The Morning Brief: Institutional crypto adoption accelerates; DeFi security tested by $75M exploit

The week's dominant thread is institutional adoption moving through multiple channels simultaneously, each narrowing the perimeter of crypto that operates outside traditional finance. But that progress collides with a sharp reminder that DeFi's collateral infrastructure is still untested at scale.

On the adoption front, Charles Schwab announced plans to add Solana (SOL), Avalanche (AVAX), and Chainlink (LINK) to Schwab Crypto accounts in the coming months, expanding beyond the Bitcoin and Ethereum trading launched in May 2026. The platform charges 75 basis points per transaction. Separately, Revolut began rolling out EURR, a euro-backed stablecoin, to customers in Denmark, Poland, and Portugal, with Bridge Building (a Stripe company) serving as the licensed e-money issuer under the EU's Markets in Crypto-Assets framework. Both moves represent wealth managers and fintech platforms treating crypto assets as standard product offerings rather than experimental sidelines.

Tokenized-stock trading shows a different form of concentration: the top seven most-traded tokenized stocks all trade on BNB Chain or Robinhood Chain, collectively generating $4.3 billion in DEX volume over 30 days, per the desk's reporting. BNB Chain averaged $676.8 million in daily volume; Robinhood Chain, which launched July 1, averaged $29.7 million daily. Uniswap processed $1.5 billion in stock token trades on Robinhood Chain in six weeks. This concentration raises a single critical question the reporting does not yet answer: whether regulatory scrutiny will follow the volume, especially if settlement or composability become enforcement targets.

On network infrastructure, RLUSD on Ethereum reached $1.33 billion in supply as of August 30, surpassing XRPL's $1.04 billion for the first time. Ethereum supply grew roughly 93% over the past 30 days, accounting for about 84% of the net increase. Ripple's stablecoin is flowing toward DeFi; XRPL's role is shrinking. Vietnam formalized a five-year pilot for tokenized assets under Government Resolution No. 05/2025/NQ-CP, signed September 9, 2025, mandating VND settlement, real-world backing, and a VND 10 trillion minimum capital per exchange. Five exchanges are moving toward approval, and unlicensed trading penalties take effect September 1, 2026.

But Friday night brought a rupture: Cronos validators halted the entire blockchain on August 31 after an attacker exploited a price-manipulation vulnerability in the Tectonic lending protocol, putting approximately $75 million at risk. The attacker pushed TONIC's price up 100x in 20 minutes, used the inflated token as collateral to borrow assets, and triggered a network-level emergency intervention. Most attacker funds remained on-chain; about $6 million reached Ethereum before validators froze the network. This is the first time network-level emergency intervention was needed to contain a DeFi failure, and it exposes a pattern: collateral systems relying on thin governance tokens lack defenses against rapid price moves. The reporting does not specify whether the halt remains active or what Cronos' recovery plan entails.

On Ethereum itself, the validator activation queue hit a 36-day bottleneck: 2.06 million ETH awaits entry at the network's 256 ETH per epoch activation limit, costing new stakers an estimated $348,000 to $366,000 daily in foregone consensus rewards. Staked ETH reached 42 million, or 35% of total supply. The exit queue held only 96 ETH, creating sharp asymmetry between entry and departure demand. Whether protocol developers propose raising the activation cap will determine if this constraint persists as material friction on staking growth.

Regulatory clarification is proceeding on parallel tracks. The SEC's proposed custody rule rewrite entered White House review on August 25, with an October 2026 notice of proposed rulemaking targeted. The framework clarifies how wealth managers and funds can hold crypto assets in compliance with federal safeguarding standards. Former SEC Chair Tim Massad and ex-CFTC Chairman J. Christopher Giancarlo are urging principles-based regulation of perpetual futures to bring the $90 trillion market into US jurisdiction, warning that strict rules will keep it offshore. The CLARITY Act, which would clarify SEC-CFTC boundaries on digital assets, has passed the House and committee but remains stalled in the full Senate, suggesting deep disagreement on whether the US should compete for perps volume or restrict leverage outright.

On compliance, HMRC published its first crypto-specific Capital Gains Tax data for 2024-25: 17,600 UK filers reported £1.38 billion in gains, with 240 whale investors earning over £1 million each accounting for £717 million. This baseline emerges before mandatory third-party reporting begins in 2027. Deribit will shut down its public daily Proof of Reserves page on September 1, 2026, after moving roughly 90% of client assets to Coinbase custody. Clients will lose direct verification access; audited statements will be available only on request. Russia's Sber announced plans to accept USDT and Ether as loan collateral alongside Bitcoin following regulatory clearance for public crypto trading.

THORChain deployed version 3.20 on August 25, enabling native Monero and Zcash swaps directly against Bitcoin, Ethereum, and stablecoins. Monero's price rose roughly 8.9% following the upgrade. The deployment removes the need for wrapped tokens or centralized exchange intermediaries, but whether THORChain's pools attract sustainable external liquidity beyond the initial phase remains untested. Polygon deployed two hard forks, Austin and Kyoto, to patch denial-of-service and consensus flaws prior to public announcement. Polygon claimed the vulnerabilities were never exploited, but the reporting does not provide independent verification or detail the timeline between deployment and disclosure.

Corporate treasury accumulation accelerated: Strive purchased 1,800 BTC between August 24 and August 28 for $143 million at $79,431 per bitcoin, raising total holdings to 23,156 BTC and entering the top five corporate treasuries. Luke Dashjr, a 16-year Bitcoin Core developer, exited OCEAN Mining on August 29 following a mutual separation over differing visions on mining protocol developments. He is pursuing a new mining venture called CONVOY. The separation statement cited protocol disagreement without naming a specific proposal. Finally, the CFTC settled insider-trading charges against Gabriel Perez, a former White House teleprompter operator, for $172,000 after he traded prediction market contracts on advance knowledge of presidential speeches. He profited more than $107,500 before the regulator caught him.