Keystone Will Destroy 18,835 Wallets After Key Theft

gm, Defiers!

These are the biggest stories in DeFi and crypto:

• Anthropic filed for its IPO; perps imply ~$1.9T
• Keystone will destroy 18,835 wallets after key theft
• X100 lost $4.85M to a governance takeover
• Hyperliquid tests permissioned markets for US perps
• Chainlink lets custodied assets back DeFi loans

Keystone is about to destroy 18,835 new hardware wallets. The company said today that an attacker stole the key it uses to prove its wallets are genuine. That key is written into each device at the factory and cannot be replaced, so every unsold unit that carries it has to go. Keystone has paused website shipments until it builds devices with a new key.

Keystone says the key plays no part in recovery phrases or transaction signing, and owners of genuine devices do not need to move funds.

It is the second maker's check to fail this month. Ledger's Genuine Check passed wallets that carried spy implants, because it verifies only the secure chip. On Oct. 12 we wrote that a buyer can confirm the chip but cannot confirm the hardware. Our first advice was to buy direct from the maker. Keystone's breach reaches people who did just that.

Scammers also know whom to target: breaches at Keystone, SafePal and Trezor's shipping provider have exposed about 146,000 customer records since August. On Sunday night, Passport maker Foundation said owners had received phishing emails from its own domains. Recipients said the emails included their names, addresses and past orders.

Stay safe out there — split keys across wallets from different makers, so one vendor's failure does not cost everything.

Read more below!

As of 22:56 UTC, Oct. 26. Data: CoinGecko, Aave, Hyperliquid. Full list

WATCH

THORChain Refused to Block the $387M Bitget Hacker. Here’s Why | Chad Barraford

Camila Russo asks THORChain technical co-founder Chad Barraford why the network refused to block the attacker who stole $387.5 million from Bitget. They cover why hackers cash out through Bitcoin, the difference between a protocol that cannot stop a thief and one that will not, and Tether's three-hour freeze of THORChain vaults. Watch the full conversation.

TRADFI AND FINTECH

Anthropic Files for IPO With $16.3 Billion in H1’26 Revenue

Anthropic filed for an IPO on Nasdaq under the ticker ANT, reporting $16.29 billion of first-half revenue. The filing sets no share count or price. Crypto venues already trade its value: Binance and Liquid perpetuals imply about $1.9 trillion, against a $965 billion private round in May. OKX offers 10x bets on the valuation, and Trade.xyz opened an ANT market while Base promoted tokenized shares with no named issuer. None of these products delivers a share, and Anthropic warns that such tokens may have no value.

Anthropic Files for IPO With $16.3 Billion in First-Half Revenue

thedefiant.io

SECURITY

Keystone to Destroy 18,835 Wallets After Device-Authentication Key Theft

Keystone will destroy 18,835 unsold wallets after an attacker used a flaw in a third-party monitoring tool to steal the key behind its online authenticity check. The same intrusion reached 25,964 purchase records from 2024 to 2026, plus 12,873 unpaid checkouts. Owners who received a device after Oct. 20 should contact support even if it passes the check. Website orders move to preorders until devices with a new key are built. Keystone also found customer data kept past its 180-day deletion limit and will cut retention to 90 days.

HACKS

X100 Exploit Nets 4.85 Million USDT After Governance Takeover

Attackers drained about 4.85 million USDT from X100 on Ethereum by taking over its governance. A flash loan of about 1.94 million USDT bought enough X to fill two of the three seats in its Senate, which voted to sell 400,000 treasury tokens into a new pool seeded with 100 USDT. A third transaction pulled 550,000 X from the Uniswap pool. The exploiter split the proceeds into four 400-ETH wallets and today sent 420.8 ETH to Tornado Cash.

DEFI

Hyperliquid Tests Permissioned Markets for Payward's US Perps Plan

Hyperliquid released a testnet of HIP-3*, an optional allowlist for builder markets, to support Payward's plan for U.S. perpetual futures. Bitnomial, a CFTC-registered exchange and clearinghouse, would run and clear the markets, and only accounts onboarded through NinjaTrader could trade. Hyperliquid's order book would match the trades, while Payward's entities carry the regulatory duties. Existing markets stay unchanged. CME's Terry Duffy objects to Jeff Yan's proposal to put compliance on market operators. The U.S. offering still needs regulatory approval.

DEFI

Chainlink Introduces CustodySync With Anchorage for Custodied DeFi Borrowing

Chainlink introduced CustodySync with Anchorage Digital Bank, so institutions can borrow from DeFi lending markets against assets that stay with a qualified custodian. A transfer-restricted receipt token represents the collateral onchain, and Chainlink feeds give the custodian and the lending market the same prices. Liquidations still run through Anchorage's own sale process. The launch names no live lending market, borrower or chain. An Aave Labs proposal from September describes one possible design on Aave V4.

Other Stories Worth Your Time

Arthur Hayes Says He Sold Maelstrom’s Directional Book — also: Ether fell below $2,300, ARB hit a four-week low and UNI slid 29% in four weeks.

Blast Reaches Withdrawal Interface Deadline With $40 Million Still in Bridge — late exits now need direct contract transactions.

Akash Opens Vote to Move From Cosmos to Solana — separately, Osmosis stopped issuing new OSMO.

Bitso Brings Morpho Lending to Its App With Bóvedas — also: Aave raised USDT borrowing costs at high utilization, and Balancer found over $500,000 in overlooked user assets.

Electrum Patches Wallet Flaw Exploited Through Malicious Servers — also: Consensys warned Ethereum operators of eMudhra risks, and a developer claims a critical flaw in daos.fun.

Researcher Cracks 'Steal My Bitcoin' Challenge With PHP Exploit — the operator paid the prize even though he had loaded the wrong key.

S&P Global Closes OpenZeppelin Acquisition — also: Strive bought 6,182 BTC, and PrimeRevenue is tokenizing payment drafts on Solana.

OCC Encourages Community Banks to Become Stablecoin Issuers — ahead of the Jan. 18, 2027 approval requirement.

NBA Names Kalshi a Preferred Prediction Market Exchange — Kalshi gets official data to settle NBA markets.

Sony-Backed Soneium Plans Native Token in Tokenized-IP Push — separately, the Dogecoin Foundation and House of Doge ended their brand deal.

Instinct Rolls Out Link Balance for AI Shopping With Spending Limits — users set a per-purchase limit for the assistant.

Buying Pre-IPO Shares vs. Funds: What US Investors Actually Own — also explained: why stock tokens trade away from the share price and tokenized deposits vs. stablecoins.

How to Check a Software Wallet—and What the Checks Cannot Prove — plus API key rotation, how a DAO vote moves money and Nexus Mutual vs. Firelight.

Trending on The Defiant