Unchained

Anthropic's AI agents escaped a hacking test and still think they're inside it. Katherine, Jessi, and Vy Le on who's liable when a model breaks free, plus the $100M Coldcard hack and Kalshi's court losing streak.

========================================================

Thank you to our sponsor!

⁠⁠⁠⁠Cape⁠⁠⁠⁠: Your biggest crypto vulnerability isn't your wallet,
it's your phone number. Cape is America's privacy-first mobile carrier
that rotates your SIM identity daily and blocks SIM swaps before they
happen. Get 33% off your first six months at https://cape.co/unchained
(use code: UNCHAINED).

========================================================

Anthropic's AI models broke out of a fake hacking simulation this week, and some still think they're inside it. One agent invented an email address and phone number to pose as a person, then published malware that twelve companies downloaded before anyone caught it.

Katherine Kirkpatrick Bos, Jessi Brooks, and Vy Le use the incident to revisit a theme running through the whole episode: who has a duty to disclose when something breaks, and why crypto and AI are both being left to police themselves.

They start with the Coldcard hardware wallet hack, where a firmware flaw cut seed phrase randomness roughly in half, letting attackers brute-force wallets meant to be unguessable. From there, the hosts turn to Kalshi's losing streak in New York courts and the race among builders to acquire a CFTC-registered designated contract market, before landing on Anthropic's own agents slipping past the guardrails meant to contain them.

Banks have 36 hours to disclose a breach. AI labs and wallet makers, the hosts argue, are still working entirely on the honor system.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Katherine Kirkpatrick Bos⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host of DEX in the City and General Counsel of Chainlink

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Jessi Brooks⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, General Counsel at Ribbit Capital⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Vy Le⁠⁠⁠⁠⁠⁠⁠⁠ - Co-host of DEX in the City and General Counsel of Veda

Timestamps

🩺 02:16 Katherine Kirkpatrick Bos on joining Chainlink Labs

🔐 03:08 How a Coldcard firmware flaw let attackers guess seed phrases with AI

💙 18:32 Cape: Get 33% off six months of privacy-first mobile service at https://cape.co/unchained

⚖️ 19:36 Why Kalshi keeps losing its fight against New York's gambling regulators

🏛️ 30:47 DCM: the CFTC license every prediction market and perps exchange needs

🤖 33:37 Why Anthropic's AI agents escaped a test and still think they're inside it

💧 45:40 Matt Damon's crypto.com ad money and the water.org donation
Learn more about your ad choices. Visit megaphone.fm/adchoices

📢 Bits + Bips has its own channel now — full episodes here: https://www.youtube.com/@Bitsandbips

A firmware bug quietly introduced into Coldcard hardware wallets in 2021 has let attackers drain an estimated 1,600 to 2,000 bitcoin, over $100 million, from cold storage addresses that sat untouched for years.

Galaxy Digital's Alex Thorn has been tracing the exploit in real time, and in this clip he breaks down exactly how the random number generator meant to secure private keys "failed silently" into "way too weak entropy," and lays out the wave-by-wave forensic trail he is using to track the attacker.

Alex Thorn identifies three confirmed attack waves and a possible fourth, and Chris Perkins makes the case that even a "trustless, permissionless" system still requires trusting something, in this case, a hardware wallet's own firmware.

Hosts:

Austin Campbell - Host of Bits + Bips, Founder of Zero Knowledge Group, and Adjunct Professor at NYU Stern

Ram Ahluwalia - Co-host of Bits + Bips and CEO of Lumida

Chris Perkins - Co-host of Bits + Bips and Head of Franklin Crypto

Guest:

Alex Thorn - Head of Research at Galaxy Digital and host of Galaxy Brains

This clip is from a longer conversation on the Coldcard hack, U.S. AI guardrails, and the case for self custody. Full episode here. https://youtu.be/0oYZGw2DSj0?si=TwubhLQ35L8cXyG_

We go live every Monday at 4:30pm ET. Subscribe to catch it live.

👉 Cape: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at https://cape.co/unchained (use code: UNCHAINED).

Chapters

🔐 00:00 Coldcard's reputation as Bitcoin's gold standard hides a deep systemic flaw

🎲 03:42 How a 2021 firmware update let key generation fail silently into weak entropy

🕵️ 09:56 Alex Thorn traces three confirmed attack waves, and a possible fourth

🤝 14:05 'They trusted Coldcard to do the right thing': what broke when a hardware wallet failed
Learn more about your ad choices. Visit megaphone.fm/adchoices

Wall Street's transfer agents want issuers, not outside platforms, to control tokenized stock. Securitize's CEO says the alternative invites insider trading.

========================================================

Thank you to our sponsor!

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Cape⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at cape.co/unchained (use code: UNCHAINED).

========================================================

Securitize took itself public twice this year: once through a direct listing, and once by tokenizing more than $265 million of its own stock via a SPAC with Cantor Equity Partners, testing whether Wall Street lets equities trade onchain.

Carlos Domingo, founder and CEO of Securitize, joins Laura Shin to argue that much of crypto's tokenized stock boom is unauthorized, offshore paper exposing investors and issuers to real legal risk, and to make the case that transfer agents, not outside platforms, should control what gets tokenized.

They cover Rule 611, the SEC rule locking onchain and offchain share prices together, the Securities Transfer Association's push for issuer authorization, and a Netflix stock split that left an unauthorized derivative trading five times off. Domingo also lays out Securitize's NYSE partnership, launching tokenized trading in the fourth quarter.

The SEC is now weighing whether to unwind the rule that keeps those prices identical, with real stakes for how equities trade next.

Host:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Laura Shin⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠, Host / Unchained

Guests:

⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠Carlos Domingo - Founder and CEO of Securitize

Timestamps

🏛️ 01:09 Why Domingo took Securitize public after Circle's IPO opened the door

💹 04:12 Securitize's SPAC: tokenizing over $265M in stock with Cantor Equity Partners

📣 10:10 Cape: Get 33% off your first six months with code unchained at https://cape.co/unchained

🔗 10:24 Why Securitize tokenized SECZ on Solana for trading, Avalanche for lockup

📜 14:51 DTCC entitlement vs onchain shares: what you actually own on Robinhood

⚠️ 16:46 Why owning tokenized versus traditional shares carries real risk

⚖️ 20:53 Why Rule 611 keeps onchain and offchain share prices identical

🧩 28:37 The three models of tokenized equity, and who should authorize them

🚨 34:47 Tom Farley's insider trading warning about unauthorized stock derivatives

🏦 40:10 Why institutions still fear crypto after Celsius, BlockFi, and FTX

🗽 44:02 Inside Securitize's tokenized trading partnership with the NYSE

🪙 50:01 Why Domingo calls Robinhood a partner, not a competitor
Learn more about your ad choices. Visit megaphone.fm/adchoices

📢 Bits + Bips has its own channel now — full episodes here: https://www.youtube.com/@Bitsandbips

Meta and Microsoft reported earnings on the same night, and investors sent their stocks in opposite directions.

Chris Galipeau of the Franklin Templeton Institute walks Steven Ehrlich through why Meta got punished for raising its CapEx guidance while Microsoft's Azure growth held steady, then makes the case that the broader AI CapEx boom is still only in its second inning, not a bubble about to pop.

Host:

Steven Ehrlich - Host, Head of Research at Sharplink - https://x.com/Steven_Ehrlich

Guest:

Chris Galipeau - Head Market Strategist at the Franklin Templeton Institute

This clip is from a longer conversation on Fed policy, Iran, AI earnings, and prediction markets. Full episode here:https://youtu.be/BXWq7OPcm24

We go live every Thursday - subscribe to catch it live.

Cape: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at https://cape.co/unchained (use code: UNCHAINED).

Chapters

🎙️ 00:00 Kicking off the Meta vs Microsoft earnings comparison

📉 00:26 Why Meta landed in the 'penalty box' on CapEx guidance

☁️ 01:25 Microsoft's Azure growth number was 'super strong'

💰 02:41 The FAANG-era CapEx inversion nobody saw coming

📊 03:41 How to actually evaluate a company's balance sheet health

🔄 04:52 The circular financing risk, and Steve's 'incestuous' tech giants question

⚾ 07:24 The baseball analogy: still early innings, and why this isn't a bubble
Learn more about your ad choices. Visit megaphone.fm/adchoices

Privacy is having a moment in crypto. As competition heats up, the pitfalls of the technology around the quantum threat, regulatory risk and more make the trajectory hard to predict.

A counterfeit bug sat undetected in Zcash's Orchard privacy pool for four years, capable of minting an unlimited supply of untraceable coins, illustrating the risks of one of the hottest crazes in crypto.

Joe Andrews, CEO of Aztec Labs, Jarrad Hope, founder of Logos, and Mert Mumtaz, cofounder and CEO of Helius, join Laura Shin to argue the bug is less alarming than what it reveals: cryptographic privacy is difficult to get right, and the industry is racing to get it right anyway, because institutions will not come onchain without it.

They cover Zcash's quantum-recoverable Ironwood upgrade and the turnstile proving the counterfeit coins never moved, Ethereum's sprawling privacy roadmap and the risk it arrives too late, Logos' mixnet built to protect validators from block relays now censoring transactions, and why all three see Canton's private stablecoins as little more than a bank with extra steps.

The fight over what actually counts as privacy on a blockchain is only getting started.

Host

⁠Laura Shin⁠ - Founder, CEO and Host of Unchained

Guest

⁠Joe Andrews - CEO of Aztec Labs

⁠Jarrad Hope - Founder of Logos

⁠Mert Mumtaz - Cofounder and CEO of Helius

Sponsor

⁠Cape⁠: Your biggest crypto vulnerability isn't your wallet, it's your phone number. Cape is America's privacy-first mobile carrier that rotates your SIM identity daily and blocks SIM swaps before they happen. Get 33% off your first six months at ⁠https://cape.co/unchained⁠ (use code: UNCHAINED).

Timestamps:

🔐 01:52 Why Joe, Jarrad, and Mert think privacy's crypto moment is now

💙 18:18 Cape: Get 33% off your first six months with code unchained at https://cape.co/unchained

⚖️ 19:14 Why Jarrad says the weak need privacy and the powerful need transparency

🔬 24:49 How zero knowledge proofs actually update encrypted state onchain

🕸️ 33:07 Why 43.7% of block relays now censor, and how Logos fixes it

🐛 36:32 The undetected Zcash bug that could have minted infinite fake coins

🔒 46:32 Mert explains how Zcash's Ironwood upgrade closes the counterfeit hole

🛤️ 51:44 Why Joe worries Ethereum's privacy roadmap might arrive too late

🏦 57:39 Why Mert calls Canton no more private than trusting JPMorgan
Learn more about your ad choices. Visit megaphone.fm/adchoices