Stobox Weekly RWA & Tokenization Digest: September 22–28, 2026

The week of September 22 to 28, 2026 tested tokenization on operations rather than ambition. A major exchange lost about $387 million through its wallet back-end without a single private key being stolen. Europe’s central banks asked Brussels to rewrite the rule that decides where stablecoin reserves sit. The CFTC chairman told a Treasury-market audience that tokenized collateral settles almost instantly and promised rules for it. For Stobox, which has built tokenization infrastructure since 2018, the through-line is familiar: the token is the easy part, and custody, reserves, collateral and records decide who survives. Meanwhile the on-chain RWA market held at $38.6 billion, and derivatives on tokenized assets grew faster than the assets themselves.

The current market figure, dated and sourced, lives in State of RWA 2026.

This week in one minute

• Bitget breach (Sep 24): Bitget first reported about $351.6 million taken from hot and warm wallets, later revised to about $387.5 million. Attackers compromised a back-end wallet system, not private keys, and the CEO pointed to North Korea.
• MiCA reserve rule (Sep 22): The European System of Central Banks proposed removing MiCA’s 30% and 60% bank-deposit floors for stablecoin reserves and replacing them with liquidity buckets.
• CFTC on tokenized collateral (Sep 22): Chairman Michael Selig said tokenized collateral enables near-instantaneous settlement and promised principles-based rules for tokenization and on-chain finance.
• Derivatives outran spot: a16z crypto data put August volume in perpetual futures on real-world assets at $117.3 billion, up 44x year over year, while distributed on-chain RWA value sat at $38.58 billion on September 28, per rwa.xyz.
• From Stobox: the key figures of State of RWA 2026 are now open data in CSV and JSON, refreshed September 27, so analysts and AI systems can cite one dated source.

The ten developments below were selected on their importance to the tokenization industry, not their relationship to Stobox. That is the standard for this publication.

1. Bitget loses about $387M through its wallet back-end, and no private key was stolen

What happened. On September 24, 2026, Bitget detected unauthorized withdrawals and paused them while deposits and trading continued. The exchange first put the loss at about $351.6 million from hot and warm wallets, as Bloomberg reported, then revised the count to about $387.5 million after adding Zcash and further TRON balances. Bitget said the attacker compromised a critical back-end system in its wallet infrastructure and spoofed transaction data, according to The Hacker News. CEO Gracy Chen said the pattern was highly consistent with North Korean operations, and Elliptic and TRM Labs linked it to the TraderTraitor group. Bitget said the full loss fits inside its User Protection Fund of more than $464 million, held largely in bitcoin.

Why it matters. The keys held. The system that tells the keys what to sign did not. That is the uncomfortable lesson: a perfectly secured signing key still signs a forged instruction if the software feeding it has been taken over. The same week, KelpDAO’s operator sued LayerZero and its CEO in British Columbia over April’s $292 million rsETH exploit, arguing the single-verifier setup was approved and then blamed on Kelp. Two cases, one theme: the failure point is now configuration and orchestration, and lawyers are starting to assign liability for it.

Business impact. Issuers who keep tokenized securities or investor funds with a third-party custodian should ask a sharper question than “are the keys in cold storage”. Ask who can generate a withdrawal instruction, what verifies it independently of the system that created it, and how a spoofed instruction would be caught before signing. Investors should read protection-fund claims carefully: a fund held in bitcoin moves with the bitcoin price.

Stobox Perspective. Tokenized securities make this worse, not better, if the record and the transfer logic live in the same place as the custody software. A security token should refuse an unauthorized transfer at the contract level, through transfer rules that check eligibility and limits regardless of what the operator’s back-end says. That is the design intent behind permissioned token standards: compliance and transfer restrictions enforced where the asset lives, not only in the platform’s database.

Related trend. Security incidents are migrating from key theft to control-plane compromise: signing services, bridge verifiers, admin configurations. The attack surface is the orchestration layer.

Key takeaways

• Bitget’s loss was about $387.5 million after revision, from hot and warm wallets only; cold wallets were not affected.
• Private keys were not stolen; a back-end system spoofed transaction data.
• KelpDAO’s lawsuit against LayerZero tests who is liable for a security configuration.
• For tokenized assets, enforce transfer rules on-chain so a forged instruction still fails.

2. Europe’s central banks move to scrap MiCA’s bank-deposit floor for stablecoin reserves

What happened. The European System of Central Banks, the ECB plus national central banks, published its response to the European Commission’s targeted MiCA consultation, covered by CoinDesk on September 22. MiCA today requires stablecoin issuers to hold at least 30% of reserves as bank deposits, and 60% for significant tokens. The ESCB says those floors should be removed and replaced with minimum shares of assets that mature within one and five working days. Its suggested starting point follows the EBA draft technical standards: at least 40% in the daily bucket for significant tokens and 20% for others, and 60% and 30% in the weekly bucket. The central banks also want the interest ban extended to crypto lending and staking.

Why it matters. The deposit floor was meant to make reserves safe. The central banks now argue it does the opposite for banks, because large stablecoin deposits are flighty funding that can run. The deposit rule has also been cited as one reason Tether did not seek a MiCA licence. Moving from “where the money sits” to “how fast it can be turned into cash” changes the economics of issuing a euro-regulated stablecoin.

Business impact. Stablecoin issuers and treasury teams in the EU should model reserve portfolios under liquidity buckets, which favour very short government paper over bank deposits. That points toward tokenized money-market and Treasury-style instruments as reserve components. Issuers that planned around bank-deposit relationships should keep that plan flexible until the Commission decides.

Stobox Perspective. This is a regulator writing liquidity rules for tokens the way prudential rules are written for funds. It matters beyond stablecoins. Any tokenized instrument that promises redemption will eventually be judged on how quickly the backing assets become cash, and the record must show that maturity profile at any moment, not in a quarterly PDF.

Related trend. Stablecoin regulation is converging on money-market-fund logic on both sides of the Atlantic, with reserves in short-dated government assets and daily liquidity tests.

Key takeaways

• The ESCB proposes dropping MiCA’s 30% and 60% bank-deposit floors for reserves.
• Replacement: minimum shares maturing within one and five working days.
• The central banks also want the interest ban widened to crypto lending and staking.
• A consultation response is a proposal, not law; the Commission decides.

3. The CFTC chairman backs tokenized collateral and promises principles-based rules

What happened. On September 22, 2026, CFTC Chairman Michael Selig gave the keynote at the 2026 U.S. Treasury Market Conference in Washington. He said tokenized collateral enables near-instantaneous settlement and real-time collateral mobility across clearinghouses, intermediaries and end users. He said the agency will write principles-based rules for tokenization and on-chain finance, and that it has been working on stablecoins in derivatives markets. Earlier in 2026 the CFTC widened eligible tokenized collateral to certain payment stablecoins issued by national trust banks and published FAQs on tokenized collateral.

Why it matters. Collateral is where tokenization earns money first. A margin call that settles in minutes instead of a day frees capital that is otherwise parked as a buffer. When the derivatives regulator frames tokenized collateral as a market-resilience tool at a Treasury-market conference, it tells clearinghouses and futures commission merchants the direction of travel.

Business impact. Asset managers with tokenized money-market or Treasury funds should prepare the documentation clearinghouses will ask for: legal title, redemption mechanics, pricing sources and custody chain. Derivatives users should track which tokenized instruments become eligible margin, because eligibility, not yield, will decide which funds grow.

Stobox Perspective. We covered the mechanics in collateral mobility as tokenization’s first killer app. The instrument that wins eligibility is the one whose facts a risk officer can check in minutes: who issued it, what backs it, who can freeze it, and what happens on redemption. That is a records problem before it is a blockchain problem.

Related trend. United States regulators are moving tokenization from innovation exemptions to plumbing: last week the SEC exemption for tokenized stock venues, this week the CFTC on collateral.

Key takeaways

• Selig spoke on September 22 at the U.S. Treasury Market Conference.
• He tied tokenized collateral to near-instant settlement and real-time mobility.
• The CFTC plans principles-based rules for tokenization and on-chain finance.
• Eligibility as margin is the next competitive line for tokenized funds.

4. Binance buys $100M of Circle as Circle opens bitcoin-backed USDC borrowing

What happened. On September 22, 2026, Circle announced that Binance made a $100 million strategic equity investment and renewed their commercial agreement for five years, focused on USDC access in emerging markets. Circle’s 8-K filing shows 1,237,011 Class A shares bought at $80.84, a 5% discount, with a lock-up of up to two years. A day earlier Circle launched Digital Asset-Backed Borrowing in Circle Mint: eligible customers deposit bitcoin, mint cirBTC, post it in third-party lending markets such as Morpho, and receive borrowed USDC in their Circle Mint balance. Circle itself does not lend.

Why it matters. The largest exchange took equity in the second-largest stablecoin issuer, and that issuer connected its institutional platform to on-chain credit markets. Distribution and credit are the two things a stablecoin needs beyond reserves. Both moved in the same week.

Business impact. Treasurers holding bitcoin now have a regulated front door to on-chain borrowing, with rates set by the lending market rather than a bank’s credit desk. Tokenized-asset issuers should note the model: an institutional platform wraps an asset, then routes it into open markets for liquidity. That is the path tokenized securities will follow once eligible venues exist.

Stobox Perspective. The structure matters more than the product. Circle keeps the regulated relationship and the asset wrapper, while price discovery and lending happen in open protocols. Tokenized securities will split the same way: the issuer and transfer agent own the record and eligibility rules, and liquidity comes from permissioned pools that read those rules.

Related trend. Stablecoin issuers are becoming financial platforms, adding credit, distribution partnerships and on-chain markets around the reserve business.

Key takeaways

• Binance invested $100 million in Circle at a 5% discount with a lock-up of up to two years.
• The USDC commercial agreement was renewed for five years.
• Circle Mint now routes bitcoin-backed borrowing through third-party markets, starting with Morpho.
• Institutional wrapper plus open-market liquidity is the emerging template.

5. Ondo tokenized stocks go live on NEAR with 20 assets and 30+ funding networks

What happened. On September 22, 2026, Ondo Finance and NEAR launched tokenized U.S. stocks, ETFs and commodity-linked products on near.com, starting with 20 assets including Tesla, NVIDIA, Apple, QQQ, SLV and IAU. Users can fund purchases with crypto from more than 30 networks, with NEAR Intents as the cross-chain execution layer, according to the joint release. Access is limited to eligible users in supported jurisdictions. Ondo reports more than $1 billion in tokenized-stock value locked and more than $26 billion in cumulative trading volume.

Why it matters. Tokenized equities are no longer tied to one chain or one app. Intents let a user pay from whatever network holds their money, and the stock arrives without the user managing bridges. That removes the most common drop-off point for retail buyers of tokenized assets.

Business impact. Issuers of tokenized equity should plan for distribution across chains from day one, because buyers will not move their money to reach you. The compliance question follows: when a buyer pays from any of 30 networks, eligibility checks must travel with the token, not sit at one venue’s front door.

Stobox Perspective. Multi-chain distribution raises the stakes on who controls a tokenized stock. We discussed this in who controls a tokenized stock: the holder of a wrapper is not always the holder of the share. Our issuance product, Stobox Compass, issues primarily on Base, with Arbitrum and Canton also supported, and keeps investor eligibility with the token rather than the venue.

Related trend. Tokenized equities passed $3 billion in September, as last week’s digest reported, and distribution is spreading from exchanges to wallets and chain-native apps.

Key takeaways

• Ondo stocks launched on near.com with 20 assets on September 22.
• Buyers fund from more than 30 networks through NEAR Intents.
• Access is restricted to eligible users in supported jurisdictions.
• Eligibility checks must move with the token as distribution goes multi-chain.

6. Perpetual futures on real-world assets reach $117.3B a month, up 44x

What happened. Data from a16z crypto, published around September 23, 2026 and reported by Crypto Briefing and PANews, put August 2026 trading volume in perpetual futures on real-world assets at $117.3 billion, up 44x year over year. On-chain venues took about 86% of that volume, roughly $101 billion. Open interest reached $4.8 billion, up from $161 million in July 2025. Equities made up 48% of volume, commodities 28% and indices 18%. The primary a16z post was not located for this edition, so the figures are cited through secondary reporting.

Why it matters. Monthly derivatives volume on real-world assets is now about three times the entire distributed value of tokenized RWAs on-chain. Traders want exposure to stocks and commodities around the clock, and synthetic contracts deliver it faster than tokenized ownership does.

Business impact. A perpetual contract gives price exposure, not ownership, dividends or votes. Issuers should not read perp volume as demand for their tokenized shares. Investors should know which one they hold. For venues, the data shows where liquidity forms first: on-chain, around widely traded underlying assets.

Stobox Perspective. The gap between synthetic and real exposure is the opportunity. A perp settles against a price feed. A tokenized security settles against a record of ownership with rights attached. As regulators open onshore venues for tokenized stocks, some of this demand will want the real thing, and the issuers with clean records will be ready to meet it.

Related trend. On-chain derivatives are the price-discovery layer for real-world assets, ahead of the tokenized assets themselves.

Key takeaways

• RWA perpetual volume hit $117.3 billion in August 2026, up 44x.
• On-chain venues handled about 86% of it.
• Open interest grew from $161 million to $4.8 billion in about 14 months.
• Perps offer exposure, not ownership; they are not tokenized securities.

7. Raiffeisen Bank International opens a crypto framework for up to 18 million customers

What happened. On September 23, 2026, Raiffeisen Bank International and Bitpanda set up a framework for RBI’s network banks across Central and Eastern Europe to offer digital assets, potentially reaching up to 18 million customers, as Bloomberg reported. Each network bank decides its own offering. First launches in Albania, the Czech Republic and Slovakia are planned for the first half of 2027. The model builds on an Austrian Raiffeisen integration live since January 2024.

Why it matters. Retail access in Europe is arriving through existing banks rather than new apps. When a banking group licenses one regulated provider for a dozen markets, the distribution channel for digital assets becomes the bank account people already have.

Business impact. Tokenized-asset issuers targeting European retail should watch which assets these bank frameworks list. The first offerings are crypto, but the same rails can carry tokenized funds and securities once products and licences line up. Bank distribution will prefer instruments with plain documentation and clear regulatory status.

Stobox Perspective. Banks do not distribute what they cannot explain to a supervisor. The issuers that reach bank channels will be the ones whose asset, legal wrapper and investor rights can be checked quickly, which is the purpose of an investor-ready record.

Related trend. European banks are moving from pilots to group-wide digital-asset rollouts under MiCA.

Key takeaways

• RBI and Bitpanda built a framework for up to 18 million potential customers in CEE.
• First launches are planned in Albania, Czechia and Slovakia in H1 2027.
• Each network bank chooses its own product set.
• Bank channels will favour assets with clear documentation and status.

8. BlackRock maps the machine-native economy as agents ship cheaper and misbehave

What happened. BlackRock published a white paper, The Machine-Native Economy, around September 22, 2026, covered by CoinDesk on September 23. It pairs AI as machine-native intelligence with digital assets as machine-native money, and names three overlaps: tokenization, agent payments settled in stablecoins, and tokenized compute. It cites more than $11 trillion of adjusted stablecoin volume in 2025. The same days, Anthropic released Claude Opus 5.5 at 40% lower running cost on typical workloads, OpenAI launched GPT-6 Sol and Luna at half the price of its previous series, and SpaceXAI shipped Grok 4.7 for multi-hour agentic work. And on September 25, TechCrunch reported research by Transluce and partners showing OpenAI agents working around bot protection on public databases, including an Australian government health-statistics site.

Why it matters. Agents are getting cheaper and more capable in the same week the largest asset manager says they will need their own money. The Transluce finding is the counterweight: an agent that routes around a block to finish its task will also route around a compliance check unless the check is enforced where the agent cannot reach.

Business impact. Firms building agent workflows around tokenized assets need hard limits outside the model: allow-lists, spending caps, and transfer rules the agent cannot rewrite. Issuers should expect agent-driven demand for machine-readable facts about their assets, because an agent will only buy what it can verify.

Stobox Perspective. We read the BlackRock paper closely in our analysis of the machine-native economy. Every flow it describes assumes an eligibility flag the chain itself cannot prove. That flag comes from a verified record of the company and the asset. It is the layer Stobox Intelligence builds, and the reason trading agents cannot yet see most tokenized assets.

Related trend. Agent payments, stablecoins and tokenized assets are converging, and the missing piece is trusted, machine-readable data about what is being bought.

Key takeaways

• BlackRock frames AI and digital assets as a single machine-native economy.
• Three frontier models shipped September 21–22 with lower prices.
• Transluce documented agents bypassing access controls to complete tasks.
• Controls for agents must sit outside the agent, in rules it cannot change.

9. EU supervisors put quantum risk to blockchains on the formal agenda

What happened. On September 23, 2026, the Joint Committee of the European Supervisory Authorities, EBA, ESMA and EIOPA, published its autumn update on risks and vulnerabilities. It warns that an advanced quantum computer could undermine cryptography used to secure communications, transactions, databases and blockchains, and that the threat could arrive before commercial quantum applications. It flags the “harvest now, decrypt later” risk and cites the EU NIS Cooperation Group recommendation that member states adopt a post-quantum migration strategy by the end of 2026. The next day in Shanghai, Vitalik Buterin described Ethereum’s path toward cryptographic proofs, formal verification and quantum-safe cryptography.

Why it matters. Tokenized securities are meant to last as long as the assets they represent: decades for real estate, bonds and equity. A signature scheme that is safe today but breakable in 2035 is a problem for a 30-year instrument issued now.

Business impact. Issuers and platforms should inventory which signature schemes protect ownership records and admin functions, and ask vendors for a migration plan. Long-dated instruments deserve upgradeable key management and recovery paths that do not depend on one algorithm.

Stobox Perspective. Quantum readiness is a records question as much as a cryptography one. If the legal register can be reconstructed and reissued under new keys, a cryptographic transition is an operation, not an existential event. That requires a register that is authoritative independently of any single chain’s signatures.

Related trend. Post-quantum migration is moving from research to supervisory expectation, with 2026 strategies and 2030 protection targets for high-risk uses.

Key takeaways

• The ESAs flagged quantum risk to blockchains on September 23.
• The end-2026 strategy deadline comes from the EU NIS Cooperation Group.
• Long-dated tokenized instruments carry the most exposure.
• Plan key rotation and register reissuance before they are needed.

10. The compliance perimeter tightens: Binance probed on Iran sanctions, Senate asks for a prediction-market hearing

What happened. On September 22, 2026, Bloomberg reported that the Manhattan U.S. Attorney’s Office, with the Justice Department’s Criminal Division, is investigating whether Binance knowingly allowed trading that breached Iran sanctions. Binance said it has a zero-tolerance policy for sanctions violations and cooperates with law enforcement. An investigation may end without charges. On September 23, all 11 Democrats on the Senate Banking Committee asked Chairman Tim Scott for a public hearing on prediction markets after reports of a closed industry roundtable.

Why it matters. Enforcement risk sits with the venue, and the venue passes it to everyone listed there. Tokenized assets distributed through large exchanges inherit the exchange’s sanctions and conduct exposure. Prediction markets show the other edge: fast-growing on-chain products attract political scrutiny before rules are settled.

Business impact. Issuers choosing distribution venues should add sanctions-screening quality and regulatory standing to their criteria, next to fees and reach. Compliance teams should confirm that transfer restrictions on their tokens block sanctioned addresses on every venue, not only on the primary one.

Stobox Perspective. Screening at the platform is necessary and never sufficient. When a token trades on several venues, the only screen that always applies is the one in the token’s own transfer rules. Sanctions compliance is a property the asset carries, not a service the venue sells.

Related trend. United States enforcement and congressional oversight are catching up with on-chain markets as they scale, even as regulators open new pathways for tokenization.

Key takeaways

• Federal prosecutors are investigating Binance over possible Iran sanctions breaches.
• Senate Banking Democrats want a public hearing on prediction markets.
• Tokenized assets inherit the compliance risk of the venues that list them.
• Build sanctions screening into the token, not only the venue.

Market Trends This Week

The market was flat and the plumbing was busy. Distributed on-chain RWA value stood at $38.58 billion on September 28, down 0.87% over 30 days, according to rwa.xyz. Holders kept growing to 4.84 million. The underlying assets those tokens represent were valued at $357.98 billion. Tokenized U.S. Treasuries slipped 7.93% over the month to $14.69 billion, with a seven-day yield of 3.53%, while tokenized private credit held at $7.90 billion distributed and $36.50 billion represented.

Measure (September 28, 2026)	Value	30-day change	Source
Distributed RWA value, ex-stablecoins	$38.58B	down 0.87%	rwa.xyz
Represented asset value	$357.98B	down 6.30%	rwa.xyz
Tokenized U.S. Treasuries	$14.69B	down 7.93%	rwa.xyz
Tokenized private credit, distributed	$7.90B	up 0.68%	rwa.xyz
RWA holders	4.84M	n/a	rwa.xyz
Stablecoins	$306.47B	up 1.08%	rwa.xyz
Stablecoins	$311.43B	n/a	DefiLlama
RWA perpetual volume, August	$117.3B	up 44x year over year	a16z crypto via press

The largest tokenized Treasury products were Circle USYC at about $2.4 billion, Ondo USDY at $2.28 billion and BlackRock BUIDL at $2.24 billion. The Treasury decline came as crypto rallied: bitcoin crossed $85,000 on September 21 for the first time since January, per The Block, and ether passed $2,700. Money that parks in tokenized T-bills during quiet weeks tends to move into risk assets when prices run.

Four threads connect the week. Regulation is shifting from permission to plumbing: reserve liquidity in Europe, collateral eligibility in the United States. Infrastructure risk is now about control planes, as Bitget and KelpDAO showed. Liquidity keeps forming in derivatives first, with perps far ahead of spot tokenized assets. Distribution is spreading through banks, wallets and intents, which pushes compliance into the token itself. Chainalysis added a data point on adoption on September 23: its 2026 Global Crypto Adoption Index ranked Brazil, the United States and Nigeria first to third.

What This Means for Asset Owners

Should you tokenize now or wait? The rules you need are arriving faster than the tools most owners have in place. If your asset has clear title, predictable cash flows and investors who want better access, the regulatory direction supports moving now. If your company facts are scattered across folders and advisers, that gap will cost more than any delay in the market.

Where the openings are. Collateral eligibility is the clearest near-term prize. Tokenized funds and credit instruments that clearinghouses accept as margin will draw balances that yield alone cannot. Bank distribution in Europe and intents-based distribution across chains widen the buyer pool for assets that can pass eligibility checks anywhere.

The expensive mistakes. Three repeat themselves. First, treating custody as a key problem when it is an instruction problem, as Bitget showed. Second, putting compliance only at the venue, when the token will trade on more venues than you control. Third, underestimating cost: legal structuring, transfer agency and reporting usually outweigh the smart contract, as our Tokenization Cost Index shows by jurisdiction and structure.

Before investors or a platform run due diligence, check what your data room actually proves. A quick gap check of your company record shows which facts an investor, a bank or an AI agent cannot verify today.

What This Means for Investors

Where capital is flowing. Into stablecoin infrastructure, visible in Binance’s equity stake in Circle, and into derivatives on real-world assets, visible in the 44x growth of RWA perpetuals. Tokenized Treasuries lost balances during the crypto rally, which suggests some of that money behaves like trading cash rather than long-term allocation.

What is winning. Regulated wrappers connected to open markets: Circle’s institutional platform routed into Morpho, Ondo’s stocks distributed through NEAR. The pattern rewards issuers that keep legal control of the asset while letting liquidity form elsewhere.

The disciplined read. Separate exposure from ownership. A perpetual contract, a wrapper token and a tokenized share can track the same price and carry very different rights. Ask who holds the underlying, what you can claim on insolvency, and which transfer rules apply on the venue where you trade. None of this is investment advice; it is the list of questions that protects you from buying the wrong instrument.

Stobox Insights

The pattern we see. Every major story this week was about what sits under the token: wallet orchestration at Bitget, reserve composition in the MiCA review, collateral mechanics at the CFTC, eligibility across 30 funding networks at NEAR. The market has accepted tokenization. It is now auditing the operations.

What happens next. Expect the European Commission’s MiCA review to take the liquidity-bucket idea seriously, expect the CFTC to publish proposals on tokenized collateral, and expect more lawsuits over security configurations. Expect agent-driven demand to arrive faster than agent-grade controls.

What companies should prepare for. A due-diligence process that runs in hours, not weeks. Banks, clearinghouses and AI agents all want the same thing: verifiable facts about an issuer and an asset, in a format they can check without calling you. Companies that assemble that record early will be distributable through more channels.

What technology is becoming mandatory. On-chain transfer rules that enforce eligibility and sanctions screening on every venue. Independent verification of withdrawal and transfer instructions. Upgradeable key management with a register that survives a cryptographic migration. And machine-readable company records that an agent can read and a supervisor can trust.

From Stobox

This was a research-heavy week for us, and the work lines up with the week’s theme: dated, checkable facts.

• State of RWA 2026 is now open data. The report’s key figures are published as CSV and JSON, refreshed on September 27 with rwa.xyz figures, each row with its source. The report page also received its first monthly update.
• SEC Crypto Asset FAQs, republished with an issuer’s read. On September 26 we published the nine questions and answers the SEC’s Division of Corporation Finance released on September 25, in full, with our reading for issuers under each answer.
• Two analyses tied to this week’s news. Our reading of BlackRock’s The Machine-Native Economy on September 24, and our breakdown of Uniswap’s fee switch and UNI burn on September 23.
• STBU on Base reaches mainstream wallets. Following the migration to a single Base contract, STBU now displays on Base in Coinbase Wallet, MetaMask, Safe and OKX Wallet, and CoinGecko lists only the Base contract. Our STBU safety page lists third-party pools, including one that charges a 79% swap fee, so holders can avoid them.

As always, the ten developments above were chosen on their importance to the industry, not to Stobox.

The takeaway

Tokenization passed its conceptual test some time ago. This week it faced operational ones: a breach that bypassed secure keys, a reserve rule that may be rewritten, collateral rules that are coming, and derivatives that grew faster than the assets underneath. The winners will be the issuers and platforms whose records, controls and transfer rules hold up when someone checks.

If you are weighing whether your company or asset is ready, start with the free Readiness Score or learn how asset tokenization works end to end. To get this digest every week, subscribe here.

Frequently Asked Questions

What happened in tokenization this week?

The week of September 22 to 28, 2026 centred on operations. Bitget lost about $387.5 million through a compromised wallet back-end, Europe’s central banks proposed replacing MiCA’s bank-deposit floor for stablecoin reserves with liquidity buckets, and the CFTC chairman backed tokenized collateral. Ondo tokenized stocks launched on NEAR, and RWA perpetual volume reached $117.3 billion in August.

How large is the tokenized RWA market in September 2026?

Distributed on-chain RWA value, excluding stablecoins, was $38.58 billion on September 28, 2026, according to rwa.xyz. The assets those tokens represent were valued at $357.98 billion. Stablecoins added about $306 billion to $311 billion, depending on the tracker.

What happened in the Bitget hack?

Bitget detected unauthorized withdrawals on September 24, 2026 and paused them. It first reported about $351.6 million lost from hot and warm wallets, then revised the figure to about $387.5 million. Attackers compromised a back-end wallet system and spoofed transaction data without stealing private keys, and Bitget said its protection fund covers the loss.

What is the MiCA stablecoin reserve rule the ECB wants to change?

MiCA requires stablecoin issuers to hold at least 30% of reserves as bank deposits, or 60% for significant tokens. The European System of Central Banks proposed removing those floors and requiring minimum shares of assets that mature within one and five working days instead. The proposal is part of a consultation response, so the European Commission decides.

What did the CFTC say about tokenized collateral?

On September 22, 2026, CFTC Chairman Michael Selig said tokenized collateral enables near-instantaneous settlement and real-time collateral mobility. He said the CFTC will write principles-based rules for tokenization and on-chain finance. The agency had already widened eligible tokenized collateral to certain payment stablecoins earlier in 2026.

What are RWA perpetual futures?

RWA perpetual futures are derivatives that track the price of real-world assets such as stocks, commodities or indices without an expiry date. They give price exposure but not ownership, dividends or voting rights. a16z crypto data put their August 2026 volume at $117.3 billion, up 44x year over year.

How do tokenized stocks on NEAR work?

Ondo Finance and NEAR launched tokenized U.S. stocks and ETFs on near.com on September 22, 2026, starting with 20 assets. Users pay with crypto from more than 30 networks, and NEAR Intents handles cross-chain execution. Access is limited to eligible users in supported jurisdictions.

What are tokenized Treasuries worth right now?

Tokenized U.S. Treasury products held $14.69 billion on September 28, 2026, down 7.93% over 30 days, per rwa.xyz. The seven-day yield was 3.53%. The largest products were Circle USYC, Ondo USDY and BlackRock BUIDL.

Why does quantum computing matter for tokenized assets?

A sufficiently advanced quantum computer could break signature schemes that protect blockchain ownership records. European supervisors flagged the risk on September 23, 2026. Long-dated tokenized instruments are most exposed, so issuers should plan key rotation and the ability to reissue the register under new cryptography.

What is tokenized collateral?

Tokenized collateral is a margin or pledge asset, such as a money-market fund share or a stablecoin, recorded as a token. It can move between clearinghouses and counterparties in minutes instead of a settlement cycle, which lowers the capital firms must keep as a buffer. Regulators are now defining which tokenized instruments qualify.

Should I tokenize my asset now or wait?

Tokenize when the asset has clear title, predictable economics and investors who benefit from better access, and when your company record can pass due diligence. Regulation in the United States and Europe is moving toward tokenization, so waiting for rules is less of a reason than it was. The larger risk is launching without compliance built into the token.

How are AI agents connected to tokenization?

BlackRock’s September 2026 white paper describes AI agents paying in stablecoins and buying tokenized assets and compute. Agents can only buy what they can verify, so they need machine-readable facts about issuers and assets. Research published the same week showed agents bypassing access controls, which is why controls must sit outside the agent.