Eight compromised certificate-authority keys, 4,000 phantom sidechain coins, $14.2bn of debt against GPUs whose rental rate an open-source release just repriced, and a 15% perpetual preferred sold against a 10% expectation. Four markets, one failure mode: the backing was asserted, not measured.
Eight private keys were enough. On Tuesday the maintainers of a site called we-have-a-problem.com published what amounts to a confession on behalf of the certificate industry: "The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores." Within hours pip shipped 26.2.2, uv shipped 0.13.4, certifi shipped 2026.10.19, each with a fresh bundle of trusted certificates. If you run Linux, your ca-certificates package now needs an update too, because the padlock on every site you visit rests on a list that just changed underneath you.
An intermediate certificate authority is a delegated promise. A root program vets a root, the root signs an intermediate, and the intermediate is then allowed to vouch for other people. Eight intermediates went at once, which is not the failure profile of a sophisticated attacker but of a layer that nobody was measuring at all.
That is the shape of this week. Four markets, four stories, one structure: a claim about backing that was asserted rather than measured, and a bill that lands on whoever holds the promise rather than whoever wrote it.
Start with the sidechain. In September someone exploited an inflation bug in the Liquid Network and created more than 4,000 LBTC that had never been backed by anything, then redeemed them for real bitcoin out of the federation wallet — roughly $320 million at the time. This week Liquid announced "the final stages of recovery," the restoration of "the network's full 1:1 bitcoin backing," and the controlled reactivation of federation peg-outs for authorised key holders, and Adam Back confirmed on Tuesday that swaps were working again.
Read that sentence about 1:1 backing twice. LBTC is a token whose entire proposition is that each unit is redeemable for one bitcoin. That proposition was true until the moment it wasn't, and the thing that made it true was not cryptography. It was a federation's code plus a set of humans holding keys.
The recovery also carries a number worth checking. Bitcoin Magazine reports the attackers still hold about 600 bitcoin, fifteen per cent of the haul, "worth close to $50 million at today's prices." At a spot price of $83,005, measured this morning, 600 coins are worth $49.8 million, so the article's own arithmetic holds. Not every number this week does, as will become clear.
Bitcoin's issuance rule is enforced differently: by every node that chooses to validate, independently, for free, every ten minutes. The difference is not that one system has better cryptography. It is the number of independent parties who would all have to be wrong at the same time. A federation is a small number. A full node is anyone who feels like it.
Now scale the same question up by three orders of magnitude, to the AI buildout.
At an internal AWS meeting in September, according to a recording obtained by Business Insider, the cloud unit's chief financial officer had a joke for the executive running much of Amazon's AI construction: "You've taken us free cash flow negative as a company, so congratulations." Amazon is spending $220 billion this year, and the executive on the receiving end expects free cash flow to stay negative for "the next couple of years or so." The same reporting has Amazon taking delivery of about $5 billion of Nvidia GB300 racks in August and roughly $3 billion more every month, with some racks going into warehouses because the data centres they were ordered for could not be powered up.
Hardware waiting for electrons is a physical mismatch. The financial version is worse. CoreWeave has announced $14.2 billion in loan facilities this year secured against its chips and customer contracts. IREN — the former bitcoin miner, same management, new collateral — took $2.4 billion from Blue Owl to buy Nvidia GPUs. And the cost of insuring CoreWeave's debt against default reached distress levels last week, as Marty Bent reported on Tuesday.
Here is the question a lender has to answer and mostly cannot: what is a GPU worth in foreclosure? A chip has no yield of its own. Its value is the rental rate it can command, times the years it can command it. CoreWeave's August facility is roughly five-year debt against customer contracts averaging about three years, so the lender is explicitly betting on renewals.
Then DeepSeek open-sourced the thing that sets the rental rate.
The Chinese lab published DeepInfer, the production inference stack behind its V4.1 Flash model, together with production figures that Latent Space summarised on Wednesday. The claims: 155 trillion tokens a day from a single cluster, a 96 per cent input-cache hit rate, 400 milliseconds to first token, and revenue of $38 per accelerator-hour at off-peak prices. Set against all-in costs of $5 to $8 per card-hour, that is a gross margin above 80 per cent. Nathan Lambert, writing at Interconnects, puts the estimate at "up to 90% gross margin" selling tokens on this stack.
Two things follow from that disclosure, and they point in opposite directions.
The first is that the margin claim survives a check. At the published price of $0.15 per million input tokens and $0.60 per million output tokens, a blended $0.14 per million applied to 155 trillion tokens gives $21.7 million a day, which is the "$22m/day" in the headline. At $5 to $8 of cost against $38 of revenue per card-hour, the margin works out at 79 to 87 per cent, which means the 80 per cent figure is not a projection but arithmetic performed on published prices.
The second is that the rest of the published set does not reconcile, and nobody seems to have tried. Work it through. $21.7 million a day is $904,000 an hour. Divide by $38 of revenue per card-hour and you need 23,794 accelerators to produce that revenue. The same report describes a decode fleet of "over ~2,400 GPUs." At 2,400 accelerators, each one would have to earn $377 an hour, roughly ten times the quoted rate. And the "$166B per GW with 81 day payback" is a third inconsistency: $166 billion of capital against $21.7 million a day is a payback of 7,650 days, twenty-one years. Only the smaller reading holds together — 81 days times $21.7 million is a cluster cost of about $1.76 billion, which is roughly what 24,000 high-end accelerators cost.
I cannot resolve which of these figures is the outlier from outside the company. What I can say is that all four are first-party production claims rather than audited measurements. They are being repeated as the equity story for a buildout that is increasingly financed with debt, and they differ from each other by a factor of ten depending on which one you believe. When the collateral is a rental rate, the rental rate had better be reconciled.
vLLM's response is the most interesting document of the week, because it cuts both ways. The team acknowledged that DeepInfer was built primarily on vLLM and released under Apache 2.0, then reported decode throughput within 6 per cent of DeepSeek's published results on GB200 under a matched configuration, and published reproduction recipes.
Read as a rebuttal, it says DeepSeek has no unique serving advantage. Read as a threat, it says something worse: the 80 per cent margin is reproducible by anyone with the source and the hardware. DeepSeek did not release its KV-cache management or its load balancing, which remain coupled to internal infrastructure — but the parts that produce the margin are now public.
A margin that can be copied is not a moat. It is a window. And when the window closes, the thing that closes is the rental rate — which is precisely the number on which $14.2 billion of CoreWeave facilities and $2.4 billion of IREN equipment loans are valued.
In 2021 the bitcoin miners made the identical trade. Price and hashrate were rising, so they ordered machines nine months to a year out. In December 2021 Marathon signed for 78,000 S19 XPs at $879 million, delivered in monthly batches through the following year, with 35 per cent paid up front. That deposit alone was $307.6 million. The machines arrived before the energy infrastructure did: by July 2022 nearly 30,000 of them sat installed in Texas, waiting for a hosting site that kept moving its energisation date.
The waiting was not what killed them. The debt was. Much of that hardware was bought with loans collateralised by the hardware itself, and when the price turned, the collateral turned with it. Hashrate Index has the newest generation of machines falling from $101 per terahash to under $15 over the course of 2022 — a decline of 85 per cent. Stronghold handed back about 26,200 miners to wipe out $67 million of debt, a lender demanded roughly $108 million from two of Iris Energy's equipment financing vehicles, and Core Scientific filed for Chapter 11 that December.
Bent concedes, fairly, that this is not a perfect analogy: an ASIC is tightly coupled to the bitcoin price, while a GPU's value depends on demand for computation that is not going away. That is the strongest form of the objection, and it is also incomplete.
An ASIC is a call option on the bitcoin price and the difficulty. A GPU is a call option on a rental rate. In 2022 the collateral fell because the underlying asset fell. In 2026 the collateral can fall because the software got better — while AI demand is still growing. The correlation argument protects a lender against a price move. It does not protect against a productivity move, and productivity moves only in one direction.
The third market is the strangest, because it is the one where the leverage was designed by people who had watched 2022 closely.
Strive listed its SATS preferred stock on Nasdaq on Tuesday: 7,000,000 shares at $90, a $630 million raise, carrying a 15 per cent dividend paid out every business day. The company holds 36,818 bitcoin — $3.06 billion at spot — after buying another 4,045 coins between 12 and 16 October, and it is debt-free, with no bonds, no credit lines and no positions that force liquidation in a drawdown. Strategy, the largest corporate holder, sits at 848,517 coins, $70.4 billion at spot, and runs five preferreds of its own.
One arithmetic note on the announcement as reported: "a 15% dividend every business day" cannot mean 15 per cent per day, which would be north of four thousand per cent annualised. Read as a 15 per cent annual rate accrued and paid daily, it is 0.0595 per cent per business day — $375,000 of cash every business day, $94.5 million a year, on $630 million raised. That reading also matches Strategy's proposal last month to move its own preferreds to daily dividends. I state it as the only reading that survives arithmetic, not as a confirmed term sheet.
Now put the coupon next to the expectation. JPMorgan's asset management arm has added bitcoin to its long-term capital market assumptions and projects it to outperform bonds, equities, gold and real estate over the long run, with roughly 10 per cent compound annual growth highlighted, as Anthony Pompliano noted on Tuesday. Raise money at 15 per cent to buy an asset you expect to compound at 10, and you have created a negative carry of five points. On this one raise that is $31.5 million a year, and over ten years a compounded gap of roughly $915 million between what the preferred costs and what the asset is projected to earn.
That is not a scandal. It is a term structure, and it is the price of eliminating duration risk. A perpetual preferred has no maturity, so there is no refinancing wall and no margin call — the holder's protection is not collateral but the issuer's ability to keep paying. Strive solved the problem that killed Core Scientific in 2022 by paying 15 per cent for capital that never has to be repaid. The common shareholder is paying that 15 per cent, in the form of everything above it.
The strongest case against everything above is that it mistakes a transition for a bubble, and it deserves to be made at full strength rather than conceded in a clause.
Real revenue exists. $22 million a day is not a slide deck; it is an invoice, from a company selling tokens at published prices to customers who can walk away. Amazon's $220 billion is funded from equity and retained earnings, not from a lender's covenant. The miners did not fail because they built too much; they failed because they borrowed against machines whose value was correlated with the asset they produced. Not one of the treasury companies in this piece has that problem: Strive is debt-free, and Strategy's preferred stack is perpetual.
And the deflation itself is the bull case, not the bear case. Halving the price of inference does not halve the revenue from an accelerator; it expands the set of things worth doing with one. Ten million tokens a day was an extravagance in 2024, routine in 2026, and will be a rounding error in 2028. If token demand roughly doubles whenever price halves, revenue per GPU holds while the addressable market compounds — and the collateral is fine, because the collateral was never the chip. It was the demand curve.
Under that reading, deepseek's 96 per cent cache hit rate is not a warning about the industry. It is a statement about how repetitive real production traffic is, and therefore how much headroom remains for everyone else to get cheaper. Cheaper is how this technology reaches the two billion people who have never paid for a token.
Three things I could not establish, and they matter.
Whether SpaceX's 18,712 bitcoin — disclosed in its S-1 at a fair value of about $1.29 billion as of 31 March 2026, an implied $68,940 a coin, against $83,005 today — is held outright or pledged. Whether the loan-to-value ratios on GPU-collateralised facilities are anywhere near the 2022 equipment loans; they are private, and Bent is right that this is the number to watch. And which of DeepSeek's four figures is wrong.
There is also a caveat that belongs to the margin itself. A 96 per cent cache hit rate describes DeepSeek's traffic mix. A rented general-purpose GPU serving fresh context at a 20 per cent hit rate earns a very different number per hour, and the industry average is not DeepSeek's. The 80 per cent is a fact about one heavily cached workload, not a property of the asset class that is being financed.
One more document from this week belongs here, because it is the only one that treats the cost of checking as a first-class engineering problem. A developer on Delving Bitcoin published a transaction filtering language for satd, a Bitcoin Core-compatible node written in Rust, and the design choices are the argument. The language is "cost-bounded and intentionally not Turing-complete." Policies quarantine rather than reject, so the decision stays visible and can be tuned. And if the node detects that a rule set might catch something important — a Lightning channel closure, say — it refuses to load the filter at all unless the operator explicitly overrides with allowdangerousfilters=1.
The author's own summary of the net effect is the sentence worth keeping: "Consensus-correct transactions still find their way into most mempools and blocks, as long as some node somewhere (or some out-of-band mining process) agrees to it."
That is the whole distinction in one line. Consensus is verified by everyone. Policy is a local choice, made by a party who has priced what it can afford to check, and honest about the price. The Liquid federation, the lenders against GPU collateral and the buyers of a 15 per cent preferred all skipped that step. They assumed the checking was happening somewhere and never asked where.
Four markers, all falsifiable. CoreWeave's contract renewals at the 2029 to 2031 boundary, which is where the five-year-notes-against-three-year-contracts bet resolves. Whether the next round of hyperscaler capex is funded from free cash flow or from paper. Whether the next bitcoin treasury preferred prices above or below 15 per cent — a higher coupon means the market is charging more for the same structure, a lower one means Strive's price was a debut premium. And whether anyone, anywhere, publishes an LTV.
The certificate story is the one to keep in mind while waiting. Nobody doubted eMudhra's intermediate keys because nobody had a reason to look; the chain was cryptographically valid, the roots were trusted, the padlock rendered. The eight keys were compromised for an unknown period before anyone measured them, and the fix arrived as a bundle update that most machines will apply silently and some will not apply at all.
That is what an unverified backing looks like right up until it fails. A peg maintained by a federation, a collateral valued by a rate nobody reconciles, a dividend paid from a 15 per cent promise against a 10 per cent expectation. Each is a claim that someone else is checking. In one asset class in this list, checking is the entire product — anyone can download the chain and confirm every coin that exists, without asking permission and without trusting a single intermediary. That is not a feature added on top of the system. It is the only reason the rest of it is worth measuring.
