Web3 Weekly: October 5–12, 2026 — ESMA orders a stablecoin cutoff as Abstract shuts down and Starknet weighs leaving Ethereum
An October 5–12 briefing on ESMA's order that MiCA-licensed firms cut off non-compliant stablecoins, the CFTC's first crypto rulemaking notice, Abstract's shutdown and Starknet's Layer 1 question, $159.5 million in fresh venture equity, and a hardware-wallet supply-chain incident with as much as $93.2 million traced.
The seven days from October 5 to October 12, 2026 split into two kinds of news: instructions that now carry deadlines, and networks that no longer earn their keep. Europe's securities regulator told the firms it supervises to stop serving stablecoins that do not meet MiCA, and told national authorities to clear what remains within three months 1. The U.S. Commodity Futures Trading Commission opened the first public step of its own crypto rulemaking 2.
The subtractions were the week's other story. Abstract, the Ethereum Layer 2 built by the company behind Pudgy Penguins, said it will switch off on December 15 3. StarkWare said an independent Starknet would be its clearest path forward 4. Both statements are arguments about one number: what a chain costs to run against what it earns.
Four venture equity rounds disclosed in the window came to $159.5 million, led by a $90 million Series B for a tokenized money-market fund issuer 56.
Two security stories ran all week. Ledger confirmed that at least one wallet drained in a suspected supply-chain attack had held an unauthorised hardware implant, and blockchain analysts put the traced total as high as $93.2 million 7. Liquid Network's bitcoin redemptions stayed frozen on day 35, with reserves covering 85.8% of outstanding L-BTC 8. Bitcoin traded below $83,000 on October 12 9.
Weekly event matrix
| Organization / Project | Category | Amount / Scope | Disclosed date | Substantive impact |
|---|---|---|---|---|
| U.S. CFTC | Rulemaking notice | Crypto asset transactions and markets | Oct 5, 2026 | Opens the first public step toward a federal crypto framework; proposes a "crypto asset market" registration subcategory; creates no obligation 2 |
| ESMA | Supervisory opinion | Non-MiCA-compliant stablecoins | Oct 8, 2026 | Calls on national authorities to make CASPs stop serving non-compliant ARTs and EMTs, with remediation inside three months 1 |
| ESMA | Call for evidence | Tokenised collateral in central clearing | Oct 9, 2026 | Asks whether EU clearing houses can safely take tokenised collateral; responses due Jan 15, 2027 10 |
| ESMA | Leadership | Carlo Comporti appointed Chair | Oct 9, 2026 | Changes who runs the regulator supervising MiCA compliance across the EU 11 |
| U.S. SEC | Comment clock set | Crypto custody proposal, File No. S7-2026-35 | Page updated Oct 6, 2026 | The 60-day comment period is now running, with comments due Dec 7, 2026 12 |
| U.S. SEC | Enforcement surface | No crypto case in the window | Oct 5–9, 2026 | The week's releases cover cross trading, a cherry-picking judgment and a compliance seminar; none is a crypto action 13 |
| Financial Stability Board | Report | Cross-border stablecoin gaps | Oct 12, 2026 | Warns that stablecoins are untested in a crisis and that multi-issuer reserves can strand assets across borders; not legally binding 14 |
| Blockchain.com | Regulatory application | CFTC designation and registration | Oct 9, 2026 | An exchange asks to offer U.S. event contracts and crypto derivatives as a designated contract market 15 |
| Abstract (Igloo Inc.) | Network wind-down | Shutdown Dec 15, 2026 | Oct 6, 2026 | Ethereum Layer 2 to close; about $17.1M in canonically bridged ETH sits on it; withdrawals run through operators 3 |
| Starknet / StarkWare | Positioning | Considering an independent Layer 1 | Oct 8, 2026 | Quantum-resistance target of 2027; no launch date; STRK gained 322% over four weeks 4 |
| Ethereum (Glamsterdam) | Testnet activation | Sepolia, near-200M gas per block | Oct 6, 2026 | The capacity rehearsal ran; Hoodi is tentatively set for Oct 27 and mainnet has no date 16 |
| Solana | Feature activation | Target slot time cut to 200 ms | Oct 9, 2026 | Slot target falls from 250 ms; the recent-blockhash validity window shortens to about 30 seconds 17 |
| Starknet | Mainnet upgrade | v0.14.4 | Oct 5, 2026 | Confirms the prior week's pending item; breaking changes for prover and full-node operators 18 |
| XRP Ledger | Vulnerability disclosure | Decade-old flaw, already patched | Oct 9, 2026 | A payment counting error could have created XRP from nothing; fixed Sept 25 in xrpld 3.4.1 19 |
| Ledger / CryptoBilis | Supply-chain incident | Up to $93.2M traced | Oct 9–12, 2026 | Tampered devices reached buyers through a reseller listed as authorised; Tether froze $10M in USDT 7 |
| Liquid Network | Frozen redemptions | About 602.53 BTC gap | Oct 11, 2026 | Peg-outs remain suspended 35 days after an exploit; reserves cover 85.8% of outstanding L-BTC 8 |
| Spiko | Equity round | $90M Series B | Oct 6, 2026 | Tokenized cash funds; total funding reaches $120M 5 |
| Meanwhile | Equity round | $37.5M | Oct 8, 2026 | Bitcoin-denominated life insurer; Bain Capital Crypto leads 6 |
| Navra | Equity round | $19M Series A | Oct 6, 2026 | A single interface onto multiple blockchains, founded by Mike Cagney 20 |
| Vest Labs | Equity round | $13M | Oct 7, 2026 | Proprietary trading firm for perpetual futures, backed by Portal Ventures 21 |
Web3 financing and capital deployment
Fresh venture equity disclosed between October 6 and October 12 comes to $159.5 million across four rounds. Last week's window produced $117.1 million across three, so the headline total is up about a third while the count of new companies barely moves. The concentration sits in cash management rather than protocols: one round is $90 million of the total.
Four instruments moved this week, and each is reported on its own terms: equity priced and disclosed in these seven days, token rounds and token purchases, undisclosed strategic placements, and one large transaction that belongs to a different industry.
Spiko — $90 million Series B (October 6). New Enterprise Associates led, with Index Ventures, Bpifrance, Speedinvest, Flourish Ventures, White Star Capital, Mirana Ventures and Wintermute Ventures participating 5. The London- and Paris-based company issues regulated money-market funds whose shares are recorded on a blockchain, sold in euros, dollars, pounds and Swiss francs, and its own post says the round takes total funding to $120 million 5. Spiko reports $2.7 billion placed in its funds, up more than fivefold in twelve months, across more than 10,000 businesses and individuals in over 25 countries, and describes itself as the largest range of tokenized treasury funds ahead of BlackRock and Franklin Templeton 5. Those figures, and the ranking, are the company's own claims; the round's size and its lead are the facts to bank on. The stated use of proceeds is new products, new European markets and hiring 5.
Meanwhile — $37.5 million (October 8). Bain Capital Crypto led, with Haun Ventures, Framework Ventures, Pantera Capital, Apollo, Northwestern Mutual Future Ventures and Morgan Creek Digital 6. The Bermuda-based insurer holds a Bermuda Monetary Authority licence and denominates its balance sheet, reserves and audited financial statements in bitcoin 22. It has signed 15 broker partners serving wealthy clients in Singapore, Hong Kong, the United Arab Emirates and Switzerland, and its newer product is aimed at buyers outside the United States 6. The round follows an $82 million raise in October 2025 that Bain Capital Crypto co-led 6.
Navra — $19 million Series A (October 6). Ribbit Capital led an oversubscribed round, with Baseline, DCM, Jump Crypto and Figure participating 20. Navra is led by Mike Cagney, who co-founded SoFi and Figure, and is pitching a single interface onto multiple blockchains for on-chain lending and securities 23. The company says a limited rollout follows in late October 22.
Vest Labs — $13 million (October 7). Portal Ventures led the round for a New York company that lets qualifying traders trade perpetual futures with firm money on the Vest Markets platform 21. Fortune reported the financing as a pre-seed and the company's own announcement described it as supporting the trading platform; the round's label is unsettled, so treat the amount and the lead as the firm ground 21.
Also disclosed, below $10 million. A weekly tally covering October 3 to 9 lists IMMIX at $3.5 million from Crane Venture Partners, BTSE and Portfolio Ventures for stablecoin conversion; Soda Labs at a $3 million seed funded entirely by NextBlock for blockchain privacy infrastructure and validator tooling; Imperial at $1.5 million in seed funding from Foundation Capital for a Solana trading platform; and Anyflo at $1 million from Mysten Labs for stablecoin payments, alongside an acqui-hire 22. That source's window opens two days before this issue's and mixes instruments, so these four are reported as disclosure, not summed into the equity total above 22.
Token rounds and strategic placements, kept separate. Umia raised $6.11 million in a public token auction with ten funds and nearly 700 bidders; Anvil announced a $5 million purchase of its ANVL token led by Founders Fund; Antseed Foundation secured a $2.4 million token round led by Spark Capital 22. Two rounds stayed undisclosed by design: OKX completed a strategic investment extension involving Circle, Ripple, Qube Research & Technologies and SC Ventures at a $25 billion pre-money valuation, and Xverse announced a strategic round led by Draper Associates for self-custodial bitcoin services 22. None of these is equity priced this week, and none is added to the $159.5 million.
Deliberately outside the Web3 ledger. Two of the largest items in the week's crypto funding databases are not Web3 businesses: Nous Research's $90 million for open AI models and Mecka's $60 million for robotics data infrastructure 22. A third, larger one is a different transaction type again: SWI said it raised $894 million to repurpose the former FTX bitcoin miner Genesis Digital into AI infrastructure 24. Counting it as crypto venture capital would inflate the week by more than five times for a deal about data centres.
Regulatory actions and market structure
The CFTC opens its crypto rulemaking
On October 5 the CFTC published an Advanced Notice of Proposed Rulemaking on its intent to build a regulatory framework for crypto asset transactions — retail commodity transactions involving crypto assets under section 2(c)(2)(D) of the Commodity Exchange Act 2. The notice asks how the agency can prevent abusive practices under a uniform national regime, how to codify industry best practices it has observed since it began overseeing parts of these markets in 2014, and how to create a new designated-contract-market subcategory called a crypto asset market, purpose-built for those transactions 2.
Chairman Michael S. Selig framed the notice as the beginning of rulemaking grounded in the Commodity Exchange Act and a presidential directive to build federal crypto market structure from existing authority, and said the aim was to prevent fraud rather than only prosecute it 2. He repeated the argument in a Wall Street Journal opinion piece the same day 25.
What this changes is narrow and worth stating precisely. An advance notice of proposed rulemaking is a request for comment, not a proposal, and nothing in it binds anyone. Comments are due 60 days after it appears in the Federal Register, and the Commission says it will use the responses to decide whether to proceed 2. The practical consequence is that the public record now has a docket where one did not exist, and firms that want a specific definition of "crypto asset market" have a window to argue for it.
Separately, the CFTC moved to treat certain event contracts as swaps, a step in its long fight over prediction markets 26. And Blockchain.com said it is seeking CFTC designation and registration so it can offer U.S. event contracts and crypto derivatives 15. Prediction-market jurisdiction is now being argued in several venues at once, including a push for the Supreme Court to take it up 27.
ESMA tells CASPs to cut off non-compliant stablecoins
On October 8 ESMA published an opinion setting out what it expects of crypto-asset services that touch asset-referenced tokens and e-money tokens — the two MiCA categories the regulation calls stablecoins — that do not meet MiCA's requirements 1. Its instruction is direct: crypto-asset service providers authorised under MiCA should stop providing services related to non-compliant stablecoins to clients in the European Union 1.
The scope is the whole MiCA service list, not one activity. It covers operating a trading platform, exchange services, order execution, placing crypto-assets, receiving and transmitting orders, investment advice, transfers, custody and administration, and portfolio management, whether a firm offers one of them or several together 1. ESMA calls on national competent authorities to check that firms neither maintain, introduce nor facilitate client access to these tokens, and to require technical, contractual and organisational controls that keep them unavailable in the EU — including controls that stop clients from acquiring or increasing exposure 1.
The deadline is the part to calendar. Where supervisors find pre-existing exposures, they should require remediation as soon as possible and no later than three months after publication of the opinion 1. Any service that continues must be limited to what is needed to liquidate, convert, withdraw, transfer or safekeep the assets, and must stay time-limited, risk-based and closely supervised 1. The underlying document is published as an opinion addressed to the national authorities, which is why its first effect is on supervisory behaviour rather than on firms directly 28.
This is the piece of the week that moved furthest past last week's news. On September 30, ESMA sent the European Commission recommendations for rewriting MiCA, including explicit rules to stop regulated firms offering services tied to stablecoins that fail MiCA 29. Eight days later it told national supervisors to act on that point now, before the review it asked for has produced any legislation.
Europe's two other moves
ESMA launched a Call for Evidence on October 9 on whether central counterparties in the EU could use tokenised forms of collateral safely, covering "digital twin" versions of assets held in traditional infrastructure, assets issued directly on distributed ledger technology, and hybrid arrangements 10. The questions are concrete: whether a clearing house could access, transfer and convert tokenised collateral into liquidity if a clearing member defaulted, and how client protection, segregation and settlement finality would hold where a distributed ledger meets traditional market infrastructure 10. Responses are due January 15, 2027, and ESMA says it will assess them in the first quarter of 2027 before deciding whether any regulatory or supervisory action follows 10. It is a question, not a decision.
On the same day, Carlo Comporti was appointed Chair of ESMA, replacing the leadership that had been carrying MiCA supervision 11. The scoped negative for Europe is now different from recent issues in one respect and unchanged in another: the ESMA news surface did carry a MiCA supervisory instrument this window — the stablecoin opinion — while it carried no technical standard, no passporting decision and no individual CASP supervision action between October 5 and October 12 30. That check covers ESMA's publication page and says nothing about national regulators, which publish authorisations on their own sites.
The SEC: a quiet enforcement surface, and a comment clock that started
The SEC's press releases dated October 5 to October 9 covered a proposal to expand the securities registered funds may cross-trade, a final judgment sought against a former Western Asset co-CIO in a cherry-picking case, a virtual compliance outreach seminar, and World Investor Week 13. None is a crypto enforcement action, and the custody proposal that dominated last week's issue is not among them 13.
One detail on that proposal did move. The rule page for File No. S7-2026-35 now carries a comment deadline of December 7, 2026, which means the 60-day clock started when the proposal was published in the Federal Register 12. Last week the date was open; anyone planning to comment now has seven weeks.
The FSB warns about stablecoins across borders
The Financial Stability Board published a report on October 12 warning that stablecoins have not been tested under severe stress or insolvency, and that national frameworks are developing at different speeds, leaving open how holders would recover funds if an issuer failed 14. The market it is describing grew from about $206 billion at the start of 2025 to $306 billion, mostly in dollar-pegged tokens 14.
The sharpest point is structural. In multi-issuer arrangements, affiliated companies can issue the same stablecoin and share liability while holding reserves in separate jurisdictions; if holders can redeem with any issuer in the group, demand can pile up on one entity while the assets sit elsewhere, and moving them may get harder in a crisis 14. Stablecoins also trade around the clock while the markets for their reserves keep business hours, a mismatch that matters in a run 14. In an accompanying letter, Chair Andrew Bailey wrote that global stablecoin arrangements are inherently cross-border while cross-border cooperation in the area is still in its infancy 31.
The FSB's recommendations are not legally binding, though members tend to commit to putting agreed standards into national practice 32. The report lands three days before G20 finance ministers and central bank governors meet on October 15 32.
Layer 2 networks and scaling
No new Layer 2 launched in this window. Two moved in the other direction, and one of them is the week's clearest statement about the economics of running a chain.
Abstract will shut down on December 15, 2026. Igloo Inc., the company behind Pudgy Penguins, announced the wind-down on October 6 and confirmed it the following day 33. The network is an Ethereum Layer 2 built for consumer applications, and the reasons given are high running costs, thin liquidity, few financial applications and little institutional appetite 33. Onchain data showed about $17.1 million in canonically bridged ETH still on the network, and the wind-down plan sets out no independent exit after December 15: withdrawals depend on operators processing them 3.
Two details distinguish this from a token project quitting. Igloo never issued a token for Abstract and never ran a coin offering, funding the chain out of its own pocket for roughly 18 months; the reported reach is around 400,000 users and somewhere between 300 million and 325 million transactions over the chain's life, figures that come from coverage of the shutdown rather than audited accounts 33. And the ecosystem token PENGU runs mainly on Solana plus Ethereum and BNB Chain rather than on Abstract, so the shutdown does not strand it; it fell around 7% on the news 33.
Starknet is weighing leaving Ethereum. On October 8, StarkWare CEO Eli Ben-Sasson said independence would let Starknet control its own security migrations instead of waiting on Ethereum or Bitcoin, with full quantum resistance targeted for 2027 — roughly two years ahead of Ethereum's own timeline 4. Starknet's own account had described an L1 move as a question rather than a decision the day before, and the network still settles on Ethereum and bridges to it 4. No launch date has been set. STRK gained 322% over four weeks to a nine-month high on the proposal 34.
And one step toward the opposite direction. On October 5 a core contributor to the Ethereum Economic Zone published evidence of an atomic Layer 1 to Layer 2 transaction settled on Ethereum mainnet — a cross-layer call carrying 0.001 ETH together with a rollup state update, packaged so both landed under the same Ethereum block ordering 35. The point of the design is that related calls on the base chain and a connected rollup either all succeed or all revert, which removes the bridging step and the half-finished state that comes with it 35. It is a narrow technical proof, not production infrastructure; Gnosis Chain has been discussed as an early target for a live EEZ rollup block in late 2026 or early 2027 35.
Protocol upgrades and infrastructure
Ethereum's Glamsterdam ran on Sepolia. The upgrade activated on the test network on October 6 at 13:53:36 UTC, at epoch 353,024 and slot 11,296,768 — the schedule the Ethereum Foundation had set in September 36. By October 8, blocks were being produced with a gas limit near 200 million, up from about 60 million before the change 16. That is a bigger budget, not three times the throughput: Glamsterdam also changes what individual tasks cost, and CoinDesk's sample of more than 25 consecutive blocks found they used roughly 52 million to 92 million gas each, between 26% and 46% of the allowance 16.
The structural changes are the reason to care. Glamsterdam writes the handoff between the specialists who assemble transactions and the validators who publish blocks into the protocol, and attaches to each block a list of the accounts and stored data its transactions touch, which lets software fetch data early and check unrelated transactions in parallel 16. One late problem was fixed first: Prysm shipped a release hours before the fork that sets its validators to the new 200 million gas limit by default rather than the previous 60 million 37. During a six-minute voting period on October 8 all 32 scheduled blocks were proposed and 99.97% of eligible testnet stake voted toward finality 16. Hoodi, the next public test network, is tentatively set for October 27 pending the Sepolia results, and mainnet still has no activation date 16.
Solana cut its target slot time to 200 milliseconds. The feature gate went active in the October 8 changelog, and shorter slots take effect one epoch after activation, which placed live 200 ms slots at epoch 1053 on October 9 1738. This is the last stage of a reduction that began at 400 ms and moved through 350 ms and 300 ms 38. The specification behind it, SIMD-0525, cuts per-slot work limits in proportion to slot duration, so capacity per second stays roughly flat while blocks get smaller and more frequent 38. What changes for builders is a tighter clock: a leader's four consecutive slots now give it 800 milliseconds rather than a second, and the recent-blockhash validity window falls from about 38 seconds to about 30, leaving less room for offline signing or human approval before a transaction's block reference expires 38.
Two supporting items landed in the same changelog. Version 3 of the solana web3.js client library is ready for general use, installed explicitly by version tag for now 17. And on October 10 Anza CEO Brennan Watt opened a discussion proposing to raise Solana's block compute limit from 50 million to 100 million compute units across five feature gates, roughly reversing an earlier halving 39. Alpenglow, the consensus replacement Anza has been preparing, remains pending on mainnet 38.
Starknet's v0.14.4 activated on mainnet on October 5, which resolves the item this channel carried last week as scheduled pending governance 18. The change users will notice is a new ceiling on what one proven transaction can carry: with SNIP-36, a proof can now be generated for a virtual block holding a single transaction that would fit inside a Starknet block gas-wise, up to 1.1 billion L2 gas, so an application can compress logic that would not fit in a regular transaction and pay for it as a proof rather than as execution 18. Large proofs take one to two minutes against three to five seconds for the small-proof flow and use a separate entry point 18. Gas weights changed for several operations, and fee estimation must be run against a 0.14.4 node because estimates carried over from the previous version will be wrong for the affected operations 18.
XRP Ledger disclosed a decade-old flaw it had already fixed. The security report published October 9 describes a counting error in the ledger's built-in exchange: an attacker could open hundreds of accounts offering tiny amounts of a token for unusually large amounts of XRP, then send one payment that bought every offer at once 19. The total owed would overflow the software's count, paying the selling accounts in full while charging the buyer almost nothing and leaving spendable XRP that had not existed 19. The ledger's post-transaction supply check would have relied on the same miscounted total, and its per-account receipt limit would not have triggered because the XRP was spread across hundreds of accounts 19. RippleX says it reproduced the attack on a standalone server, found no evidence of exploitation on any public network, and shipped the fix in xrpld 3.4.1 on September 25 without saying what it repaired 19.
Security incidents
| Project | Amount | Method | Time | Status |
|---|---|---|---|---|
| Ledger devices via reseller CryptoBilis | Up to $93.2M traced (Bitquery); $94.5M (YFarmX) — neither confirmed by Ledger | Suspected supply-chain tampering; unauthorised hardware implant found in at least one device | Reported Oct 9; implant confirmed Oct 10–11 | Under investigation; Tether froze $10M in USDT; about $81M still traceable as of Oct 11 7 |
| Liquid Network | About 602.53 BTC reserve gap | Peg-out mechanism trusted the sidechain's validated state instead of a separate reserve check; an invalid transaction drained roughly 4,000 unbacked L-BTC | Exploit Sept 6; status Oct 11 | Redemptions still suspended on day 35; 85.8% reserve coverage; no reopening date 8 |
| XRP Ledger | None lost | Counting error in the ledger's built-in exchange could have created unbacked XRP | Bug dated to 2015; fixed Sept 25; disclosed Oct 9 | Patched; no evidence of exploitation on public networks 19 |
Ledger's reseller problem ran all week. The hardware-wallet maker said on October 9 that it was investigating reports of stolen funds linked to devices sold through CryptoBilis, a reseller in Southeast Asia, and asked the reseller to pause all sales and shipments 40. It told buyers who had purchased from the reseller within 90 days not to set the devices up, and told those who had already activated a wallet to move assets to a new device with a newly generated recovery phrase — because restoring the same phrase on new hardware recreates the same keys and does not change them 41.
By October 12 the picture was firmer in some respects and no firmer in others. Ledger said every confirmed case involved devices sold through CryptoBilis and that its own systems and direct sales channels were unaffected, while declining to give a device count or a loss figure 41. It confirmed an unauthorised hardware implant in at least one affected device without explaining how the implant worked or how the devices were tampered with 7. Blockchain analytics firm Bitquery said it traced $93.2 million to the incident, mostly USDT and TRON tokens from 315 wallets across six blockchains, while security research platform YFarmX reported $94.5 million from 521 addresses across seven 42. Tether has frozen $10 million in USDT tied to the theft, and Bitquery said roughly $81 million could still be traced onchain as of October 11, with some funds having moved through Tornado Cash and Zcash 7.
The part that has drawn criticism is the framing. CryptoBilis was listed as an authorised reseller on Ledger's own website for Malaysia and Indonesia when the sales pause was requested, which is why some holders argue the failure belongs to Ledger's channel controls rather than to one reseller 41. Ledger said it is reviewing authorised-reseller controls and advancing hardware protections, and has warned buyers about scammers exploiting the incident 41. At least one other hardware wallet, OneKey, has cut off the same reseller and offered free replacements 43. For anyone holding a device bought through a regional reseller rather than direct, the practical action is unchanged: do not initialise an unused device, and if one is already active, generate new keys.
Liquid's redemptions are still closed. Liquid Network is a Bitcoin sidechain whose L-BTC token is designed to be backed one-for-one, and its bitcoin redemptions, known as peg-outs, remained suspended on October 11, 35 days after an exploit drained reserves 8. A snapshot that day showed 3,632.23 BTC in federation reserves against 4,234.76 L-BTC outstanding — about 85.8% coverage, leaving a gap of roughly 602.53 BTC 8. Blockstream's own assessment of the September incident put the amount still subject to recovery at approximately 602 BTC 44.
Transfers on the network resumed on September 10, but peg-outs restart only once full one-for-one backing is confirmed and required software updates, testing and an independent security audit are complete, and the published recovery plan gives no firm reopening date or commitment to fund the gap 8. The underlying flaw was a validation one: the cache of previously verified cryptographic proofs accepted an invalid transaction, creating roughly 4,000 unbacked L-BTC that were then converted into bitcoin through the normal peg-out process 8.
For scale, the incidents already on the industry's ledger this year include Bitget above $350 million, Liquid around $320 million, Drift at $295 million and Kelp at $293 million, according to the hack tables CoinDesk cites 40. The Ledger episode is not in those tables, because it is not a protocol exploit: the assets were in user wallets, and the suspected failure was in how the hardware reached them.
Editorial view
The reading that follows is this outlet's, drawn from the events above; the events themselves are the sources' unless stated otherwise.
The week made one argument twice. An Ethereum Layer 2 funded by its own company for 18 months without a token has decided the cost structure is unwinnable and set a shutdown date, and that decision follows Blast's, which cited $1,793 of monthly network revenue against a peak near $3.5 million 3. The same week, the parent company of the largest zero-knowledge rollup floated leaving Ethereum entirely, which is a statement about control of security spending and not only about quantum resistance 4. Both point at the same pressure: block space on a rollup is sold in a market where the marginal cost of running the chain does not fall when demand does.
The second argument is about who writes the compliance calendar. In September, ESMA asked the European Commission to change MiCA, and one of its asks was explicit rules to stop regulated firms offering services tied to non-compliant stablecoins 29. Eight days later it published an opinion telling national supervisors to require exactly that, with a three-month remediation clock 1. The legislative route has not produced anything; the supervisory route has produced a deadline. For a firm deciding whether to keep a euro stablecoin on its venue, the operative date is the supervisor's, not the Commission's.
The third thread is timing rather than substance. The CFTC's notice is a request for comment, the SEC's custody proposal is still a proposal with comments due December 7, and the FSB's report says it is not binding. Three of the week's four regulatory items create no obligation on anyone today, and the one that does is a supervisory opinion with a clock attached to it. That is the shape to hold onto: this week's rules are mostly in the future, and this week's enforcement is mostly absent.
Follow-up by role
Founders and operators. If you run a MiCA-authorised firm and any part of your stack touches a euro or dollar stablecoin that is not on the compliant list, your three-month remediation window opened on October 8; ESMA expects supervisors to require that exposures be cleared, and any residual service to be limited to liquidation, conversion, withdrawal, transfer or safekeeping 1. If you are building on Abstract, the deadline to bridge balances off is December 15 and the withdrawal path runs through operators, so start now rather than on the deadline 3.
Investors and deal teams. Four rounds totalling $159.5 million is the equity number for the week, and $90 million of it went to tokenized cash funds — a category that now has a fund-issuer with $2.7 billion placed and a tokenized-money-market peer set to compare it against 5. Bear in mind that of the week's other large headline figures, Nous Research and Mecka are AI and robotics companies tracked by crypto funding databases, and SWI's $894 million is an AI data-centre transaction, so none of them belongs in a Web3 comparables set 2224.
Compliance teams. MiCA's stablecoin perimeter just acquired a supervisory deadline, so the question for a firm is not whether a token is listed somewhere but whether it is available to EU clients through any MiCA service it provides 1. On the U.S. side, the comment window on the SEC's custody proposal closes December 7, 2026, and the CFTC's notice will open its own 60-day window on Federal Register publication 212.
Node, validator and staking operators. Sepolia operators have already forked; Hoodi is tentatively set for October 27, so treat the next month as a client-update window for both execution and consensus clients 1636. On Starknet, v0.14.4 makes proofs from the previous version invalid and does not support running two prover versions side by side, so SNIP-36 prover operators must upgrade in the same window as the network and should expect a few minutes of downtime for private transactions 18. Solana's 200 ms slots shorten leader windows and roughly double pre-Alpenglow vote fees per unit of time, which is worth watching in your own vote-latency numbers 38.
Watchlist
- ESMA's three-month stablecoin clock. Supervisors should require remediation of pre-existing exposures no later than January 8, 2027, three months after the October 8 opinion, and ESMA has said any residual service must be time-limited 1.
- The CFTC's crypto rulemaking. Comments run 60 days from Federal Register publication, and the agency will then decide whether to propose rules, including the proposed crypto asset market registration category 2.
- The SEC custody proposal, File No. S7-2026-35. Comments are due December 7, 2026 12.
- Glamsterdam on Hoodi, tentatively October 27, pending the Sepolia results, with mainnet still undated 16.
- Abstract's December 15 shutdown and the $17.1 million in bridged ETH still on the network, and whether any independent exit path appears before the deadline 3.
- Starknet's L1 question. Starknet's own account called it a question rather than a decision; watch for a governance proposal, a date, and whether settlement on Ethereum changes 4.
- Ledger's investigation. Whether the company publishes a device count and a loss figure, how the implant worked, and whether it offers any reimbursement for the drained wallets 7.
- Liquid's reopening conditions. Peg-outs restart only on full one-for-one backing plus a completed audit, and no date or funding commitment for the roughly 602 BTC gap has been published 8.
- Blast's October 26 withdrawal deadline, carried from last week, which falls before Abstract's 45.
- The MiCA review. Whether the Commission takes up the recommendations ESMA sent on September 30, including DeFi access as a licensed service and binding opinions on token classification 29.
- Kalshi's reported round, still unclosed since it was reported in the previous window, against Polymarket's 46.
- The G20 finance ministers' meeting on October 15, three days after the FSB's stablecoin report, where the cross-border recommendations may or may not be taken up 32.
References
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10ESMA
esma.europa.eu
- 11ESMA
esma.europa.eu
- 12SEC.gov
sec.gov
- 13SEC.gov
sec.gov
- 14FSB
fsb.org
- 15CNBC
cnbc.com
- 16CoinDesk
coindesk.com
- 17Solana
solana.com
- 18Starknet Community Forum
community.starknet.io
- 19CoinDesk
coindesk.com
- 20Business Wire
businesswire.com
- 21Fortune
fortune.com
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30ESMA News | European Securities and Markets Authority
esma.europa.eu
- 31Letter from the Chair | FSB
fsb.org
- 32
- 33
- 34
- 35
- 36Glamsterdam Testnet Announcement | Ethereum Foundation Blog
blog.ethereum.org
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44Liquid Network security incident assessment | Blockstream
blog.blockstream.com
- 45CoinDesk
coindesk.com
- 46Blockhead
blockhead.co
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.