October 11, 2026 · Crypto & Web3 Daily Digest
A roundup of crypto, regulation, and Web3 developments for October 11, 2026, with summaries, links, and commentary.
I. Regulation and Policy
1. After Clarity Stalls in the Senate, Executives See Onchain Experiments While Lawyers Say Spot Markets Still Lack a Statute (Regulation)
Summary:
CoinDesk reported on October 11 that the Digital Asset Market Clarity Act's failure to advance in the Senate has moved the next phase of U.S. crypto regulation to the Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). The SEC's five-year Innovation Exemption, introduced September 17, lets qualifying venues trade tokenized U.S. stocks through blockchain liquidity pools while permanent rules are written. On October 5 the CFTC asked for feedback on rules for leveraged retail crypto trading and a new registration category for crypto markets. The SEC's October 1 custody proposal would let state trust companies safeguard client crypto and, under certain conditions, let advisers and funds hold it themselves. Ordinary unleveraged spot trading still lacks comprehensive federal oversight beyond the CFTC's anti-fraud and anti-manipulation powers, the gap Clarity was meant to close. Bitwise chief investment officer Matt Hougan said the agency path is more favorable in the short term than legislation that would need years of follow-up rules, and that Clarity's failure preserves a regulatory moat for Coinbase, Kraken, and other incumbents. Lev Breydo, an assistant professor at William & Mary Law School, said only Congress can deliver a comprehensive framework with statutory durability.
Links:
Commentary:
Tokenized stocks and custody can proceed under agency rules, while the federal supervisor for unleveraged spot trading and the durability of those rules remain open until Congress acts.
2. Lawyers Say the CFTC's CTX and CAM Plan Is Clever and May Not Survive Review after Loper Bright (Regulation)
Summary:
CryptoBriefing on October 11 cited lawyer Renato Mariotti, who called the Commodity Futures Trading Commission's plan to police leveraged crypto trading under existing Commodity Exchange Act authority a clever reading that does not need a new statute from Congress, and warned that courts may reject it after the Supreme Court's 2024 decision in Loper Bright reduced deference to agency interpretations. On October 5 the CFTC published an advance notice of proposed rulemaking introducing Regulation CTX and Regulation CAM. CTX targets leveraged and margined retail crypto-asset transactions. CAM would create a subcategory for crypto-asset markets and a voluntary federal registration path. Venues registered under CAM would have to provide proof of reserves and maintain anti-manipulation controls. The notice sets no numerical leverage cap; staff would review a leveraged offering before it reaches customers. Unleveraged spot trading would remain under state money-transmitter licenses. Comments are expected within 60 days of publication. A Senate procedural vote on the Clarity Act failed 49-50 on September 15, after which Chairman Michael Selig pushed the rulemaking.
Links:
Commentary:
Leveraged venues have a draft federal registration path, and a court challenge after a final rule could leave early compliance spending attached to a framework that does not survive.
3. ESMA Tells Licensed Firms to Wind Down Non-MiCA Stablecoin Exposure, with an Outer Date around January 8, 2027 (Stablecoins)
Summary:
On October 8 the European Securities and Markets Authority published an opinion telling national supervisors to ensure that crypto-asset service providers authorized under the Markets in Crypto-Assets Regulation stop maintaining, introducing, or facilitating EU client access to non-compliant asset-referenced tokens and e-money tokens. The expectation covers trading platforms, exchange, order execution, transfers, custody, and portfolio management. Where legacy exposures remain, national authorities should require remediation as soon as possible and no later than three months after publication. Any continued service should be limited to liquidation, conversion, withdrawal, transfer, or safekeeping, and should stay time-limited, risk-based, and closely supervised. ForexCrunch wrote on October 11 that the outer date is about January 8, 2027, that the opinion names no token or issuer, and that new purchases, promotion, and continued market availability are prohibited. Warnings and client acknowledgements do not replace issuer-level authorization on reserves, redemption, and governance. The opinion guides national authorities, which carry out implementation. Full MiCA rules for crypto-asset service providers have applied since July 1, 2026.
Links:
- ESMA — Supervisory expectations on services related to unauthorised stablecoins
- ForexCrunch — ESMA gives EU firms three months to unwind non-MiCA stablecoins
Commentary:
Non-compliant stablecoins on EU-licensed platforms are on a dated exit, and coins held in self-custody sit outside the direct reach of this opinion.
4. Prediction Markets Head toward the Supreme Court as the CFTC Keeps Event Contracts inside the Swap Definition (Regulation)
Summary:
CoinDesk wrote on October 11 that parties filed amicus briefs last week urging the U.S. Supreme Court to take a case on whether sports-based prediction-market contracts are swaps. Former Senator Chris Dodd, former CFTC and SEC chair Gary Gensler, the National Football League, 39 states and the District of Columbia, and 145 tribal nations were among the filers. Most briefs asked the Court to side with the states and treat at least sports-related prediction markets as gambling regulated at the state level. Appellate courts are split: two have ruled that prediction markets touching sports are gambling products, and one has ruled that they are a CFTC matter. On Friday the CFTC proposed an interim final rule and a separate proposal. Casino-style gambling falls outside its definition of a swap, while event contracts remain inside it, and the agency wants sports, politics, culture, and weather formally included as event contracts counted as swaps. Kalshi received an extension to respond, with a deadline of November 9, 2026. The Supreme Court has not said whether it will hear the case.
Links:
Commentary:
State gambling law and the CFTC swap definition are now in a circuit split, November 9 is Kalshi's reply date, and a grant of review is still the Court's decision.
II. Market and Major Assets
5. Bitcoin Trades in a Narrow Band around $83,000 on Sunday, While Ether Is Still Down about 7% on the Week (Market)
Summary:
TechUpscale, citing CoinGecko as of 12:58 UTC on October 11, put bitcoin at $83,032, up 0.4% in 24 hours and down 2.5% over seven days, with a market value of $1.67 trillion. Ether was $2,502.27, up 0.3% in 24 hours and down 7.3% over seven days, with a market value of $305.6 billion. Solana was $109.39, down 0.2% in 24 hours and 9.6% over seven days. XRP was $1.39, down 0.7% in 24 hours and 7.2% over seven days. The ten largest crypto assets were worth $2.56 trillion combined. CryptoWatchDesk recorded bitcoin near $83,001 on Kraken and about $82,998 on Coinbase spot at 08:36 UTC, inside a $425 range from $82,716.1 to $83,141.0 since midnight UTC. Saturday's range was $614.9, or 0.7%. That note put Thursday's low at $80,328.6 and Monday's high at $86,973.6. Deribit's volatility index, DVOL, read 36.9, implying about 1.9% a day, while realized volatility over the prior 48 hours was 19% annualized.
Links:
- TechUpscale — Crypto market watch, October 11, 2026: bitcoin at $83,032
- CryptoWatchDesk — First print, October 11: bitcoin is calm and options are not
Commentary:
Sunday spot trade sat between Thursday's low and Monday's high, and the options market still priced a larger daily move than the prior two days delivered.
6. Starknet's Token Gains More Than 52% on Sunday, With No Governance Proposal Yet for an Independent Layer 1 (Protocol)
Summary:
Stocktwits reported on October 11 that Starknet's STRK token extended its rally, up more than 52% in 24 hours. StarkWare co-founder and chief executive Eli Ben-Sasson warned that the quantum threat may be much closer than widely assumed, and said artificial intelligence is speeding the reduction in qubits needed to break elliptic-curve signatures. He described a "bunker mode" that needs the right cryptography, the ability to upgrade it without friction, and, for Starknet, possibly its own layer-1 chain. The timeline he drew puts Ethereum's full quantum resistance at the end of 2029 and says Starknet could reach it next year if it does not have to wait on Ethereum. StarkWare researcher Avihu Levy spent a bitcoin output on mainnet in August using hash-based Quantum-Safe Bitcoin, and the cost later fell from about $320 to about $50. Starknet said that transaction does not make Bitcoin itself quantum-resistant. STRK had already jumped more than 30% on Friday, its largest single-day gain in more than a year, and is up 37% so far this year. Reporting on the independent layer-1 idea still showed no filed governance proposal, launch date, or migration plan.
Links:
Commentary:
The token is pricing a route that has not been put to a vote, and the 2027 quantum target depends on whether Starknet leaves Ethereum's timetable.
III. Tokenized Assets
7. The IMF Says More Than Half of Tokenized U.S. Stock Trades Happen Outside Regular Hours, at about 1.5 Times the Volatility (Institutions)
Summary:
CoinDesk on October 11 described a chapter of the International Monetary Fund's Global Financial Stability Report, Scaling Tokenization: New efficiencies and new vulnerabilities. The study looks at the five most actively traded tokenized U.S. equities, including Tesla, Nvidia, and Alphabet, plus measures such as the Nasdaq 100, across centralized and decentralized venues. More than half of trading took place outside regular U.S. market hours, and about 80% of trades were for less than one share. Within five minutes of the U.S. open, more than 85% of the overnight move in tokenized shares showed up in the conventional shares. The IMF estimated the tokenized real-world-asset market at about $65 billion as of July 31, with tokenized equities about $2.3 billion of that, against a 2025 global equity market capitalization of just under $160 trillion cited from the Securities Industry and Financial Markets Association. Tokenized stocks were about 1.5 times as volatile as the equivalent shares on traditional venues and significantly less liquid. The report says automated margin calls and liquidations, collateral moving between platforms, and 24-hour trading could make a shock harder to contain, and that legal rules on ownership, liquidity safeguards, links between systems, and settlement need to be in place before the market grows much larger.
Links:
Commentary:
Overnight prices already pass into the underlying shares within five minutes of the open, and $2.3 billion of tokenized equities is still small beside the global stock market those safeguards have to cover.
IV. Protocols and Security
8. The XRP Ledger Discloses a Payment-Engine Overflow That Could Have Minted about 18 Trillion XRP in One Transaction (Security)
Summary:
The Block reported on October 11 that an integer overflow in the XRP Ledger payment engine, present since 2015, summed a payment that consumed many order-book offers with unchecked 64-bit addition. A large enough total wrapped around to a small number, while the engine still credited each offer owner in full and charged the buyer only the wrapped total. The official XRPL disclosure says investigators found no evidence the issue was exploited on any public network. The attack needed hundreds of offers priced in a way no ordinary trader would use, could not be triggered by accident, and cost a few hundred XRP in account and offer reserves plus ordinary fees. Veria Labs co-founder Cayden Liao wrote on X on Saturday that an AI agent found the bug and built a working exploit, that one transaction could have created about 18 trillion XRP, about 184 times the 100 billion supply cap, and that Ripple paid the bug-bounty program's maximum of $250,000. The report was filed through the bounty on September 22. RippleX reproduced it the same day, raised it to critical, and shipped the fix in xrpld 3.4.1 on September 25, effective as soon as a server upgraded. More than 80% of validators on the default Unique Node List were running that version the same day. The project said this was the first time in more than ten years of the amendment system that a transaction-processing change deliberately skipped the normal activation process. The Batch wrapper fix and Batch itself activated on mainnet on October 9, and older servers are now amendment-blocked.
Links:
- The Block — XRP Ledger patches a decade-old bug that could have minted trillions of XRP
- XRPL — Vulnerability disclosure report for xrpld 3.4.1
Commentary:
The supply rule was protected by an emergency upgrade rather than a two-week validator vote, and servers still below 3.4.1 can no longer stay in sync with mainnet.
9. A Phishing Link Appears on Coldcard's Official X Account on Sunday; the Company Says the Account Has Used Offline Two-Factor Authentication since 2017 (Security)
Summary:
Cointelegraph reported on October 11 that bitcoin hardware-wallet maker Coldcard said an unauthorized phishing link appeared Sunday on its official X account and that the post was later deleted. The company said it is investigating how the post was published from the account, has contacted X, and is reviewing all account access. It told users not to visit or interact with the link. Coldcard said the official account has used offline two-factor authentication with tightly restricted access since 2017, and that its only official website is https://coldcard.com. It said it will share further verified updates. In the same report, Cointelegraph noted DefiLlama figures putting July 2026 crypto thefts at $247.4 million, second this year to $644 million in April. Galaxy Digital said that month's Coldcard-related exploit stole at least $100 million in bitcoin from 7,300 wallets across three confirmed waves, with a suspected fourth wave that could bring the total to about $130 million. Sunday's incident is an account post, and the company has not reported user losses from the link.
Links:
Commentary:
The report does not describe a compromise of device firmware or the official site, so the exposure is whether anyone entered a recovery phrase at the link in the deleted post.
10. Ledger Confirms a Hardware Implant in a Reseller Device, and an Investigator Estimates Losses May Exceed $86 Million (Security)
Summary:
Cointelegraph reported on October 11 that hardware-wallet maker Ledger confirmed in a Saturday post on X that one affected user's device contained an unauthorized hardware implant, and that it is contacting users as the investigation continues. Investigator Specter estimated that losses may exceed $86 million across bitcoin, ether, and Tron. Ledger has not confirmed how many customers are affected or the value of the losses. The company told Cointelegraph the incident appeared isolated to a single reseller and its Southeast Asian market. CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia, and the Philippines, has stopped sales of its hardware-wallet inventory until the investigation ends. Ledger said its infrastructure, systems, and services were not compromised. Buyers who have not set up a device from this reseller should not start setup. Those who already have should consider moving assets to a new Ledger signer with a new seed. Tips can go to bounty@ledger.fr.
Links:
Commentary:
Ledger has tied the case to the reseller channel and one inspected device, and the $86 million figure remains an investigator's estimate rather than a company-confirmed total.
11. Liquid Redemptions Stay Closed after 35 Days, with 598.5 Bitcoin Still in the Attacker's Wallet (Security)
Summary:
Bitcoin.com reported on October 11 that Liquid Network peg-outs, the redemption of L-BTC for bitcoin, remain suspended 35 days after an exploit in the Elements software. Attackers drained nearly 4,000 BTC from the protocol and had returned about 3,400 BTC by September 7, retaining 598.5 BTC worth $49.69 million on Sunday. The report said the attackers described themselves as white hats, asked for a 10% bounty, and were refused by Blockstream, which demanded the rest of the bitcoin back. Reserve coverage is still about 86%. On September 29 Liquid said on X that an independent external security audit of Elements v23.3.4 is underway, that the federation is updating the peg-out authorization list, and that peg-out keys are being moved to cold storage. The report gives no date for restoring redemptions. One user said moving bitcoin out through SideSwap and SideShift cost about 5% in spread and fees and took weeks because of thin liquidity.
Links:
Commentary:
Transfers inside Liquid are not the same as a 1:1 redemption onto bitcoin mainchain, and the gap is still the 598.5 BTC sitting in the attacker's wallet.
Today's Summary
- CoinDesk said that after the Clarity Act failed to advance in the Senate, the SEC's five-year innovation exemption, the October 1 custody proposal, and the CFTC's October 5 request for comment on leverage and registration are the active U.S. rule path, while unleveraged spot trading still lacks comprehensive federal oversight. CryptoBriefing cited a warning that CTX and CAM could face a court challenge after Loper Bright.
- ESMA's October 8 opinion tells national supervisors to require MiCA-licensed firms to stop services in non-compliant stablecoins, with legacy exposure remediated no later than three months after publication, an outer date around January 8, 2027. The opinion names no token. On prediction markets, the CFTC on Friday kept event contracts inside the swap definition, and Kalshi's Supreme Court reply deadline is November 9.
- A CoinGecko snapshot at 12:58 UTC put bitcoin at $83,032, up 0.4% in 24 hours, and ether at $2,502.27, down 7.3% over seven days. STRK rose more than 52% in 24 hours on Sunday as StarkWare described an independent layer 1 as its quantum-resistance route, with no governance proposal filed. The IMF put tokenized equities at about $2.3 billion and about 1.5 times as volatile as the underlying shares.
- The XRP Ledger's official disclosure says the payment-engine overflow was not found exploited on a public network and that the fix in xrpld 3.4.1 took effect on upgrade on September 25. The Block cited a researcher who said one transaction could have minted about 18 trillion XRP. Coldcard's official account carried a phishing post on Sunday, Ledger confirmed a hardware implant in a reseller device, and Liquid's bitcoin redemptions have been paused for 35 days with reserves at about 86% coverage.
Daily Framing:
Sunday in this crypto cycle was a catch-up day on a flat tape: bitcoin held near $83,000, the SEC and CFTC kept filling the gap left by Clarity, Europe put non-compliant stablecoins on an exit running to about January, and the XRP Ledger, Ledger, and Liquid were still closing security holes that were already open.
This digest is compiled from real-time search results and is for reference only.