TLDR Crypto 2026-10-29

Bithumb, South Korea's second-largest exchange, said an outsider breached the internal mobile system employees use for work and messaging, and personal information was stolen. No crypto funds were reported lost. It says the system is separate from its trading platform, so customer assets can't be reached that way. It has not said how many people's data were exposed or whether deposits or withdrawals were affected. Regulators are also assessing Daishin Securities, which said data for 38,490 customers leaked, and Mirae Asset Global Investments, which blocked abnormal access. The regulator's governor said cyberattacks had hit 16 financial firms as of October 14. In February, Bithumb mistakenly credited customers with 620,000 BTC instead of 620,000 won.

Moody's gave RLUSD an A2 long-term and P-1 short-term deposit rating. It cited reserve credit quality and market value, coverage, liquidity, redemption arrangements, segregation, and third-party custody. The reserve is mostly short-term US government assets and cash held at BNY (Aa1), and the custodian targets 103% coverage. Ripple says it is the first stablecoin to get an investment-grade rating from Moody's. RLUSD has a $2.5B market cap and is used mainly inside Ripple's payments and as collateral in Ripple Prime. The ratings could fall if reserve quality, coverage, or liquidity weakens. Ripple also just got final OCC approval for Ripple National Trust Bank.

Fynd AMM introduces a last-mover pricing mechanism where the pool sets its price during routing after observing all competing quotes, rather than submitting a fixed price before DEX aggregators query it. Traditional AMMs and propAMMs bid blind, causing LPs to either overbid on trades they win or lose trades they could have priced to win. A backtest of 60 ETH/USDG trades on Robinhood shows a standard 30 bps pool captures half the trades but collects only 37% of available fees, while Fynd AMM charges the maximum fee that still wins each trade, generating 2.7x more LP revenue. The protocol is launching on Ekubo's concentrated liquidity infrastructure and is already integrated on Robinhood and Base.

Stripe Link balance is a pre-funded wallet for AI agents that removes per-transaction approval by letting consumers deposit funds and set spending limits upfront, with Instinct as the first integrated assistant. The stack routes fiat through Stripe Crypto Onramp into dollar-denominated stablecoins on Tempo, uses Privy's non-custodial wallets for key management and signing, then converts back to virtual debit cards via Stripe Issuing, so merchants receive standard card transactions with no crypto integration required. Agentic purchases through Link grew 38x in one month, with Muse reporting over 25% of weekly users shopping via agent. The architecture deploys stablecoins as settlement infrastructure rather than a user-facing asset class, keeping crypto rails invisible to both merchants and consumers while solving the approval-friction bottleneck that has constrained autonomous agent commerce.

Spiral, Block's Bitcoin-focused subsidiary, published a report arguing Bitcoin payments infrastructure is production-ready but adoption remains a demand problem, not a technology gap. Lightning runs in production, self-custodial wallets have abstracted most complexity, and over one million US merchants can accept Bitcoin through Square. The strategic concern is that major payment providers are now updating financial rails with stablecoin support, and if those rails exclude Bitcoin natively, switching costs could lock the current payments upgrade cycle into stablecoin infrastructure. Spiral is issuing a call for moonshot ideas to accelerate Bitcoin payment adoption before that window closes.

CVE publications hit 14,939 in September alone, four times the 2025 monthly average, with Critical and High severity vulnerabilities up 161% year-over-year and now comprising more than half of all new records. The surge coincides with a structural shift: internet security was architected around human attackers, so CAPTCHAs, rate limits, and fraud detection all break when AI agents can solve challenges in milliseconds and fire thousands of requests per second. Proposed fixes are crypto-native: verifiable on-chain agent identity, cryptographic authorization proofs, and machine-to-machine payment rails like x402. Hacktron is positioned as a security scanner for this agent-centric web, using the same AI techniques attackers deploy.

Buybacks mechanically raise price, and crypto needs them because token holders have no legal rights. There is positive evidence for buybacks. However, buybacks compound slowly and fail if the business is a flash in the pan. Teams that ran points programs have a moral duty to show alignment through buybacks. Investors should buy coins where the protocol is the marginal buyer.

The “Pump.fun is the enemy” backlash repeats what happened to OpenSea when NFTs faded. When a speculative asset class stops paying, the platform tied to it becomes the villain. Memecoins are exhausted, liquidity is fragmented, and average traders now compete against professionals. Removing Pump.fun wouldn't fix that, because another platform would take its place. People are seeking a platform-level fix for a market-level problem. However, some of Pump.fun's decisions deserve criticism regardless.

Aero is processing 10.5% of all DEX spot volume so far this week, its highest weekly share in two years and the second highest ever.

Robinhood's crypto revenue rose 20% from the prior quarter to $120M, including $26M from Robinhood Chain in its first quarter on mainnet.

Base expanded its tokenized stock roster with $AAPLc and additional tickers now tradeable and composable as DeFi primitives.

Zones proving is coming soon to Tempo, the stablecoin settlement layer currently running in no-proof mode that underpins Stripe's Link balance for agentic payments.