What has been happening this week in the world of blockchain and cryptocurrencies? This weekly review rounds up the key events and background reports of the past seven days, spanning index policy, law enforcement, network security, banking licenses, and US politics.

MSCI's new rules could drop Strategy (MSTR) and Metaplanet from its global indices

Index provider MSCI has finalized new rules for companies with little operating business, and the changes put Strategy and Metaplanet — both large holders of Bitcoin — at risk of dropping out of its global equity indices. The stakes are considerable, because passive funds worth billions track these indices and automatically sell the shares of stocks that are removed. Strategy, the company formerly known as MicroStrategy, pioneered the model of turning a listed firm into a vehicle for holding Bitcoin, and Metaplanet has pursued a similar approach from its Tokyo base — the profile the revised methodology targets.

The review proceeds in two stages. First, MSCI checks whether a company's operating assets exceed half of its balance sheet. If a company fails that test, MSCI then applies five financial ratios. Existing index members, however, only drop out if they fail in both of their last two annual reports. MSCI will name the affected companies in November, with the exclusions taking effect from December.

Strategy estimates that funds linked to MSCI indices hold around 3.1% of its shares. An exclusion would not force the company to sell its Bitcoin. Nevertheless, weaker demand for the stock would make further Bitcoin purchases harder to finance, since Strategy has historically funded its purchases by issuing new shares and debt. Strategy has criticized the rule as discriminatory toward companies with crypto reserves.

Turkish media report arrest of HEX founder Richard Heart

According to Turkish media, authorities in Istanbul have arrested Richard Heart, founder of the controversial crypto projects HEX and PulseChain. The reports say officers also seized weapons, dozens of luxury watches, and cash.

The arrest reportedly rests on an Interpol notice that Finland requested in December 2024. Finnish police are investigating suspected tax evasion, which Europol, the EU police agency, puts at hundreds of millions of euros. In addition, investigators accuse Heart of assaulting a 16-year-old. Some reports cite crypto fraud as the reason for the arrest, although Finland makes no such allegation. Heart's projects have drawn regulatory scrutiny before: in 2023, the US Securities and Exchange Commission sued him, alleging that HEX and related token offerings were unregistered securities and accusing him of fraud.

An Interpol notice, however, is not an international arrest warrant. It merely asks authorities to locate a person and arrest them provisionally, which means Turkey decides on any extradition itself. So far, there is no public record of a request from Finland, and official confirmation of the arrest is still pending. Until a verdict, the presumption of innocence applies to Heart.

RippleX quietly closes decade-old XRP vulnerability

RippleX, Ripple's development arm, has fixed an XRP Ledger flaw that likely dated back to 2015. The XRP Ledger is the blockchain behind the cryptocurrency XRP.

The bug sat in the code that matches payments against offers on the network: amounts were added without an overflow check. Very large sums therefore wrapped around to a small number. Sellers would have received the full amount, but the buyer would have paid only the small sum, and the difference would have emerged as new XRP. According to the researcher who reported the flaw, a single transaction could have created around 18 trillion XRP — an far beyond the total supply that would have devastated the cryptocurrency. For scale, XRP's total supply is capped at 100 billion tokens. There is no evidence of exploitation.

The fix also departed from normal procedure. Rule changes on the network usually need more than two weeks of approval from validators, but the patch took effect immediately with each server update. RippleX additionally published the source code only about two weeks later, keeping attackers from finding the flaw early.

Kraken secures an EU banking license with Saldo Bank acquisition

Payward, the parent company of crypto exchange Kraken, is acquiring Lithuania's Saldo Bank. The deal gives the Kraken group an EU banking license with deposit-taking once it closes in 2027. A full banking license would allow the group to accept customer deposits directly and, through the EU's passporting rules, to offer regulated banking services across all member states from a single national license. The move comes as the EU tightens oversight of crypto firms under its Markets in Crypto-Assets (MiCA) framework, which has been fully in force since the end of 2024.

Crypto firms face subpoenas after the US midterm elections

In November, the US will elect the entire House of Representatives and part of the Senate. Polls see the opposition Democrats as favorites in the House and slightly ahead in the Senate. Whoever wins a chamber chairs its committees and can subpoena witnesses. That matters for crypto in particular, because committees such as the House Financial Services Committee and the Senate Banking Committee oversee the regulators and agencies that write the rules for digital assets.

Even so, the Democrats could hardly stop the loosening of rules for banks and crypto firms under President Donald Trump. That effort largely runs through agency decisions, and new laws would fail against the president's veto. The pressure would instead come through hearings that agency heads and company executives would have to attend. According to lawyers, negative headlines do more damage than legal costs. Media reports also say Democrats are planning investigations into the Trump family's crypto ties.

In short, a Democratic midterm win could slow the crypto push: it would hardly stop deregulation, but it would likely bring crypto firms and banks subpoenas and hearings.