Morning digest: October 10, 2026
Saturday’s crypto lead is security. The XRP Ledger disclosed a decade-old bug that could have minted XRP from nothing, and it was already patched without any known exploitation. Ledger is investigating wallet drains tied to a Southeast Asian reseller, with outside estimates running from $72M to about $93M. Sui’s Bitcoin-lending network Hashi detailed its launch, Zcash set a January target for quantum-resistant signatures, Volo on Sui lost about $3.5M, and Thailand’s crypto ETFs start Oct. 16. In health, the signals are walking and multimodal exercise for sleep, late-night eating and liver disease, an ultraprocessed meal’s insulin response, cannabis and fragmented sleep, a urolithin A trial that didn’t improve cognition, and a large diet-and-cognition analysis that found little. At home, the White House announced a Russian diesel deal with a temporary U.S. sanctions waiver, stocks rose with the 10-year yield near 5.24%, Prince William County’s early vote is at 6.93%, Fairfax’s Dominion–NextEra hearing was packed, and Treasury’s dyed-diesel guidance deadline is today.
Blockchain: XRPL’s patched bug, Ledger wallet drains, Hashi on Sui and Zcash’s quantum plan
The XRP Ledger disclosed and patched a decade-old bug that could have created XRP from nothing. In a vulnerability report published Friday, Ripple’s engineers said the payment engine added up amounts across many order-book offers using an unchecked 64-bit integer. A few hundred crafted offers could make the total wrap around to a tiny number, crediting sellers in full while charging the buyer almost nothing, and the “no XRP created” safety check used the same arithmetic, so it missed the problem. A bounty researcher reported it Sept. 22 and the fix shipped Sept. 25 in xrpld 3.4.1. It took effect on upgrade rather than by the usual amendment vote, the first time that has been done, because publishing the code would have exposed a live exploit for weeks. XRPL says it found no evidence of exploitation on the public network, and more than 80% of default-list validators had upgraded within a day. A separate fix for a validation flaw in the new Batch feature, which bundles up to eight transactions, also activated on mainnet Friday, so servers older than 3.4.1 are now blocked. This is the follow-up to the PaymentBurn warning that came with delegated permissions on Oct. 8. (CoinDesk)
Ledger is investigating suspected wallet drains tied to a Southeast Asian reseller. The hardware-wallet maker told anyone who bought a device in the last 90 days from its authorized reseller CryptoBilis (Indonesia, Malaysia, Philippines) not to set it up, and to move funds to a fresh device with a new recovery phrase if it’s already in use. Loss estimates differ and none are confirmed by Ledger: on-chain researchers put suspected losses at $72M to $86M, and Bitquery’s investigation estimates $92.9M across 311 wallets on five chains. Ledger says its own channels and infrastructure show no similar reports. That points toward supply-chain tampering with devices rather than a flaw in Ledger’s firmware, but that is not established. If you own a Ledger, the practical rule is to buy only from the manufacturer or a retailer you’re sure about. (CoinDesk; Bitquery; Finance Magnates)
Sui detailed Hashi, a Bitcoin-collateral lending network, with $500M committed. Holders deposit BTC into multisig-controlled custody on the Bitcoin network and receive hBTC, a claim token on Sui that lending, borrowing and credit apps can use; burning hBTC releases the original BTC. More than 20 partners committed the $500M, and mainnet rolls out in phases later this month. It targets idle institutional BTC without a wrapped-token bridge, but safety rests on the multisig custodians, and the $500M is commitments, not deployed capital. (CoinDesk)
Zcash developers set January as the target for quantum-resistant signatures. The Zakura node team plans opcodes that verify hash-based signatures, first protecting transparent payments, which hold about 70% of issued ZEC. January is a development target, not a confirmed activation date, and shielded payments need separate work. It follows Justin Drake’s “bunker mode” warning from earlier this week; no practical attack has been shown. (CoinDesk)
DeFi exploits: Volo Protocol, a liquid-staking platform on Sui, lost about $3.5M from three vaults (WBTC, XAUm, USDC), froze all vaults, froze roughly $500K of the attacker’s assets and blocked a 19.6 WBTC bridge-out. The team says the other vaults, about $28M, are unaffected and that it will absorb the loss. Two small ones: BitBay’s Polygon DAI/USDC vault (about $14K) and EtherVista’s WETH/VISTA pool (about $18.6K). (Chain Grid News; Crypto Times)
Regulation and tokenization, briefly: Thailand’s rules for locally listed bitcoin and ether ETFs take effect Oct. 16, with at least 80% exposure to one asset, SEC-licensed custodians and no margin loans (The Block). ESMA opened a call for evidence on whether clearinghouses could access and liquidate tokenized collateral if a member defaults (Cointelegraph). Treasury Secretary Bessent said Thursday the U.S. will “probably” seize $1B in Iran-linked crypto this week, though it’s unclear whether that is additional to earlier claims (The Block). Tron says it will launch tokenized stocks, including U.S. Treasury assets, in Q4, with no issuer, stock list or regulatory detail yet, so treat it as an intention (Aurellix). Animoca Brands and Franklin Templeton announced a collaboration to expand the assets on NUVA, with no new assets or launch date (Animoca).
Usage and tooling: CoinDesk found Robinhood Chain’s average daily transactions fell 42% from mid-September to Oct. 2–8 and spot volume also declined, though deposits stayed above $1B and perpetual-futures volume rose; it reads as weaker trading, not an outage (CoinDesk). Anthropic opened an AI security-scanning program for open-source projects, and Ethereum client Nethermind and the ZEUS Bitcoin/Lightning wallet were among the crypto projects that applied (Cointelegraph). No new Ethereum Foundation or LayerZero posts in the last day, and no verified Swift shared-ledger news.
Health: walking and sleep, late-night eating, an ultraprocessed meal and a cannabis warning
Two 2026 meta-analyses of randomized trials point the same way on walking and sleep. In 21 trials (1,707 adults), moderate-intensity walking at a talk-test pace for 30 to 60 minutes, 3 to 5 times a week for 12 to 24 weeks, improved self-reported sleep quality, most for people who started with poor sleep. A second review of 8 trials in 683 middle-aged and older adults found about 34 more minutes of total sleep and about 12 fewer minutes awake after falling asleep, but no significant change in sleep efficiency or time to fall asleep, and sessions of 30 minutes or more looked better. The evidence is weak: the first review graded its certainty “very low” because of self-reported sleep, open-label trials and publication bias, and the second pooled few, very different trials. Walking is cheap and worth doing for other reasons, but don’t expect a guaranteed sleep fix. (Frontiers in Public Health; Scientific Reports)
In a randomized trial of 32 adults aged 60 and older, 16 weeks of supervised multimodal exercise three times a week (45 to 60 minutes of posture, mobility, aerobic, strength, agility and power work) raised actigraphy-measured sleep efficiency by 6.6 percentage points versus no training (95% CI 1.8–11.4) and cut time awake after falling asleep by about 33 minutes. Total sleep time didn’t change. It’s very small, mostly women, used wrist actigraphy only, and the participants didn’t have insomnia to begin with. (Brazilian Journal of Physical Therapy)
Analysis of the Nurses’ Health Studies and the Health Professionals Follow-up Study, nearly 200,000 people, found that those who reported eating after dinner or after bedtime had roughly 20 to 30% higher rates of fatty liver disease (MASLD) and cirrhosis. The authors suggest keeping calories to the hours well before bed, and an OHSU team is recruiting a trial of earlier eating. It’s observational with self-reported eating times, so it shows an association, not that earlier eating protects the liver. The paper’s DOI hadn’t resolved yet at collection time. (Medical Xpress)
A Virginia Tech randomized crossover study of 57 healthy-weight adults compared a roughly 300-calorie ultraprocessed meal with a minimally processed meal matched for calories, macros, fiber, sodium and water. The ultraprocessed meal produced higher insulin from 40 to 120 minutes, less carbohydrate burning and higher energy expenditure, while overall glucose exposure didn’t differ. Processing level may matter beyond the nutrition label, but it’s a single meal in young, healthy people, unblinded, with no long-term outcomes. (Virginia Tech; DOI)
Cannabis use was associated with worse objectively measured sleep in the 35-year CARDIA cohort (JAMA Network Open). Among 891 participants around age 61 with wrist-monitor data, each additional “cannabis-year” was linked to higher odds of fragmented sleep and of 30 or more minutes awake after sleep onset (OR 1.21), and recent users averaged 11 more minutes awake than never-users, even though their self-reported sleep quality wasn’t worse. If you use cannabis to sleep, feeling that it helps doesn’t mean your sleep is less fragmented, and it’s reasonable to talk to a clinician about a trial off it. It’s observational, self-reported use that clusters with tobacco and alcohol, so it can’t show cause. (JAMA Network Open; EurekAlert)
A small randomized trial of urolithin A, 1,000 mg daily for four weeks in 50 adults aged 40 to 64 with obesity, improved a brain blood-flow response on near-infrared imaging but not cognitive-task performance or blood-vessel function. The evidence doesn’t justify starting it for cognition or longevity; the blood-flow result is an early signal for further research. It was short and mostly women. (JAMA Network Open)
A harmonized analysis of eight cohorts and 17,368 participants (Journal of Nutrition, published in June and newly reported Oct. 9) found limited, inconsistent links between named healthy diets and cognitive change over time. Only the MIND diet was tied to a better executive-function trajectory, and only in three U.S. cohorts. It doesn’t justify picking one diet just to protect cognition, though a good-quality diet is still reasonable for other health reasons. It’s observational, with different diet and cognition measures across cohorts. (Journal of Nutrition; Medical Xpress)
General / local: Russian diesel waiver, stocks and yields, dyed-diesel deadline, PWC and Fairfax
Trump announced a Russian diesel deal, and Treasury issued a temporary sanctions waiver. After a Friday call with Putin, Trump posted that Russia agreed to supply more than 300,000 tons of diesel immediately, 500,000 in November and 1 million shortly after, plus 3 million more depending on Russia’s refineries. Putin’s own statement said only that Russia is willing to supply oil products, with no amounts, and the Kremlin hasn’t confirmed Trump’s numbers. OFAC’s General License 135 authorizes the sale, delivery and import (including into the U.S.) of Russian-origin diesel through April 7, 2027, but doesn’t release Russia’s central bank, National Wealth Fund or Finance Ministry accounts. It is a product-specific waiver, not a broad suspension of sanctions, and nothing in it changes the rules for personal transfers to Russia. Zelensky called it “a weak decision” and Sen. Blumenthal said it runs against Congress’s intent, while one analyst told the BBC the first tranche is about 2.25 million barrels against U.S. use of roughly 3.8 million barrels a day, so it “won’t make a material difference to pump prices.” Kremlin aide Yuri Ushakov said Putin told Trump that resuming trilateral peace talks is unlikely for now. I found no new restrictions on Russian money transfers, payments or messaging dated Oct. 9–10. (CBS/AP; BBC; OFAC; CNBC)
Stocks rose Friday while yields stayed near 24-year highs. The S&P 500 gained 0.59% to 7,811.51, the Dow 0.83% and the Nasdaq 0.64%. Brent settled around $104.72 and WTI at $91.85, and the 10-year Treasury yield ended at 5.24% after touching its highest level since 2002 earlier in the week. The average 30-year mortgage rate is at its highest in nearly three years. Weekly jobless claims were 197,000, still near 57-year lows, even though September payrolls rose just 29,000. Big banks report earnings next week and the September CPI is due Wednesday, Oct. 14. AAA’s Saturday average for regular is $4.3669 nationally and $4.1867 in Virginia, with Virginia diesel at $6.2309. (Kiplinger; BNN Bloomberg/AP; AAA)
Dyed-diesel tax relief: today is the deadline, and no guidance has surfaced. Executive Order 14435 gave Treasury five days, until about Oct. 10, to decide whether it can defer diesel excise tax penalties for dyed diesel used on highways from Oct. 5 through Dec. 31 and to direct the IRS to announce it. As of about 6:10 a.m. ET I couldn’t find a Treasury determination or IRS announcement. Any relief would be a deferral, not forgiveness. (White House)
Prince William County’s early vote is at 6.93%. The Office of Elections dashboard shows 23,269 ballots cast through 5 p.m. Oct. 9 (11,857 early in person and 11,412 returned mail ballots) out of 335,785 registered voters, about 3,100 more than two days earlier. The deadline to request a mail ballot or update your registration is Friday, Oct. 23, and early voting runs weekdays 8:30 a.m. to 4:30 p.m. at 9250 Lee Ave. and the Woodbridge DMV, with Wednesdays until 7 p.m. Manassas city early voting is at the Voter Registrar’s Office, 9025 Center St., with Saturday hours Oct. 24 and 31. (PWC Votes; Manassas)
Manassas “Operation False Front” follow-up and a bus-stop investigation. The three people arrested face prostitution-related charges, with one held without bond; these are charges, not convictions, and Manassas police ask anyone with information to call 703-257-8000 or Crime Solvers (Fox 5). Separately, Prince William police are investigating three reports (Sept. 18, Oct. 5 and Oct. 8) of a man in a gray Nissan sedan making obscene gestures at two teen girls at a school-bus stop near Coverstone Drive and Gales Court in Manassas, with no arrest announced (Daily Voice). The Board of County Supervisors meets Tuesday, Oct. 13, with a joint session with the School Board that evening, and Manassas Park offices are closed Monday for Indigenous Peoples Day.
Fairfax’s Dominion–NextEra hearing drew a large crowd. At the Fairfax County Government Center on Friday night, speakers focused on rate hikes, affordability and what it costs to power data centers. Supervisor Walter Alcorn said he fears “a much larger entity and people making decisions” farther away, and Prince William Chair Deshundra Jefferson said higher bills mean residents sacrifice “other things that they need.” One HOA speaker reported utility bills up 20%, while a few speakers backed the roughly $67 billion deal for union jobs. The companies have promised $10 monthly bill credits for four years if it’s approved. Written comments are due Nov. 9, and WTOP reports a decision is expected in January 2027. (WJLA; WTOP)
Fairfax early voting and county news: the county’s unofficial report, updated Oct. 9, shows 59,993 ballots cast, 7.30% of 821,728 registered voters (28,935 early in person and 31,058 returned absentee). Don’t compare it with the statewide VPAP or ELECT totals. At an Oct. 6 work session, Board Chair Jeff McKay told the legislative delegation that the state is pushing funding responsibilities onto localities (“The exhaustion level is getting real”), and the draft 2027 priorities include K-12 funding, dedicated Metro funding, housing, collective bargaining and tax reform. T5 Data Centers has also applied to build a 312,000-square-foot data center in Chantilly that would be the county’s first fuel-cell-powered one, with about 48 MW of natural-gas fuel cells and up to 27 MW from Dominion; no hearing date has been given. (Fairfax County; FFXnow; FFXnow on Chantilly)
Bottom line
The XRP Ledger’s overflow bug was fixed before anyone is known to have exploited it, but anyone with a Ledger bought through CryptoBilis in the last 90 days should follow Ledger’s advice and not use it, since suspected losses are in the tens of millions. Hashi’s $500M is commitments, not capital, Zcash’s January date is a target, and Volo’s $3.5M loss is a reminder that Sui DeFi isn’t immune. In health: walking and exercise are modestly linked to better sleep, with weak evidence, late-night eating and ultraprocessed meals are associations to watch rather than proven harms, cannabis may fragment sleep even when it feels like it helps, and neither urolithin A nor a specific diet has earned a place in a cognition plan. The Russian diesel waiver is narrow and changes nothing for personal transfers to Russia. Stocks rose, the 10-year is near 5.24%, and CPI is Wednesday. Locally, Prince William’s early vote is 6.93% and Fairfax’s is 7.30%, the Dominion–NextEra decision is expected in January, and Treasury’s dyed-diesel guidance is due today.