Daily Brief: October 24, 2026
Pause, Pulls, Banks, and Bugs
TL;DR: This week shows crypto leaning into safety and real-world rails. Ethereum paused its Glamsterdam rollout after gas EIP concerns could break contracts, forcing more audits and slower scaling. Spot Bitcoin ETFs saw a $635M one-day outflow, a reminder that large flows can flip fast around price levels. HSBC launched RedCoin, a regulated HKD stablecoin inside everyday apps, making tokenized payments routine for millions. CoinDCX exposed custody gaps when an old-wallet sweep let money move from deprecated addresses, highlighting operational risk. Bitcoin Core changed disclosure to push faster, public fixes after AI found bugs, so teams must treat upgrades as urgent.
Market Overview
š Ethereum Glamsterdam pause
We paused the Hoodi rollout after researchers flagged changes to gas calculations that could change how contracts fail or succeed. That broke our assumptions and forced a rethink before mainnet moves forward.
ChainSecurity found 13 contracts that might behave dangerously if the new rules land, turning temporary failures into permanent errors or lost retries. Thatās why testing stopped and audits kicked off.
The trouble centers on EIP-8037 and EIP-8038, which could restore gas during undo steps and let failed ops resume. Wallets, indexers, and gas estimators will need checks if those EIPs change assumptions.
No new Hoodi date yet. The All Core Devs group is digging in, balancing higher block capacity with contract safety. We should expect more audits and a slower timetable.
Why it matters: This pause matters because the gas model shapes contract reliability and scaling plans, so getting it wrong risks real user funds, tooling breakage, and delayed throughput gains.
š Spot Bitcoin ETFs reverse ā $635M outflow
US spot Bitcoin ETFs saw a sudden $635M net outflow on Thursday, the largest single-day reversal since June and erasing earlier inflows that week.
The selling was concentrated, led by BlackRock and Fidelity, which together accounted for roughly three quarters of the withdrawals and pushed month-to-date flows into the red.
Flows flipped as Bitcoin traded near an ETF holdings cost basis around $81,500, a level analysts say matters for where selling could accelerate toward lower support.
Ethereum ETFs mirrored the caution with about $111M outflows, while smaller token products showed mixed activity, underlining selective rotation rather than broad buying.
Why it matters: Large, concentrated ETF withdrawals show institutional demand can flip quickly around price thresholds, meaning short-term flows will likely drive volatility even as the market matures.
š£ HSBC launches RedCoin ā a regulated HKD stablecoin
HSBC has rolled out RedCoin RCHKD, a 1:1 HKD stablecoin redeemable through its custody setup, starting in the PayMe ecosystem for millions of users. This is a regulated bank-issued onramp, not an experiment.
The initial launch targets over 3.3 million PayMe users and 100,000 merchants, letting people send money and pay without separate wallets, which helps adoption by fitting into habits we already have.
HSBC plans to add RedCoin wallets to its banking app and offer tokenized investments, like a new HKD money-market share class, while exploring wholesale and institutional flows next.
Why it matters: A bank-backed, regulated stablecoin inside everyday apps lowers friction for people and institutions, speeding tokenized products and making digital assets part of routine finance.
š§¾ CoinDCX: old wallet sweep slips expose custody gaps
CoinDCX says an automated sweep of deprecated deposit addresses failed, letting funds move out of old wallets while users were still credited. The exchange says active wallets werenāt breached.
Blockchain sleuths flagged about $16 million in suspicious outflows tied to those retired addresses, and one large 15.8M USDT transfer drew attention to lingering risks from legacy keys.
CoinDCX says affected customers were credited and central cold wallets stayed intact, but the firm hasnāt fully quantified losses or clarified how long the sweep failed.
Why it matters: This shows custody risk isnāt just about hacks; operational processes for deprecated addresses and sweeps matter as much for protecting user funds and trust.
š Bitcoin Core tightens disclosure as AI finds bugs
Bitcoin Core will now flag and fast-patch issues an AI can find with a simple prompt, cutting long embargoes and shrinking the window attackers have to exploit a known flaw. This speeds protection at the cost of less bake time.
The projectās new security policy backports fixes to all actively maintained major versions and pairs releases with notices, so operators must treat upgrades as urgent rather than optional. This makes maintenance a core security step.
The move follows AI-assisted scans that flagged thousands of potential flaws and some live exploits, which proved secrecy can be bypassed. Expect faster fixes, louder public advisories, and more pressure on downstream projects.
Why it matters: Faster, public fixes reduce the time attackers have to exploit issues, so teams running nodes, wallets, or services need to prioritize upgrades and rethink patch workflows.
