This briefing covers announcements and changes from September 28 to October 4, 2026, Korean time.
1. Base: Cobalt Mainnet Upgrade
Base completed the Cobalt Mainnet Upgrade at 18:00 UTC on September 30. The core feature, Validity Transactions, allows users to attach conditions such as expiration time, block height, Flashblock position, and contract storage values to signed transactions. The sequencer holds these transactions and only includes them in a block when all conditions are met. Transactions submitted via base_sendRawTransactionValidity are not exposed to the public mempool until execution, and if conditions remain unmet, they are never executed. Previously, a Keeper had to monitor the state and compete to submit, but now the block builder directly evaluates eligibility.
Base's Cobalt release notes describe this feature as useful for conditional swaps and withdrawals. It eliminates polling infrastructure and resubmission competition but does not lock the rest of the chain's state at the time of signing. Therefore, wallets and dApps must clearly show users the execution conditions, expiration time, and the possibility of eligible transactions being outbid in gas fees. Additionally, when managing transaction life cycles, it is advisable to categorize states such as submitted, pending, eligible, block-included, and expired, rather than treating initial signatures as completed orders.
Cobalt also expands Base's native token standard, B20. Issuers can combine existing KYC whitelists and sanction blacklists with AND/OR logic, reserve changes in display quantity multipliers for corporate actions like stock splits, and activate the seizeWithMemo feature if necessary. This last feature allows an approved administrator to forcibly transfer a specific holder's balance to another address while recording the reason on-chain. These primitive functions elevate the compliance and recovery processes of stablecoins and tokenized assets to the protocol level, forming a completely different permission model from typical ERC-20. Wallets, indexers, and explorers must clearly expose account freezing and seizure functions, distinguish between actual and multiplier-applied display balances, and update systems to match the new ABI.
2. SEC: Custody Regulation Proposal for Advisory Firms and Regulated Funds
On October 1, the SEC proposed new custody regulations for registered investment advisors and regulated funds. This acknowledges that existing qualified custodians may not support new crypto assets that funds wish to handle. According to the proposal, qualified state trust companies1 can participate as custodians, and if no qualified custodian can be found, advisors or funds may directly custody the assets. This is not a finalized rule and will undergo a 60-day comment period following publication in the Federal Register.
Self-custody here does not mean individual investors managing their wallets directly. It refers to advisors or funds acting as custodians for client assets. Commissioner Hester Peirce explained that before taking custody, it must be confirmed that no qualified custodian is available, and this must be reassessed quarterly. State trust companies must undergo initial and annual due diligence on licensing status and security measures. If advisors or funds directly take custody, they must meet stringent requirements for expertise, cybersecurity, annual audits, internal reporting, account statements, and client disclosures.
If this framework is adopted, the role of institutional custody products will extend beyond simple key storage. They must provide evidence of custody capability per asset, internal custody approval processes, quarterly reassessments, and incident record management. Platforms transferring assets to state trust companies must continuously verify the institution's licensing status and control. As custody paths diversify, the importance of wallet policies, key generation and management ceremonies, role division, and auditable approval processes will inevitably grow.
3. Roughrider: Integrating Solana-based Bank Tokens with Existing Core Banking Systems
On October 1, Fiserv announced that it had opened its digital asset platform to financial institution clients, with North Dakota Bank's 'Roughrider Coin' becoming the first real-world use case. Roughrider Coin is a representative example of integrating the fast speed of public chains with strict participant restrictions and recovery controls into core banking workflows.
Over 90 banks and credit unions in North Dakota can use it for interbank fund transfers. VersaBank USA handles issuance, redemption, reserve management, and custody, Fireblocks provides digital asset infrastructure, and Solana processes transactions. Participating institutions use the existing 'Fiserv Commercial Center' interface for transactions.
According to North Dakota Bank's architecture description, this token is not a general retail public stablecoin. It is a permissioned, institution-only token matched 1:1 with the US dollar. It uses Solana's Token-2022 control features, including account freezing and clawback, and participating institutions trade through Fireblocks MPC wallets with automated compliance policies. Token minting occurs only after cash is deposited from the operating account of a participating institution to a designated FBO account. When tokens arrive in the recipient institution's wallet, a smart contract command automatically burns the tokens.
In this structure, on-chain finality and final bank ledger state operate separately. In addition to token transfers and automatic burning, funds between FBO accounts are net settled daily and moved via ACH files2. Therefore, the system should not immediately consider the success status on a blockchain explorer as final settlement completion.
4. MetaMask's Default Security Settings Reveal Metadata Exposure and Infrastructure Dependency Issues
On September 29, MetaMask integrated profile and privacy control features into a single default setting. This setting is enabled by default for new users, supporting token and NFT detection, transaction simulation, security alerts, phishing prevention, ENS domain resolution, contract decoding, and network status checks. In return, wallet addresses are linked to individual profiles, and standard network requests are sent when some features operate. Wallets using the Secret Recovery Phrase method can disable this setting but will lose access to these features. In contrast, wallets created through social logins like Google, Apple, or Telegram are tied to the login model, so this setting cannot be disabled. This is separate from the optional anonymous metrics collection setting.
The default-enabled security protection features reduce phishing or blind signing incidents but make linking addresses and profiles a default behavior. While self-custody may ensure control over private keys, it does not conceal the metadata needed for token detection, simulation, and security alert backends. Wallet services must clearly inform users, outside of the privacy menu, about which addresses and requests are sent to which services before account creation, what features are disabled when the setting is turned off, and how social login methods differ from the recovery phrase method.
In the same week, separate operational infrastructure dependency issues arose. From September 30, MetaMask proactively removed affected validators from non-custodial staking operations in response to a security incident affecting part of its infrastructure. As of October 1, MetaMask stated there was no indication of impact on wallets or customer funds, and it does not manage customers' withdrawal keys. Since the company has not disclosed specific causes, it is premature to speculate on attack vectors or impacts. However, this incident highlights that key custody and service availability are distinctly separate boundaries. Even if funds remain safe under user control during staking, simulation, alert, and backend-based functions can still degrade. Therefore, status notifications and incident response processes must report these states separately.
5. Ethereum Glamsterdam Upgrade: Testing ePBS and Parallel Validation on Sepolia
The Ethereum Foundation announced on September 28 that Glamsterdam will be activated on Sepolia on October 6 at 13:53:36 UTC. There is no schedule yet for Hoodi and the mainnet. Glamsterdam includes Amsterdam execution layer changes and Gloas consensus layer changes. The core features are proposer-builder separation (ePBS) and block-level access list (BAL) embedded in the protocol.
This blog details the changes in Glamsterdam. Read more: Fusaka, Glamsterdam, Hegota: Evolution of Ethereum L1 Core and Scalability Roadmap
The briefing is prepared every Monday based on analysis generated by Codex. It undergoes direct review and approval by the blog operator before publication.
Footnotes
-
State Trust Company
A financial institution specializing in trust operations, licensed and regulated by a specific state government in the U.S. ↩ -
ACH File
ACH stands for Automated Clearing House, a network used by U.S. banks for batch transfers. Banks send multiple transfers in a NACHA format file instead of sending money in real-time for each transaction. This is called an ACH file. The receiving bank reads the file to deposit or withdraw from accounts. Typically, transactions are batched daily and do not complete in seconds like blockchain transactions. ↩