India's securities regulator SEBI and the Reserve Bank of India unveiled "Demat 2.0," a pilot that issues corporate bonds as native digital tokens on a private, permissioned ledger run by depositories NSDL and CDSL. Three issuers have already used it — REC raised ₹500 crore on Sept. 7 (billed as India's first tokenized corporate bond), Larsen & Toubro raised ₹500 crore and IIFL Finance raised ₹25 crore, for a combined ₹1,025 crore (roughly $107 million).

This is a landmark institutional milestone for tokenized real-world assets: a sovereign securities regulator and central bank are running live issuance into a $620 billion corporate bond market, rather than experimenting in a sandbox. If extended to secondary trading and retail access as planned, the framework could become a template for other jurisdictions wiring regulated securities onto distributed ledgers settled in central bank money.

The token ledger is linked to the RBI's wholesale digital rupee (e₹-W) through a Unified Market Interface, enabling atomic delivery-versus-payment in which the bond and cash either both settle or neither does — potentially freeing proceeds to issuers on the bidding day rather than days later, with smart contracts automating coupon payments and redemptions. SEBI stresses the bonds keep their legal terms, credit ratings, debenture trustees, listing rules and investor protections, and that investors can hold tokens in existing Demat accounts without fresh KYC; depositories retain ownership records and manage investors' bond-token private keys, and secondary trading plus retail access are slated for later stages.

Circle plans to launch its Arc Layer-1 blockchain mainnet on Sept. 16, naming 11 outside institutions — including BlackRock, DTCC, Visa, Mastercard and ICE — as founding validators alongside Circle itself. More than 100 institutional and ecosystem builders are already working on Arc's private mainnet, and the relationships extend beyond validation: BlackRock invested in Circle's private sale of ARC tokens and is expected to deploy its BUIDL money-market fund on Arc.

The structure places prospective customers inside the very infrastructure they may later depend on, merging the roles of network operator, investor and end user in a single cohort of Wall Street firms. It marks a substantial step in institutional adoption of stablecoin-native settlement infrastructure, while concentrating consensus power among a small set of vetted institutions whose individual voting weights remain undisclosed.

Arc is built around deterministic finality: its Malachite consensus engine uses a permissioned Proof-of-Authority model in which a rotating validator proposes a block and more than two-thirds of the validator set must pre-commit to the same block before it is finalized, after which Arc says transactions cannot be reorganized or reversed at the consensus layer. Launch configuration is expected to use roughly 20 SOC 2-certified validators across multiple regions, though individual voting power has not been published, and Arc's disclosures state that neither Arc Network Services LLC nor its permissioned validators is responsible for the content, legality or functionality of third-party applications.

Coinbase-incubated Ethereum Layer 2 network Base announced it is consolidating its codebase away from Optimism's OP Stack into a Base-operated repository, ending its reliance on external dependencies that had powered the chain since launch. The move follows Base's Azul mainnet upgrade, which the network described as its first independent protocol upgrade and a step toward Stage 2 decentralization.

Base is one of the largest and most used Layer 2 networks, and its departure from the shared OP Stack codebase weakens the assumption that the Superchain's member chains will always upgrade in lockstep. It gives Base unilateral control over its roadmap and release cadence, while raising questions about what the Optimism Collective's shared infrastructure and governance model still deliver to partners.

By controlling its own repository, Base's engineers no longer have to wait for an external collective of chains to agree on coordinated hard forks, which reporting suggests lets them ship protocol performance upgrades and custom patches roughly twice as fast. Base remains an Ethereum Layer 2 settling to Ethereum, and the Azul upgrade introduced a multiproof system alongside a new client stack.

Robinhood CEO Vlad Tenev and crypto head Johann Kerbrat said the company plans to add one-for-one share redemptions and voting rights to its tokenized stock products, a direct response to criticism that the tokens offered limited ownership features. Tenev framed the features as forthcoming rather than live, writing that "step one is to scale adoption of Stock Tokens" with redemptions for shares 1:1 and voting for eligible holders on the roadmap.

Tokenized equities have generally delivered only economic exposure rather than actual share ownership, so adding redemption and voting rights would narrow the gap between a stock token and a conventional brokerage position. If Robinhood ships these features, it raises the market-structure bar for rival tokenized-equity venues such as Kraken's xStocks and Gemini and could push the sector toward genuine on-chain ownership rather than price-tracking wrappers.

The features are not live: Tenev explicitly said "not yet, but they're coming," and voting is described as applying to "eligible" Stock Token holders, implying eligibility criteria that have not yet been published. In standard tokenized-securities mechanics, redemption means a holder returns tokens to the issuer, the custodian unwinds the underlying position and value is returned, whereas a 1:1 share redemption would be an in-kind delivery of the actual equity.

On Sept. 11, TokenLogic proposed the Umbrella plan for Aave V4, under which Aave's DAO would absorb lending losses first through "deficit offsets" of 33 ETH, 15,000 USDC and 15,000 USDT, with volunteer underwriters covering deficits beyond that layer. The initial bad-debt backstop would apply only to the Core Ethereum Hub's WETH, USDC and USDT reserves, with underwriting targets of 800 ETH, 400,000 USDC and 400,000 USDT.

The proposal materially reshapes Aave's risk structure by shifting first-loss exposure onto the DAO treasury and creating a new yield-for-risk role for underwriters, which changes how lenders, AAVE holders and the protocol's governance assess solvency risk. If adopted, it could become a template for how large DeFi lending markets socialize tail risk in V4's Hub-and-Spoke architecture.

Coverage is defined per reserve rather than per token, so USDC supplied to another Hub would not be protected, and capital allocated to one Hub asset cannot clear another reserve's deficit; underwriters face a 20-day cooldown plus a two-day withdrawal window, and their staked assets remain exposed to slashing while waiting to exit. TokenLogic explicitly declines to recommend initial general-purpose coverage for USDG and frxUSD, citing uncertain incentive-sensitive lending activity and, for frxUSD, a concentrated issuer-linked supplier base.

Balancer has put forward a governance proposal to wind down the protocol, moving all pools into withdrawals-only mode on Oct. 30 and allowing BAL holders to burn their tokens for a pro-rata share of the roughly $9 million treasury starting May 2027.

This is a full, formal wind-down of one of DeFi's longest-running automated market makers, converting a governance token into a claim on residual treasury assets rather than a perpetual protocol token, and it sets a precedent for how dying DeFi protocols return capital to holders. It directly determines whether BAL holders can recover value and signals how the market prices governance tokens after a severe exploit.

The redemption mechanism is voluntary: holders burn BAL in exchange for a pro-rata slice of the treasury, but the process does not begin until May 2027, and BAL's market cap of just $7.7 million is far smaller than the roughly $9 million treasury, so the implied per-token recovery depends on the final claim structure. Pools become withdrawals-only on Oct. 30, meaning liquidity provision and swaps stop while users can still pull funds out.

S&P Global led a strategic investment in Paris-based crypto market data provider Kaiko, extending its Series B round to $110 million, with additional participation from BNP Paribas, Bpifrance, Broadridge, Canton Foundation, Coinbase Ventures, DRW Venture Capital, Nasdaq Ventures, Royal Bank of Canada, Stellar and Susquehanna Private Equity Investments. Kaiko said the capital will fund its core digital asset market data business and its expansion into onchain financial infrastructure, including data services for tokenized Treasury bills, money market funds, equities and bonds.

The presence of S&P Global, BNP Paribas, Nasdaq Ventures, RBC and other traditional institutions marks a significant institutional endorsement of crypto market data infrastructure as a foundational layer for tokenized securities. The investors will also join a Kaiko-led industry working group on data and infrastructure for tokenized financial products, positioning the company at the intersection of traditional market data standards and onchain markets.

Kaiko CEO Ambre Soubiran said the investors cover several key areas of digital asset markets—pricing, trading, capital allocation and blockchain development—and will serve as partners in building institutional onchain finance infrastructure. The raise follows a run of expansion moves: the acquisition of MiCA-regulated onchain infrastructure provider Cometh in May, US digital asset data provider Amberdata in June, and a February partnership with Bloomberg to bring licensed financial data onchain.

Bybit said it detected and blocked a coordinated wave of fake deposit attacks that targeted multiple blockchain networks, preventing potential losses exceeding $1 billion worth of DOT. The exchange described the attempts as using increasingly sophisticated techniques aimed at exploiting weaknesses in its deposit scanning systems.

Fake deposit attacks strike the verification layer of exchange infrastructure — the part users implicitly trust to credit their balances correctly — so a successful hit at this scale would have ranked among the largest losses in exchange history. The episode also signals that centralized exchange deposit pipelines remain a live attack surface that attackers can industrialize across chains and tokens.

According to Bybit, the campaign spanned multiple blockchain networks and was coordinated rather than opportunistic, suggesting the attackers had mapped deposit-scanning logic in advance. The headline figure refers to the notional value of DOT that could have been fraudulently credited, not funds actually lost, since Bybit says the attempts were stopped before settlement.

Binance has launched bStock trading, allowing eligible international users to buy and sell tokenized stock products directly on Binance Spot, 24/7, just like any other crypto asset. According to Binance's own materials, the offering covers more than 7,000 US-listed stocks and ETFs.

This pushes the world's largest crypto exchange further into traditional equity market structure, putting it in direct competition with tokenized-equity venues such as Kraken's xStocks and blurring the line between a crypto venue and a brokerage. It also widens access to US equity exposure for non-US users while raising fresh questions about how securities regulators will treat tokenized shares sold offshore.

Each bStock is backed 1:1 by a real US share held at a regulated custodian, and the tokens trade continuously on Binance Spot rather than only during US market hours. Availability is limited to eligible international users, and the product spans both individual US-listed stocks and ETFs.

Amazon.com Services and Perplexity AI are facing off before the U.S. Court of Appeals for the Ninth Circuit in case No. 26-1444, an appeal arising from Amazon's suit alleging that Perplexity's Comet browser tool unlawfully accessed Amazon's website in violation of the federal Computer Fraud and Abuse Act (CFAA) and California's Comprehensive Computer Data Access and Fraud Act (CDAFA). At issue is Comet's AI "Assistant," which, when activated by a user, navigates Amazon.com on that user's behalf and sends browser screenshots back to Perplexity.

The outcome could help define whether platform terms of service and anti-hacking statutes can be used to block third-party AI agents from acting on a user's behalf, drawing a legal boundary around agentic commerce. Whoever wins, the case shapes who is allowed to intermediate between shoppers and large marketplaces, affecting AI browser vendors, agent developers, and the platforms whose ad-driven business models depend on controlling the shopping surface.

Amazon's claim turns on whether an agent acting at a user's direction exceeds authorized access under the CFAA and CDAFA, with the transmission of browser screenshots to Perplexity's servers a central factual element. The Ninth Circuit is the largest of the 13 U.S. courts of appeals, covering nine states and two territories with 29 active judgeships, so its rulings carry unusual weight.

UK-based fintech Revolut confirmed that attackers used a legitimate government-agency email domain to submit fraudulent requests for customer information, and those attackers are now publishing leaked identity documents while allegedly demanding 10,000 BTC (roughly $780 million) to stop further releases. Revolut has not confirmed the ransom demand and has not authenticated the material circulating online.

The alleged 10,000 BTC demand is one of the largest crypto-denominated ransom figures ever attached to a fintech breach, and it shows how a simple email-impersonation trick can defeat the verification checks of a bank that holds both fiat and crypto assets. For the crypto sector, the possible exposure of transaction histories belonging to high-profile holders — including former Mt. Gox CEO Mark Karpelès — raises concern about targeted attacks on wealthy on-chain users.

Potentially exposed data includes names, dates of birth, addresses, email addresses and phone numbers, plus copies of passports and driving licences, while customer notifications also referenced account statements, IBANs, withdrawal records and full transaction histories including BTC activity. Revolut says the number of affected customers was "very limited" and that its systems and customer funds were unaffected, while the 10,000 BTC figure remains unverified and some observers, including analyst Max Karpis, doubt the demand is genuine because such a payment would be traceable on-chain.