November 3, 2026
Four stablecoin developments bankers should know about

The Stablecoin Banker is a periodic newsletter keeping bankers on top of the stablecoin industry. I highlight top stories that are relevant to banks, with my insights and commentary to draw out the most important conclusions.

If you find this content useful, please feel free to forward it to your friends and colleagues. They can also subscribe directly or read back issues at thestablecoinbanker.com. If you're interested in stablecoin services for your bank, feel free to reach out to us at Omnia.

"One network combining fiat, stablecoins, and tokenized deposits with interoperability and utility across our infrastructure."
— Ryan McInerney, Visa CEO (Oct. 27, 2026)

In This Issue

• Tokenized Money Is Riskier, But Bank Exposure Is Increasing.
• Tokenized Deposits Are Still a Database With Better Marketing
• Visa Is Building the Any-Money Network on a 16-Digit Address
• Agents Are Knocking, and Most Banks Can't Afford to Say No

Plus, tidbits you may have missed in our Coupon Clippings section.

Tokenized Money Is Riskier, But Bank Exposure Is Increasing.

On October 29, about $6.3 billion left Binance hot wallets on 10 blockchains, most of it within roughly 20 minutes, passing Bybit's $1.5 billion loss in February 2025 as the largest crypto theft on record. Binance suspended deposits and withdrawals; its preliminary finding pointed to a compromised DevOps engineer's laptop, but on October 30 co-CEO Richard Teng said investigators had found additional points of breach. Binance said it will cover all losses from its $1 billion SAFU fund and corporate funds, and it began phased withdrawals on November 1. Stablecoins made up roughly half the stolen funds, and Tether and Circle froze more than $2.3 billion of them. The same day, Polymarket halted trading for about an hour after a compromised third-party monitoring script hijacked logged-in sessions to sell positions and withdraw about $2.7 million from roughly 730 accounts; the company says users will be made whole. Sources [Al Jazeera, CoinDesk, TechCrunch]

My Take:

Tokenized money is riskier than bank money today. I don't expect that to last, because the gap is closing from both sides.

Start with the root causes. Binance's preliminary account traced the attack to a compromised engineer's laptop, and the company now says there were additional points of breach. Either way, the attacker reached the systems that sign and submit withdrawals, and from there nothing slowed the bulk of $6.3 billion leaving across 10 chains in about 20 minutes. At Polymarket, a compromised third-party script running inside the company's own website impersonated users in sessions they had already logged into, selling positions and withdrawing funds without anyone clicking a thing. Had users been required to approve each sale or withdrawal on a second device, like a phone or a security key, the script could not have run silently. The common failure is that neither firm required an approval the compromised system couldn't grant itself. Banks know these controls well: dual control, out-of-band callbacks, and velocity limits on how fast money can leave.

Those controls are part of why bank money is harder to steal. The rest is the system itself. Moving bank money runs through a multilayered, intermediated chain, and an attacker who wants to abscond with a large sum in one move has to understand a specific bank's tech stack and its bespoke wire procedures. The fragmentation and opacity work to banks' advantage. The backstop differs too. Tokenized money lacks the legal protections of a bank deposit, and there's nothing like FDIC or SIPC behind a custodial digital asset balance. Binance is covering every dollar, but its $1 billion SAFU fund was less than a sixth of the loss. I doubt most custodians or exchanges hold a capital cushion big enough to absorb an attack this size, so token holders are counting on the institution having the capital, and the willingness, to make them whole.

It's more useful to think of digital assets as the leading edge than as a separate risk class. Exchange balances are visible on chain, transactions use standardized formats, and money moves instantly which makes them an obvious target. I expect both sides of the risk equation to change. On the bank side, real-time payments will dramatically increase the speed at which an attacker can move money out of a bank, eating into the time delays and manual approvals that fraud teams have always relied on. On the digital asset side, privacy protocols will bring to digital assets some of the opacity that makes banks harder to attack, and digital asset firms, with modern systems and tech-forward teams, can harden their security faster than most banks can.

Better security hygiene, from third-party script scanning to second-device approvals, may have stopped both of these attacks. But that lesson fights yesterday's war, and winning it doesn't prevent the next one. The deeper problem is the siloed architecture of risk systems, and this affects digital asset and traditional finance players equally. Financial institutions have historically built risk prevention in functional verticals: BSA/AML transaction monitoring in one place, fraud scoring in another, security threat detection in a third. I imagine a last line of defense that scores every internal and external action immediately before execution, and holds the ones, financial or otherwise, that show aberrant signals. That's hard. It requires coordination across functions, "black box" models that weigh more parameters than a person can reason about at once, and data from many systems, all particularly hard for organizations with verticalized staff, legacy systems and fears about explainability.

Tokenized money is riskier today, but the gap is closing. Bank money is getting faster, and therefore a better target, while digital asset firms are getting more secure. Banks moving toward instant payments, or toward products that let customer funds move onto open blockchains, should look for their own threat model in these attacks. Watch which defenses the digital asset industry adopts over the coming months, and start now on the harder work of connecting fraud, BSA/AML and security monitoring into a single check before money moves. In a bank organized by function, that takes years, and it's far easier to begin while wire delays and manual approvals still buy time to catch fraud.

Tokenized Deposits Are Still a Database With Better Marketing

On October 22, SoFi Bank launched SoFi Earn (SOFIE), an FDIC-insured tokenized deposit for consumers that pays a 4.40% variable APY and converts 1:1 into SoFi's SoFiUSD stablecoin; it is rolling out to SoFi Crypto members through November. On October 19, JPMorgan's Kinexys made its JPMD deposit token available to institutional clients on Ethereum mainnet, nearly a year after launching it on Base. Blockchain analytics firm Sentora counts about $1 million of JPMD outstanding on Base across two addresses, and none on Ethereum. Also on October 19, Texas community banks Vantage Bank and Rio Bank settled a loan participation principal-and-interest payment with tokenized deposits on Hazel Network, built by Vantage and Custodia, with loan software provider Participate handling allocations; funds reached Rio Bank in under three minutes, and amounts were not disclosed. Sources [SoFi, crypto.news, Participate]

My Take:

The tokenization theater performance continues uninterrupted. These three stories show more evidence of the natural limitations of tokenized deposits, alongside a glimmer of opportunity worth noting from the Texans.

Start with customer use, where tokenized deposits offer zero incremental benefit over ledgered bank money. SOFIE is simply equivalent to a deposit balance at SoFi, which the customer already had before the token existed. SoFi's FAQ states that "SOFIE itself stays on SoFi," meaning the user can't do anything on chain with it, and the release names no blockchain because the detail is irrelevant. Trading between SOFIE and SoFiUSD or crypto will be functionally equivalent to trading from the dollar balance SoFi already offers; the only differences are in the bank's implementation and the terminology the user sees. Until the token is accepted on third-party platforms, like centralized or decentralized exchanges, it offers no new capabilities and probably just adds confusion. Off-platform acceptance brings significant BSA/AML, liquidity management and risk challenges, so I don't expect it any time soon.

JPMD's results mirror this. In nearly a full year on Base, the amount outstanding still stands at about $1 million, spread across a whopping two wallet addresses. The $4 trillion of volume JPMorgan cites runs on its private, internal blockchain, also known as a real-time database.

The Vantage and Rio story is different because it's a live transaction between two institutions, but it is still mostly an example of faster database entries. The on-chain transfer simply replaced a nostro/vostro entry on Vantage's ledger. As the bank managing the loan, Vantage would otherwise have credited Rio's account directly, and the token transfer ultimately writes back to the bank ledger anyway. The only activity on chain is the bank liability accounting. The hard parts of participation management - loan management and payment allocation - still live in Participate's database.

Despite this critique, it is a baby step toward tokenized deposits offering actual differentiated value. This happens when the loan documentation moves on-chain, and gets magnified when tokenized deposits are offered on common blockchain technology, meaning chains built on consensus mechanisms widely understood like Ethereum or Solana. Moving loan docs on chain decouples the participating banks from offchain loan management providers like Participate, so banks don't need to coordinate their off-chain LMS data formats and integrations. Offering deposit tokens on common blockchains enables banks to easily integrate with multiple networks, and to realize tech spend efficiencies as each additional network can ride on the bank's existing integrations. Of course, these two goals are at odds with the economic interests of private network operators and LMS providers that are predicated on holding the source-of-truth for loan records. Today, Vantage's Hazel is the only U.S. tokenized deposit network pursuing this strategy, building on Ethereum (for the astute reader, JPMD and other deposit tokens on public chains haven't made an effort to build a network around them).

Banks are being courted by many tokenized deposit projects (FIS, Cari, BankChain, Vantage and more). They should ask each bidder how integrating into its network will make it easier to integrate into others, and what their plan is for moving up the stack above the payment to enable on-chain workflows. Without a compelling answer, a bank should treat the project as another closed, privately controlled network, no different from TCH or IntraFi, where each one has to support a business case that justifies a full network integration on its own.

Visa Is Building the Any-Money Network on a 16-Digit Address

On its fiscal fourth-quarter earnings call on October 27, Visa said stablecoin settlement on its network passed a $25 billion annualized run rate, up 10x year over year, across 10 blockchains and five stablecoins. It now counts more than 225 stablecoin-linked card programs with 5 million cards in over 50 countries. CEO Ryan McInerney described the company's vision as "one network combining fiat, stablecoins, and tokenized deposits," and said Visa will soon launch the first stablecoin-linked Visa Flex credential with Norwegian exchange NBX. Earlier, Mesh announced a partnership with Visa that lets wallet apps built on its payments SDK spend users' stablecoin and crypto balances at Visa merchants without running their own card program. Mesh acts as program manager and handles onboarding and KYC, a Visa credential is provisioned behind the scenes, and the merchant receives a standard card payment; no issuer, launch wallets or live date were named. Sources [Visa, PR Newswire]

My Take:

McInerney gave all the context needed to understand these stories: one network combining fiat, stablecoins and tokenized deposits. That's an exciting proposition for users and for stablecoin proponents, and Visa brings more to it than distribution scale. It brings something that has eluded the tokenized ecosystem for a decade: universal addressing.

I often hear people dreaming about payments that move like packages. State your package size and destination, then choose among carriers based on price and speed. That only works with globally standardized addresses that abstract away the rail. USPS, FedEx and DHL can each run their own package networks because local governments assign addresses to properties. Banking doesn't work that way. Addresses are assigned locally, sometimes by governments and sometimes by private bodies; in the U.S., routing numbers are assigned not by the government but by a registrar the American Bankers Association designates.

Visa and Mastercard hold a globally unique asset: the primary account number. Billions of cardholders can be reached with a 16-digit string anywhere in the world. Recognizing this, Visa is building its any-money network on top of that addressing. Its Flex credential already lets a cardholder connect multiple funding sources to a single card and choose among them, and the first stablecoin-linked Flex card is on the way with NBX.

In the Mesh partnership, Visa has the addressing and, somewhat ironically, Mesh has the distribution. Mesh provides wallet and payments components to user-facing wallet companies, each of which would otherwise need to find its own program manager to issue a stablecoin-backed card, and whose users would have to go through a traditional card onboarding flow. Mesh makes that automatic. Once a user onboards through Mesh, a Visa credential is provisioned behind the scenes, ready for tap-to-pay worldwide. Visa provides the card number; Mesh maps it to the user's balance.

As exciting as this seems, it doesn't change the market structure in a way to favor stablecoins. Simplifying account management, and letting a single card number reach any balance, makes stablecoins easier to use for people who already want them. Financial institutions are adopting tokenization in ways that are skeuomorphic and fit into existing business models. Mesh lets any stablecoin wallet spend on Visa rails, but it does so through a Visa card, issued by a traditional Visa issuer, running on Visa's standard network rules and carrying typical interchange. Nothing about that tilts the market toward stablecoins other than making it slightly easier for wallets to add stablecoin-backed cards. Instead, it's Visa's move to absorb any new money network into what it does best.

Within banking, Visa's trajectory should still create some concern. Visa is keeping these money flows within the industry's four walls for now, but as stablecoins become easier to spend over Visa rails, the banks that stand to benefit are the ones with the most stablecoin-friendly BIN sponsor programs. Longer run, the risk facing banks sources from Visa's increasing direct reach into fintechs that are aggressively pursuing banking customers with bank-like products. With direct access to payors and merchants, Visa is increasingly incentivized to create network rules specifically for end-to-end stablecoin transactions that skip issuing or acquiring banks. BIN sponsor banks have the near-term opportunity to support stablecoin-linked cards in order to establish themselves in this evolving story.

Agents Are Knocking, and Most Banks Can't Afford to Say No

On October 13, JPMorgan said it is blocking outside AI agents, starting with Meta's Muse, from using customers' credentials to operate their digital banking, and pointed them instead to customer-authorized data sharing through open banking providers; on October 27, Bank of America reminded customers who share logins with an AI assistant that they are responsible for the resulting activity. On October 21, Walmart opened Agent Gateway, which lets approved AI shopping agents search and buy, with customers able to require approval per purchase or set spending limits, while Amazon continues to block agents. The next day, Anthropic's Claude Duet app began purchasing on behalf of users through Stripe's Link agent wallet, with the user approving each purchase. On October 26, AI agent Instinct, which already enabled Link cards, began rolling out Link Balance, a prefunded balance held in USDC that its agent can spend without approval up to a per-purchase cap the user sets. Sources [Fortune, TechCrunch, The Defiant]

My Take:

I'd frame these stories as the beginning of a messy period of discovery over how agents will interact with their humans and their humans' services. Some early fault lines are already visible.

The first is in shopping: Amazon says no, Walmart says yes. Amazon took in nearly $20 billion in advertising revenue last quarter, and Google said on its third-quarter call that lower monetization in AI Mode weighed on its Search revenue growth. Until someone builds an agent-friendly ads model, businesses that earn material revenue from eyeballs on their own sites are more likely to block agents.

The second is in banking: JPMorgan and Bank of America say no, Mercury and Ramp say yes. JPMorgan points agents to open banking, which in the U.S. means read access at best; an agent can see the account but not act on it. Mercury and Ramp let agents act, within permissions the customer sets. There's probably some truth to the big banks' concern about risk, but their account agreements already place liability on the user who shares a login. I suspect the bigger fear is agentic optimization and losing control of the customer experience. JPMorgan pushed Plaid and other aggregators into paid data-access agreements last year. Maybe they will do the same for agentic access.

My favorite fault line is stablecoins versus cards. Instinct adding Link balance, after already offering Link's card wallet, is telling. With the card wallet, the user's own card sits behind Link, and Link requires the user's approval before minting a single-use, spend-limited card for each purchase. Neither company has said why that setup can't run autonomously. I think the upstream card issuer is the obstacle, since it can block an unattended transaction outright or require an interstitial step like 3D Secure. Link balance works the same way at purchase time, minus the approval. The user is present to load the balance, which Stripe holds in USDC, and then it's hands off the wheel. Each purchase runs through a prepaid card issued by Lead Bank, so the user's card issuer is no longer in the loop. Stablecoins don't solve the proof-of-intent problem or settle whether chargeback rules need to change for agents. What the prefunded balance does is separate the funding step from the spending step, the same Lego-style trick stablecoins enable in cross-border payments, where an intermediary balance separates the on-ramp in one country from the off-ramp in another.

Bankers should consider the power dynamics. Consumers already want agentic payments. Large, differentiated platforms like JPMorgan and Amazon still have enough power to say no to agents; most banks do not. Bank customers are sticky, so most banks will get away with not leading the charge, but strategies are already forming, from letting customers' agents provision virtual cards from the bank, à la Stripe Link, to prefunded or stablecoin-based agent wallets, to bank-offered personal agents tuned for leading use cases like shopping. The upshot is that agents give banks white space to build new customer-facing products that keep customers engaged before they get fully built out by external providers.

Coupon Clippings

The OCC Trades Bright Lines for Judgment

On October 21, the OCC became the first agency to finalize its GENIUS Act rule, covering issuance, reserves, redemption, capital and custody for the stablecoin issuers it supervises, effective January 18, 2027; five days later, it invited community banks to apply as issuers. Overall, the changes from the NPRM move from prescriptive toward principles-based regulation. Yield is still prohibited, but only in principle: rewards programs are no longer presumed to violate the ban and will be judged case by case. Reserves no longer face the proposed weighted-average-maturity test, though they still need a 5% on-demand floor and enough liquidity to meet redemptions and manage interest-rate risk, and the rule sets no one-brand limit, so the existing practice of one issuer running many branded stablecoins can continue. With fewer prescriptive rules, issuers' practices will diverge, and risk-sensitive holders and counterparties will need to analyze issuer risk more closely. That plays to banks, which are built to understand and take on risk, and puts them in a better position than most to offer multi-stablecoin services. Sources [OCC, CoinDesk]

Stripe Just Built Fifth Third a New Front End

On October 21, Stripe launched Treasury for Agents, which lets companies use ChatGPT, Claude or Cursor to check balances, pay invoices, move money between accounts and convert currencies. Fifth Third provides the accounts behind Stripe Treasury, and asked whether Stripe wants the product to become startups' primary financial account, Treasury product lead JR Farr said, "Absolutely." I believe software will unbundle in the coming years, separating the interface from the backend. Banks of the future won't need their own front ends, since they provide nearly homogeneous services and a branded app that treats every user the same way adds little. Stripe is moving in that direction, essentially building a separate interface for Fifth Third through its agents. The opportunity for banks is to offer Stripe-like agents directly in addition to programmatic endpoints that users connect to with a tailored interface, whether that's a chatbot, a UI built by their chatbot, or a third party app designed around the customer's needs. Banks that support the transition stand to benefit: tech spend can go down as digital banking front ends go away, while customers get AI tools that make sure they finish their task every time. [Full Story]

Ripple Receives a Final Approval, But Keeps Its Stablecoin Out

On October 26, Ripple received final OCC approval for Ripple National Trust Bank, nearly a year after its conditional approval and while ICBA's lawsuit against the OCC's trust charters is pending. The trust bank will manage the segregated reserves backing Ripple's RLUSD stablecoin, act as collateral trustee for holders and offer digital asset custody, but RLUSD will still be issued by Ripple's NYDFS-regulated trust company. Ripple is a test case in two ways. First, like Circle, it has kept stablecoin issuance outside its national charter. The reason could simply be historical, since Ripple applied well before the GENIUS rules were known, or it could be that New York requires a BitLicense to serve its residents and exempts only NY-chartered banks, an untested question for a national bank. Whether the difference matters will become clear in how RLUSD's capabilities, uses and distribution compare with other stablecoins. Second, Ripple describes its custody as "fiduciary," while American Banker describes their activity as nonfiduciary, a distinction that took on new importance when ICBA sued the OCC over its authority to charter trust banks for substantially nonfiduciary activities. The difference comes down to whether the custodian makes investment decisions on behalf of the stablecoin issuer, so the case may help clarify whether reserve management takes enough discretion to count as fiduciary work. Sources [Ripple, American Banker]

Ramp's Trust Charter Is Aimed at Business Banking

Spend-management fintech Ramp applied to the OCC on October 16 for a national trust bank charter focused on digital asset custody and investment management, following Modern Treasury and Rain earlier in the month. Ramp's charter application describes a USDR stablecoin for use within the Ramp ecosystem, along with on- and off-ramps, payments and custody. This is more than another stablecoin issuer play, because the filing reveals Ramp's plan to compete in business banking. Its financial management pillar describes "integrated financial management services to facilitate treasury, expense management, bill payment and related operations," and aims to "enable seamless access to business funds while optimizing yield." That goes after business banking directly, and after competitors like Mercury, whose Treasury product still limits automatic transfers back to the operating account to two a month. The landscape for business banking keeps getting more competitive as alternative models expand, whether that's fintech-on-bank, the depository neobank or the trust bank. [Full Story]