinted at another Bitcoin purchase, posting "there's always room for more orange" on X. Strategy bought 334 BTC for $28.7 million between September 28 and October 4, bringing its holding to exactly 848,000 BTC, and repurchased about 1.77 million preferred STRC shares for $176.3 million over the same period.
The company's holdings are worth roughly $70.48 billion, about 4.04% of Bitcoin's total supply. A formal SEC filing may not appear before Tuesday because of Columbus Day. Buys by the largest corporate holder of BTC remain a visible signal of institutional demand and a supply-side factor.
In a parallel development, Evernorth completed its merger with Armada Acquisition Corp. II and prepared to begin trading on Nasdaq under the ticker XRPN on October 12. The company reported roughly 473 million XRP and about $300 million in gross proceeds, with investors including Ripple, SBI Group, Pantera Capital, Kraken and GSR.
CEO Asheesh Birla said the firm will actively deploy capital across the XRP ecosystem and grow XRP per share. One complication: Evernorth will carry its holdings at historical cost, subject to impairment, with no ability to reverse it given its ties to Ripple. The listing broadens institutional infrastructure around XRP and creates a new demand channel.
Sources: Cointelegraph, U.Today, CryptoSlate, Brave New Coin.
Regulators Draw New Lines Around Prediction Markets and Stablecoins
The CFTC issued two documents that could define the future of prediction markets. An interim final rule excludes casino-style gambling from the definition of a swap, while a separate proposal would bring event contracts — spanning sports, politics, culture and weather — into that definition.
Chairman Michael Selig framed these as commodity derivatives within the CFTC's exclusive jurisdiction. Kalshi received an extension to respond before the Supreme Court until November 9, 2026, and appellate courts have split, with two treating sports prediction markets as gambling and one as a CFTC matter.
On Capitol Hill, the failure of the Digital Asset Market Clarity Act in the Senate shifts the next phase of U.S. crypto regulation toward the SEC and CFTC. A five-year SEC Innovation Exemption from September 17 lets qualified venues trade tokenized U.S. stocks through blockchain liquidity pools, the CFTC sought comment on rules for retail leveraged crypto trading, and a SEC custody proposal from October 1 would allow state trust companies to hold client crypto. Lawyers caution that ordinary unleveraged spot trading still lacks comprehensive federal oversight without legislation.
In Europe, BaFin rejected the MiCA application of futurum bank AG, operator of Bitcoin.de, after a 15-month review. Trading has been suspended since June, affecting more than 1.1 million users. In parallel, ESMA is tightening requirements for stablecoins outside MiCA, with USDT and PayPal USD facing restrictions on holding and transfer and exchanges given three months to comply. The Bundestag also approved international information exchange under the OECD's CARF framework.
Sources: CoinDesk, Cointelegraph, CoinDesk, BTC-ECHO.
Geopolitics and Macro Keep Traders on Edge
Reports that the Houthis attacked King Khalid International Airport in Riyadh, with casualties, sharpened geopolitical tension. At least 12 people were reported killed and more than 300 injured. Secretary of State Marco Rubio condemned the attack and confirmed the death of an American citizen, while President Trump hinted the U.S. could join strikes on the Houthis. These reports remain unconfirmed and should be treated with caution.
Trump separately said he does not plan new strikes on Iran before the November 3 midterm elections. Bitcoin held near $83,000 ahead of the U.S. September consumer price index release on October 14.
In a more constructive note, Trump announced an energy ceasefire between Russia and Ukraine on Truth Social, saying both sides had agreed. Ukrainian President Volodymyr Zelensky said Ukraine supports the truce and is awaiting details from the American side. Bitcoin added more than 1% to $83,900 after his remark, having initially shown little reaction. Bloomberg's Javier Blas noted that Trump has made a similar claim before.
Sources: CryptoPotato, BTC-ECHO, CoinDesk.
Tokenization Draws Both Enthusiasm and Caution
An IMF report found genuine demand for tokenized U.S. stocks but flagged elevated volatility and thin liquidity. The fund estimated that tokenized equities are roughly 1.5 times more volatile than the underlying shares, with a market valued at about $2.3 billion and Ondo Finance and xStocks by Backed Finance accounting for more than 70%.
More than half of trading occurs outside regular U.S. market hours and about 80% of trades involve less than one share. Traditional stocks absorbed 87–99% of overnight price moves in tokenized shares at the open. The IMF recommended that regulators consider protections for round-the-clock trading — framing that will matter as large exchange players enter the space.
Nasdaq CEO Adena Friedman told TOKEN2049 in Singapore that tokenization could unlock tens of billions of dollars of trapped capital, citing U.S. Treasurys, equities and money market funds. Nasdaq agreed in September to invest $100 million in Payward, the parent of Kraken, targeting Nasdaq Equity Tokens in the second quarter of 2027, and Securitize launched tokenized versions of 12 U.S. stocks on Solana. Friedman cautioned that not every asset is liquid enough for 24/7 trading.
On the payments side, a Visa survey found that 46% of Asia-Pacific consumers would use stablecoins within five years, up from 16% over the past 12 months. Awareness stood at 66%, yet only 6% understood how they work, and 49% expected stablecoins to become common for international transfers within five years. The survey covered 14,250 people across 14 markets in June and July 2026, with fraud fears (38%) and lack of understanding (36%) the main barriers.
Sources: CoinDesk, Decrypt, U.Today, The Daily Hodl.
Altcoin Rotation: Privacy and New Narratives Take the Stage
A notable reshuffle occurred in the top 10 non-stablecoin cryptocurrencies. Zcash, Hyperliquid and Monero pushed out Cardano and Chainlink, while the top six remained unchanged. Zcash entered around $1,232 with a market cap near $20.8 billion, Monero around $530 with about $10 billion, and Hyperliquid traded near $85 at roughly $21.6 billion.
Over the year, ZEC climbed about 441%, HYPE about 127% and XMR about 77%, while ADA fell roughly 61% and LINK about 25%. The rotation reflects capital moving toward privacy and newer DeFi narratives at the expense of older altcoins.
Zcash is also trying to get ahead of future threats. A node developer expects post-quantum signature opcodes to arrive in January, combining address rotation after each transaction with WOTS hash-based signatures as a backup, while private information retrieval (PIR) rolls out in the Vizor wallet. The plan covers transparent payments only, and no network activation date is confirmed.
Dogecoin, by contrast, showed signs of fading institutional interest. It recorded net outflows of about $57.2 million over seven days ($538.16 million out versus $480.96 million in) while trading around $0.085–0.086, down roughly 9% for the week. Bitwise will halt trading of its Dogecoin ETF, BWOW, on October 14, with NAV calculation on October 21 and payout on October 22. DOGE remains the 11th-largest crypto by market cap at $14.8 billion, just ahead of Zcash.
Sources: U.Today, Decrypt, U.Today, Crypto.News.
Starknet, Papertrade and Other Market Movers
Starknet said it is actively considering becoming an independent Layer 1 with the goal of a fully quantum-resistant network by 2027. On that narrative, STRK surged 116.7% in a week to $0.119, including a 17.7% gain in a day as of October 11. A token unlock on October 15 could release up to 127 million STRK for early contributors and investors, and a trader on Hyperliquid turned a $2.9 million 3x STRK long into about $1 million in unrealized profit in under a day. StarkWare published a three-phase roadmap in June, while the Ethereum Foundation targets quantum resistance by December 2029.
In DeFi, perpetual DEX Papertrade on Hyperliquid saw open interest collapse 93.7%, from $11 billion to $693 million in about 24 hours, while TVL fell from $118 million to $70 million and then $67 million. The platform acknowledged attempts to manipulate BTC and ETH prices through Hyperliquid's BBO pricing and said it would tighten trading limits and cap exposure on-chain and through relayers. Oracle-manipulation allegations followed, with one wallet reportedly showing about $1.73 million in realized profit.
The incident highlights oracle and managed-pool risks in newer DEXs and raises questions about the durability of such models. Meanwhile, Coinbase completed its integration with Deribit for institutional traders, giving former International Exchange clients access to Deribit's options suite and margin system, with U.S. Prime options trading to roll out separately — a consolidation of options infrastructure that strengthens Coinbase's hand in institutional derivatives.
Sources: CryptoSlate, Finbold, The Defiant, Bitcoin.com News, The Defiant.
Looking Ahead
Attention has already turned to the U.S. September CPI print on October 14 and the expected XRPN debut on Nasdaq the same week. For now, the picture is one of a market digesting heavy ETF outflows, absorbing a string of security shocks to self-custody, and waiting on macro data and geopolitics to set the next direction.