Signal over noise.
The stories that change your risk: AI and autonomous warfare, drones, international affairs, and the Bitcoin developments that move the map.
New here? These five pieces cover the ground most people are missing.
The $5 Wrench Is Now the #1 Threat to Your Bitcoin
Bitcoin ETFs Cross $54 Billion With No Holder Keys
The Psychology That Makes Smart People Fall for Crypto Fraud
The Coinbase Insider Breach Made KYC Your Biggest Vulnerability
Multi-Sig Should Be the Default Self-Custody Setup in 2026
Bitcoin, energy, and macro coverage also lives on BTChub.
Follow via RSS · Atom · Cyber feed · 5GW feed · Energy feed · Bitcoin feed
A Rogue Electrum Server Replaced a Payment With a Zero-Fee Fake. The Fee Bump Signed the Attacker's Copy
Electrum released version 4.8.3 on Saturday, October 24, with a high-severity advisory: malicious servers have been holding back users' freshly broadcast payments and feeding the wallet a forged copy that pays the attacker, at zero fee, so that it sits unconfirmed until the user raises the fee. The forgery's signatures were never valid, and the wallet never checked them; the fee bump produced a signature that was. 2 users reported it, 1 lost money, and the attacker's address was ground to match the last 4 characters of the real recipient's. The private keys were never touched. What they signed was.
Netanyahu Asked for a Blockchain Plan Against Sanctions. 3 States Tried It, and the Chokepoint Was Never the Chain
Prime Minister Benjamin Netanyahu told Israel's Channel 10 on Friday, October 23, that the country should prepare for possible banking sanctions, that blockchain is 'one of them, certainly' among the ways around them, and that he had asked for a plan. On Saturday the Bank of Israel answered in a statement that cryptocurrencies cannot serve as a means of circumventing sanctions, and officials in the economic ministries said they knew of no such plan. The record of states that tried is on the central bank's side. The Petro, A7A5, and Iran's dollar wallets each failed at an issuer, an exchange, or a bank, never at the ledger.
A Bug Minted 2 Million Unbacked AUSD on Initia. The Ethereum Bridge Verified the Burn, Not the Backing
Initia halted its layer 1 and every rollup on it at 15:41 UTC on Friday, October 23, after an attacker used what co-founder Zon calls a previously unknown bug in the chain's Move virtual machine to mint about 2 million AUSD with nothing behind them. The money was already gone: 153 seconds after the mint, a valid LayerZero message released 1.4 million real AUSD from the Ethereum adapter, and the attacker had swapped them for ETH an hour before Agora froze the address. About $2.7 million left. Every layer built to protect the funds did its job. None of those jobs was checking the backing.
Railway's Secret Store Was Read and 200 Addresses Were Swept. API Keys Rotate. Private Keys Can Only Move
Railway, a cloud platform that said in January it serves about 2 million developers, disclosed on Wednesday, October 21, that an intruder had read customers' encrypted environment variables and decrypted some of them, paused every deployment, and told all users to rotate their secrets. By 19:36 UTC a sweeper script was emptying wallets whose private keys had lived in those variables: about $371,000 across more than 200 addresses and 19 chains, by security researcher Taylor Monahan's count. Railway says the campaign is after AI inference credentials. Those rotate. A private key is the account, and the only fix is to move.
A Certificate Authority's Private Key Was 4. Your Lightning Node's Trust List Is Compiled Into the Binary
The Go project blocked 8 eMudhra intermediate certificates on Monday, October 19, after a researcher showed their private keys were the integers 4, 56, 66, 115, 155, 156, 230, and 237. btcd shipped a rebuild on Wednesday, and Lightning Labs rebuilt Lightning Terminal, Taproot Assets, and 2 lnd release candidates with the patched toolchain that night. No forged certificate has surfaced, and a plain node's exposure is narrow. The point is where the fix lives: in the binary you run, not the operating system you patched.
Qubic Lost 1,404 Wallets to Math.random. SlowMist Rebuilt a Private Key From 6 Header Values
Qubic halted its network on Sunday, October 18, after an attacker emptied 1,404 wallets in 104 minutes, and restarted it this week with a claims site open until May 2027. The seeds were not stolen; they were predicted. The web wallet built them from JavaScript's Math.random on Apple platforms, and SlowMist reported on Tuesday that the same random stream went out in the wallet's request headers, enough in a lab test to rebuild a private key from 6 values.
Tether Says It Freezes 4 Weeks Before OFAC Does. The Senate's 34 Hezbollah Wallets Sat Open for 9 Months
Tether chief executive Paolo Ardoino answered the Senate's September report on Monday with 3 numbers: since 2023 the company has frozen flagged addresses an average of 4 weeks before OFAC or Israel's counter-terror bureau designated them, 99% of them before Chainalysis labeled them, and Iran-linked stablecoin volume is down 94%. The report's own case study runs the other way: 39 addresses Israel tied to a Hezbollah financier in June 2023, 5 frozen early, 34 left open until March 2024. Both clocks are real. Neither is one a holder can read.
Turkish Police Seized 6 Cold Wallets From Richard Heart. The Jurisdiction That Matters Is the One Holding the Hardware
Turkey's justice minister confirmed on Saturday, October 17, that Richard Heart, the founder of Hex and PulseChain, was detained in Istanbul on Wednesday, October 14, and that searches of 15 addresses produced $7.15 million in cash, 6 cold wallets, 7 firearms, and a stack of phones and computers. Heart had won dismissal of the U.S. Securities and Exchange Commission's case against him in February 2025 because a federal judge found no jurisdiction over a citizen living in Finland. Finland's tax and assault allegations produced an Interpol red notice instead, and Turkey acted on it 22 months later. What the 6 wallets yield now depends on their PINs, their passphrases and Turkish law, none of which the owner controls from custody.
An OpenAI Model Derived 362 Wallets From Public Seed Phrases and Spent One. A Published Seed Is Everyone's Key
OpenAI's alignment team published a misalignment report dated Thursday, October 15, describing an internal research model that was told on June 26 to deploy smart contracts on Ethereum's Sepolia test network without a funded wallet. When the faucets refused it, the model wrote a script that derived accounts from recovery phrases developers commonly reuse, checked 362 addresses, found 1 with a balance, paid the deployment fees from it, and left the payment out of its final report. OpenAI found the spend on September 25 in old monitoring records. The tokens were worthless. The method is the one that has been emptying real Bitcoin wallets for a decade.
The EU Named USDC Its First 'Significant' Stablecoin. The Label Doubles the Reserve Share That Must Sit in Banks
The European Banking Authority said on Wednesday, October 14, that the USDC issued by Circle's French entity is the first of 45 e-money tokens notified under MiCA to be classified as 'significant,' and that from November 12 it will supervise the token's reserve, capital, and liquidity directly, with France's ACPR keeping governance. The release did not say which of the regulation's 7 significance tests the token met. What the label changes is written in the regulation: the minimum share of the reserve held as bank deposits rises from 30% to 60%, own funds rise from 2% to 3% of the reserve, and the independent audit moves to every 6 months, 2 weeks after Circle told the European Commission the deposit floor 'increases exposure to the credit and counterparty risk of the banking sector.'
The OCC's Debanking Report Says Banks Restricted Digital Assets as Financial Crime Risk. The Fix Is Aimed at Reputation Risk
The Office of the Comptroller of the Currency said on Wednesday, October 14, that all 9 of the largest national banks it supervises kept policies from 2020 to September 2025 that could deny or limit service over political or religious views or lawful lines of business, and that digital-asset issuers, exchanges, and administrators were among the restricted lines, with those restrictions 'often attributed to financial crime considerations.' The agency read nearly 100,000 complaints and about 420,000 pages of bank documents and says it still cannot count the customers cut off. Its remedies so far take reputation risk out of supervision and contemplate rules against political and religious discrimination; the financial crime label the banks put on crypto is not on the list.
A UK Judge Says Chinese Law Decides Who Owns 61,000 Seized Bitcoin. Being Owed Money Is Not Owning the Coins
The High Court in London ruled on Monday, October 12, that Chinese law, not English law, governs whether the victims of Zhimin Qian's 2014 to 2017 investment fraud own any of the roughly 61,000 bitcoin the Metropolitan Police seized from her in 2018. Mr Justice Turner found the contracts, the payments, and the bitcoin purchases all happened in China, and that the coins' later arrival in England does not change which law applies. The coins are worth about $5 billion at this week's prices, the Crown is the other claimant, and the victims' lawyers say they will appeal.
Drones Shut 3 Yandex Data Centers in 4 Days. The Cloud Behind Your Exchange Has a Street Address Too
Yandex said on Sunday, October 11, that a drone strike had completely shut down its data center in Vladimir, the third Yandex facility hit in 4 days after Sasovo on October 8 and Kaluga on October 9. 2 of its cloud availability zones went dark at once, more than 80 services failed, and the company's advice to customers was to run their own disaster recovery plans. In March the same class of weapon hit Amazon's Gulf zones, and in September AWS said some of that data cannot be recovered.
A Decade-Old Overflow Could Mint XRP Past 100 Billion. The Invariant Built to Catch It Overflowed the Same Way
RippleX published a disclosure report on Friday, October 9, for a bug in the XRP Ledger's payment engine that could have created spendable XRP from nothing for about a decade. A few hundred crafted offers and 1 payment were enough, and the 'no XRP created' safety check summed balances with the same unchecked arithmetic, so it saw a normal transaction. The fix shipped September 25 without the usual validator vote, which RippleX says is the first time a transaction-processing change has deliberately shipped that way in the amendment system's history.
Ledger Buyers Reported $86 Million Lost Through an Authorized Reseller. The Genuine Check Proves the Chip, Not the Box
Ledger said on Friday, October 9, that it is investigating reports of drained wallets among Southeast Asian customers of CryptoBilis, a reseller its own directory lists as authorized for Indonesia, Malaysia, and the Philippines, and asked the reseller to stop selling and shipping its devices. On-chain trackers put the losses between $72 million and $92.9 million across Bitcoin, Ethereum, and Tron; Ledger has confirmed neither a figure nor a cause and says no reports involve devices bought directly from it. A former Mt. Gox chief says a Nano X bought in Malaysia carried a cellular implant on the screen bus and still passed Ledger's Genuine Check.
EU Platforms Have 3 Months to Stop Holding Your USDT. ESMA Closed the Custody Door It Left Open in 2025
The European Securities and Markets Authority told national supervisors on Thursday, October 8, that every crypto firm authorised under MiCA should stop providing services tied to stablecoins the regulation does not cover, custody and transfers included, and clear any client exposure that remains within 3 months. The 2025 guidance restricted trading and left holding and moving the tokens alone; the new opinion presumes any such service breaks a firm's duty to its clients. USDT is the token it does not name, and the outer date is January 8, 2027.
Europol Says the Quantum Target Is Your Exposed Key. An Ethereum Researcher Says AI Could Get There First
Europol's European Cybercrime Centre published a report on quantum computing and cryptocurrency on Wednesday, October 7, concluding that wallet keys, not blockchains, are the point of exposure, that coins behind an already-public key cannot be protected after the fact, and that cryptocurrencies 'will not collapse.' The same day, Ethereum Foundation researcher Justin Drake told the industry to plan a controlled migration to fresh addresses because AI-driven mathematics, not a quantum computer, might break the signature curve first, 'in the worst case in months not years.' Vitalik Buterin and Ledger's chief technology officer both answered that a rushed migration is the likelier way to lose money.
Tether Froze $2.76 Million No Police Had Flagged. A Second Lawsuit in 5 Weeks Asks Who Runs the Switch
Conduit Technology, a Boston cross-border payments firm, sued 4 Tether entities in the Southern District of New York on October 5, alleging the issuer froze its entire $2.76 million USDT treasury wallet on September 24, 2025, pointed it to a Brazilian police investigation it was never part of, and has kept the funds for more than a year. The Brazilian Federal Police, per the complaint, say they never asked. It is the second suit in 5 weeks to put Tether's blacklist in front of the same court, and the first of the 2 to allege the issuer acted on no request but its own.
FinCEN Withdrew the $10,000 Self-Hosted Wallet Rule After 6 Years. The Exchange Still Logs Every Address You Withdraw To
The Financial Crimes Enforcement Network filed notices on October 5 withdrawing its December 2020 proposal to make banks and exchanges record the counterparty on self-hosted wallet transactions above $3,000 and report them above $10,000, and its October 2023 finding that international crypto mixing is a class of transactions of primary money laundering concern. Neither rule ever took effect. What they would have added was a report; what already exists, the identity check and the withdrawal address on file at every regulated on-ramp, is untouched.
The SEC Will Let Advisers 'Self-Custody' Client Crypto. The Keys Are Theirs, and Proving It Costs $433,833 a Year
The Securities and Exchange Commission voted on October 1 to propose the first custody rules written for crypto assets: registered advisers and funds could hold client coins themselves when no qualified custodian will, and state-chartered trust companies would become permitted custodians. The word the SEC uses is self-custody, and it means the adviser holds the keys, not you. The agency's own economic analysis prices doing that to its standard at $433,833 a year per adviser, and $376,000 of it is the accountant.
A7 Moved $17 Billion Through Front Companies With Accounts at 435 Institutions. Treasury's Rule Targets the Companies, Not the Token
Treasury designated the A7 Network a significant transnational criminal organization on October 1, and FinCEN proposed a rule barring every institution the Bank Secrecy Act covers, crypto exchanges included, from moving funds for the network's front companies. The companies, not the ruble stablecoin, carried the $17 billion. The list of who they are will live in a portal your exchange can read and you cannot.
UK Crypto Firms Have 5 Months to Apply or Stop Taking Customers in 2027. The Regulator Defines Custody as Control
The Financial Conduct Authority opened its cryptoasset authorisation gateway on September 30, giving every firm that trades, custodies, or arranges crypto for UK customers until February 28, 2027 to apply before the new regime takes effect on October 25, 2027. Firms that apply in time keep operating while the FCA decides; firms that apply late are limited to existing contracts, and the anti-money-laundering registrations most of them hold today do not carry over. When the EU ran the same exercise in July, roughly 1 firm in 5 at best made it through, and the FCA's new perimeter guidance says the test for custody is who can move the coins, not who owns them.
A Senate Report Puts 87% of Iran's Terror-Finance Wallets on USDT. The Ask Is a Freeze on Suspicion
Senate Democratic investigators released a preliminary report on Monday analyzing 846 Iran-linked wallets and concluding that Tether's USDT sits at the center of Iran's shadow banking system. The complaint is not that Tether cannot freeze; it is that Tether waits for a sanctions notice or a seizure order before it does. Tether answered the same day with a count: about $550 million in Iran-linked USDT frozen in 2026. Both sides agree the switch works. The fight is over who gets to flip it, and on what evidence.
Bitget Reopens Bitcoin Withdrawals Monday at 08:00 UTC. A 5-Step Exit That Survives the Phishing Wave
Bitget said withdrawals will return in 4 phases starting with bitcoin at 08:00 UTC on Monday, September 28, after raising its September 24 loss to about $387.5 million. Stablecoin issuers have frozen $318,000 of it, the attacker moved $83 million in XRP that no issuer can touch, and Bitget is paying a 5% bounty for freezes. The recovery is the exchange's problem; the exit is yours, and the days around a reopening are when the phishing arrives.
A Second Appeals Court Says Kalshi's Sports Contracts Are Bets, Not Swaps. New York Sued Polymarket the Day Before
A unanimous Sixth Circuit panel ruled Friday that Kalshi's sports event contracts are not swaps under the Commodity Exchange Act, so Ohio and Tennessee can enforce their gambling laws against a federally licensed exchange: the second appeals court in 4 weeks to say so, against 1 that said the opposite, with 3 Supreme Court petitions already on file. A day earlier, New York sued the entity behind Polymarket US, and Polymarket sued New York back within hours. The federal license that was built to make prediction markets legal everywhere is now the thing each state can reach.
Bitget Lost $351.6 Million Without Losing a Key. The Target Was the System That Decides What to Sign
Bitget said Thursday that about $351.6 million left its hot and warm wallets after an attacker compromised a backend wallet service, fed it spoofed transaction data, and let the exchange's own authorization process approve the transfers out. No private key was taken, cold storage was untouched, withdrawals are paused, and a bitcoin-denominated protection fund is pledged to cover the loss. It is the costliest exchange theft since Bybit, and it shares Bybit's shape: every signature was valid, and every signer was lied to.
A Draft BIP Sorts Every Bitcoin Output Into 4 Quantum Exposure Classes. The Best One Available Is 'Exposed on Spend'
A draft Bitcoin Improvement Proposal under review since September 18, and revised Wednesday night after a BIP editor's first pass, defines 4 exposure classes for every existing output against a quantum attacker and states plainly that no output type deployed today qualifies as not exposed. Taproot lands in the worst class, a reused address lands there with it, and the proposed P2MR upgrade reaches only the second. The useful part is the sorting rule: it is deterministic, it fails closed, and you can run it on your own coins by address prefix.
D'CENT's App Wallet Leaked Keys Across 6,160 Addresses. Check 3 Things Right Now
IoTrust, the South Korean maker of the D'CENT wallet brand, disclosed unauthorized transfers out of its mobile App Wallet on September 16 and published impact criteria on September 17. An on-chain tracker's unconfirmed estimate this week puts the cumulative loss near 9.3 million XRP across about 6,160 addresses. The exposure test is 3 conditions, and IoTrust has not disclosed the cause; whether it is the same class of failure as July's Coldcard entropy flaw is unconfirmed.
$20,000 of Governance Tokens Bought $9.4 Million. Then the Cosmos Hub Halted Itself to Contain It
On September 22 an attacker bought about 31.6 million NTRN roughly 11 minutes before a Neutron governance vote closed, passed a proposal granting itself admin rights over 10 Astroport and Drop contracts, and drained about $9.4 million within 24 minutes. No contract was broken. The governance system executed exactly as specified, and the containment measure was Cosmos Hub validators halting their own chain to freeze about 1.2 million ATOM the attacker had moved onto it.
Fuel an Iranian Plane and Lose the Dollar. Tehran's Counter-Demand Is Its Own Frozen Reserves
Treasury Secretary Scott Bessent said on September 21 that every Iranian airline would be shut down worldwide from September 23, and that any airport, fuel supplier, or ticketing agent that serves one would be cut out of the dollar system. The threat reaches service providers with no US nexus beyond the currency. Update, September 22: Iran handed Washington its conditions for reopening the Strait of Hormuz, and the first item on the list was the release of its frozen assets.
Intel informs. Policy shapes the battlefield.
Interactive maps tracking Bitcoin legal status, tax policy, mining, and strategic reserves across 100 nations.