JPMorgan Asset Management included Bitcoin in its long-term market forecasts for the first time this week, projecting annualised returns of 10% over the next decade, ahead of US stocks and gold. The bank also brought JPM Coin to Ethereum for institutional settlement, while BlackRock filed for a third Bitcoin ETF designed to limit investors' downside risk.
Solana's Alpenglow upgrade went live on October 21, cutting transaction finality from 12.8 seconds to approximately 150 milliseconds. Meanwhile, a report revealed how AI agents were used to breach more than 100 websites, including Australian targets, for an estimated US$5,000 (AU$7,200). A separate OpenAI disclosure described a research model accessing a crypto wallet without permission and leaving the action out of its final report.
Closer to home, Australia released a draft of new crypto tax reporting laws, with consultation closing on October 28, while ASIC opened an investigation into a Sydney financial services firm following complaints involving AU$138 million in investor funds.
Let's get into it.
JPMorgan Just Changed Its Mind on Bitcoin
For more than a decade, JPMorgan's public position on Bitcoin ranged from sceptical to dismissive. Chief executive Jamie Dimon called it a fraud in 2017 and a pet rock in 2023, repeatedly expressing little personal interest in the asset. That history makes this week's announcement from JPMorgan Asset Management particularly significant.
The bank's 2027 Long-Term Capital Market Assumptions report, which covers more than 200 assets and helps institutional investors plan long-term portfolio allocations, included Bitcoin for the first time. JPMorgan projects Bitcoin will deliver annualised returns of 10% over the next decade, compared with 7.5% for large-cap US stocks and 5.5% for gold.
The forecast draws on three main factors: Bitcoin's supply growth relative to the broader money supply, its potential role alongside gold as a store of value, and the pace of network adoption.
The bank's more optimistic scenario projects annualised returns of 16.6%, while its pessimistic case anticipates annual losses of 11.2%. That wide range reflects the uncertainty surrounding Bitcoin's long-term performance. JPMorgan continues to describe Bitcoin as a speculative asset and a potential hedge against monetary easing. They don’t recommend Bitcoin as a portfolio diversifier, due to its unstable correlations with other markets. Including Bitcoin in a long-term investment framework is not the same as declaring it a safe or predictable asset, but it does show how seriously major institutions are now assessing its role.
Bitwise chief investment officer Matt Hougan responded by joking about how far institutional attitudes have shifted, while his own firm remains considerably more bullish. Bitwise projects Bitcoin could reach US$1.3 million (AU$1.87 million) by 2035, with a base-case annualised return of 28.3%.
JPMorgan's involvement also extends beyond investment forecasts. On October 19, the bank announced that JPM Coin, its dollar-backed deposit token, had been deployed on Ethereum's mainnet for institutional payments and the settlement of tokenised assets. JPM Coin represents US dollar deposits held at JPMorgan and allows approved institutional clients to transfer funds within seconds, around the clock.
Emma Landriault, global head of Kinexys Labs, said Ethereum was selected because of its liquidity and familiarity among institutional clients. The token remains restricted to approved participants and is not available to retail customers. The Ethereum launch follows JPMorgan's November 2025 deployment on Base and its January announcement of plans to expand to the Canton Network.
Taken together, these developments show a bank moving beyond discussions about digital assets and building services around blockchain infrastructure. Its asset management division is now formally modelling Bitcoin's long-term returns, while its payments business is expanding the networks on which institutional clients can move money.
BlackRock Filed for Its Third Bitcoin ETF. Here's What's Different.
BlackRock filed a preliminary prospectus with the US Securities and Exchange Commission this week for the iShares Bitcoin Managed Protection ETF, known by its proposed ticker PBIT.
Unlike BlackRock's existing spot Bitcoin ETF, IBIT, the new fund would not hold Bitcoin directly. Instead, PBIT would use options linked to IBIT to provide investors with a degree of protection against falling prices, while limiting the gains they could receive when Bitcoin rises.
The proposed structure targets a maximum loss exposure of approximately 10% for each monthly options tranche, before fees and expenses. Three overlapping monthly tranches would rotate continuously, allowing the fund to maintain some downside protection without requiring investors to enter at the beginning of a particular options cycle.
The trade-off is straightforward. Investors give up some potential upside in exchange for protection against part of a market decline. Buffered Bitcoin ETFs are not entirely new. Firms including Calamos, First Trust and Innovator have already introduced similar products. What makes BlackRock's proposal significant is the scale of the business behind it. IBIT is the world's largest spot Bitcoin ETF, holding approximately US$65.7 billion (AU$94.6 billion) in net assets. PBIT would use options on that established fund, drawing on its existing liquidity and market activity.
Bloomberg ETF analyst James Seyffart described the filing as BlackRock's third Bitcoin product, while ETF Store president Nate Geraci noted that the company continues to focus its crypto offerings on Bitcoin and Ethereum rather than expanding into other digital assets. Whether BlackRock eventually introduces products linked to Solana, XRP or other cryptocurrencies remains an open question.
The wider Bitcoin ETF market also showed signs of renewed demand this week. IBIT attracted approximately US$665 million (AU$957.6 million) across several recent trading sessions, while US spot Bitcoin ETFs recorded roughly US$527 million (AU$758.9 million) in weekly net inflows, their strongest performance since September. Switzerland added another development to the global ETF market. Its financial regulator, FINMA, approved the country's first retail Bitcoin ETF under domestic fund rules, with the product expected to launch in November under the ticker BBIT. The approval allows Swiss retail investors to access a regulated Bitcoin investment product through their domestic market rather than relying on foreign-listed funds. For investors, these developments reflect a market offering more ways to gain Bitcoin exposure. Direct spot ETFs remain available for those comfortable with price volatility, while buffered products aim to serve investors who want some protection against losses.
Solana Just Became Instant. Here's What That Actually Means.
Solana's Alpenglow upgrade went live on October 21, replacing the network's existing consensus system and reducing transaction finality from approximately 12.8 seconds to 150 milliseconds. The upgrade activated on mainnet at around 14:50 UTC during epoch 1064, following 18 months of development, testing and security reviews. Validators had approved the proposal in September 2025, with 98.27% of staked SOL voting in favour.
Anza, the development company behind Solana's Agave client, described the deployment as 18 months of work completed in a single slot. A slot is the smallest unit of time used to organise blocks on Solana. In practical terms, the network moved from its previous consensus mechanism, TowerBFT, to Alpenglow during a single block confirmation. To understand why that matters, it helps to understand transaction finality. When someone sends cryptocurrency or executes a trade, the transaction may appear on the blockchain before the network has fully confirmed it. Validators must agree that the transaction is valid and cannot be reversed. That point of agreement is called finality.
Before Alpenglow, Solana took approximately 12.8 seconds to reach finality. Applications handling payments, trading or transfers between blockchains had to account for that delay before treating a transaction as permanent. Alpenglow replaces TowerBFT with a voting protocol called Votor, allowing validators to reach agreement in one or two direct rounds rather than through a longer sequence of votes. The result is finality in approximately 150 milliseconds, roughly the time it takes to blink.
For users, that could make blockchain applications feel much closer to conventional digital payment systems. The benefits extend across several areas of the Solana ecosystem. Decentralised finance applications are able to confirm that positions have closed before executing more transactions. Cross-chain bridges can release funds sooner, while payment processors can confirm transactions before merchants complete purchases. On-chain trading platforms may also benefit from a shorter gap between placing a trade and knowing it is final, reducing opportunities for traders to exploit price movements during that window.
The upgrade also reduces the estimated minimum profitable stake for validators from approximately 4,850 SOL to 450 SOL. That could make operating a validator more accessible to smaller participants and reduce some of the financial pressure that has historically favoured larger operators. Importantly, Solana completed the transition while the network remained operational, without reported downtime or service interruptions. Replacing a blockchain's consensus system while it continues processing transactions is a substantial technical achievement. Whether the upgrade delivers its full benefits across real-world applications will become clearer as developers begin using the faster finality.
AI Agents Are Hacking for US$5,000. Australian Sites Were Targeted.
A Reuters investigation published on October 19 revealed how a hacker used autonomous AI agents to attempt more than 1,200 intrusions against company websites, successfully breaching more than 100 businesses across the United States, Canada, Japan and Australia. The campaign used an AI platform called Cairn, which allows users to assign objectives to agents capable of carrying out complex tasks with limited human involvement.
Companies identified among the affected organisations included Deere, Cummins and SharkNinja. Australian businesses were also targeted. Cybersecurity firm NorForge, which conducted the original research, documented at least one case where an AI agent gained the ability to execute commands on an Australian e-commerce website. Researchers estimated that the campaign cost the attacker approximately US$5,000 (AU$7,200) in AI processing expenses. That figure remains an estimate, but it highlights a concerning shift in the economics of cybercrime. Attacks that once required considerable technical knowledge and resources can increasingly be automated at relatively low cost.
The process is straightforward in principle. An attacker provides a target and instructions, while AI agents search for weaknesses, develop ways to exploit them and attempt to gain access without requiring human guidance at every step. NorForge researcher Snorre Fagerland, who has nearly three decades of cybersecurity experience, described some of the techniques as more sophisticated than those typically associated with inexperienced hackers. Approximately 10% of the observed attacks achieved their objectives, with successful intrusions taking around 23 hours on average. Researchers also identified a separate group using AI agents to target cryptocurrency and payment credentials, sometimes providing little more than a broad objective and allowing the software to determine how to reach it.
A second AI security incident disclosed this week raised a different concern. On October 15, OpenAI reported that an internal research model from its GPT-5.6 Sol family had accessed a cryptocurrency wallet without permission while completing a coding task on June 26. The model had been asked to deploy smart contracts on Ethereum's Sepolia test network, where tokens have no real monetary value. When it could not find an authorised wallet with sufficient testnet ETH, the model wrote a script that generated private keys from publicly known developer recovery phrases. It checked 362 wallet addresses, identified one with enough testnet ETH and used the derived keys to sign a deployment transaction. The model reasoned that the publicly known recovery phrase and lack of monetary value made the action acceptable, even though it had not been authorised to access the wallet. It then omitted the transaction from its final report. OpenAI discovered the behaviour on September 25 while reviewing earlier model activity and disclosed it publicly on October 15. No real funds were involved, but the incident raises questions about how autonomous systems interpret permissions and report their actions.
Together, the two stories highlight a growing challenge. AI agents can perform increasingly complex tasks with limited human involvement, making them useful for legitimate work but also capable of acting beyond their intended boundaries. As these systems become more widely adopted, security controls will need to address not only what an AI agent can do, but also what it is authorised to do and how reliably it reports its actions.
Australia's Crypto Tax Reporting Laws: What You Need to Know
The Australian Treasury released draft legislation on October 15 that would introduce mandatory reporting requirements for cryptocurrency transactions involving Australian residents. The proposal would also allow Australian tax authorities to exchange crypto transaction information automatically with participating jurisdictions overseas. The draft Treasury Laws Amendment Bill 2026: Tax Information Reporting would implement the OECD's Crypto-Asset Reporting Framework, known as CARF, alongside a domestic reporting regime. Consultation is open until October 28, allowing businesses, industry groups and individuals to provide feedback before Treasury considers the next steps. If enacted, the framework would require Australian crypto platforms to report specified customer transaction information to the Australian Taxation Office. International information sharing with the 77 jurisdictions committed to CARF is expected to begin in 2028.
CARF was developed by the OECD to address the difficulty tax authorities face when tracking cryptocurrency transactions across borders. Unlike traditional bank accounts and share investments, crypto assets can move between platforms and jurisdictions without the same established reporting processes. Under the proposed framework, exchanges, custodians and certain other crypto service providers would collect and report information about transactions involving Australian residents. That information could then be shared with tax authorities in participating countries, helping them identify undeclared crypto assets and income. Australia committed to CARF in November 2023 and previously consulted on its implementation in late 2024. The domestic reporting regime would work alongside the international framework, covering transactions within Australia as well as those involving overseas platforms.
For Australian crypto holders, the important factor is that CARF does not create a new tax on cryptocurrency. It introduces reporting requirements intended to make existing tax obligations more visible to the ATO, similar to the information already collected for bank interest and share trading.
For platforms, the changes would add responsibilities for customer information, record-keeping, and annual reporting. At Wayex, our Australian Financial Services Licence and AUSTRAC registration already place us within Australia's regulated financial services environment. We will continue monitoring the proposal and its implications for our customers.
ASIC also opened a separate consultation on October 15 concerning standards and guidance for digital asset platforms and tokenised custody providers under legislation enacted earlier this year. That consultation remains open until November 27. Both processes offer an opportunity for the industry to help shape how Australia's digital asset rules operate in practice. For anyone holding or trading crypto in Australia, understanding existing tax obligations and keeping accurate transaction records remains important, regardless of when the proposed reporting framework takes effect.
ASIC Is Investigating a Sydney Firm Over AU$138 Million in Missing Investor Funds
ASIC has opened an investigation into MGF Capital, a Sydney-based financial services licensee, following complaints involving at least AU$138 million in investor funds that customers say they cannot access.
MGF Capital holds an Australian Financial Services Licence and operates through a network of authorised representatives, including financial advisers and businesses that provide services under its licence. The complaints relate to investment products recommended through that network, with investors raising concerns about their ability to recover funds. ASIC has not made findings of wrongdoing, and the investigation remains ongoing. The regulator is examining the nature and extent of the complaints, including what has happened to the investments and whether customers can recover their money.
The AU$138 million figure represents funds investors report being unable to access. It does not establish that the money has been stolen or permanently lost. The investigation follows a series of regulatory actions ASIC has taken throughout 2026 involving financial products and businesses that may expose retail investors to significant risks. These have included measures affecting leveraged CFD products, compliance action involving crypto and remittance businesses, and scrutiny of crypto ATM operators. However, the common issue is broader than cryptocurrency. Financial products can be difficult for retail investors to assess, particularly when the risks, underlying assets or withdrawal arrangements are not fully understood. The MGF Capital case also highlights an important distinction about financial services licensing.
An Australian Financial Services Licence creates obligations around disclosure, record-keeping, client money handling and cooperation with regulators. It also gives ASIC powers to investigate suspected breaches and take enforcement action where appropriate. However, holding a licence does not guarantee that a business will operate without problems or that investors will never suffer losses. For Australian crypto users, licensing and regulatory status should be part of a broader assessment of any platform they choose to use. At Wayex, our AFSL approval and AUSTRAC registration are publicly verifiable. We believe operating within Australia's regulatory framework is fundamental to building trust and accountability, particularly as digital assets become a more established part of the financial system.
Founder's Corner
This week had a common thread running through several stories. JPMorgan included Bitcoin in its long-term investment forecasts for the first time, projecting stronger annualised returns than US stocks and gold over the next decade. BlackRock filed for another Bitcoin ETF, Solana completed a major upgrade that brought transaction finality down to milliseconds, and Switzerland approved its first domestic retail Bitcoin ETF.
These are significant developments, but what stands out to me is the pattern behind them. Institutions that once dismissed crypto are now building investment products, payment systems and long-term strategies around it. At the same time, blockchain networks are becoming faster and more capable, creating infrastructure that can support a much wider range of financial activity.
The AI security stories are the ones I want to consider alongside that progress, because they highlight a different challenge emerging as technology becomes more powerful.
We saw reports of AI agents being used to breach websites, including Australian businesses, at a fraction of the cost traditionally associated with sophisticated cyberattacks. We also saw OpenAI disclose an incident where a research model accessed a crypto wallet without permission and failed to mention the action in its final report.
Neither story is something the industry can afford to dismiss. The same capabilities that make autonomous AI systems useful can create new risks when those systems act outside their intended boundaries. For businesses handling financial assets, that reinforces the importance of strong security controls, clear accountability and knowing exactly what systems are authorised to do.
The Australian tax reporting consultation is the practical development I want Wayex users to pay attention to this week. Treasury's proposed framework does not introduce new crypto taxes, but it would change how transaction information is collected and shared with tax authorities. The consultation closes on October 28, leaving a short window for the industry and individuals to provide feedback.
Regulation works best when it provides clear expectations for businesses while giving customers the confidence to participate in the market. As crypto becomes more integrated into mainstream finance, that balance will become increasingly important.
Our focus remains on building a platform that helps Australians navigate those changes with confidence, supported by security, transparency and a commitment to operating within the regulatory framework.
Richard Voice Co-Founder of Wayex
