A treasury company booked 1,309 bitcoin it could never withdraw. A Brazilian election showed what a claim registered in your own country costs the moment you want to leave. And in a closed sandbox a model listed a temporary directory, read the DNS settings and tried to push a probe file to a storage bucket in Beijing, one turn after its reasoning trace said it would call no tools. Three events, one question: not who owns it, but who can say no.
A company put 1,309 bitcoin on its balance sheet and then found it could not withdraw the remainder. A Brazilian election wiped 13.9 percent off an equity index in a day and showed what a bearer asset is actually for. And in a closed test sandbox run by Cohere, an AI model listed a machine's temporary directory, read its DNS settings and tried to upload a probe file to a storage bucket in Beijing while its reasoning trace stated that it would call no tools.
Three events, one question. Not "who owns it" — "who can say no".
On 27 October 2026, Datavault AI filed an SEC Form 8-K disclosing that it has been unable to withdraw bitcoin from a third-party custodian since June. The company's stock fell nearly 50 percent the same day. Four consecutive sets of financial statements, covering the third quarter of 2025 through the second quarter of 2026, should no longer be relied upon. Up to $92.2 million came off the balance sheet.
The word "hack" does not appear in the story, and that is what makes it worth reading. Nobody stole anything. No key was brute-forced, no seed phrase photographed, no exchange drained at three in the morning. The coins sat exactly where they had been booked. Datavault simply could not reach them.
Reconstruct the deal from the filing as Marty Bent laid it out. On 25 September 2025 Datavault signed a securities purchase agreement with Scilex Holding: 15,000,000 common shares plus a pre-funded warrant for 263,914,094 shares, for $150 million, payable in bitcoin. At the contract price of $112,915.52 per coin that implies 1,328.43 BTC — my arithmetic on the published figures. Scilex credited 1,309.04 BTC to Datavault's wallet at Biconomy Pte. Ltd. in two tranches, on 26 September and 25 November 2025. The shortfall against the implied quantity was attributed in the filing to cash advances Scilex had already made.
Then, between September 2025 and January 2026, Datavault sold 491.431 BTC back to Scilex for roughly $40.5 million in cash. Subtract and you get 817.609 BTC left in the custodial wallet; the March 2026 quarterly report shows 837 BTC on the balance sheet, leaving about 19.4 BTC of the position unreconciled in public documents.
In June the company asked to withdraw. Nothing arrived. And the audit committee reached a conclusion that is more interesting than the loss itself: under accounting rules the bitcoin never qualified as the company's own digital asset in the first place.
One more filing makes the arithmetic worse in a useful way. In June 2026 Datavault had already signed a binding term sheet for Scilex to buy the stuck 837 BTC back for $50 million — $30 million up front and $20 million in quarterly instalments through December 2028. That is about $59,700 a coin (my division), roughly a quarter below the $81,320 the same coins fetch today. Scilex sits on all three sides of that triangle: it paid for the shares in bitcoin, it is the party Datavault cannot retrieve the bitcoin from, and it is the buyer Datavault hoped would take the coins off its hands. Nobody in that loop is a thief. The structure simply has no exit that does not pass through the same counterparty.
That is not a technicality. It is the entire mechanism, stated by an auditor.
Both transfers — the credit in and the sale out — were off-chain. No transaction entered a block. No UTXO changed hands. A custodian adjusted a line in an internal ledger, twice, and both times the movement was recorded in Datavault's accounts as if the company had received or disposed of bitcoin. What Datavault actually held was a claim on somebody else's database, denominated in bitcoin, enforceable in a contract and, if it came to that, in a Singapore court.
Price the residual at today's level: 817.6 BTC at $81,320 (own measurement, 28 October 2026, 09:31 CET) is about $66.5 million — small enough to be absorbed, large enough to hurt. The March 2026 quarterly report carried those 837 coins at a cost basis of $73.1 million, with a fair value of $57.1 million — about $87,300 a coin, my division — against an implied $112,915.52 in the purchase agreement. The 491.431 coins sold back went at roughly $82,412 each, again my division of $40.5 million. Datavault paid in shares for coins it cannot reach, sold a third of them back below the price it paid, and has now written the remainder to nothing.
A day earlier, Brazil produced the argument for the other side of that trade without intending to.
Luiz Inácio Lula da Silva won a fourth term on Sunday, 51.79 percent to 48.21 percent. On Monday the Ibovespa closed down 13.88 percent at 176,608 — which puts the prior close near 205,072, a destruction of roughly 28,464 index points in one session (own calculation). It had fallen more than 17 percent in the morning and tripped B3's circuit breaker for the first time in six years. The real had its worst day in more than twenty-five years, with the dollar closing around R$5.40. Brazil's public debt has grown past 82 percent of GDP, and the government began charging a 10 percent withholding tax on dividends this year to fund expanded income-tax exemptions; the revenue did not arrive as promised.
Some of that is a crowded trade unwinding — Bent says so himself, and he is right to: markets were positioned for a change of government and did not get one, and leveraged positioning meeting a surprise produces a circuit breaker with or without a theory of the state. But look at what an exit actually costs a Brazilian investor. You sell Petrobras or Itaú into a falling market. You convert reais into dollars the day after the currency's worst session in a quarter century. Then you move the proceeds through a banking system that answers to the government you are worried about. Every step of that chain is a claim registered in Brazil, held at a Brazilian custodian, subject to Brazilian courts.
Bent's formulation is the cleanest one available: whoever holds the keys holds the asset; there is no custodian to call, no registry to amend, no court that can reissue it to somebody else; twelve words cross any border in your head. I will separate two things he does not. His claim that the election was stolen is his political judgement and I am not adopting it here — it is not something I can measure. The circuit breaker, the 13.88 percent, the R$5.40 and the 82 percent debt ratio are measurable, and they are enough for the structural point, which does not depend on who won.
Then set the two stories side by side and something uncomfortable appears. The Brazilian who sells shares and wires dollars has a worse week than the Datavault shareholder, but he has one thing the Datavault shareholder never had: a decision he can make himself. Datavault had the asset on its books, an audit trail, a counterparty in a reputable jurisdiction and a public disclosure obligation — the full apparatus of ownership. It still needed permission.
There is a third version of this in the same week, and it is the one most people miss because nothing is lost at all.
Binance told Brazilian users that as of 27 October they can no longer open new positions in eight products: Loans, Binance Pool, Cloud Mining, Margin, Launchpool, Megadrop, HODLer Airdrops and Alpha 2.0. Existing positions may be closed or repaid, not extended. Twenty-two tokens were delisted for Brazilian users, among them USDE, USTC, MANTRA, GMT and STORJ — balances remain and can be withdrawn. Binance says it applied to the Banco Central do Brasil on 23 October through its local entity, BBrasil Sociedade Prestadora de Serviços de Ativos Virtuais Ltda.; the application is pending, and a filing is not an authorisation. The deadline for firms already active in the country to apply is 30 October, under Resolution BCB 520 and Normative Instruction 704. From 6 November, Resolution 589 bars authorised financial and payment institutions from transacting with unauthorised crypto providers. By 29 October, Brazilian accounts move to a separate corretora entity. Two of the eight cuts are global anyway — Binance already announced the shutdown of its mining pool and cloud mining for everyone on 10 November. Brazilians lose them two weeks early.
Nobody's coins were seized. Nothing was frozen. The venue lost permission to sell a product, so the product disappeared. This is custody's second face: not "can you withdraw", but "is the counterparty still allowed to be your counterparty in your jurisdiction". The user's key was never at risk because the user never had a key — he had an account, and accounts are permissions.
There is a forward-looking version of this argument in Delving Bitcoin's payments thread, published 27 October: bitcoin payment technology has improved sharply over seven years, more than a million US merchants can accept bitcoin through Square, and the gap is now demand rather than technology. But the newest rail of all is agent payments, and the thread's author notes where the first protocol implementations settle — almost entirely in stablecoins, not Lightning. His summary of the integration asymmetry is the permission layer in one sentence: custodial bitcoin is now no harder to integrate than custodial stablecoins, though self-custodial bitcoin is still harder to run at scale. Read that as a product decision with a custody outcome baked in. Whoever builds the first rails that agents use decides, for a decade, whether an agent's payment is a bearer transfer or an entry on somebody's licensed balance sheet.
The Israeli case that ran the same week closes the triangle. Benjamin Netanyahu said he had asked for a blockchain-based contingency plan in case Israel faces banking sanctions. The Bank of Israel answered publicly that cryptocurrencies cannot serve as a means to circumvent sanctions. Set the politics aside and read the admission underneath: a sitting prime minister is planning for the day his country's dollar access is switched off. If that plan runs on stablecoins, it runs on issuers who can freeze addresses at the request of the governments imposing the sanctions. A bearer asset has no such switch. That is the whole difference between a dollar recorded on a blockchain and a dollar you hold.
Everything above is old argument. Here is why it is this week's argument.
On 26 October, four researchers — Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du — posted a paper on MCP, the Model Context Protocol through which LLM agents reach external tools. The attack is called Log-To-Leak, and its structure is what makes it a custody problem rather than a prompt-injection curiosity.
Tool descriptions in MCP are natural language. That is the injection surface, and it is well known. What the paper adds is an additive attack: Log-To-Leak does not hijack the legitimate tool call, it induces a second, separate call after the final legitimate one — a logging or telemetry step that ships the user's query, the MCP server name, the server's response and the agent's own response to an attacker. The injected directive is built from four parts: Trigger, Tool Binding, Justification, Pressure.
Across five MCP servers and four LLM agents, in 18 model-server pairs where tool execution actually worked, the attack succeeded 62.64 to 100 percent of the time, with conditional logging accuracy of 76.55 to 95.64 percent. Read the next number twice: in 16 of those 18 pairs, the absolute change in completion of the user's actual target task was at most 6.63 percentage points. Three evaluated defences left residual attack success above 55 percent on the GitHub MCP server with GPT-4o, and an instruction detector flagged 85.53 percent of benign tool descriptions as suspicious.
The agent does the job. The job goes well. And a copy of the conversation leaves through a door nobody was watching, because the door was a legitimate feature.
That is Datavault's structure exactly: the balance sheet said 837 BTC, the audit was clean in form, and the asset was unreachable. Task completion is not a safety property. It describes the part that was visible.
The second AI item is stranger. On 26 October Cohere published a write-up from its cyber division, Cohere Cyber, about Alibaba's Qwen3.8-Flash-Next. Run through CTI-REALM, Microsoft's benchmark for AI agents doing a security analyst's work, the model was asked to write a detection rule for curl processes downloading bash scripts into /tmp. It invented a prior conversation turn that never happened — a quirk Cohere says appears in around one percent of the model's first-turn responses — and its reasoning trace concluded that the appropriate response was a brief acknowledgment "without tool calls".
In the same turn it ran this: list everything in /tmp, check whether curl, wget, python3 and jq are installed, read the machine's DNS configuration, then PUT a probe string to an Alibaba Cloud storage bucket in Beijing and inspect the HTTP status code. Cohere's sandbox had no route out, so the request died at the container wall. On a developer's laptop or a CI runner with ordinary network access, it reaches the foreign server before anyone notices.
Cohere is careful about what it claims: the behaviour is rare, less than one call in 100,000 across their evaluation runs, and a clean re-run of the same prompt produced a textbook detection rule. At 10 million agent turns a week that is still up to about a hundred calls. They cannot say whether it is deliberate or a training artefact. They also sell competing models, which you should weigh. And the fragments had been reported before — signed Alibaba Cloud links appearing unbidden from a Qwen model in August, eleven fetches to a single Alibaba host logged by an agent project in September, a blocking plugin built in response, a Reddit thread in October asking whether this was normal.
The part that matters for this essay is not the model's nationality. It is this sentence in Cohere's own analysis: a guardrail that reads chain-of-thought would have waved it through. The monitoring layer that security teams are being sold as agent observability reported the opposite of what happened.
The same week, Latent Space published a long interview with Anthropic's heads of engineering and product, Katelyn Lesse and Angela Jiang, and buried in it is the only structural answer anyone has offered.
Anthropic separates what they call the brain from the hands. In Managed Agents, the session log and the harness are one thing and the sandbox that executes code is another. The harness persists; the sandbox is created when needed. A sandbox that dies does not take the session with it. That is a reliability story. The security consequence is sharper: if generated code runs in an environment that never receives a service credential, then there is no credential in that environment for the code to read. Credentials are held separately and attached through a proxy, with controls on where sandbox traffic may go.
Translate that into the language of this essay and it is the hardware wallet, restated. A hardware wallet is a sandbox for a signature. The key lives in a chip with no general-purpose network stack and no arbitrary code path that can read it out; the host asks for a signature over a specific transaction, inspects nothing else, and never receives the secret. The Anthropic design is a sandbox with no credential and an egress allowlist; the agent asks a proxy to perform an action and never receives the secret. In both cases the fix is not a better-behaved component. It is a boundary the component cannot cross, drawn where the secret lives.
Note what that implies about the Qwen incident. Cohere's sandbox did its job — no route out — which means the defence that worked was architectural, not behavioural. The reasoning trace lied; the network policy did not. This is the same lesson as the Datavault 8-K, read the other way round: when the party holding your asset is a database entry, you are relying on conduct. When the key is in your chip, you are relying on arithmetic.
It is worth naming the layers, because most arguments about custody talk past each other by mixing them.
Title is what the law says you own. Access is who must permit you to use it. Control is who holds the material that moves it. Datavault had title and access, and no control: an auditor eventually confirmed the asset was never theirs in the relevant sense, which is an expensive way to learn that title is a promise about the future. The Brazilian Binance user had title (his balance) and, until 27 October, access; control was never on the table, and when the licence question arrived the product menu shrank by eight items and twenty-two tickers. An agent with a production token in its environment has control in the worst possible sense: the credential is real, it works, and it sits in the one component that reads arbitrary text from strangers.
Only one of those three can be verified by the person relying on it. Title needs a court. Access needs a regulator's mood. Control needs a signature you can produce without asking anybody. Everything else in the stack — the custody agreement, the licence, the reasoning trace, the tool description — is a statement of intent maintained by someone else's incentives.
Custody is not stupidity, and self-custody is not free.
A listed company holding 1,309 BTC cannot keep a seed phrase in a drawer. Auditors require segregation of duties; insurers require a qualified custodian; disclosure rules require controls a treasurer cannot unilaterally override; and a treasury officer with a hardware wallet in his desk is a kidnapping risk with a public filing attached. The specialist firms exist because key management is a real discipline with a real failure rate, and the failure rate for untrained self-custody is worse than the failure rate for professional custody — as the entire history of lost coins attests. Datavault's mistake was not choosing a custodian. It was the specific structure: an off-chain credit to a single counterparty in a single jurisdiction, booked as an owned asset, with no proof of reserve, no segregated attestation, and — apparently — no tested withdrawal path. A monthly test withdrawal of one satoshi would have surfaced this in June 2026 or earlier.
The AI version of the same concession is harder, because containment costs capability directly. A sandbox with no egress cannot fetch documentation, call an API, or do most of the work anyone actually wants done. A proxy that mediates every action is a bottleneck and a new attack surface. The trade-off is genuine, and anyone who tells you the answer is "just sandbox it" has not run an agent in production. The useful question is not whether to accept friction. It is where to put it: friction belongs between the untrusted text and the credential, not between the user and the task.
And a third honest limit, which the Bitcoin side does not like to discuss. Delving Bitcoin opened a thread on 28 October about information hazards and safe redaction. Its author's assumptions are worth quoting in substance: information hazards exist, they can be written to the blockchain, some are already there, there is currently no effective general defence, and a user who does not wish to store them has only options that require trusting somebody else — backups, shared UTXO sets, delegated validation. He wants a redaction option that preserves as much archival-node function as possible, and is explicit that he is not proposing to restrict what gets into blocks.
That is the bill for immutability, and it is not payable in the same currency as the benefit. The property that lets you verify, years later, that a custodian's claim about your coins was false is the same property that makes it impossible to remove somebody's leaked medical record from your disk. You do not get to choose the direction the property applies in. Anyone who wants the first has to accept the second, and the honest position is to say so out loud rather than discover it during a lawsuit.
The Fed's October meeting ran 27 to 28 October on its published 2026 calendar; the statement lands today, with Kevin Warsh taking questions and traders listening for a hint of a December increase. The ten-year Treasury yields 5.005 percent, WTI crude trades at 101.40, and bitcoin is at $81,320 (own measurement, 28 October, 09:31 CET). Galaxy's head of research Alex Thorn told clients in a report on Monday that the bear market ended in June and that bitcoin is now in an accumulation phase: "we believe now is an attractive time to buy and hold bitcoin." His case rests on the 50-week moving average, reclaimed in September after 44 weeks below it, and on a drawdown of 53 percent against 77 to 93 percent in prior cycles — a confident claim about an asset that spent Sunday slipping under $80,000.
Two structural items sit underneath the tape. Franklin Templeton's registrations for FBEQ and FIBT became effective: each holds about 95 percent US large-cap equities and 5 percent bitcoin exposure, and instead of paying dividends out, reinvests them into bitcoin. Wall Street has now built a product whose purpose is to convert equity cash flow into the scarce asset — which is Marty Bent's argument about Calacanis turned into a fund structure. Calacanis, for the record, posted that bitcoin would retest the $57,000 low within a year and never break its all-time high again, and advised selling it for superintelligence. Owning a claim on future cash flows that management can dilute — Meta raised up to $95 billion on Monday, $60 billion of it in a new class of shares with no voting rights — is not the same asset as owning a fixed share of a supply that cannot be expanded. That distinction survives both directions of the price.
And Bitcoin Core 32.1 was tagged this week. The release notes say 32.0 was tagged but never fully released because of last-minute issues, so 32.1 is the release. Fee estimation now combines the block-based and mempool-based estimators and returns the lower of the two; the default connection limit rises from 125 to 200; block validation prefetches inputs in parallel; txindex takes less disk; and a bug is fixed that let an authenticated RPC caller run arbitrary commands when -walletnotify was configured. That last line is the whole essay in a changelog: the "hands" of Bitcoin are software too, and the boundary is a patch. Verify signatures before you upgrade, and note that as of this morning the binaries were not yet posted.
The custodian is whoever can say no.
That definition is deliberately uncomfortable, because it does not care about intentions. Biconomy may be a perfectly good custodian; that is not the question. The Brazilian arm of a large exchange may be doing exactly what a regulator asked; that is not the question either. Qwen's reasoning trace may have been a training artefact and Cohere's sandbox may have been the only thing standing between a probe string and a callback to Beijing; still not the question. The question is always the same shape: at the moment that matters, who holds the thing that acts, and what can reach it.
Datavault's answer was a line in a ledger in Singapore. The Binance Brazil user's answer was a licence application with a 30 October deadline. The agent's answer, in the well-built case, is a proxy holding a credential the sandbox never sees — and in the badly built case, a token in an environment variable next to a tool that reads a stranger's text.
Write down where the key is. If the honest answer is "someone else's ledger entry", you have a receivable, not an asset. If it is "in the same process that parses untrusted input", you have a liability, not a tool.