Bitcoin finance, weekly · 17 to 23 October · Published by Hemi Labs Stablecoins become spendable. Bitcoin buyers come back. The week in five lines Visa and Mesh will make crypto balances spendable at more than 175 million merchant locations. US spot ETFs took in $439M in four trading days, led by IBIT's biggest day in a year. Bitcoin loans kept growing. Borrowing against cbBTC on Base reached $1.61B, up 1.7% on the week. Black October hit. AI-found flaws and a hosting breach put keys stored on servers at risk. Odyssey, the next Hemi ecosystem launch, went live, and the ZK proving beta opens this week. By the numbers Week to 23 October; ETF flows through 22 October
Money20/20 Puts Stablecoins in the Checkout Line Visa and Mesh will let wallet apps spend crypto and stablecoin balances wherever Visa is accepted. Mastercard shipped a risk screen for stablecoin payments, and Circle's payments network took an industry award.
How Visa and Mesh work: a Visa credential lives inside the wallet app; Mesh converts the balance and the merchant gets a normal fiat payment. Mastercard's Stablecoin Security scores the risk of a stablecoin payment before it completes, through one API. OUR READ The card networks are building the spending and compliance layers for stablecoins. Bitcoin's opening is the other side of the ledger: the collateral those dollars are borrowed against. On Base alone, that book now tops $1.6 billion.
ETF Buyers Return. Bitcoin Loans Keep Climbing. Spot ETFs took in $439 million in four trading days, led by IBIT's biggest day in a year, as BTC traded between about $81,000 and $84,800. US spot BTC ETF net flows by day
Friday's flows not yet reported. Source: Farside IBIT took in $665M on 19 October, its biggest day since October 2025. 24/7 Wall St. Thursday gave some back. Funds lost $636M as soft tech earnings hit risk assets. CoinDesk Morpho and Aave grew; Spark and Venus trimmed BTC posted with lenders, net of borrowing
Spark −501 BTC, mostly LBTC (−453). Venus −403, mostly SolvBTC (−430). DefiLlama, Morpho API. Institutions Strategy lifts its buyback to $3B. It bought 267 BTC for $22.1M and repurchased $193.1M of STRC in the week to 18 October. The Coin Republic Coinbase's crypto-backed loans reach $2.3B outstanding, with 17 banks involved. SpendNode GENIUS Act comments close with 123 filings; the Blockchain Association asked for clearer DeFi and foreign-issuer rules. The Block
Borrowing Against Bitcoin Tops $1.6B on Base Coinbase customers drive most of it, borrowing USDC against cbBTC through Morpho at about 5.2% variable. Across Morpho, BTC-backed loans now run from about 3% to 5%. Largest BTC-backed loan markets on Morpho
Borrowed amount and variable borrow APY, 23 October. Orange: cbBTC. Grey: kBTC. Black: WBTC. Ethereum unless noted. Morpho API. Coinbase offers both rates. Variable loans run through Morpho on Base; a fixed-rate, fixed-term option via Morpho Midnight launched 22 September. TokenPost Collateral kept coming. cbBTC posted on Morpho rose 290 to 49,840, and kBTC rose 3.4%. Lombard's LBTC backing eased 3.2% to 7,427 BTC, in step with LBTC leaving Spark.
Black October Puts Every Key on Notice AI tools surfaced a wave of critical flaws in four days, and crypto keys were caught in the blast. In Washington, two big rulebooks finished taking comments. Black October Security disclosures, 19 to 22 October PHP2Shell. Two critical PHP flaws, found with help from frontier AI models, were patched 21 October. Cloudflare saw exploit attempts climb into the millions within hours. 404 Media Railway breach. An intruder may have read and decrypted customer environment variables, where some bots keep wallet keys. Researchers tie about $371K in wallet drains to it; Railway has not confirmed the link. CryptoTicker LiteLLM poisoned. A trojaned 1.107.0 release hit PyPI and Docker on 21 October, stealing cloud and AI keys before it was pulled. Forkast OUR READ Black October is mostly a disclosure wave: old bugs, found fast by AI. The defense is old too. Keep signing keys off servers, and rotate anything Railway or LiteLLM touched. Status board As of 23 October
Crypto losses this week: about $2.5M
On a Bitcoin layer: Arkadiko's attacker got a malicious contract approved through governance, then withdrew vault collateral, including 1.65 sBTC. Its USDA stablecoin lost its peg.
Odyssey Lifts Off as ZK Proving Opens to Testers The next Hemi ecosystem launch is live: one app for looping, lending, and prediction markets. And Tuesday's Midweek with Max put the ZK beta on this week's schedule. NEXT HEMI ECOSYSTEM LAUNCH · ODYSSEY Your Home for Onchain Finance One account, many protocols. Smart contract accounts connect Aave, Compound, Euler, and Morpho. Loopr builds a leveraged loop in one click with flash loans, and simulates it before you confirm. Predictr lets you trade Polymarket markets without giving up custody. Isolated by design. Each position stands alone, and strategy upgrades are opt-in. Leverage can magnify losses. Read the launch post · All launches From Midweek with Max ZK beta this week. A private, limited beta of the ZK miner, marketplace, and testnet. A baseline reward goes to testers who run the benchmark and confirm the miner works on their setup. Full recap A prover-agnostic marketplace. It ships with RISC Zero, SP1, and OpenVM verifiers, and anyone can add one. GPU kernels now run on AMD and Intel cards too. veHEMI auto-relock goes to audit, and retroactive claims for expired veHEMI arrive with the next rewards contract update. Office Hours went wider. Wednesday's Protocol Engineering Office Hours streamed on X, YouTube, and LinkedIn. Watch the replay COMMUNITY · HAIR GAMES SEASON X Season X Is Still Running Candy Cascade's 500 match-3 levels are live, with 30,000 HEMI across the top 15. At its peak, the season drove 36% of Hemi's daily transactions. Arcade contest #2 is also open; rules are in Discord. Earn on Hemi: BrownFi pools Merkl incentive APR as of 23 October
Jurisdictional restrictions may apply. Rates may fluctuate based on market conditions.
Ahead: The Fed, Strategy, and an Index List
Figures as of 23 October 2026, 18:00 UTC, from DefiLlama, Morpho, Farside, and Merkl. Hemi Pulse is published by Hemi Labs for information only. It is not investment, legal, or tax advice. Digital assets involve risk. |
Hemi Pulse - October 23, 2026
Written by:
