The House Can Lose

Contribution by Peter

In a casino, winning is perfectly fine. A lovely evening, a bit of luck at the roulette table, and you walk out with more money than you brought in. The croupier hands you your chips with a broad smile, knowing full well that the casino won't lose a wink of sleep over your victory. As long as enough people keep playing, the money flows in on its own. Those are simply the rules of the game.

That's a position Scott Bessent quite likes. Last Tuesday, the US Treasury Secretary spoke at a university in Texas about his edge over currency traders. When the Japanese authorities step in to prop up the yen, he knows pretty well what they're up to. After all, he speaks with them directly. ‘I am the house now’, he said. Anyone who wants to bet against him is welcome to try.

That sounds nicely self-assured, especially coming from someone who spent years making his living trading on financial markets. Yet in Bessent's case, it's a rather amusing remark. He knows from personal experience that the house can most certainly lose.

In September 1992, he was working for George Soros. The British were trying to keep the pound within the agreed limits of the European exchange rate mechanism (ERM). Soros and his associates didn't believe they could hold the line, and placed a huge bet on the currency falling.

They were proven right. On 16 September, the British gave up the defence and pulled out of the mechanism. The position against the pound earned Soros well over a billion dollars and made him famous as the man who brought the Bank of England to its knees. The young Bessent had played a part in that. The house had lost, and he was among the winners.

More than thirty years later, the roles are reversed. Now it's Bessent who has to convince investors that he has the situation under control. That's a trickier trade than pointing out from the sidelines where things are going wrong. As a trader, you can profit from a government's failure. Now he has to persuade investors that his own policy deserves their trust. And however good his information may be, he can't decide for them where to put their money.

Last week gave him a nice little demonstration of that. Interest rates on long-term US government bonds are climbing, which means the government pays ever more when it borrows. Companies and homebuyers feel the pinch of those higher rates too. Bessent is keen to bring them down, and one way he's trying to do so is by buying back existing government bonds.

These buybacks have been going on for a while. The Treasury regularly repurchases older bonds that see little trading, so the market keeps functioning smoothly. But the amounts are growing. In August, the Treasury announced it would raise the cap on such operations for long-term bonds from 2 billion to at least 4 billion dollars. Last Wednesday it emerged that for the next round, up to 6 billion dollars would be available.

That was three times as much as before, yet investors weren't impressed. Major investment banks had been counting on a bigger intervention. Bonds were sold off and the ten-year yield rose to around 4.85 percent. Bessent offered more, and got a higher rate in return.

Perhaps investors understand the situation perfectly well and simply want to be paid better for lending out their money. That's what Bessent's former colleague Stanley Druckenmiller recently pointed out to him: the higher rate is a warning about inflation and large budget deficits. Those problems don't disappear just because the Treasury buys back a few billion in old bonds.

Anyone who declares themselves the house shouldn't be surprised when traders want to find out how much those words are really worth. Somewhere out there is bound to be a young investor doing exactly what Bessent once did: testing how long the government can keep its promise.

It gives extra fuel to the revived ‘debasement trade’: investing in scarce assets such as gold and bitcoin, out of fear that governments will ultimately only be able to keep their debts affordable with cheaper money. Because if interest costs keep rising and cutting spending is politically too painful, how great is the temptation to let the value of money slide?

Debasement trade to take bitcoin to $300,000 in three years, Bernstein says

Bitcoin could soar as the debasement trade comes into focus again, according to Bernstein. That could also boost shares of Strategy.

CNBCLiz Napolitano

Bessent's buyback programme isn't currency debasement in itself. But his struggle does show why that narrative resonates. He has to keep an ever more expensive national debt manageable while investors demand higher interest. Meanwhile, there's nothing he can do about bitcoin's issuance.

More Alpha

Are you a Plus member? Then we're carrying on with the following topics:

1. A setback for Ambitious, and perspective for bitcoin companies
2. In Iran, crypto has simply become money
3. 4k BTC stolen from bitcoin sidechain, after a well-meant bug fix

Below that come the news snacks, a handy overview of the news that really mattered this past week.

1️⃣ A setback for Ambitious, and perspective for bitcoin companies

Contribution by Peter

Ambitious will have pictured its first year rather differently. The company, which grew out of Amdax, wants to go public and use the capital it raises to claim a prominent place in the bitcoin economy. But last Tuesday it had a setback to swallow: the highest administrative court, the CBb, ruled in favour of the AFM. The prospectus for the planned IPO was rightly rejected.

That brings a temporary end to a journey in which the plans themselves also shifted. Ambitious got its start during the summer of the treasury companies, when firms worldwide sprang up like mushrooms with the same promise: stockpile bitcoin and increase the amount of BTC per share. Along the way, the emphasis moved towards doing business with bitcoin. The bitcoin holdings were meant to become the working capital the company could put to work to earn money.

For an entrepreneur, that's an understandable evolution. You start with an idea and refine it as you go. For the regulator, however, that shift touches on a fundamental question: are investors mainly getting bitcoin through your shares, or are they becoming co-owners of a business that needs bitcoin to do its work? Those two directions come with different rules.

Ambitious failed to convince the court sufficiently that it belonged in the second category. Its ambitions to accumulate at least 210,000 bitcoin and to increase the amount of bitcoin per share still weighed against it. The original story kept echoing, however clearly the company now emphasises doing business.

That stings. At the same time, the ruling contains something Ambitious and other entrepreneurs can build on: bitcoin can indeed serve as a business asset, just like real estate or machinery. Holding bitcoin on your balance sheet doesn't automatically make you an investment institution. So in the Netherlands too, there's room to build a listed company around bitcoin.

The challenge is to make that business convincingly visible. Where does the revenue come from, what does the company do to earn it, and what role does bitcoin play in that? Ambitious is considering its next steps. It's still unclear whether the founders want to make another attempt. But the ruling does give them something to work with: more clarity about what they need to show to make their ambition a reality after all.

2️⃣ In Iran, crypto has simply become money

Contribution by Peter

Many people look to the price as the measure of success. Higher prices feel more important than what's happening in the real economy — even though that's where real adoption takes place. In countries where the traditional financial system is creaking at the seams, for example.

Iran is one such place. The country has been largely cut off from international payments for years. Yet oil still has to be sold, iron and steel exported, and companies still need to pay their suppliers abroad. Crypto turns out to be particularly well suited for that.

According to the Financial Times, using crypto for cross-border payments has by now become completely commonplace. The digital dollar USDT is popular, but bitcoin is used too. In 2025, according to data firm TRM Labs, nearly 10 billion dollars in crypto passed through Iran.

For years, the Iranian central bank kept a tight grip on companies' foreign currency. Exporters had to sell their earnings at government-set rates. That system was so unappealing that businesses held tens of billions of dollars outside the official channels.

That attitude is now changing. Traders are being given more and more freedom to decide for themselves what to do with their money. Stablecoins are attractive because their value is pegged to the dollar. Bitcoin has the advantage that no one can simply block transactions or freeze balances. Iran itself has been profiting from bitcoin for years by putting cheap domestic energy to use for mining. Elliptic estimates that the country accounts for 4.5 percent of global bitcoin production.

Slowly but surely, something resembling a parallel financial system is emerging. Out of necessity — and there's a certain irony in that. America is the party pushing Iran towards the fringes of the banking system with sanctions. Trump is also a major advocate of the growth and adoption of cryptocurrency. That message has landed well in Iran.

3️⃣ 4k BTC stolen from bitcoin sidechain, after a well-meant bug fix

Contribution by Erik

On Liquid, Blockstream's bitcoin sidechain, nearly 320 million dollars in bitcoin was siphoned off last week. Not through stolen keys, but by exploiting a bug fix for a problem recently spotted by AI. And the ‘white hat’ hacker who pulled off the exploit turned out to have more than just good intentions.

If I tell you the hack was a form of rangeproof verification cache poisoning, then I surely don't need to explain any further. Right? All right, some extra context: this involved abuse of a consensus layer cache key collision. That makes everything crystal clear.

All joking aside. It's time for plain English.

Liquid makes it possible to move things like bitcoin quickly and confidentially between parties. With such Confidential Transactions, the amount isn't visible to everyone. Yet every node must be able to verify that money isn't secretly being conjured out of thin air.

To do that, Liquid uses so-called rangeproofs: mathematical proofs that establish hidden amounts fall within valid limits, without revealing those amounts themselves.

Verifying such a proof takes computing power. And the same check can come up multiple times: first when a transaction appears in the mempool, later in a block, and then again at the nodes verifying that block.

That's why Elements, the software underpinning Liquid, uses a cache. Once a proof has been approved, the node stores a digital fingerprint of it. If that same fingerprint comes up again, the heavy cryptographic work doesn't have to be redone.

Handy. Until two different things can end up with the same fingerprint.

A bug fix with a new bug

The cache has been around for years. But it turned out to have a flaw: not all the information that determines whether a rangeproof is valid was being factored into the fingerprint.

According to Blockstream boss Adam Back, that flaw was found with the help of AI. This happened during a period in which the Bitcoin Red Team — formed after the major Coldcard hack — was using AI models to comb through hundreds of open-source projects within the bitcoin ecosystem.

Blockstream made a fix. A security release was already shared with members of the Liquid Federation in August; on 1 September the change also appeared publicly on GitHub. That's when it became clear that the bug fix itself contained a lethal bug.

To make the cache safer, extra fields were added to the fingerprint. Only they were simply strung together one after another, without recording where one field ended and the next began.

Think of it like the word ‘pakten’. It could come from ‘pakt’ + ‘en’, but also from ‘pak’ + ‘ten’. The end result looks the same, even though the original components were different.

Security firm SlowMist reconstructed how the situation arose. An attacker could first submit a valid transaction and get the corresponding approval into the cache. Then came a carefully crafted, invalid transaction that produced the same cache key. The node looked into its memory, saw ‘already verified’ there, and skipped the real verification.

And the trick was in that second transaction: nearly 4,000 L-BTC (BTC tokens on Liquid) came into existence for which no bitcoin had been set aside in reserve at all.

‘Return the bitcoin’

On 6 September, the flaw was actually exploited. Through SideSwap, the newly created L-BTC was swapped for almost the same amount of real bitcoin.

So no keys were stolen, and the security of the Liquid Federation's bitcoin wallet wasn't cracked either. The system signed off on a withdrawal that looked valid, and wrongly accepted the L-BTC it was offered as genuine.

The attacker then made contact via messages on the bitcoin blockchain and called themselves a white hat. First fix the bug on all relevant nodes, was the message, after which most of the money would be returned. And indeed: on 7 September, they sent back 3,400 BTC.

The remaining 598.5 BTC stayed put. Not long after, a message followed that fit rather less neatly with the classic definition of responsible disclosure:

“You SHALL pay 10% using your own money as bug bounty.”

On 11 September, Blockstream was done negotiating. The company's message was short: return the bitcoin. According to Blockstream, anyone who takes money without permission and holds part of it hostage until they get paid isn't doing white hat research. That's theft.

Liquid has been producing blocks again since 10 September; the routes for extracting BTC from it remain closed for now.

🍟 Snacks

To wrap up, a few quick snacks:

• Hunter Biden's memecoin LAPTOP crashed almost immediately after launch. The irony is that the memecoin was issued partly as consolation for burned TRUMP investors. The former president's son named the coin after the notorious laptop incident that dogged him for years. After a flying start, the price sank at breakneck speed. Hunter blamed bots and thin liquidity. The political family was different this time, but the outcome was painfully familiar.
• Convincing phishing emails sent in the name of BitBox and Trezor are trying to fool hardware wallet users. The scammers gained access to marketing platform Brevo, which both companies use. From there they could send emails that were barely distinguishable from genuine traffic. As far as is known, the hardware wallets themselves are safe; the danger lies in what the sender asks you to do. Never enter your recovery phrase on a website, no matter how credible the email looks.
• Anyone who dismisses bitcoin as gambling misses its significance. So argues Bloomberg journalist Eric Balchunas on X. He cites a piece by human rights activist Alex Gladstein about saving and paying in countries where currency debasement and frozen bank accounts shape daily life. Balchunas adds an uncomfortable question: financial freedom may seem a given in America, but who guarantees it will stay that way?
• US bitcoin funds in the red after three strong trading weeks. In total, some $460 million flowed out of the funds last week. In the three weeks before that, the funds had actually pulled in $3.8 billion. The picture fits a market cooling off after an explosive rally. Notably, ether funds are showing a different dynamic. Last week too they posted green figures, with nearly $200 million in inflows. BlackRock's fund (ETHA) captured the bulk of that, almost $150 million.
• Latin America's largest internet bank introduces a stablecoin account. Such an account with Nu Global is available worldwide. Deposits are automatically converted to a digital euro (EURC) or a digital dollar (USDC). Customers can make transactions within and between 35 countries. On all stablecoin balances, the bank pays out interest daily, running up to 3.5 percent on an annual basis. In the same breath, Nu announced it is also entering the US market. The bank has more than 140 million customers in total.
• The Clarity Act faces an important test on Tuesday. Will the US crypto bill get enough support to be taken further? Senator Cynthia Lummis presented a revised text on Thursday, including clarifications on oversight of DeFi. This procedural vote requires sixty votes, and therefore also the support of at least seven Democrats. It's unclear whether the latest text addresses their objections. The changes Lummis presented don't tackle the most sensitive issue: conflicts of interest.

Thank you for reading!

To stay informed about the latest market developments and insights, follow our team members on X:

• Bart Mol (@Bart_Mol)
• Peter Slagter (@pesla)
• Bert Slagter (@bslagter)
• Mike Lelieveld (@mlelieveld)

We appreciate your continued support and look forward to bringing you more comprehensive analysis in our next edition.

Until then!