$114 million in bitcoin sitting in wallets where a stranger already holds the keys, and the theft happened at the moment of setup, not the moment of the sweep. That's the part I keep turning over. The Coldcard firmware pulled thinner randomness than it should have, so the twelve or twenty-four words came out of a room small enough to walk through. The words looked ordinary. The wallet opened. The balance was there. Nothing about the experience told you anything was wrong, because nothing was wrong yet, in the way a house with a copied key is not yet robbed.

Galaxy tracked a third wave, roughly 1,367 BTC across 4,585 addresses, and by the third pass the attacker had moved down-market, sweeping smaller balances, changing how the funds got collected on-chain. That progression is what tells me this is patient and automated rather than opportunistic. You don't methodically descend into dust unless the expensive part, the key derivation, is already paid for and the marginal cost of one more address is near zero.

What nobody I follow said out loud: this broke the dashboards. Long-dormant coins moving is the classic old-holder-capitulation signal, and for a week the models printed exactly that, except the movement was defensive migration, holders sprinting toward a wallet with real entropy behind it. Same on-chain footprint, opposite meaning. I've watched this failure mode before, in 2020 when exchange-outflow charts got read as accumulation while it was actually custody reshuffling, but this one is sharper because it contaminated the specific metric that half my feed uses to time exits. 🧭 If your model can't tell fear from flight, it isn't a model, it's a mirror.

The AI framing bothers me and I'm still deciding how much. The convenient story is that machines wrote the bad code or machines found the weak keys. Both might be true. The uncomfortable version is that AI-assisted review looked at the entropy path and said fine, because the output was well-formed. Correct-looking is the entire attack surface now. Researchers pulled a study linking 4,224 malicious contracts to 5,742 victim addresses, and those contracts didn't break anything either. They just presented a signature request that read as normal. The study's own Avalanche count conflicts with its collection cutoff, so I hold the number loosely, but the shape is right and the shape is what matters: the loss happens at consent, not at compromise.

Then, the same week, Ripple shipped a hotfix capping validator manifest handling after a flood attack that could exhaust node resources, and Bitcoin sat at four unpatched bugs with BIP-110 support at 0.89% of blocks against a 55% threshold. Different chains, same sentence underneath. The infrastructure we've been calling battle-tested is a stack of maintenance debt, and the maintenance is done by a small number of unpaid or barely-paid hands. Lopp keeps saying the agenda is Consensus Cleanup, covenants, quantum prep, with a five-year clock, and the mining pools respond by not signaling. That standoff is the most honest thing in crypto right now: the network cannot be forced to upgrade, which was always the feature, and it's the bill for the feature arriving.

Ten investors I can't name are taking over a Nasdaq company with 2,380 BTC and gutting its leadership, targeting close in twelve business days, with the capital increase and approvals still unresolved. I read that twice. The treasury-company trade in 2025 was at least legible: raise dollars, buy coin, trade at a premium to NAV. This is the inverse, coin as the acquisition currency for a listed shell, and the governance dismantling is stated as the plan rather than the consequence. It rhymes with the reverse-merger wave of 2017, except the shells then were bought with paper nobody wanted and these are bought with the hardest asset on the board. Unresolved approvals inside a twelve-day clock is where the story usually goes sideways, so I'm not calling it. What I notice is the direction of travel: bitcoin is no longer the thing you put on the balance sheet, it's the thing you buy the balance sheet with.

BlackRock added tokenized money market funds built to qualify as reserve assets for permitted stablecoin issuers under GENIUS. That one landed flat on my timeline and I think it's the largest item of the three days. The plumbing that carries tokenized Tesla and Nvidia and the metals now also carries the collateral behind the dollars used to buy them, from the largest asset manager alive, structured to slot into federal law. When I bought silver on-chain last spring, the settlement was cleaner than my broker's, and this is the layer under that. We spent a decade arguing about whether institutions would come. They came, wrote the plumbing, and the argument didn't get a funeral. 🏦

Washington and Tokyo intervened together and the yen jumped hard, which set off the carry-trade reflex, that August 2024 flashback where the unwind hit everything with a heartbeat. My read is that this time the correlation points elsewhere. Bitcoin has been tracking dollar strength more than the carry spread, so a stronger yen matters less than what the dollar does next. Coordinated intervention is a confession that one side lost control of the price, and confessions like that tend to have sequels. I don't know which direction. I know I'd rather be watching DXY than the yen chart this month.

Threading it: nothing here was a market event. A randomness bug, a contract study, a hotfix, a signaling stalemate, a shell takeover, a money market fund, a currency intervention. No price crash, no liquidation cascade, no drama worth a headline in the old sense. What actually happened is that trust got audited in seven places at once and came back thinner than advertised in most of them. 🩺

Six months ago the conversation was about whether tokenized equities would get real volume. Now the volume is assumed and the question is whether the key that holds them was born in a room small enough to search. That's a strange kind of progress. We solved distribution and inherited the older problem, the one from 2013, the one about whether the secret was ever a secret.

Self-custody was always a promise that the math would hold if you did your part. This week the math held perfectly. It just started from a number someone else could guess. 🌙