分类： Bitcoin

For a few days in November, a malicious Chrome extension ranked as the fourth result for “Ethereum wallet” on the Chrome Web Store.

The extension, called “Safery: Ethereum Wallet,” looked polished enough to pass as legitimate. It had a clean icon, a generic name adjacent to security language, a flood of five-star reviews, and boilerplate descriptions familiar to anyone who’s downloaded a crypto wallet.

Behind that frontend was a purpose-built attack designed to steal seed phrases and empty user wallets by encoding stolen secrets into micro-transactions on the Sui blockchain.

Socket, a security tooling company focused on open-source software supply chains, installed and analyzed the extension after it was discovered.

Their aim was to understand how “Safery” avoided detection, climbed the Chrome Store rankings, and moved stolen seed phrases without raising alarms, as well as what users could do to spot similar threats. The report walks through the attacker’s approach and serves as both a postmortem and a warning that browser extensions remain a dangerous blind spot in crypto.

This case is noteworthy because the hackers didn’t just steal seed phrases. That part is, unfortunately, well-trodden territory in crypto.

What makes it notable is that Safery didn’t spoof an existing wallet brand. It wasn’t a MetaMask lookalike or a recycled phishing domain. It invented an identity, bought or botted fake reviews to climb search rankings, and launched as a “new” wallet option.

This approach meant the listing showed no immediate red flags: no broken grammar, no odd permissions, and no redirection to shady domains.

The Chrome Web Store publisher page had no prior complaints, and its support URL led to an off-platform site that hadn’t been flagged by security trackers at the time of Socket’s analysis.

Given its polished appearance, most users wouldn’t have hesitated before clicking “Add to Chrome.” The extension asked to run on “all websites,” a common request for crypto wallets that need access to decentralized apps.

Notably, it didn’t prompt for extra permissions or try to inject content scripts that would trigger Chrome’s more aggressive warnings. The branding was minimalist, the website matched the extension’s name, and the setup screen prompted users to create or import a wallet, again, standard behavior.

The seed heist, broadcast over Sui

The real damage began once a seed phrase was entered. Instead of storing the phrase locally or encrypting it for user access, the extension silently split it into fragments and encoded them as what appeared to be random wallet addresses.

Socket’s research shows these fragments were inserted into Sui blockchain transactions. Specifically, the extension issued tiny SUI token transfers, minuscule amounts that would draw no attention, to addresses controlled by the attacker.

Hidden inside those transactions, either in memo fields or obfuscated addresses, were pieces of the user’s seed phrase.

This approach had tactical advantages. It didn’t require the extension to send outbound requests to malicious servers. There was no command-and-control beacon or exfiltration over HTTP or WebSockets that a browser or antivirus might flag.

The payload left the user’s device as a normal-looking blockchain transaction, routed through a widely used, low-fee chain. Once on-chain, the data was publicly accessible, allowing the attacker to retrieve it later, reconstruct the seed phrase, and sweep wallets without touching the user’s device again.

In effect, the scam used the Sui blockchain itself as a communications channel. And because Sui has fast confirmation times and negligible transaction costs, it functioned like a low-latency message bus.

Socket traced multiple examples of these seed-fragment transactions and confirmed the link between seed entry and eventual asset loss. While the thefts occurred off-chain, either on Ethereum or other L1s where the victims’ wallets held funds, the instructions for carrying them out were hidden in plain sight.

Before releasing the version that landed in Chrome’s top wallet results, the publisher likely tested this method in private. Evidence shows earlier builds experimented with simpler data leaks before the Sui encoding was refined.

By the time the active extension was flagged, it had enough installs to reach Chrome’s “trending” tier, further boosting its visibility. Brave New Coin reported that the “Safery” wallet sat among the top results for “Ethereum wallet” searches even as reports of suspicious behavior circulated on Reddit and Telegram.

How the Chrome algorithm let it happen

The success of “Safery” hinged on Chrome’s ranking logic. The Web Store search algorithm weighs keyword match, install count, review velocity, average rating, and update recency.

Extensions with a burst of activity, especially in niche categories, can climb rapidly if better-vetted competitors aren’t updated frequently. In this case, “Safery” had a name that scored well for common queries, a blitz of positive reviews, many templated or duplicated, and a fresh upload date.

No evidence shows that Google manually reviewed this listing before publication. Chrome Web Store policy treats most new extensions with a brief automated scan and fundamental static analysis.

Extensions undergo deeper scrutiny when they request elevated permissions, such as access to tabs, clipboard, file systems, or history. Wallet extensions often avoid these flags by operating within iframes or using approved APIs. “Safery” stayed within those bounds.

Even when users raised concerns, the time between reporting and takedown stretched long enough for damage to occur. Part of that lag is structural: Chrome doesn’t act on flagged extensions instantly unless there’s an overwhelming consensus or known malware signatures.

In this case, the payload was obfuscated JavaScript that relied on blockchain infrastructure, not external hosts. Traditional malware detection methods didn’t catch it.

This isn’t the first time Chrome extensions have been used to steal crypto. Previous scams include fake Ledger Live apps that prompted users to enter recovery phrases, or hijacked legitimate extensions that allowed attackers to access the developer’s publishing key.

What makes “Safery” different is the smoothness of the facade and the absence of backend infrastructure. There was no phishing site to take down, no server to block, just one extension moving secrets onto a public chain and walking away.

Users still had some recourse. If they acted quickly, they could limit exposure by rotating seeds and revoking transaction approvals.

Socket and others provided triage steps for anyone who installed the extension: uninstall immediately, revoke any token approvals, sweep assets to a new wallet using a clean device, and monitor associated addresses. For users who didn’t notice the exfiltration or who stored large amounts in hot wallets, recovery remained unlikely.

The real trouble begins before the wallet ever loads

Security researchers and developers are calling for stronger heuristics from Chrome itself. One proposed solution is to automatically flag any extension that includes UI elements prompting for a 12- or 24-word phrase.

Another approach is to require publisher attestation for wallet extensions, which provides verifiable proof that a given publisher controls the codebase behind a known wallet brand. There are also calls for tighter inspection of wallet-related permissions, even when those don’t include dangerous access patterns.

For end users, Socket published a practical checklist for extension management. Before installing any crypto extension, users should review the publisher’s history, verify association with a known project, inspect the review pattern, especially bursts of identical reviews, check for real website links with public GitHub repositories, and scan the permissions tab for vague or sweeping access.

A clean name and high rating aren’t enough.

This case raises broader questions about the browser’s role in crypto. Browser wallets gained popularity due to accessibility and ease of use. They enable users to interact with decentralized applications without switching platforms or downloading separate apps.

But that accessibility has come at the cost of exposure. The browser is a high-risk environment subject to extension manipulation, session hijacking, clipboard scrapers, and now covert blockchain exfiltration.

Wallet developers are likely to rethink distribution models. Some teams already discourage Chrome Web Store installs, preferring mobile apps or desktop binaries. Others may build warnings for users attempting to install from unverified sources.

The core problem remains: distribution is fragmented, and most users don’t know how to distinguish a legitimate wallet from a polished clone.

The “Safery” extension didn’t need to look like MetaMask or masquerade as Phantom. It created its own brand, seeded fake trust signals, and built an invisible backdoor that used the Sui blockchain as a courier.

That should force a rethink of how trust is established in crypto UX, and how close to the metal even casual tools like browser extensions really are.

Crypto users assume Web3 means sovereignty and self-custody. But in the wrong hands, a browser wallet isn’t a vault, it’s an open port. And Chrome won’t always warn you before something slips through.

For a while, owning Bitcoin was professionally awkward. Big asset managers couldn’t touch it, compliance teams didn’t know what to do with it, and internal mandates typically banned the direct custody of anything that looked like a bearer instrument.

But equities? Equities were fine. That’s how MicroStrategy, a Virginia-based enterprise software firm, became the most traded Bitcoin proxy in the US equity market.

After CEO Michael Saylor pivoted the entire company into a Bitcoin holding vehicle in 2020, institutional desks began buying MSTR not for its software solutions, but for its balance sheet.

The trade was about finding a liquid, listed, regulator-recognized asset that let you get Bitcoin exposure on your books without the hassle of actually holding it.

That trade worked for four years. Saylor issued convertible notes, bought billions in BTC, and amplified shareholder exposure well beyond spot.

MSTR became the shadow ETF that Wall Street wasn’t allowed to buy. And the demand was real: at one point, MSTR traded at a 2× premium to its net Bitcoin per share.

The company leaned into it. “We’re a leveraged long Bitcoin operating company,” Saylor said in 2021. Some analysts even stopped modeling software revenue altogether when analyzing MicroStrategy’s performance.

Many allocators treated MSTR as a synthetic Bitcoin play. The logic was: direct Bitcoin access remained constrained, but here was a stock whose fortunes were tightly linked to Bitcoin’s.

That arrangement worked until it didn’t.

The great unwind of Q3

Between the end of Q2 and the end of Q3 2025, institutional portfolios decreased their marked paper exposure in MSTR by approximately $5.38 billion, based on aggregated filings (from ~$36.32 billion to ~$30.94 billion). That represents a drop of ≈14.8% in institutional paper value held.

This wasn’t a markdown. Bitcoin remained relatively steady throughout the quarter at around $95,000, even peaking above its new ATH of $125,000 at one point.

MSTR traded mostly sideways during the period, hovering near $175. This kind of price stability effectively rules out forced selling and deleveraging as primary drivers. There was no wipeout event to blame this on.

This means the exposure vanished because institutions actively took it off.

Major fund managers, including Capital International, Vanguard, BlackRock, and Fidelity, each trimmed over $1 billion in exposure or close to it. The reduction spans the institutional ladder, not just fringe players.

In aggregate terms, it’s a 14.8% reduction in value across the board. That may not sound catastrophic, but in dollar terms it is meaningful, and structurally it marks a pivot.

How big is “big”? Framing the number

A $5.3 billion reduction needs context. On the one hand, it’s large. Even for Wall Street, where hundreds of billions of dollars change hands every day, it’s enough to move the needle.

On the other hand, it’s modest relative to total institutional holdings of MSTR, which topped $31 billion at the end of Q3.

Imagine a fund with $100 billion in assets deciding to retreat by $15 billion from a trade; the move is visible, but the exposure remains. That’s the state of MSTR: still widely held, still relevant, but no longer unique or immune.

Expressed differently: if you owned $100 of institutional MSTR exposure at the end of Q2, you would hold about $85.20 at the end of Q3. If you held $1 billion, you would be down to ~$852 million in exposure.

The drop matters because it signals shifting conviction.

But the trade is far from vanished. It looks more like institutions quietly exploring alternatives.

Historical context reinforces the point. In 2021, when Bitcoin hit earlier peaks and volatility reigned, MSTR boasted premiums of nearly 2× its net Bitcoin holdings per share.

That gap has since compressed. In that light, the Q3 reduction marks a transition from scarcity-driven premium to choose-your-route flexibility.

New variables: Bitcoin’s Q4 dip and what comes next

In Q4, the table has changed. Bitcoin has retreated from recent highs. Another pause or pullback in Bitcoin may present a test for MSTR’s remaining holders.

Bitcoin remaining below $90,000 for a while would expose the leverage embedded in MSTR: corporate debt, equity dilution risk, and software results overshadowed by treasury holdings.

However, if Bitcoin finds support at $100,000 or higher, MSTR could retain its appeal as a Bitcoin-enhanced vehicle.

If Bitcoin moves higher again, companies might decide to reverse course and increase MSTR exposure. On the flip side, touching $80,000 will likely prompt an even larger reduction in MSTR exposure.

Either scenario suggests Q4 filings could show a reduction or a return to previous levels of MSTR exposure, but most likely no increase compared to Q2.

Why the shift matters

This change matters for more than just the companies involved. It marks a milestone in how mature Bitcoin exposure has become.

For a while, MSTR served as a workaround for Wall Street. Now, that pathway has become mainstream with both institutions and retail active in MSTR trading.

Spot Bitcoin ETFs and other regulated custody solutions mean large portfolios can now hold BTC without the equity-wrapper compromise. As institutional strategies evolve, assets like MSTR stop being essential and start being optional.

The implication is twofold for retail. First, the fact that institutions are rethinking the proxy trade is validation that Bitcoin access has entered a new phase. If allocators feel comfortable holding Bitcoin directly, that signals deeper structural acceptance.

Second, MSTR likely shifts in role: rather than being the go-to way to hold Bitcoin, it may become a tactical hedge or leveraged play.

MSTR is still enormous. More than $30 billion in institutional market exposure remained at the end of Q3.

The company is far from redundant, but its monopoly on institutional Bitcoin access is over.

For investors who still believe in Bitcoin long-term and are comfortable with corporate wrapper risk, MSTR remains a viable option. For those seeking pure Bitcoin exposure without the corporate overlay, the path has broadened.

The proxy era has transformed. The 14.8% reduction in institutional value held in MSTR matters because it reflects a change in mindset, not a mass exodus.

For Bitcoin, it’s a marker of maturation. For MSTR, it’s a pivot in role. For the market, it’s the quiet next act in the story of institutional crypto adoption.

In 2019, Rodolfo Novak sent a Bitcoin transaction from Toronto to Michigan without internet or satellite. He used a ham radio, the 40-meter band, and the ionosphere as his relay.

Nick Szabo called it “Bitcoin sent over national border without internet or satellite, just nature’s ionosphere.” The transaction was tiny, the setup finicky, and the use case borderline absurd.

Yet, it proved something: the protocol doesn’t care what carries its packets.

That experiment sits at one end of a decade-long stress test the Bitcoin community runs quietly in the background, a distributed R&D program testing whether the network can function when the usual infrastructure fails.

Satellites broadcast blocks to dishes across continents. Mesh radios relay transactions across neighborhoods without the need for ISPs. Tor routes traffic around censors. Ham operators tap out hexadecimal over shortwave.

These aren’t production systems. They’re fire drills for scenarios most payment networks treat as edge cases.

The question driving it all: if the internet fragments, how fast can Bitcoin come back online?

Satellites give Bitcoin an independent clock

Blockstream Satellite broadcasts the full Bitcoin blockchain 24/7 via four geostationary satellites covering most populated regions.

A node with an inexpensive dish and a Ku-band receiver can sync blocks and stay in consensus even if local ISPs go dark.

The system is one-way and low-bandwidth, but it solves a specific problem: during regional blackouts or censorship, nodes need an independent source of truth for the ledger state.

The satellite API extends this further. Anyone can uplink arbitrary data, including signed transactions, from ground stations for global broadcast. goTenna partnered with Blockstream to let users compose transactions on offline Android phones, relay them via local mesh, then hand them to a satellite uplink that broadcasts without touching the wider internet.

The bandwidth is terrible, but the independence is absolute.

This matters because satellites provide an “out-of-band” channel. When regular routing fails, nodes scattered across different continents can still receive the same chain tip from space, providing a shared reference point for rebuilding consensus once terrestrial links return.

Mesh and LoRa build Bitcoin backhaul at human scale

Mesh networks take a different approach: instead of broadcasting from orbit, they relay packets device-to-device across short hops until one node with internet access rebroadcasts to the broader network. TxTenna, built by goTenna, demonstrated this in 2019.

Users send signed transactions over a mesh network from offline phones, hopping node to node until reaching an exit point. Coin Center documented the architecture: each hop extends reach without requiring any participant to have direct internet access.

Long-range LoRa mesh pushes this concept further. Locha Mesh, started by Bitcoin Venezuela, builds radio nodes that form an IPv6 mesh over license-free bands.

The hardware, Turpial and Harpia devices, can carry messages, Bitcoin transactions, and even block sync over several kilometers without an internet connection.

Tests in disaster zones proved successful crypto transactions across multi-hop networks where cellular and fiber were both down.

Darkwire fragments raw Bitcoin transactions into small packets and relays them hop-by-hop over LoRa radios. Each node reaches roughly 10 kilometers of line of sight, turning a neighborhood of hobbyist radios into ad hoc Bitcoin infrastructure.

Urban range drops to a 3 to 5 kilometers range, but that’s enough to route around localized outages or censorship chokepoints.

Academic projects like LNMesh extended this logic to Lightning Network payments, demonstrating offline micropayments over local wireless mesh during power outages.

The volumes are small and the setups fragile, but they establish the principle: Bitcoin’s physical layer is fungible. As long as there exists a path between the nodes, the protocol functions.

Tor and ham radio fill the gaps

Tor represents the middle ground between the regular internet and exotic radio. Since Bitcoin Core 0.12, nodes automatically start a hidden service if a local Tor daemon is running, accepting connections via .onion addresses even when ISPs block known Bitcoin ports.

The Bitcoin Wiki and Jameson Lopp’s setup guides document dual-stack configurations in which nodes route traffic over both clearnet and Tor simultaneously, complicating efforts to censor Bitcoin traffic at the ISP level.

Experts warn against running nodes exclusively over Tor due to eclipse-attack risks, but using it as one routing option among several substantially raises the cost of blocking Bitcoin infrastructure.

Ham radio sits at the far end of the spectrum. Beyond Novak’s ionosphere experiment, operators have relayed Lightning payments via amateur radio frequencies.

These tests involve manually encoding transactions, transmitting them over HF bands using protocols like JS8Call, then decoding and rebroadcasting on the other side.

The throughput is laughable by modern standards, but the point isn’t efficiency. The point is demonstrating that Bitcoin can move across any medium capable of carrying small data packets, including ones that predate the internet by decades.

What a global partition actually looks like

Recent modeling explores what happens during a prolonged global internet outage.

One scenario splits the network into three regions, Americas, Asia-Pacific, and Europe-Africa, with roughly 45%, 35%, and 20% of hash rate, respectively.

Each partition’s miners continue producing blocks while adjusting the difficulty independently. Local exchanges build their own fee markets and order books on diverging chains.

Within each partition, Bitcoin continues working. Transactions confirmed, balances updated, local commerce proceeds, but only within that island. Cross-border trade freezes. When connectivity returns, nodes face multiple valid chains.

The consensus rule is deterministic: follow the chain with the most cumulative proof of work. Weaker partitions are reorganized, and some recent transactions are removed from global history.

If the outage lasts hours to a day and the hash distribution isn’t wildly skewed, the result is temporary chaos followed by convergence as bandwidth returns and blocks propagate.

Prolonged outages create the risk that social coordination will override protocol rules, exchanges, or that large miners will choose their preferred history. Still, even that remains visible and rule-bound in ways that traditional financial reconciliation is not.

Banks don’t have fire drills for this

Contrast that with what happens when payment infrastructure breaks. TARGET2’s 10-hour outage in October 2020 delayed SEPA files and forced central banks to manage liquidity and collateral manually.

Visa’s Europe-wide failure in June 2018 saw 2.4 million UK card transactions fail outright and ATMs run dry within hours after a single data center switch died.

The ECB’s TARGET system suffered another major outage in February 2025, prompting external audits after backup systems failed to activate.

IMF and BIS documentation on CBDC and RTGS resilience explicitly warns that large-scale power or network outages can simultaneously hit primary and backup data centers, and that centralized payment systems require complex business-continuity planning to avoid systemic disruption.

The architectural difference matters. Every Bitcoin node holds a full copy of the ledger and validation rules.

After any outage, as soon as it can communicate with other nodes, via satellite, Tor, mesh, or restored ISP, it simply asks: what’s the heaviest valid chain?

The protocol defines the resolution mechanism. No central operator reconciles competing databases.

Banks depend on a layered, centralized infrastructure comprising core banking ledgers, RTGS systems such as Fedwire and TARGET, card networks, ACH, and clearinghouses.

Recovery involves replaying queued transactions, reconciling mismatched snapshots, sometimes manually adjusting balances, then bringing hundreds of intermediaries back into sync.

Visa’s 2018 outage took hours to diagnose despite a full-time operations team. The ECB’s TARGET incidents required external reviews and multi-month remediation plans.

Bitcoin practices for worst-case scenarios

So, in a crisis, a plausible scenario emerges: a subset of miners and nodes stays synchronized via satellite and radio, maintaining an authoritative chain tip even as fiber and mobile networks fail.

As connectivity returns in patches, local nodes pull missing blocks and reorganize to that chain within minutes to hours.

Meanwhile, banks figure out which payment batches settled, reschedule missed ACH files, and wait for RTGS systems to complete end-of-day reconciliation before reopening fully.

This doesn’t mean Bitcoin “wins” instantly. Card rails and cash still matter for consumers. But as a global settlement layer, it might reach a consistent state faster than a patchwork of national payment systems, precisely because it’s been running continuous fire drills for world-scale failure modes.

The ham operators tapping out transactions over shortwave, the Venezuelan mesh nodes routing sats across blackout neighborhoods, the satellites broadcasting blocks to dishes pointed at the sky, and these aren’t production infrastructure.

They’re proof that when the usual pipes break, Bitcoin has a Plan B. And a Plan C. And a Plan D that involves the ionosphere.

The banking system still treats infrastructure failures as rare edge cases. Bitcoin is treating it as a design constraint.

Coinbase spent 2025 positioning itself as the infrastructure layer for retail crypto access, absorbing teams and technology that could accelerate its “everything exchange” vision.

A Nov. 21 announcement that it acquired Vector.fun, Solana’s fastest-moving DEX aggregator, fit the pattern: acquire the rails, sunset the product, integrate the speed.

But the deal carved out an unusual exception.

While Coinbase takes Vector’s team and infrastructure, the Tensor Foundation retains the NFT marketplace and the TNSR token. Token holders keep their governance rights but lose the asset that justified the token’s existence.

The separation raises a question: if equity holders capture value from acquisitions while token holders get stripped of core assets with no compensation, why buy tokens from Coinbase’s platforms at all?

TNSR traded at $0.0344 on Nov. 19, down 92% year-to-date. By Nov. 20, it peaked at $0.3650, an 11-fold gain in 48 hours.

Volume spiked from months of sub-$10 million days to $735 million on Nov. 19, then $1.9 billion on Nov. 20. As of Nov. 21, TNSR dumped 37.3% in 24 hours to $0.1566, logging $960 million in selling volume.

The pattern suggests a classic front-running: someone knew, someone bought, and retail arrived late.

The logic behind stripping Vector from Tensor

Coinbase framed the acquisition as a bet on Solana infrastructure. Per the announcement, Solana DEX volume already topped $1 trillion in 2025, and Vector’s technology identifies new tokens the moment they launch on-chain or through major launchpads.

That speed matters for Coinbase’s DEX trading integration, which needs to compete with native Solana apps that onboard users directly into high-velocity trading.

But Vector wasn’t a standalone product. It was Tensor’s consumer-facing play, designed to drive utility for TNSR and channel liquidity back to the NFT marketplace.

Separating the two makes sense only if Coinbase wanted the infrastructure without the governance entanglements of holding or backing a token.

By leaving TNSR with the Tensor Foundation, Coinbase avoids regulatory exposure while extracting the operational layer that made Vector valuable.

Token holders are left with a governance token for a marketplace that just lost its most promising growth driver.

Omar Kanji, investor at Dragonfly, framed the disconnect bluntly:

“Some serious dissonance between Coinbase ‘coining’ everything and paying token holders ‘nothing’ in their Vector acquisition. TNSR token holders just had their best asset stripped and got ~$0 in return. If this continues, people will just stop buying tokens.”

The comment speaks to a larger friction in crypto’s dual-class system. Equity investors in Coinbase capture the upside when the company acquires technology. Meanwhile, token holders in projects like Tensor are forced to absorb asset stripping without a seat at the negotiation table.

The infrastructure that makes separation possible

Account abstraction and modular blockchain architecture let companies slice products into components and acquire only the pieces they need.

Vector’s infrastructure sits between on-chain liquidity sources and user interfaces, routing trades across automated market makers, order books, and liquidity pools.

Coinbase can plug that routing layer into its DEX integration, rebranding the experience as native functionality while discarding Vector’s consumer app.

Solana’s sub-second finality and low transaction costs let aggregators like Vector process thousands of trades per second. That speed matters for meme token launches and NFT mints, where price discovery happens in minutes.

Coinbase now controls that speed advantage, which it can deploy to compete with Raydium, Orca, and Jupiter for retail order flow on Solana.

The Tensor Foundation keeps the NFT marketplace, a slower-moving, out-of-the-narrative, lower-margin business that Coinbase likely sees as non-core.

What breaks if this becomes the norm

If token holders consistently get stripped of assets during acquisitions, the incentive to hold governance tokens collapses. Tokens become short-term bets on hype cycles rather than long-term stakes in protocol value.

Jon Charbonneau, co-founder of investment firm DBA, pointed out the reputational cost:

“Harder for Coinbase to sell their new ICO platform when they set the precedent of tokenholders getting rugged on Coinbase’s own acquisitions. As an active buyer of ICO launches right now, it gives me more questions doing due diligence on ICO tokens from them versus other platforms that walk the walk themselves.”

The front-running pattern compounds the problem. TNSR’s $1.9 billion volume spike on Nov. 20, one day before the announcement, suggests information leaked.

The largest daily volume TNSR recorded in 2025 before Nov. 19 was $83.7 million on Mar. 10. The 25-fold increase in volume doesn’t happen organically.

Someone likely bought ahead of the news, and retail traders who chased the pump absorbed the exit liquidity when the announcement hit.

Regulatory scrutiny around crypto insider trading remains inconsistent, but the optics could damage Coinbase’s positioning as the clean, compliant onramp for institutional capital.

The company spent years distancing itself from offshore exchanges that operate with looser disclosure standards. If its acquisitions now trigger the same front-running patterns that define pump-and-dump schemes, the distinction blurs.

What this means for token launches and platform credibility

Coinbase plans to expand its token listing infrastructure, positioning itself as the primary venue for new asset launches in US markets. The Vector acquisition undermines that pitch.

If developers and early investors know that Coinbase will acquire their technology while leaving token holders with depreciated governance rights, they can structure deals to favor equity over tokens.

That shifts capital formation away from decentralized models and back toward traditional venture-backed structures, where equity holders control exits and token holders provide liquidity without representation.

The alternative would require Coinbase to compensate token holders during acquisitions, either through token buybacks, equity conversion, or direct payouts. None of those options is simple.

Buybacks could trigger securities law concerns. Equity conversion would require treating tokens as investment contracts, which Coinbase avoids for regulatory reasons.

Direct payouts would set a precedent that every acquisition must include token consideration, limiting Coinbase’s flexibility to cherry-pick infrastructure without governance baggage.

Every token launch on Coinbase’s platform now carries the implicit risk that the company will later acquire the underlying project, extract the valuable assets, and leave token holders with depreciated governance rights.

If Coinbase wants to dominate token launches, it needs a better answer than “equity holders benefit, token holders don’t.” The Vector deal proves it doesn’t have one yet. The market will decide whether that matters.

Younger, wealthier Americans seem to be rewriting the house rules of wealth management.

They like broad equity indices. They park cash in T-bills. They still buy real estate and private deals. But they also expect to see Bitcoin, Ethereum, and a handful of other digital assets on the same dashboard as everything else.

For them, crypto is a normal slice of a portfolio. For many of their advisors, though, it’s still a compliance headache and a career risk.

That gap between young investors and advisors is there, and it’s getting wider every day. Zerohash’s new “Crypto and the Future of Wealth” report surveyed 500 investors aged 18–40 in the US with household incomes ranging from $100,000 to over $1 million.

Most of them already work with a financial advisor or private wealth manager. Yet when it comes to crypto, a big chunk runs a separate stack of apps, exchanges, and wallets because their advisory firm either can’t or won’t touch it.

Tens of trillions will flow from older Americans to younger heirs and charities over the next two decades. The people set to receive that capital already treat a 5–20% crypto allocation as usual, and they’re now benchmarking advisors on whether they can underwrite that reality without blowing up fiduciary duty, tax planning, or basic cybersecurity.

The decision younger wealthy clients have to make is simple: if you won’t manage the part of my portfolio I care most about, I’ll find someone who will.

The demand signal Wall Street tried to pretend wasn’t there

The numbers from Zerohash’s survey are blunt: around 61% percent of affluent 18–40-year-olds already hold crypto. That share climbs to 69% among the highest earners in the sample, and most don’t see crypto as a fun lottery. Among high-income investors, 58% put 11–20% of their portfolios into digital assets.

For all of them, crypto sits in the same mental bucket as real estate and core equity funds, not as a side bet. The study notes that 43% of young investors allocate 5–10% of their portfolios to crypto, 27% allocate 11–20%, and 11% allocate more than 20%. Zerohash also adds that 84% of crypto holders plan to increase those allocations over the next year.

Those are the numbers for the demand side.

On the supply side, the advisory channel is basically a ghost town. The survey showed 76% of crypto holders invest independently, outside their brokerage or wealth management firm. Only 24% hold crypto through an advisor at all.

These are not your BTC maximalists living in cold storage; these are people who already pay a basis-point fee for advice and still feel they have to run a separate portfolio in another browser tab.

Their money is already moving, as 35% percent of all affluent investors in the sample say they have shifted assets away from advisors who do not offer crypto.

Among the top-earning group on $500,000 to over $1 million, that share jumps to 51%. More than half of those who left moved between $250,000 and $1 million per head.

And yet, the same dataset shows how easy it would be for wealth managers to keep these clients. About 64% of respondents say they would stay with an advisor longer or bring more assets across if that advisor provided crypto access; 63% say they would feel more comfortable investing through an advisor if digital assets sat on the same portfolio dashboard as their stocks and bonds.

The main takeaway is that the bar for advisors is very, very low. The bar isn’t “become a crypto hedge fund,” but “recognize this asset class exists and can be held inside the same reporting stack.”

Layer this on top of the Great Wealth Transfer, and the stakes get very large, very fast. Cerulli and RBC estimate that total wealth moving from older Americans to younger generations and charities will be in the $84–$124 trillion range through the 2040s.

That wall of inheritance and business proceeds is drifting toward cohorts who already treat crypto as a regular part of their portfolio.

The advisory machine is built for everything except on-chain

If the demand is this clear, why do so many advisors still default to “we can’t touch that”?

Part of the answer sits in product design. For a long time, the only way an advisory firm could get crypto exposure into a model portfolio was through weird closed-end funds, trust structures, or offshore vehicles nobody wanted to explain in a compliance exam.

Even now, with spot Bitcoin and Ethereum ETFs out in the wild, many RIAs and broker-dealers treat those tickers as curiosities.

Then there is the paperwork. Investment Policy Statements written in the past 10 years often lump Bitcoin into “prohibited speculative instruments” alongside penny stocks and options. Changing that language takes committee meetings, E&O reviews, and legal memos. The path of least resistance for a mid-level compliance officer is usually to write “not approved at this time.”

Underneath that sits custody law. Under SEC rules, registered advisers need to hold client funds and securities with a “qualified custodian,” which usually means a bank, broker-dealer, or similar institution that meets strict safeguards.

For years, crypto didn’t fit neatly into those boxes, and the coveted SAB 121 (Staff Accounting Bulletin 121) made life even more complicated by forcing public banks that held digital assets to record matching liabilities on their balance sheets.

That logjam has started to clear. In early 2025, the SEC rolled out new guidance and no-action relief that made it easier for state-chartered trust companies to serve as qualified crypto custodians, effectively retiring SAB 121. The regulatory stack might still look like uncharted waters for many, but it no longer treats digital assets as radioactive waste.

However, on the ground, a new cast of partners is rushing into the gap. Fidelity Crypto for Wealth Managers offers custody and trade execution through Fidelity Digital Assets, wired directly into the same Wealthscape interface that an RIA already uses for stocks and bonds.

Eaglebrook Advisors runs model portfolios and SMAs focused on BTC and ETH for wealth managers, with portfolio reporting and billing wired into standard RIA systems. BitGo has built a platform aimed at wealth management that ties qualified custody to a TAMP-style overlay.

Anchorage Digital pitches itself as a regulated digital asset custodian with reporting, reconciliation, and governance controls explicitly designed for RIAs.

On paper, a mid-sized advisory shop could now bolt on a crypto sleeve with partners it already recognizes from the institutional world. But in practice, the pipes inside many firms are still stuck in the last cycle. OMS and PMS systems do not always know what to do with staking yield. The billing logic struggles with on-chain positions.

So advisors do something they know how to do: they stall.

The structural gap shows up in the Zerohash numbers around behavior: 76% of crypto holders in the survey buy and manage their digital assets independently. That means they already know how to move funds through exchanges, hardware wallets, and on-chain apps. For that cohort, advisors become essentially useless for buying Bitcoin, Ethereum, or any other number of coins ranging from XRP to DOGE. Their value lies in tax, estate, and risk engineering for something the client has already done.

This is where the “crypto-competent advisor” idea matters. A serious under-40 client today doesn’t care if their advisor can quote the Nakamoto consensus section of the Bitcoin whitepaper. They care about whether that advisor can:

• Translate a 5–15% BTC/ETH sleeve into an IPS that an investment committee and E&O carrier can live with.
• Set boundaries for rebalancing so the position doesn’t silently swell to 40% in a bull run.
• Decide when to use ETFs for ease of tracking and when to hold coins directly for long-term conviction or on-chain activity.
• Map these holdings into estate plans, including how heirs inherit multisig or hardware wallets without locking themselves out.

None of that is science fiction anymore. It’s just regular old financial advisor work. And it’s work that younger, wealthier investors have begun using as a scorecard.

Follow the assets

Zerohash’s survey shows a slow-motion run on legacy investment platforms.

Start with the top-line: 35% of affluent investors in the 18–40 bracket have already moved assets away from advisors who do not provide crypto access. Among the highest-earning slice, that share is 51%. More than half of those who left had household incomes between $250,000 and $1 million.

Put that into revenue terms. A $750,000 account billed at 1% is $7,500 per year. Lose ten of those relationships because you cannot stomach a 5–10% Bitcoin sleeve, and you have burned through the equivalent of a junior advisor’s salary. Lose fifty and you are into “we used to have an office in that city” territory.

The path usually looks something like this:

First, the client opens a self-directed account or a mobile app to get exposure while their advisor waffles. They buy the spot BTC ETF or a mix of coins on a mainstream exchange.

Then, as that bucket grows and starts to feel real, they go shopping for someone who can treat it as part of a serious balance sheet.

Crypto-focused RIAs and multi-family offices have picked up that brief, from DAiM in California to new arms like Abra Capital Management.

Along the way, TikTok, YouTube, and Discord serve as the new discovery layer. A creator walks through how they run a 60/30/10 portfolio with T-bills, index ETFs, and a BTC/ETH sleeve. A podcast brings on a family office CIO who talks casually about budgeting 5% for digital assets. The message lands: if your advisor cannot even discuss this, others will.

Culture becomes distribution. The golden aura around mahogany offices, golf club memberships, and brand-name wirehouses sits alongside a screen showing real-time P&L for a Coinbase or Binance account.

For clients under 40, trust is starting to look like proof-of-reserves, qualified custody, hardware wallets, 2FA, and the ability to see everything in one portal, not just a logo they grew up seeing on CNBC.

The Zerohash survey backs this up: 82% percent of respondents say that moves by names like BlackRock, Fidelity, and Morgan Stanley into digital assets make them more at ease with crypto in advisory portfolios. This is brand halo used in a new way: not to sell the firm’s own stock-picking skill, but to validate a new asset class they already hold.

The portfolio design underneath all this is boring in the best way. Most affluent young investors in the survey sit inside a barbell: treasuries and broad indices on one side, a 5–20% crypto sleeve on the other, and some private deals or real estate sprinkled in between.

They are not trying to reinvent modern portfolio theory. They are just adding one more risk bucket, then asking why the person who manages everything else in their life cannot help them manage this one.

What does a “crypto-competent” advisory practice look like?

On the policy side, it lists Bitcoin and Ethereum as permitted assets in the IPS, subject to a defined cap, with clear language on liquidity events, rebalancing bands, and concentration limits.

On the product side, it offers a simple menu: spot ETFs for clients who care about convenience and easy tax reporting; direct coins with institutional custody for those who want on-chain access; minimal alt exposure, if any, and only in products that clear compliance checks.

On the operations side, it chooses partners who plug into existing reporting and billing systems: perhaps Fidelity Crypto for custody and execution, Eaglebrook or Bitwise strategies inside model portfolios, Anchorage or BitGo for more advanced clients who need governance features and staking.

And it works on cybersecurity: how to talk about hardware wallets, key backups, SIM-swap risk, and what happens if a client loses access.

On the human side, it stops treating crypto questions as a nuisance and starts treating them as an early warning system. The client who quietly moves $500,000 to a self-directed platform because you refused even to discuss Bitcoin is telling you something. Not necessarily anything about their risk tolerance, but a lot about how replaceable they think you are.

All of this sits atop that $80-plus trillion to $120-plus trillion wall of wealth slated to move from boomers to their heirs over the next two decades. The inheritors of that capital grew up in a world where spending and sending feel as normal as wiring a bank transfer, and they’re busy watching which advisors respect that reality.

The window is open for Wall Street, but it will not stay open forever. The first wave of crypto-competent RIAs, family offices, and fintech platforms is already laying the groundwork for weaving Bitcoin and digital assets into plain-vanilla wealth management without blowing up fiduciary duty, tax planning, or cybersecurity.

Everyone else can keep arguing about whether a 5–10% crypto sleeve belongs in a portfolio while their clients quietly walk their accounts out the door.

The wealth transfer is happening either way. The question is who gets to book the AUM when it lands.

Oracle did what every legacy tech giant dreams of. In September, it announced a $300 billion cloud deal wrapped around OpenAI, the hottest name in software, and watched its stock rip higher.

Two months later, the market gave its verdict. Oracle has shed more than $300 billion in market value, trading below its pre-AI announcement levels, while reports began calling it a “ChatGPT curse.”

Analysts are now treating the mega deal as a case study in what happens when AI promises outrun the cash flows that are supposed to support them.

At the same time, Cursor just raised $2.3 billion at a $29.3 billion valuation. The company crossed $1 billion in annualized revenue this year and more than tripled its valuation since June.

The coding tool vacuumed up venture capital on the promise that engineers would live inside an AI pair programmer that would write most of the code for them.

A private devtool startup and a public software incumbent are suddenly part of the same mental spreadsheet as most L1 tokens, and investors are now asking a slightly rude question.

When AI can hand a three-year-old startup a $29.3 billion price tag, does money still need crypto at all, or does crypto just get pulled into the same trade under a different ticker?

The AI money hose

A nice close look at the insane funding numbers explains this mood.

Global AI startup funding reached around $100 billion in 2024, roughly 80% more than in 2023 and close to a third of all venture capital that year. S&P Global puts generative AI funding at more than $56 billion in 2024, nearly double the prior year.

The Stanford AI Index tracks private investment in generative AI at $33.9 billion for 2024, more than eight times 2022. EY estimates that in just the first half of 2025, generative AI startups raised another $49.2 billion.

Crypto remembers what that looks like. In 2021, the hot trades were token issuance, DeFi yield, and metaverse equity. In 2024 and 2025, the center of gravity moved. The big checks went into training runs, data centers, and a small circle of foundation model labs. Barron’s counts roughly a third of global VC going into AI names like xAI, Databricks, Anthropic, and OpenAI.

On the public side, companies are raising giant debt piles to chase GPU capacity. Oracle is reportedly lining up around $38 billion of bonds to fund its cloud buildout. Nvidia’s data center revenue has reshaped entire equity indices. If you want exposure to “future cash flows from compute,” the highest beta now lives in AI infra and foundation models.

That does not mean liquidity vanished from crypto. It means marginal dollars are priced against a new benchmark. If a mid-size AI startup commands a $30 billion valuation and OpenAI can talk about trillion-dollar capex plans without being laughed out of the room, the bar for a $10 billion token with thin real-world usage gets higher.

AI tokens and the ASI experiment

Crypto did the logical thing: it tried to package AI inside tokens. The flagship effort was the Artificial Superintelligence Alliance, a plan to merge SingularityNET, Fetch.ai, and Ocean Protocol into a single ASI token and brand the whole stack as decentralized AI. Fetch.ai’s merger blog set out a simple sales pitch in 2024. One treasury, one token, three projects that claimed to cover agents, data, and models.

This worked for a while. Billions of dollars worth of AGIX, FET, and OCEAN liquidity were pointed at the same narrative. Exchanges lined up spot and perpetual pairs for ASI. Retail holders got migration bridges and one token that mapped cleanly to “AI” on a watchlist. It looked like crypto had found a way to compress a messy sector into something that could live in a single line of a derivatives blotter.

Then Ocean walked.

In October, the Ocean Protocol Foundation announced its withdrawal from the alliance, asking to depeg OCEAN from ASI and relist it as a separate asset.

Ocean framed the exit as a matter of “voluntary association.” Fetch.ai has since launched legal action, with court filings tracing conversions of more than 660 million OCEAN to FET and alleging broken promises around the merger.

This little governance drama tells you something about the AI token trade. It’s chasing the same story as the private AI boom, just with more volatility and basically no revenue. When ASI traded well, everyone wanted in. When valuations cooled and community politics reemerged, the “alliance” reverted to being three cap tables with different agendas.

From a liquidity point of view, AI tokens feel less like a separate asset class and more like a way for existing money in crypto to shadow what is happening in private AI. Cursor’s latest round or Anthropic’s new funding from Amazon do not move ASI on a strict basis, but they set the emotional tone. Crypto traders watch equity deals and price their AI baskets accordingly.

From Bitcoin mines to AI model farms

The clearest merger between AI and crypto sits in power contracts. Bitcoin miners spent a decade building data centers in cheap-energy regions, and AI hyperscalers are now paying up for the same megawatt base.

Bitfarms is the most explicit case. The company has announced plans to wind down Bitcoin mining entirely by 2027 and redeploy its infrastructure into AI and high-performance computing.

Its 18-megawatt facility in Washington state will be the first site converted, with racks designed for Nvidia GB300-class servers and liquid cooling capable of handling around 190 kilowatts per rack.

Bitfarms’ press release describes a fully funded $128 million agreement with a large US data center partner. Management claims that one AI facility could out-earn the company’s entire historical Bitcoin mining profits.

Bitfarms is not alone. Iris Energy rebranded as IREN and is shifting its hydro-powered sites into AI data centers, with Bernstein research pointing to billions in expected revenue from Microsoft-backed GPU deployments.

Hut 8 talks openly about being a power first platform that can point 1,530 megawatts of planned capacity to whatever workload pays best, with AI and HPC at the top of the list.

Core Scientific went far enough down this route that AI cloud provider CoreWeave agreed a $9 billion all-stock deal to buy it, aiming to lock up more than a gigawatt of data center power for Nvidia-heavy clusters, before shareholders pushed back.

The pattern is the same in each of these cases. Bitcoin mining gave these firms cheap power, grid connections, and sometimes hard-fought permits.

Then AI came along and offered a higher dollar per megawatt. For shareholders that have watched multiple halvings compress mining margins, routing energy into GPU stacks clearly looks like swapping a maturing carry trade for growth.

This is where the “AI is eating crypto liquidity” headline gets literal for Bitcoin. Every megawatt that moves from SHA-256 to GB300 or H200 is a unit of energy that no longer secures the network. Hash rate has continued to grow as new miners enter and older hardware is retired, but over time, a higher share of cheap power will be priced by AI’s willingness to pay.

When AI attacks the rails

There is one more junction between AI capital and crypto: security.

In November, Anthropic published a report on what it called the first large-scale espionage campaign orchestrated by an AI agent. A China-linked group jailbroke the company’s Claude Code product and used it to automate reconnaissance, exploit development, credential harvesting, and lateral movement across roughly 30 victim organizations.

Some of the attacks succeeded. Some failed because the model hallucinated fake credentials and stole documents that were already public. But the most alarming part was that most of the attack chain was driven by natural-language prompts rather than a room full of operators.

Crypto exchanges and custodians sit right in the middle of that blast radius. They already rely on AI inside trading surveillance, customer support, and fraud monitoring.

As more operations move into automated agents, the same tools that route orders or watch for money laundering will become targets. A dense concentration of keys and hot wallets makes them attractive to any group that can point a Claude-sized agent at a network map.

The regulatory response to that sort of event will not care whether the affected venue trades Nvidia equity, Bitcoin, or both. If a major AI-driven breach hits a big exchange, the policy conversation will treat AI and crypto as a single risk surface that sits on top of critical financial infrastructure.

So is AI really eating crypto liquidity?

The honest answer is that AI is doing something more interesting. It’s setting the price of risk for anything that touches compute.

Venture money that might once have chased L1s is now funding foundation models and AI infra. Public equity investors are weighing 30% drawdowns in Oracle against the chance that a $300 billion OpenAI cloud deal really does pay off.

Private markets are happy to value a devtool like Cursor on par with a mid-cap token network. Bitcoin miners are rebranding as data center operators and signing long-term contracts with hyperscalers. Token projects are trying to bolt “AI” onto their ticker because that is where the excitement sits.

Looking at this market from the depths of the crypto industry makes it look like a food chain where AI simply devours everything.

But alas, it’s always more nuanced and complicated than it looks. Over the past two years, AI has become the reference trade for future computing, and that trade drags Bitcoin infrastructure, AI tokens, and even exchange security into the same story.

So, liquidity is not leaving outright. It’s moving around, pricing everything else against the one sector that convinced markets to fund trillion-dollar capex plans on a promise and a demo.

CME FedWatch now implies better than 70% odds that the Federal Reserve will cut rates by 25 basis points at its Dec. 9-10 meeting, dropping the target range from 3.75%-4.00% to 3.50%-3.75%.

That marks a dramatic intraday reversal on Nov. 21, when New York Fed President John Williams told reporters the Fed can still trim rates “in the near term” without threatening its 2% inflation target.

A few days before, the same probability sat near 30%, weighed down by a government data blackout and hawkish Fed commentary.

The question now is whether a December cut carries enough conviction to pull Bitcoin (BTC) out of protection mode, or whether the macro tailwind arrives too late for a market already bleeding leverage and ETF flows.

Between Nov. 20 and 21, Bitcoin dove from $91,554.96 to $80,600, before recovering to $84,116.67 as of press time. The movement worried investors, who are not certain if BTC reached its local top this cycle at $126,000, and there is no steam left for an upward movement.

The rate-cut narrative matters for Bitcoin because it translates directly into real yields and liquidity.
Over the past two months, inflation-adjusted Treasury returns climbed as markets priced out easing, pulling capital away from high-beta assets and tightening global liquidity.

If the Fed now delivers the cut markets expect and signals more to come, real yields should compress and liquidity should expand, conditions that historically correlate with Bitcoin outperformance.

However, on-chain data from Glassnode and derivatives positioning show the market hasn’t flipped yet.

Recent buyers are underwater, ETFs are bleeding, and options traders are paying double-digit premiums for downside protection.

What changed and why it moved odds so fast

Williams’ comments hit a market that had just repriced December odds down to 30% amid uncertainty over employment data.

His statement that near-term cuts remain viable without jeopardizing inflation control permitted traders to reload rate-cut bets. By Nov. 21 close, FedWatch probabilities had spiked above 70%, reversing a multi-week drift lower.

The swing reflects how sensitive markets have become to Fed messaging after two cuts already delivered in 2025, the most recent on Oct. 29, which brought the funds rate to 3.75%-4.00% and announced that quantitative tightening would end Dec. 1.

September payrolls printed at 119,000 with unemployment edging up to 4.4%, data that split Wall Street. JPMorgan, Standard Chartered, and Morgan Stanley pulled their December-cut forecasts, arguing the jobs print wasn’t weak enough to justify further easing.

Citi, Deutsche Bank, and Wells Fargo held firm, pointing to the uptick in unemployment as proof that the Fed has room to ease. Williams’ remarks tipped the balance, validating the dovish camp.

Markets now price a 70% chance the Fed follows through in December, with further easing expected in 2026 if inflation remains contained.

The 10-year nominal Treasury yield has already fallen roughly 60 basis points this year, and TIPS breakevens sit just above 2.2%, suggesting markets believe inflation can stay anchored even as policy eases.

Real yields, liquidity, and why Bitcoin cares

The relationship between Bitcoin and real yields has become the dominant macro narrative this fall.
Rising inflation-adjusted returns on Treasurys pull capital away from zero-yielding assets like Bitcoin.

S&P Global’s work shows a negative correlation between Bitcoin and real yields that has strengthened since 2017, with the asset tending to outperform when policy eases and liquidity expands.

Bitwise’s research overlays Bitcoin against global M2 money supply, showing that periods of re-accelerating money growth and easier Fed policy coincide with stronger Bitcoin performance.

The recent dollar pullback and renewed M2 expansion should become tailwinds once markets trust that cuts will continue.

A December cut backed by guidance toward further easing would cap real yields and rebuild the liquidity backdrop that historically supports Bitcoin.

Yet, the mechanics only work if the cut arrives with conviction. A one-and-done cut followed by hawkish guidance would leave real yields elevated and liquidity constrained.

Williams’ comments matter because they suggest the Fed sees room for multiple moves, not just a token cut in December. If that proves true, the path toward falling real yields and a softer dollar becomes credible, giving Bitcoin a chance to flip from selling off with liquidity to trending with it.

What Glassnode sees on-chain and in derivatives

Glassnode’s Nov. 19 report maps how hard the recent drawdown hit and why positioning remains defensive.

Bitcoin broke below the short-term holder cost basis and the -1 standard deviation band, slipping under $97,000 and briefly touching $89,000, which aggravated on Nov. 21 with BTC almost losing the $80,000 footing.

That leaves almost all recent cohorts sitting at an unrealized loss and turns the $95,000-$97,000 zone into resistance.

Glassnode estimates 6.3 million BTC now sit underwater, mostly in the -10% to -23.6% range, a distribution that resembles 2022’s range-bound bear market more than full capitulation.

Two price levels stand out. The Active Investors’ Realized Price sits around $88,600, representing the average cost basis for coins that move regularly.

The True Market Mean, near $82,000, marks the threshold between a mild correction and a deeper 2022-style bear phase. Bitcoin currently trades between those levels.

Off-chain flows reinforce the caution. US spot ETFs show a firmly negative seven-day average, with November outflows approaching $3 billion.

That suggests institutional allocators aren’t stepping in to buy the dip. Futures open interest drifts lower alongside price, implying traders are de-risking rather than adding leverage.

Options positioning screams protection mode. Implied volatility spiked back toward levels last seen during October’s liquidation event, skew tilts sharply negative, and one-week puts trade at a double-digit premium to calls.

Net flows show traders paying up for $90,000 downside strikes while adding only modest call exposure. Glassnode’s read is that dealers are short delta and hedging through futures selling, which mechanically adds pressure when the market weakens.

The path forward depends on Fed conviction

A December cut accompanied by guidance toward further easing would cap real yields and rebuild liquidity, the conditions Bitwise and S&P Global identify as historically favorable for Bitcoin.

The 70% probability now priced into FedWatch reflects growing confidence that the Fed sees a path to ease without reigniting inflation, which is exactly what Bitcoin needs to flip the narrative.

But Glassnode’s on-chain and derivatives data show the immediate setup remains fragile. Recent buyers are underwater, ETFs are bleeding, leverage is unwinding, and options positioning favors protection over conviction.

That means even a December cut might not trigger an immediate reversal if it comes without clear guidance on future moves.

If the Fed blinks or delivers a one-and-done cut while emphasizing inflation risk, the macro impulse could prove too weak to shift ETF flows or flip risk appetite.

Bitcoin would remain pinned below the $95,000-$97,000 resistance that Glassnode now considers structural.

Williams’ comments cracked the door open. A December cut with forward guidance could push it wider. Whether that’s enough to pull Bitcoin through depends on whether the Fed treats December as the start of a new easing cycle or the end of a brief recalibration.

Markets are pricing the former at 70% odds. The on-chain data suggests traders aren’t convinced yet.

The story of corporate Bitcoin adoption is often told as a parade of logos. New CFO decides to be bold. Board nods. Treasury buys coin. Number go up.

That parade has not shown up for two months. According to BitBo’s treasuries tracker, the last fresh company to join the BTC-on-balance-sheet club was GD Culture Group on September 18. Since then, it’s been nothing new, and the “new entities” table just sits there with that same date at the top.

That doesn’t mean there’s no corporate demand. It just means that it looks different. The net bids are dominated by the same cast of repeat accumulators, with Strategy the poster child for tradfi’s thirst for Bitcoin.

On Nov. 17, the company added 8,665 BTC in a single shot, a reminder that the most consistent buyers are already in the pool. The market might not be onboarding new swimmers, but it sure is watching the veterans do extra laps.

To understand why the pattern changed and what it means for the next leg of adoption, we must dive deep into the numbers.

The empty on-ramp

Let’s start with the absence.

BitBo’s “Newly Added Treasury Entities” log is a rolling register of first-time holders. The lines before Sep.18 read like a bull-cycle scrapbook, with small public companies testing the waters, a few private names, and even some municipal experiments.

After GD Culture Group’s acquisition on Sep.18, the list goes quiet until Nov. 21. In a market that’s built on momentum, you can’t ignore two months of stillness. This lack of activity shows us that onboarding has a cadence, and right now, the cadence is slow.

So, why the quiet period? There are a few plausible culprits.

First, accounting and governance. Even after the move to fair value accounting in the US, many boards still treat BTC like a spicy footnote rather than a core treasury asset. Policy templates and audit comfort take time to propagate. No amount of keynote speeches instantly rewires board risk committees.

Second, substitution by proxy. Spot Bitcoin ETFs solved a pain point for institutions that wanted Bitcoin exposure without custody and policy overhead. If your board can buy IBIT or FBTC through the same brokerage stack that holds your bond ETF, the perceived need for raw coin on the balance sheet drops.

BitBo’s “Latest Changes” feed is now a daily ledger of ETF inventory shuffling, which is great for liquidity but does not add a logo to the corporate treasuries wall.

Third, attention allocation. This year has so far felt like a choose-your-own-adventure between AI capex and digital asset policy. But, CFOs have finite focus, and if the marginal dollar is being routed to GPUs or debt paydown, the “buy BTC” memo tends to land lower in the stack.

As a result, new corporate entrants have paused, and repeat buyers are powering the headline prints. Case in point: Strategy’s November acquisition. If you care about market structure rather than narratives, this concentration matters more than the absence of fresh logos. (Bitbo)

Who is selling into the quiet?

Now we turn to the other side of the ledger. The same BitBo change log that shows Strategy’s bulk purchase also shows a run of meaningful disposals and restructurings among miners and small caps.

HIVE Digital is the most striking example because the percentage change jumps off the page. On Sep. 30, HIVE’s reported BTC balance moved from 2,201 to 210, a reduction of 1,991 coins, roughly a 90% drawdown. HIVE’s management explained the split: as of Sep. 30, there were 210 BTC unencumbered in treasury and 1,992 BTC pledged.

This means that a big stack exists, but much of it is tied up to finance expansion rather than sitting as free liquid collateral. While the headline number shrank, the economic exposure didn’t vanish. However, that nuance is easy to miss if you only skim a table.

Look beyond HIVE and you see more pragmatic balance sheet choices. Argo Blockchain’s BTC line declined about 82% between snapshots; Cathedra’s was down roughly 74%. Miners live inside a three-variable equation of hashprice, energy cost, and capital availability.

When electricity is volatile and investors prefer self-funding over equity taps, selling inventory or pledging it to back equipment becomes the rational choice.

You also see aggressive accumulation by miners that can. Bitdeer’s entries show steady increases through November, while Hut 8’s balance rose by over 3,400 BTC between quarter-end snapshots as integration and treasury strategy evolved. The “miners are selling” headline is too simple. Some are, that’s true, but some are also not, and the spread illustrates their cost structures and access to financing.

Why this lull matters

If new corporate entrants aren’t arriving and repeat whales are setting the tone, the shape of corporate demand changes, and concentration rises. Liquidity depends on a handful of buyers and a handful of professional sellers. That’s not inherently bad.

However, it means volatility around announcements becomes more theatrical. When Strategy posts an 8,665 BTC add on a slow news day, the narrative vacuum basically fills itself. The more silent the onboarding pipeline, the louder the whales sound.

There is also a supply signal hidden in the miners’ column. Pledged coins are not the same as coins ready to market. HIVE’s update is the cleanest example because management laid out the tally on the record: 210 unencumbered, 1,992 pledged.

This is a clear split between liquid and financed exposure. The pledged slice is functionally collateral for capex, and it may convert back to liquid inventory later. Until then, we shouldn’t double-count it as “available to sell.”

Add the ETF presence to the picture, and you have a triangle. ETFs transform demand from a corporate treasury decision into a portfolio allocation decision, which siphons some would-be corporate first-timers into fund units.

The corporate logo board stops growing, but the pool of addressable buyers gets deeper through brokerage rails. The BitBo feed now looks like a morning newsletter for ETF inventory and miner housekeeping. It’s boring if you want logos, but a blast if you want to find out what the market’s microstructure looks like.

What would restart the parade of new corporate treasuries?

There are a few realistic triggers.

Clearer peer examples in specific sectors, as sector clusters often move together. If one mid-cap software vendor outlines a sleepy, boring BTC treasury policy that passes audit with minimal fuss, three more will follow inside two quarters.

A stable price regime that lowers perceived headline risk. Paradoxically, melt-ups can slow adoption because boards hate buying tops. A quarter or two of rangebound trading after capitulation could make BTC look like a working capital hedge rather than a moonshot.

Cheaper financing and easier power for miners. If your cost of carry drops, you hold more inventory and pledge less. That reduces forced selling and nudges the corporate share of on-chain supply toward patient hands.

None of these require new regulation or a celebrity bellwether, just time and a handful of plain vanilla case studies.

The bigger picture

Corporate Bitcoin adoption has never been a straight line. It moves in waves that rhyme with the cycle, the cost of capital, and the convenience of substitutes.

The 2025 version of that rhyme includes ETFs that make it effortless to add exposure without rewriting treasury policies, miners that act like industrial businesses rather than mascots, and one publicly traded software firm that treats BTC like a second headquarters.

To explain why there have been no new logos in the past two months, you just need a calendar and a basic grasp of how CFOs make decisions. They watch peers. They prefer boring processes. They hate surprises.

The takeaway for readers is practical: don’t judge corporate adoption by the count of press releases alone. Watch who is actually moving size, and why. Separate liquid treasury coins from pledged collateral.

And maybe keep an eye on the whales. When the onboarding ramp is quiet, the veterans tend to own the pool. On Nov.17, one of them swam another 8,665 meters.

Whether the next lap belongs to a new entrant or the same buyer is the question that will decide how this phase of the market prices liquidity. The table will tell you when the parade starts again.

An unnamed national bank has asked the Office of the Comptroller of the Currency for permission to hold crypto on its own balance sheet to support blockchain-based services. On Nov. 18, the OCC finally answered.

In Interpretive Letter 1186, the agency confirmed that national banks may hold the native assets needed to pay blockchain “network fees,” clearing the way for regulated institutions to run on-chain operations without external workarounds.

The letter says a national bank may pay blockchain “network fees,” commonly known as gas, as an activity “incidental to the business of banking.” It may hold, as principal, the crypto assets needed to cover those fees where it has a “reasonably foreseeable” operational need.

That one-sentence clarification just removed the biggest operational hurdle facing banks that want to custody tokens or move stablecoins on public chains: you can’t settle transactions on Ethereum if you’re not allowed to hold ETH.

The ruling sits between plumbing and precedent. Network fees on public chains are paid in the native asset of the chain. Hence, any bank that wants to custody tokens, move customer stablecoins, or run tokenized deposits on Ethereum or similar networks needs some amount of ETH or an equivalent in hand.

Until now, many banks either stayed away from on-chain activity entirely or leaned on third-party providers to front gas and wrap it into a fiat fee.

The OCC is now saying banks can hold those native tokens themselves as principal if they’re only needed to run the pipes.

For large custodians, tokenization desks, and stablecoin issuers operating under the GENIUS Act framework, that shift means they can finally be full-stack on specific networks without outsourcing the last missing piece.

How this connects to GENIUS and the March pivot

The OCC explicitly links the letter to activities already allowed under the GENIUS Act stablecoin framework.

The agency said those activities will require banks to pay network fees “as agent for the customer or as part of its custody operations.”

The letter also builds on the broader March-May 2025 pivot, when the OCC rolled back old “you must get prior approval for any crypto activity” guidance and reaffirmed that banks can engage in crypto custody, some stablecoin activity, and participation in distributed-ledger networks without pre-clearance, subject to standard risk management.

Letter 1186 zooms in on a specific operational snag inside that new framework: you can’t do on-chain custody or tokenized deposits if you’re not allowed to hold the gas token.

American Banker quotes the letter’s logic directly. If serving as a node is permissible, then “accepting the crypto asset network fee” and holding it for some period must also be acceptable.

Otherwise, a bank could be “practically barred” from a lawful activity. That reasoning gives large custodians a cleaner path to maintain a small gas balance in-house rather than farming that function to fintech intermediaries or staying off-chain altogether.

The same letter confirms that banks can also hold limited amounts of crypto as principal to test otherwise permissible crypto-asset platforms, whether built in-house or bought from a third party.

In other words, the OCC is blessing small, working inventories of native tokens so banks can actually move transactions on the rails they’re allowed to use, and safely test those rails before committing customer funds or balance-sheet capital to production deployments.

What changes for custody and payments

For payments and settlement, this is about plumbing, not proprietary trading. The change matters most for banks running stablecoin operations or tokenized deposit programs that settle on public chains.

Those institutions now have explicit authority to hold the gas needed to process customer transactions without structuring workarounds or relying on external liquidity providers.

The guidance also covers situations where the bank pays fees on behalf of customers in its role as custodian or agent, especially for GENIUS-compliant stablecoins.

Several summaries stress that holdings are limited to “operational needs,” including fee buffers for settlement and for testing custody platforms, not open-ended speculative positions.

That’s the distinction between fee custody and balance-sheet crypto exposure: banks can hold enough ETH to cover foreseeable transaction volumes and platform testing, but they can’t build a speculative book or treat native tokens as an investment asset.

The OCC’s framing makes clear this is operational inventory, not a new asset class for bank treasuries.

For custody desks, the ruling removes a layer of counterparty risk and operational complexity.

Banks that previously relied on third parties to provide gas now have the option to internalize that function, which shortens execution timelines and eliminates intermediaries that might themselves face liquidity constraints during network congestion or market volatility.

It also positions national banks to compete more directly with crypto-native custodians that have always held native tokens as part of their service stack.

The constraints banks still face

The OCC stresses that all of this must be done in a “safe and sound” manner and in compliance with existing law.

The agency’s press release and commentary from the American Bankers Association highlight that banks must narrow the size of these holdings, tie them to specific permissible activities, and run the usual market, liquidity, operational, cyber, and BSA/AML risk frameworks around them.

The OCC only oversees national banks, while the Federal Reserve has, in a separate policy statement, continued to describe holding crypto as principal as “unsafe and unsound” for state member banks, creating cross-regulator friction even after the OCC loosened its stance earlier this year.

That divergence means OCC-chartered banks have the green light to use operational gas balances. However, the broader US bank universe still faces mixed signals, depending on charter type and primary regulator.

Banks will also need to navigate price volatility. Native tokens like ETH fluctuate, which means the dollar value of a bank’s gas inventory can swing day to day even if the token quantity stays fixed.

The OCC’s “reasonably foreseeable operational need” standard implies banks should size buffers conservatively and avoid holding excess tokens that would expose them to speculative risk.

That creates a balancing act: hold too little and banks risk running out of gas during high-congestion periods. On the other hand, holding too much implies carrying volatile assets on the balance sheet without a clear operational justification.

What’s at stake for the industry

The broader question Letter 1186 answers is whether US banks can participate in on-chain finance without regulatory workarounds or structural disadvantages relative to crypto-native competitors.

For years, the implicit answer was no: banks could offer crypto services only by staying off-chain, partnering with third parties, or seeking case-by-case approval for activities that involved direct token handling.

The March pivot opened the door to custody and stablecoin activity. This letter removes the last operational blocker by allowing banks to hold the gas needed to actually settle transactions.

If the stance holds, expect national banks with existing tokenization or stablecoin programs to bring gas management in-house over the next year.

That shift won’t change the fundamental economics of on-chain payments. Still, it will consolidate more of the service stack inside regulated institutions and reduce reliance on fintech intermediaries for basic settlement functions.

It also sets a precedent for how regulators might approach other operational necessities that require holding native tokens, from staking for proof-of-stake networks to liquidity provisioning for decentralized-finance protocols that banks might eventually touch.

The risk is that this remains an OCC-only position. If the Fed doesn’t follow suit with similar guidance for state member banks, the result is a two-tier system in which charter choice determines whether a bank can hold gas tokens at all.

That would push more institutions toward national charters for crypto-related businesses, concentrating activity under a single regulator and leaving state-chartered banks at a competitive disadvantage for on-chain services.

For now, Letter 1186 is permission, not policy convergence, and the distance between those two will define how far US banks can actually go.