Open Vault

Is anything on the internet still safe?

On Wednesday morning, the NSA told every organization running PHP to update immediately or take its systems offline. PHP is the language behind roughly 70% of the web. Two critical flaws let attackers seize those servers without a password, and Wiz, the firm that found them with help from AI, says every version released in the past decade is exposed. The choice for much of the internet was simple: patch or go dark.

The attackers didn’t wait. Amazon caught someone trying the exploit four days before a fix existed, and Cloudflare has since fended off millions of attempts. By Friday, security firms Palo Alto Networks and Trail of Bits were reporting confirmed break-ins, and banks, hospitals and some government agencies had pulled servers offline to patch. One researcher estimates more than 1.3 million servers are exposed, and most of them run old versions of PHP that will never get an official fix.

It was not the only alarm this week. Railway, a cloud platform where software companies run their apps, halted every deployment after an intruder decrypted its customers’ secrets. Some of those secrets were the private keys to crypto wallets. The first theft came more than two hours before Railway told anyone what had happened, and one researcher has traced about $371,000 drained so far. In Korea, at least seven banks and lenders have been breached since late September.

Then, on Wednesday afternoon, Microsoft revealed who is behind some of it. A Chinese state-aligned group it calls Storm-0940 has been using ARTEX, an AI hacking tool, to attack hundreds of organizations at once, including financial firms. Public reporting has tied the same tool to the Korean bank breaches. In one campaign, its AI agents tried to break into more than 2,250 corporate cloud accounts at 2,900 login attempts per minute. Some reached privileged access in under three hours. As Microsoft put it, these agents work around the clock, on weekends and on holidays. Finding a serious security flaw once took a skilled researcher about two months. AI now does it in about four hours. This is the internet now.

On Thursday, Axios reported that America’s biggest banks, including JPMorgan, Bank of America and Wells Fargo, are finding AI agents operating inside customer accounts, some taking actions nobody asked for. Most were let in by customers who handed over their own passwords. Bank executives called it horrifying, and one admitted they can’t always tell whether an agent was invited in or has gone rogue. A bank’s front door is a password, and a password is just a secret waiting to be shared, phished or stolen.

Now picture running a bank or a crypto exchange. Your attacker needs to find one door you forgot to lock. You need to find every one of them, across decades of code, every day, forever. Reuters reported that smaller U.S. banks can’t even afford the computing power to scan their own systems with Mythos, Anthropic’s most powerful AI security model, so they wait for the big banks to tell them what’s broken. Our own Finance Ministry and the Bank of Canada have sat down with bank executives to discuss it.

Here is where we believe this goes. Holding other people’s money is about to become prohibitively expensive. Every bank, exchange and custodian must now defend against attackers who work at machine speed, and the cost of that defense will only climb. Some will pass it on to you in fees. Some will cut corners. Many will be hacked, and their customers will lose money.

Every custodian is a honeypot, and AI just made raiding them cheap. The more money a platform guards, the more an attacker can afford to spend breaking in. In September, hackers walked out of the exchange Bitget with $388 million. Less than 0.3% of it has been frozen. The rest is gone.

The platforms that will feel this least are the ones with nothing to drain. A non-custodial exchange sends bitcoin straight to its customers’ wallets and never holds their coins, so there is no pile for an attacker to take. Self-custody turns the math upside down. A million people holding their own keys offer no single vault to crack. An attacker has to find you, then beat you, one wallet at a time, for a sliver of the payoff. AI will find bugs in everything, including the hardware we use to hold our keys, and nobody should pretend otherwise. But the damage is smallest for the person who spreads their keys across devices from different makers and follows best practices. Distributed among millions of hands, bitcoin becomes the hardest target there is.

And then there is Bitcoin itself.

Bitcoin is the biggest prize in the history of the internet. More than a trillion dollars sits on a public ledger that anyone on earth can read and anyone can attack. There is no firewall around it, no security team on call and no one to phone when something goes wrong. Find a way to forge a coin or spend someone else’s, and you would become the richest thief who ever lived, paid out instantly. Every hacker, every nation-state and every AI agent working through the night knows exactly where it is.

Nobody has collected. Every bitcoin ever stolen was lifted from a key stored somewhere weak, never by breaking Bitcoin itself. This week’s Railway thief proved the point: nobody broke a blockchain, they just found keys sitting on someone else’s server.

Instead, the network grows stronger with every block. Bitcoin’s miners now make about a sextillion guesses every second, making it the most powerful computing network ever built, and all of that energy serves one purpose: making the ledger impossible to rewrite. While banks scramble to patch decades-old code, Bitcoin has stood in the open for seventeen years, and its walls get taller every ten minutes.

In an age when everything can be broken, Bitcoin is the one thing that hasn’t been. In an era of uncertainty, it is the most certain thing we have.

Enjoy another Sunday edition ☕

Buy Bitcoin ⚡️

---

*Dollar figures in USD unless CA$ indicated.

🔐  Security

• Patch or go dark. The NSA told every organization running PHP to update or take systems offline. Exploit attempts began four days before the patch, and by Friday security firms were confirming break-ins. NSA, TechCrunch
• Railway’s breach became a crypto heist. An intruder decrypted customer secrets on the cloud platform, and a researcher traced about $371,000 drained from wallets whose keys were stored there. crypto.news, Railway
• AI agents went to work. Microsoft says a Chinese state-aligned group used the AI hacking tool ARTEX against hundreds of organizations, including financial firms, sometimes reaching privileged cloud access in under three hours. The same tool has been tied to the Korean bank breaches. Microsoft
• Banks can’t tell who’s inside. Major U.S. banks are finding unauthorized AI agents in customer accounts, some acting on their own, and several are now blocking them. Axios
• GitLab’s second perfect 10 in two months. An unauthenticated attacker could run code on GitLab servers. Last month’s critical flaw was exploited in the wild. BleepingComputer
• Malware in the training loop. A researcher ran arbitrary programs inside PyTorch’s training process using a loss term that equals zero. Elon Litman

📊  Market

• Everything sold off Thursday. Oil hit a five-month high after new strikes on Saudi targets, the Nasdaq had its worst day since June and silver fell nearly 5%. Bitcoin is trading around CA$112,000. Reuters, Beaver Bitcoin BTC-CAD
• JPMorgan expects bitcoin to return about 10% a year over the next decade, ahead of stocks, bonds and gold. CoinDesk

---

With Beaver you have four ways to buy bitcoin, whether you’re buying for the first time or funding a corporate treasury.

• Instant Buy: from $150 to $25,000+ via Interac®️ e-Transfer
• Large Buy: up to $100,000 via bill pay or bank transfer
• Recurring Buy: fully automated from your bank account
• OTC: for more than $100,000 there’s Beaver Plaid

---

The custodians cannot win this fight. A business built on keeping everyone’s money in one place will always be worth attacking, and the attackers just got hundreds of times faster. The bill will land on customers, either as higher fees or as a notice that their funds are gone.

Bitcoin was built for exactly this world. It is a ledger defended by math and energy instead of firewalls, and money that lives in your hands instead of someone else’s vault.

Holding your own keys is a responsibility, and it can feel heavy at first. But the alternative is trusting your savings to a target that gets bigger and softer every year. The sooner you take custody, the safer you will be.

Beaver is non-custodial by design. When you buy bitcoin with Beaver by Interac e-Transfer, bill payment or wire, it goes straight to a wallet only you control. We never hold your bitcoin, so we are never the honeypot.

Aubrey

---