Crypto opened a lot of doors this week. The Amazons checked the locks, the exits, and the fine print the hype squad forgot to read. A custody proposal, a Lightning warning and an L2 wind-down ask the same question: Who has control when the headline stops smiling?
The keyholder isn’t always you
On 1 October, the US Securities and Exchange Commission proposed custody changes for registered advisers and regulated funds. Under specified conditions, an adviser could hold client crypto when no permitted custodian is available; state trust companies could qualify under conditions too. Valeria’s verdict: “Self-custody” sounds heroic until you ask whose self. Commissioner Hester Peirce clarified that this means an adviser holding clients’ assets, not an individual holding their own keys. Put the confetti cannon away: This is a proposal, with comments due 60 days after Federal Register publication, not an enacted rule.
Patch the node. Check the scoreboard.
Core Lightning warned on 2 October that attackers were targeting unpatched nodes. Operators on version 26.06.7 or earlier were urged to move to 26.06.8, which contains security fixes. The attack path and loss total were not identified. Serious software alert? Yes. Bitcoin base chain failure? No.
Nyra’s ETF scoreboard has a hole in it. Farside shows $148.7 million net out on 30 September and $102.7 million net in on 1 October. At a 4 October recheck, its 2 October row displayed $31.7 million while BlackRock’s IBIT entry remained blank. That displayed figure adds the reporting funds; it is not a complete daily net, and it cannot close a defensible full-week total. Nyra refuses to award a weekly victory trophy with a missing score. The two complete daily totals show a reversal, not proof that the same investors switched sides.
Ethereum’s Glamsterdam plan schedules ePBS and block-level access lists for the Sepolia testnet on 6 October at 13:53:36 UTC. Hoodi and mainnet dates remain undecided. A testnet invitation is not a mainnet launch party.
The exit sign has a date
Blast said its Ethereum L2 will wind down because costs exceed revenue. Users were asked to withdraw to Ethereum through the regular interface by 26 October; afterward, withdrawals require direct bridge-contract interaction. Blast also warned of a temporary pause while withdrawing Lido assets. The bridge route remains, but the easy door has a deadline. Kaia checks the exit before the sign changes.
NEAR Intents suffered a reported $3.8 million exploit. On 2 October, co-founder Illia Polosukhin said the funds had been returned. Good news. Valeria still wants a postmortem and clear service status before stamping the file “closed.”
Real rails, limited magic
Lloyds and Visa reported a seven-day pilot settling $750,000 in USDC obligations, with funds reaching Visa in under an hour, including over a weekend. Real rails, small test; nobody paid for coffee this way. The Ethereum Foundation and Open Anonymity introduced zkAPI on mainnet to hide the billing link for metered API use. The provider still sees requests, while IP addresses and timing can betray identity. Privacy is a stack, not a magic cape.
Aurelia’s weekly rule: If a headline says “self-custody,” ask whose keys. If it says “live,” ask how widely. If it says “private,” ask from whom. And if it promises an exit, find the route before you need it.
The market moves. The Amazons stand watch. ⚔️🟠
