Issue #011 · Week of September 13, 2026

This Week’s Verdict

The novelty this week was watching two very different institutions get robbed with a straight face: Blockstream negotiating a Liquid ransom in the open on-chain, and Revolut couriering customers’ passports to a fraudster who simply asked nicely from a government domain. Meanwhile Anthropic published the confession the industry keeps pretending is hypothetical: its own model is already doing the work. None of this is surprising. It was all priced in the moment we decided convenience and automation were security features.

The Breaches

The headline number is Blockstream’s Liquid exploit. As of Sept. 8, roughly 3,400 BTC had been returned and about 598.5 BTC (~$47M) remained outstanding, with transactions resumed but peg-outs disabled during recovery. What makes this one worth reading the chain for is the venue: the “white hat” framing collapsed into an extortion negotiation conducted publicly via OP_RETURN. Blockstream’s answer was blunt: it is theft, no ransom, and they will bring in law enforcement, exchanges, and forensics. Correct posture. Whether it recovers the last 600 BTC is a separate question from whether paying would have set the going rate for every federation operator watching.

The other real-money event was data, not coin. Revolut fulfilled a fraudulent information request sent from a genuine government agency email domain, exposing passports, selfies, and full Bitcoin transaction histories for a “limited” number of users. ZachXBT speculated the targeting was aimed at high-net-worth users, which is the only rational read: a KYC dossier tying an identity to on-chain activity is a wrench-attack shopping list. The fintech control that failed here was not cryptographic. It was a human trusting a From: header.

For scale, one circulating report tallies $3.63 billion stolen since 2025, with CEXes bleeding through private-key compromise and DEXes through contract exploits and fake UIs. The mix has not changed. The perpetrators have professionalized.

Vulnerabilities Worth Your Attention

  • GitLab CVE-2026-85706 (CVSS 10.0): An unauthenticated path traversal in the repository commits API allowing arbitrary file reads. In-the-wild probing began within hours of disclosure. If you self-host, you were already late when you read this.
  • JFrog Artifactory chain: Attackers chained two flaws to bypass auth, gain admin, and plant a Rust backdoor on self-hosted servers ( Wiz observed activity Aug. 15 to Sept. 8). Patches predated the attacks, so this is a patch-hygiene failure, not a zero-day. Now on CISA’s KEV.
  • Cisco Secure FMC CVE-2026-20079 (CVSS 10.0): Auth bypass exploited by three clusters, including Qilin ransomware operators. Firewall management planes are the keys to the kingdom; treat them accordingly.
  • Check Point VPN (CVE-2026-85102/85103): The Dutch NCSC warns exploitation is imminent. Also newly on KEV: ScreenConnect and MikroTik RouterOS flaws.
  • Trezor / Brevo: A login flaw at email vendor Brevo exposed 347,000 Trezor subscriber addresses; 2,500 users clicked the phishing link. Trezor is treating every address as compromised. Your seed was safe; your inbox was the attack surface.

Threat Actors & Campaigns

The week belonged to Anthropic’s disclosure that threat actors are actively using Claude across the kill chain. It branded them Generative Threat Groups: a Russian state-sponsored cluster (GTG-20006, aligned with Midnight Blizzard) used Claude to rebuild malware after detection; a Russian-speaking operator hit 20-plus organizations; a Mali-based consultant built a mass-surveillance platform. Separately, hackers abused Claude to extract secrets from 1.8 million Android apps, and OpenAI agents were tied to the May RubyGems supply-chain attack that reached RCE on RubyDoc servers. Anthropic also disrupted industrial-scale distillation from seven China-based labs. The through-line: automation cuts the cost of competent attacks, which means more of them, not scarier ones.

Elsewhere, Microsoft detailed passkey- and SSO-themed social engineering by ShinyHunters, Helix, and other extortion crews to breach Microsoft 365 and exfiltrate data, plus a million-message CEO-fraud blast. And North Korea continues staffing the pipeline the old-fashioned way, using third-country IT workers to pass interviews before DPRK operatives take the seat. The passkey angle deserves a note: the phish targets the enrollment and fallback flow, not the credential. Phishing-resistant does not mean social-engineering-resistant.

The Bigger Picture

Macro did the heavy lifting. Hotter-than-forecast core CPI (+0.3% in August) pushed Fed hike odds toward the mid-60s, the 30-year Treasury yield cleared five years of closes, and Brent topped $106. Bitcoin sank below $77,000 before a brief rebound toward $79K; CryptoQuant insists the tape needs to clear $81,700 (and up to $88,700) to confirm a new leg. Bitcoin ETFs shed $449M over three days. Two golden crosses flickered and failed. This is what a market without a bid looks like.

On the structural side, the CLARITY Act returned as Schrödinger’s legislation ahead of a cloture vote, with revised text adding CFTC registration and Bank Secrecy Act obligations for “non-decentralized” trading protocols and confining the DeFi title to spot commodity transactions. Lummis claims 100-plus Democrat-requested changes. Read it as the on-ramp for supervised finance, because that is what it is.

The adoption stories were quieter and more durable: India’s SEBI Demat 2.0 pilot issued $107M in tokenized corporate bonds settled via wholesale CBDC, the opening move on a $620B market. Circle paid $400M for Tazapay’s emerging-market rails. Ripple is pitching RLUSD at corporate treasuries and stuffing AI agents into its own $1B treasury bet. And Bitwise is euthanizing its Dogecoin ETF after ten months and roughly $688K in assets, a tidy reminder that a wrapper does not manufacture demand. Also filed under “priced in”: TRM found that of $52.7M across 198.9M x402 settlements, almost none is actually AI agents spending money. The autonomous-commerce narrative is early. The autonomous-attack narrative, per Anthropic, is not.

Resources

More: Issues · Field Notes · RTFM

New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.