Hey,
On Sunday, 4,000 bitcoin left the wallet that backs Blockstream's Liquid sidechain.
Not through a stolen key.
Every signature checked out.
Whoever did it left a note on-chain:
Fix the bug, and we'll send it back.
The rest of the week rhymed with that sentence in ways I didn't expect.
Let's get into it.
📊 The tape, quickly
Thursday: $731M into the spot ETFs, the biggest day since January. BTC tagged ~$82K.
Friday: 162K jobs vs 56K expected.
$BTC ( ▲ 0.23% ) back under $80K.
$ETH ( ▼ 0.48% ) ~$2,500, flat on the week.
👉 Markets now price a ~66% chance the Fed hikes on September 16.
📆 CPI on Thursday decides.
🔓 Liquid lost 95% of its Bitcoin
Liquid is Blockstream's bitcoin sidechain:
You lock BTC on mainnet,
You get L-BTC
Move it fast between exchanges.
The locked BTC sits in a wallet that needs 11 of 15 federation members to sign.
📆 On September 6, ~4,000 of its ~4,200 BTC walked out — about $320 million!
The transaction said: "we are whitehats. contact us on chain."
A follow-up OP_RETURN set the terms:
Nobody stole a key.
Blockstream's early read is a bug in Elements, the node software — L-BTC that shouldn't exist got created, then pegged out through an approved venue that couldn't tell fake from real.
The federation signed, because from where it stood, everything was valid.
Network paused.
L-BTC frozen on exchanges.
As of this morning, nothing has come back.
A hack breaks your lock.
This walked through the front door with the right paperwork.
"White hat" is a claim, not a status:
Until the coins return, this is a $320M negotiation.
And if they do return, the lesson gets worse: the most serious federation in bitcoin was one node bug away from a 95% hole, and found out from the attacker.
🏦 21 banks announced a stablecoin. There is no stablecoin. 🤷♂
Bank of America, Citi, Goldman, UBS, Wells Fargo, Santander, BBVA, Fidelity and thirteen more will form a joint company to issue a dollar stablecoin.
Incorporate in H2 2026.
Dollar coin in H1 2027.
Euro later. GENIUS + MiCA compliant.
What the release doesn't contain: a name, a CEO, a chain, a custodian, a reserve manager, or a single quote.
Missing from the list: JPMorgan — the bank furthest along, with JPMD already live.
Meanwhile Tether and Circle hold ~83% of a $310B market.
Twenty-one competitors sharing one product means none of them wants to own it alone.
The point is to not lose, not to win.
And the one bank actually shipping stayed out.
This is a placeholder — a way to tell shareholders "we're in stablecoins" without picking a chain, a partner, or a fight.
🤖 OpenAI built a model that finds zero-days on its own
Same day Anthropic shipped Claude Fable 5.1, OpenAI announced Astra: the first model to hit the "Critical" tier of its cyber framework.
Their definition: a model that can find and exploit zero-days "in many hardened real-world critical systems without human intervention."
In evals it found two zero-days unprompted, aced ExploitBench, escaped a browser sandbox and chained OS flaws to root.
So it ships behind restricted access: isolated environments, monitored actions, vetted testers first.
👀 Now look at DeFi from a machine's point of view:
Open-source
Publicly deployed
Holding billions
Instant permissionless payout for whoever finds the bug first.
The largest bug bounty ever built — and it can't be taken offline to patch.
Astra is behind a door today.
Competitors, open weights and leaks all point to that door not holding.
The audit you paid for last year was priced for human attackers.
⚡ Quick hits
Robinhood vs AMC.
Robinhood sells a token that tracks AMC's stock price — without asking AMC.
AMC's CEO publicly demanded they stop;
Robinhood's legal chief replied "send your lawyers and we'll educate them."
Since the token isn't a share, AMC has no say. Worth knowing before you buy one.
The US Commerce Department is now an “Oracle”.
GDP and PCE go on-chain via Chainlink across 10 networks.
Quietly bigger than most token launches.
The takeaway 🫡
This week the code failed, and look what's on offer instead:
Liquid's attackers: trust us, we'll return it once you patch.
Twenty-one banks: trust us, the coin ships in 2027.
OpenAI: trust us, the dangerous part stays locked.
Three promissory notes. None verifiable today.
Crypto's pitch was that you'd never have to take anyone's word for it.
See you next week. 👋
— Juan