WuBlockchain Weekly: a16z Crypto Rebrands, CZ Warns of Critical PHP Vulnerabilities, First Rules Under GENIUS Act Released, etc - Substack

Security concerns dominated the week. CZ, founder of Binance, cautioned that some website administrators may not install patches promptly after PHP fixed two critical vulnerabilities on October 21. Attackers could execute malicious code remotely without authentication, take control of web servers and steal user credentials. Amazon's threat intelligence team said exploitation attempts began October 17 and intensified after public disclosure, though it did not name victims. NCC Group's Matt Hull warned that some vulnerable systems may already be compromised and backdoored. Dragonfly Managing Partner Haseeb Qureshi argued crypto is experiencing a global hacking wave first, since on-chain attacks are the easiest to monetize. He noted that annualized stolen value remains roughly on par with 2025 even as attack counts surged, implying lower average losses per incident, with attackers focusing on small, poorly maintained DeFi protocols.

Regulatory developments included the OCC's first final GENIUS Act rule, covering stablecoin issuance, custody and third-party arrangements. The OCC said existing yield programs are not automatically compliant and will be assessed case by case, while noting rewards based partly on other grounds may fall outside the statutory prohibition. Coinbase, PayPal and Kraken currently offer stablecoin reward programs. Separately, FINMA approved Switzerland's first domestic retail Bitcoin ETF, classified as an alternative investment fund, with mandated volatility disclosures and FinSA suitability requirements. JPMorgan analysts said recent U.S. regulatory actions, including an SEC five-year innovation exemption for tokenized securities and OCC national trust charters, partly offset the stalled CLARITY Act, but such measures could be reversed and cannot replace legislation. JPMorgan does not expect the CLARITY Act to pass this year.

Industry news included a16z's plan to remove "Crypto" from its flagship blockchain fund name and expand beyond cryptocurrencies, with uncertainty over its crypto business. Its $2.2 billion fifth crypto fund closed in May, and its five crypto funds total roughly $9.8 billion. On infrastructure, Solana's Alpenglow upgrade went live Wednesday, moving validator voting off-chain into certificates and cutting finality from about 6 seconds to around 150 milliseconds, with projected validator cost reductions of about 60 percent. Mastercard opened early access to Agent Pay for Machines after pilots with Coinbase, Base and others, and an Ethereum draft proposing consensus decoupling remains unmerged. Finally, sixteen firms, including Microsoft, Alphabet and Goldman Sachs, have objected to tokenized trading of their shares on the OKX-ICE platform, up from nine per an October 19 notice.