Author: Westen

JPMorgan is taking JPM Coin, its token for dollar deposits at the bank, onto Ethereum. Kinexys, the bank’s blockchain unit, said in a Monday statement shared with The Block that the token, known as JPMD, now supports peer-to-peer transfers across the Ethereum ecosystem, including Ethereum itself and Base, the Coinbase-built network where it launched.

The token is for approved institutional clients only. It is not something retail users can buy, and it is not listed on exchanges.

What JPM Coin is

JPM Coin is a deposit token. Each one represents U.S. dollars sitting in an account at JPMorgan. The bank’s own FAQ says it is “not a cryptocurrency or a stablecoin,” and that clients’ funds “never leave the firm’s regulated banking infrastructure.” Clients move between cash and tokens through accounts at the bank, and only vetted counterparties can transact.

That is the key difference from a stablecoin like USDC. A stablecoin is issued by a company that holds reserves. JPM Coin is a claim on a bank deposit at the largest U.S. bank, with JPMorgan controlling who can hold it.

JPMorgan first tested the token on Base in mid-2025 and made it available to institutional clients there in November 2025.

Why Ethereum, and what’s still unclear

Kinexys said Ethereum’s “established depth of onchain liquidity and tokenized assets” made it the natural next network. Emma Landriault, global head of Kinexys Labs, told Bloomberg the bank wants to serve crypto firms making blockchain payments and financial firms that need a token to settle trades or back tokenized assets, according to CoinDesk’s summary of that interview.

One detail is not settled in public yet. CoinDesk, citing Bloomberg, reported that Landriault did not say when JPM Coin would become available on Ethereum. As of Monday morning, JPMorgan’s JPM Coin web page still described the token as issued on Base. Clients should confirm timing and the official token details with the bank directly.

The bigger picture

JPMorgan said Kinexys has handled more than $4 trillion in transactions since launch and averages about $7 billion a day. That is still a small slice of the bank’s overall payments business. The bank has also launched tokenized money market funds on Ethereum, the first in December 2025 and a second in May 2026, and said in January it planned to take JPM Coin to the Canton Network as well.

The move adds to a busy month for bank tokenization. Japan’s three megabanks reported a joint yen stablecoin test, and a U.S. bank, Cross River, added Ripple’s RLUSD to its core banking system. The pattern is the same: big banks are putting regulated money on public blockchains, while keeping control over who gets to use it.

A safety note: JPM Coin is not sold to the public. Any token calling itself “JPM Coin” on a public trading app or decentralized exchange should be treated as suspect.

Sources: The Block; CoinDesk; J.P. Morgan Kinexys; J.P. Morgan Payments; TokenPost

Japan’s three largest banks say a jointly issued yen stablecoin worked in a test. MUFG Bank, Mizuho Bank and Sumitomo Mitsui Banking Corporation (SMBC) announced on Oct. 16 that they had issued, transferred and redeemed the coin in a proof-of-concept run from July 17 to July 23.

The test used a cross-border payment scenario between Mitsubishi Corporation’s offices in Japan and overseas. Mitsubishi UFJ Trust and Banking acted as the agent trustee, and tech firm TISI built the wallet and blockchain connections. SMBC provided the blockchain platform used in the test, according to the banks.

How the coin is built

The coin was issued under Japan’s Payment Services Act as a trust-type stablecoin, with the three banks acting together as joint principal trustees. The money behind it sits in bank deposits. The banks said the design has no circulation cap, because they expect large-scale use.

There is one big limit by design. The coin is meant to move only among users who have completed identity checks at the banks. That makes it a permissioned bank product, not an open token anyone can pick up on an exchange.

The project ran with support from the Financial Services Agency’s FinTech PoC Hub, which approved the initiative in November 2025. The banks said the test also checked anti-money-laundering controls and how the operation works with several banks issuing one coin.

What it is not yet

This was a one-week test, not a launch. The banks did not disclose amounts moved in the test. They said the design “may be subject to change” and that they will keep working through issues with regulators in Japan and abroad before real-world use.

The timeline points to the near term. In the same release, the banks pointed back to a June 10 announcement about launching live transactions of the three-bank coin in fiscal 2026. Japan’s fiscal 2026 ends in March 2027.

The news landed the same week that Visa moved stablecoin prefunding for Visa Direct into commercial use and a U.S. bank, Cross River, added Ripple’s RLUSD to its core banking platform. The common thread: banks and payment networks are building stablecoin rails inside regulated systems, not around them.

Sources: MUFG Bank; SMBC; Mizuho; Trade Finance Global; Visa

Cross River Bank is integrating Ripple USD (RLUSD), Ripple’s U.S. dollar-backed stablecoin, into its proprietary Core Operating System, with support for transactions on the XRP Ledger.

The Fort Lee, N.J.-based bank, a New Jersey state-chartered FDIC member, announced the partnership on Oct. 15. RLUSD becomes an additional payment rail on Cross River’s platform, next to ACH transfers, wire transfers and real-time payments. Eligible fintech customers can reach it through a single API without standing up their own blockchain systems, the bank said.

What the bank says it unlocks

Adam Goller, Cross River’s head of fintech banking, said the bank is expanding on stablecoin capabilities already in development. The setup is meant to let fintechs convert between U.S. dollars and RLUSD, settle cross-border payments and treasury moves around the clock, and keep those rails on the same banking platform as traditional payment options.

Markus Infanger, senior vice president for RippleX at Ripple, said Cross River is bringing RLUSD and the XRP Ledger’s settlement into a regulated banking platform so fintechs can move money in real time across borders without running a parallel system.

The two companies also pitched the work as a settlement option for payment networks, giving issuers and acquirers more flexibility to settle intraday. The release cites typical XRP Ledger settlement of about three to five seconds, fees of a fraction of a cent, and more than $1.3 trillion settled on the ledger to date. Those are company figures and have not been independently verified.

What’s narrow — and what this is not

Availability is narrow. Cross River’s release states that services are currently only available in limited U.S. states. It did not name those states or give a timeline for a wider rollout.

What this is not: a custody product, a retail deposit product, or a sign that every Cross River client can use RLUSD today. The release describes payment and settlement access for fintechs and payment networks through the bank’s existing core. Separately this week, DriveWealth said it plans to use RLUSD on the XRP Ledger for brokerage settlement starting in Europe, with no launch date, and Standard Chartered said institutional RLUSD custody is live at its Dubai branch. Those are different arrangements.

The release did not name any fintech or payment network that is using the RLUSD rail yet.

Sources: Cross River; Business Wire; Ripple

Evernorth Holdings Inc. has hired Hugo Jeandesboz as chief investment officer to lead its XRP treasury strategy, the company said in an Oct. 12 press release that it filed with the SEC on Tuesday.

Jeandesboz joins from Coinbase Asset Management, where he was co-chief investment officer and led the firm’s Solutions investment strategies. According to the release, he was previously Coinbase’s lead derivatives trader, traded interest rate derivatives at HSBC in New York, and started his career at Société Générale. He reports to founder and Chief Executive Officer Asheesh Birla.

The release says the role covers “treasury allocation, liquidity management and the active management of Evernorth’s own XRP holdings,” and makes him the company’s senior contact for trading counterparties and custodians. The filing does not disclose his compensation or a separate start date. The release says he “has joined.”

The same Form 8-K corrects the company’s post-closing report. At the Oct. 9 closing of its merger with Armada Acquisition Corp. II, Evernorth issued 1,078,613 Class A shares to investors with delayed-funding subscription agreements, “not 663,510 shares as was indicated” in that earlier filing, “due to a clerical error,” the 8-K says. Those shares were priced at $10.00 each against the subscription amount, whether paid in cash or XRP. The correction also changes several other figures. Class A shares outstanding at closing are now 23,638,882, and Class C shares are 31,392,746. Former SPAC public shareholders held 20.5% of the Class A stock.

XRPN closed Tuesday at $16.48, down 2.54% on its second day of trading as Evernorth, according to StockAnalysis. It traded between $15.70 and $17.86 on about 1.27 million shares.

Company leadership is scheduled to ring the Nasdaq closing bell on Wednesday, Evernorth said in its Oct. 9 announcement.

Sources: SEC Form 8-K; Evernorth press release (Ex. 99.1); StockAnalysis

Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to stop selling its hardware wallets and take them off shelves. The move widens a sales halt that began last week with a single reseller.

In an update posted on X on Tuesday evening, the Paris-based company named Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. “The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened,” Ledger said. The request builds on Ledger’s Oct. 9 call for CryptoBilis, a reseller in the region, to pause all sales and shipments.

Earlier Tuesday, Ledger’s Donjon security team described how the tampering works. An added component sits inside the device’s case and reads the screen. When the wallet shows its 24-word recovery phrase during setup, the implant decodes the words and sends them out over a mobile network using a built-in eSIM. Ledger said the implant does not modify the Secure Element, the chip that guards private keys, or the device’s operating system, and does not alter transactions or signatures. The company said it has no indication that its own systems or its direct sales channel were compromised.

Ledger says the confirmed losses so far are confined to Southeast Asia. “We have not verified a drain linked to a device bought elsewhere,” it said. In replies to users on Wednesday, the company said confirmed losses involve devices sold “through a limited number of resellers,” without naming them.

Ledger has not confirmed a loss total or a victim count, and says figures circulating online come from third parties. Blockchain analytics firm Bitquery counts $102.0 million taken from 324 wallets across six blockchains, up from early estimates near $86 million. Bitquery says Tether froze $10.0 million in USDT and that about $84 million could still be traced on-chain as of Tuesday morning.

The worry has reached store shelves elsewhere. In Singapore, The Straits Times reported that a tampered device had been sold at Metapod in Changi Airport and that another was reportedly bought at a Challenger outlet. In Europe, MediaMarktSaturn has pulled Ledger products after a customer in Germany reported an implant. Ledger said no funds were lost in that case. Rival Trezor said Tuesday it is cutting its own reseller network as a precaution, adding that “there is not a single piece of evidence” its devices have been compromised.

Ledger’s advice has not changed. CryptoBilis buyers should not set up unused devices, and anyone already using one should move funds to a new device with a new recovery phrase. People who lost funds should contact law enforcement before opening the device.

Sources: Ledger; Bitquery; The Straits Times; Cointelegraph; The Block

Standard Chartered has started offering institutional custody of Ripple USD (RLUSD), Ripple’s dollar-pegged stablecoin issued on the XRP Ledger. The bank announced the service on Oct. 12 and is running it through its branch in the Dubai International Financial Centre, which the Dubai Financial Services Authority (DFSA) regulates.

The second half of the announcement is not live yet. Standard Chartered, Ripple and LMAX Group say they are working to make RLUSD “eligible collateral for agreed LMAX Group products and solutions across trading and collateral management.” The releases from all three companies say those “agreed future capabilities remain subject to final documentation, successful testing, applicable laws and regulations, internal approvals and jurisdictional readiness.” None of them gave a launch date.

What is live today

What changes now is who holds the stablecoin. Eligible clients can keep RLUSD in a bank’s custody unit inside a DFSA-supervised branch, instead of with an exchange or a crypto-native custodian. The releases did not say which clients qualify, what the service costs, or how much RLUSD the bank holds.

What is still a plan

The planned piece is about how that custody would connect to trading. Under Standard Chartered’s “collateral mirroring” model, the value of eligible collateral would be mirrored to LMAX “without requiring the underlying RLUSD to be transferred directly to the trading venue,” the bank said. In plain terms, the bank would keep the tokens and the venue would accept their value as margin. The companies say this is meant to cut transfer-related operational risk and counterparty exposure. Neither the bank nor LMAX has published the legal or operational terms.

“Institutional clients want to participate in digital asset markets without compromising on how their assets are safeguarded or how risk is managed,” said Waqar Chaudry, Standard Chartered’s global head of digital assets for securities services.

Luke Dorney, LMAX Group’s head of custody for digital assets, said the venue had agreed “to adopt Standard Chartered’s collateral mirroring model.” Jack McDonald, Ripple’s senior vice president for stablecoins, said customers want “the efficiency of a regulated stablecoin without giving up the custody standards they already trust.”

Several regulators, no single sign-off yet

The custody sits under the DFSA in Dubai. LMAX’s businesses are licensed separately: according to the company, its FX exchange is regulated by the UK’s FCA and Singapore’s MAS, and LMAX Digital by Gibraltar’s GFSC. Which LMAX entity would accept RLUSD collateral, and under which approvals, has not been disclosed.

The firms already have commercial ties. Ripple provided LMAX with $150 million in financing in January as part of plans to embed RLUSD in its infrastructure, CoinDesk reported. CoinDesk also reported last week that Standard Chartered plans to offer crypto and stablecoin custody to institutional clients in Singapore. That is a separate plan, and the Dubai launch says nothing about when it will start.

The bottom line: a regulated bank is now holding RLUSD in Dubai. Using that RLUSD as collateral at LMAX is still a plan.

Sources: Standard Chartered; Ripple; LMAX Group; CoinDesk

The XRP Ledger’s core software carried a bug for roughly a decade that could have let an attacker create spendable XRP beyond the token’s fixed 100 billion supply, according to a vulnerability disclosure report published Oct. 9 on XRPL.org. The report says there is no evidence the flaw was exploited on any public network.

What the bug did

The problem sat in the ledger’s payment engine. When one payment consumed many offers from the built-in order book, the engine added up the XRP owed with 64-bit integer math and no overflow check. A large enough total wrapped around to a tiny number. Each offer owner was paid in full, while the buyer was charged only the wrapped amount.

The ledger’s “no XRP created” safety check used the same arithmetic, so it missed the gap too. A separate per-account limit did not trip either, because the new XRP would have been spread across hundreds of accounts.

It could not happen by accident, the report says. It took hundreds of offers priced in a way no real trader would use, then a payment built to consume them all at once. The cost to an attacker would have been a few hundred XRP in reserves plus fees.

Who found it

Researcher Cayden Liao and Veria AI reported the flaw through the XRPL bug bounty program on Sept. 22. RippleX reproduced it the same day and raised the severity to critical. Veria Labs says its proof of concept could have created about 18.4 trillion XRP in one transaction, and that it received the program’s maximum $250,000 bounty. Those are the firm’s own figures.

The fix shipped in xrpld 3.4.1 on Sept. 25. More than 80% of default validators were running it that day, per the report. The supply check now uses a wider counter that cannot wrap.

The governance question

How it shipped is the bigger story for the network. Rule changes on the ledger normally go through amendments, which must hold more than 80% validator support for two weeks before switching on. This fix took effect on each server as soon as it upgraded. The report calls it the first deliberate exception in more than ten years.

The report’s reasoning: the code is open source, so a normal amendment would have shown attackers where the bug was for weeks while it was still live on Mainnet. Validators received compiled software before the source code was public.

That sequence drew criticism from Cyber Capital founder Justin Bons, who argued a public ledger briefly ran on closed code, ETHNews reported. The report says the call was made with the XRPL Foundation, RippleX and validators, and that skipping amendments stays reserved for the most severe bugs. The 3.4.1 source code has since been published.

What it means now

The same release carried a separate fix for the new Batch feature, which went live on Mainnet Oct. 9 through a normal amendment vote. Servers not running 3.4.1 or later are now amendment blocked. The report does not ask XRP holders to do anything.

About 99.986 billion XRP exist today, slightly under 100 billion because fees are burned, CoinDesk reported, citing the foundation. XRP traded near $1.40 Monday morning, little changed on the day.

This is reporting, not investment advice.

Sources: XRPL.org, Veria Labs, CoinDesk, ETHNews, Kraken

Special Report. Two custody and market-rails stories for the week ahead.

1. Ledger confirms a hardware implant in a reseller-sold device

Ledger said Saturday that one affected user’s device contained an unauthorized hardware implant. The update came from @Ledger_Support at 1:09 p.m. Eastern. Ledger said it is reaching out to impacted users as its investigation continues.

The probe started Friday. In an Oct. 9 statement, Ledger said it was investigating reported losses among users in Southeast Asia who bought devices from CryptoBilis, a reseller. Ledger asked CryptoBilis to pause all sales and shipments of Ledger devices. News reports describe CryptoBilis as an authorized reseller in Indonesia, Malaysia and the Philippines.

Ledger said it has no indication that its security infrastructure, systems or services have been compromised, per @Ledger_Support replies on Saturday. Ledger has confirmed one implanted device. It has not said how many devices were affected or how the implant got there.

Loss figures are not from Ledger. On-chain researchers tanuki42 and Specter published thief addresses with losses above $86 million. Blockchain data firm Bitquery, in a tally verified Oct. 11, counts $93.2 million taken from 315 wallets across six chains, mostly USDT on TRON. Bitquery says Tether froze $10.0 million. Ledger has not confirmed any of these totals.

Independent research adds context but not proof. Tibane Labs examined two Nano X units with suspected implants that could read the recovery words shown during setup, ForkLog reported. Those units were not shown to come from CryptoBilis.

What Ledger advises. If you bought from CryptoBilis in the last 90 days and have not set up the device, do not set it up. If you already set it up, consider moving assets to a new Ledger signer with a new recovery phrase. Never share your 24 words with anyone, including people claiming to be Ledger.

Basic custody hygiene.

• Buy hardware wallets only from the maker’s official store or resellers it lists by name.
• Run the device’s built-in authenticity check through the official Ledger Wallet app before loading funds.
• Be wary of a device that arrives with a recovery phrase already printed or set up.
• Generate your own seed on the device, and keep it offline.

The key point is the supply chain. A hardware wallet is only as trusted as the path it took to your hands.

2. XRPN debuts on Nasdaq Monday

Evernorth’s closing 8-K, filed Oct. 9 at 4:25 p.m. Eastern, names Monday, Oct. 12 for Nasdaq trading. Class A shares trade as XRPN. Warrants trade as XRPNW. As of Sunday morning, Oct. 11, EDGAR shows no newer Evernorth filing.

The filed facts:

• The Armada merger closed Oct. 9.
• About 80.3% of shares with redemption rights cashed out, about $195.39 million in total.
• The XRP lots filed at closing add up to about 389 million XRP. Evernorth projected about 473 million on Oct. 1.
• Each XRPNW warrant lets the holder buy one Class A share at $11.50.

What to watch on day one. First prints for XRPN and XRPNW. Trading volume against a float thinned by heavy redemptions. Any first holdings update or press release from Evernorth. Any fresh SEC filing, such as a Form 4 or a resale prospectus.

The trust angle holds. Evernorth’s XRP now sits inside a Nasdaq-listed company that reports to the SEC. Monday shows how the market prices that wrapper. Background: Westen’s Evernorth close piece.

This is reporting, not investment advice. Hardwire Crypto makes no price calls.