Decent Newsroom
Sign In

Cheap Intelligence, Expensive Trust

By Roger October 26, 2026
In seventy-two hours the price of frontier-class weights fell to almost nothing while the debt that pays for serving them shut off. The one price that did not move is the price of proof.
Cheap Intelligence, Expensive Trust

Cheap Intelligence, Expensive Trust

On Sunday evening, Elon Musk answered an investor’s thread on X with a sentence that should have moved more prices than it did. The debt market for companies whose revenue depends on AI data centers, he wrote, had “almost entirely shut off access to money.” His own rocket company had just borrowed forty billion dollars for GPUs, and the reason it could is that SpaceX has income from something other than the thing it was borrowing against. Then the punchline: “That means the 200+ neoclouds are going to see guppy-level death and consolidation.”

Three days earlier, Moonshot released Kimi K3.1 Pro: 2.8 trillion parameters, 104 billion active, a million-token context, and fourth place on Artificial Analysis’ intelligence index, three points behind the best closed model on earth. The weights are promised for November 4.

Read separately, those two items are a bearish signal and a bullish one. Read together, they are the same event. The thing being sold — a unit of intelligence — is getting cheaper by the month. The thing required to produce it — capital, and the electricity behind it — has just become harder to borrow. Between those two curves sits an entire industry that owns neither the model nor the power plant, and last week the spread between them closed on it.

And there is a third price nobody quoted, which did not fall at all: the price of proof.

The market that closed

A neocloud is a simple business with a brutal shape. It borrows money, buys GPUs, leases them to AI developers, and hopes the lease outlives the depreciation schedule. It works while credit is cheap and demand compounds faster than the racks fill. When credit tightens, both ends fail at once: refinancing gets expensive in the same month customers discover they can consolidate onto a hyperscaler.

Musk’s claim is not that lenders demanded better terms. It is that they stopped answering the phone for anyone without revenue that exists independently of AI compute. The follow-up, relayed by Reuters, added the detail that matters for timing: the SpaceX debt is “primarily callable,” with the GPUs arriving in the first and second quarter of 2027. Nothing breaks this quarter. Everything breaks when the deliveries land and the calls come due.

Derivatives traders voted first: on October 24, crypto longs lost $404 million in four hours as bitcoin briefly slipped below $80,000, a level it was still hovering at two days later.

Equity investors have already started voting. CoreWeave peaked at $183.58 in June 2025 and traded near $54 in late October 2026 — a drawdown of roughly 70 percent, by my own arithmetic on the two reported figures. Nebius and IREN each lost more than 30 percent in October alone. Gartner published a forecast in October projecting that more than 80 percent of independent neoclouds could be gone by 2030. And Jensen Huang, who has no interest in talking his own demand down, told CNBC on October 22 that “the demand of the capital is much greater than the availability of the capital.” That is a strange sentence from the man selling the shovels. It means the constraint has moved from silicon to balance sheets.

Nik Bhatia saw the same thing from the rates desk. In his October 24 note he describes a near three-sigma move in US Treasuries alongside a NASDAQ selloff. One detail most commentary skipped: the cost of calls on long-dated Treasuries relative to puts has returned to positive territory for the first time since the first quarter of 2026. Traders are positioning for further rallies in the risk-free asset. That is not a rotation out of risk in the usual cyclical sense; it is a repricing of duration because the credit that financed the boom is no longer expanding on its own.

Energy is doing the opposite of what the AI trade needs. Brent settled at $110.11 and WTI at $101.35 on the morning I wrote this, with gold at $4,027 and the dollar index at 101.8 — readings from my own dashboard on October 26 at 09:31 CET. Bhatia notes that the US Strategic Petroleum Reserve is at its lowest level in more than forty years, that diesel export bans have been discussed, and that Washington is pressing European allies to release reserves. Expensive oil is a tax on every data center that has not yet signed a fixed-price power contract. It is also, for the same reason, a gift to anyone who can produce electricity cheaply and sell it without a narrative attached.

The model that got cheap

Now the other side. Kimi K3.1 Pro is, by the numbers published at launch, the closest an open-weights model has come to the frontier. Artificial Analysis ranks it fourth at 55 on its intelligence index, behind Opus 5.5 at 58 and Sonnet 5.5 and Muse Wonder Full at 56. It entered Code Arena’s WebDev leaderboard at eighth with 1,692 points, thirty-seven points and nine places above its predecessor. On the same lab’s cyber index it scored 64 percent, the highest figure for any publicly accessible model and second overall to a trusted-access system at 69.
Kimi K3.1 Pro against the best closed models on the Intelligence Index and the Cyber Index

That last number deserves a pause, because it explains the week. Moonshot deliberately reduced cyber-related training, and the model still lands near the top of a benchmark built to measure offensive capability. Capability of that kind does not stay in the lab once weights are downloadable. Nathan Lambert and Florian Brand spent most of their Interconnects podcast on exactly this. Their framing is useful: cyber experts and AI experts looked at the same release and described it in incompatible vocabularies. One group saw a new attack surface, the other a benchmark table.

What follows in the launch material is a study in how a release can be real and oversold at once. Kimi’s own blog carries headline numbers that are strong, and later numbers that are jagged: roughly twenty points behind the leading closed model on Terminal-Bench Science, weaker on some interactive tasks. Latent Space’s summary calls the closed-AI lead one month, which is a fair reading of the index and a generous reading of the tail. There were allegations of undisclosed paid promotion, sourced to a screenshot of press instructions that nobody has corroborated. The weights are promised, not shipped, which makes “soon-to-be open-weight” the accurate phrase and “open source” the marketing one. The licence is unknown. A trillion-parameter model you can download is not a model you can run on a desk.

The macro version of that argument arrived at the IMF in Bangkok on October 17, when Jack Clark used the Per Jacobsson lecture to tell an audience of central bankers that the singularity has begun. His evidence was not a benchmark table but a production figure: researchers at Anthropic now write almost ten times as much code as they did in the company’s first four years. Whether or not you accept the framing, the claim underneath it is the one this article is about — that cognitive work has become a manufactured input, priced by the cost of the factory rather than the cost of the worker.

That distinction is worth spelling out, because the local-AI story depends on it. At 4-bit precision, 2.8 trillion parameters occupy about 1.4 terabytes; at 16-bit, 5.6. An 80-gigabyte accelerator therefore holds a seventeenth of the model, so serving it takes at least eighteen of them before you count the cache or the runtime state. Decoding reads the active parameters for every token: 104 billion at half a byte each is 52 gigabytes of memory traffic per token, and at 3.35 terabytes per second of memory bandwidth that caps a single accelerator at roughly 64 tokens per second. Spread over eighteen devices, aggregate bandwidth gives an ideal ceiling near 1,160 tokens per second for the whole cluster, before interconnect, batching and scheduling take their cut. These are my own arithmetic on published parameter counts and hardware figures, not measurements of Moonshot’s serving stack — but the shape is not in dispute. Mixture-of-experts lowers training cost and stores knowledge more cheaply per byte read. It does not lower the memory bill for the token being generated right now. A 104-billion-active-parameter model carries a dense-104B memory bill, every token, forever.
Weight memory for 2.8 trillion parameters at 4-bit and 16-bit, against two accelerators

Put that next to the credit story and the conclusion writes itself. If the model is free to download, the gross margin migrates to whoever serves it at the lowest cost of capital and the cheapest megawatt. A neocloud has neither, which is why Musk’s sentence was about them and not about Nvidia. Weights are the commodity. The scarce goods are the power purchase agreement and the investment-grade rating.

The missing comparison

Here is where I want to change the subject, because the third price is the one I think is mispriced.

Within the same three days, three systems that people trust with money were broken in the same way.

First, Core Lightning. Versions 25.02 through 26.04 crashed on a channel announcement whose two endpoints were the same node. The BOLT 7 specification requires the sender to order node IDs lexicographically, which implies they differ, but it never required the receiver to check. So gossipd parsed the announcement, verified all four signatures, wrote it to disk, and then loaded it into an in-memory graph that assumes each node appears once. With both endpoints identical and previously unknown, the loader creates the node twice and trips a no-duplicates assertion, which aborts the daemon and takes the node down. The announcement is already on disk, so the node aborts again on every restart. Upgrading does not help, because the patch does not remove a record that is already stored. The operator has to find it and take it out by hand, and until then the node is blind to the chain — blind to a revoked commitment being broadcast, blind to an HTLC expiring. Attacker cost: one unspent 2-of-2 output they control, plus the on-chain fee to create it. Its fix, merged in April and released in 26.04.1, is a single comparison: reject any announcement where node_id_1 is not strictly less than node_id_2.

Second, Electrum. The wallet trusts servers for transaction history, and before version 4.8.3 it did not verify signatures on unconfirmed transactions spending the user’s own coins. A malicious server could substitute a fake pending payment, signed with invalid signatures, paying the attacker. The trap was elegant, and worth following step by step: the fake transaction carried no fee, so it looked stuck, and when the user chose Replace-by-Fee to unstick it, the wallet signed a valid replacement sending coins to the attacker. Attackers also generated addresses whose last four characters matched the real destination, because they knew the fee dialog is not where anyone checks. Two reports arrived in October. In the first, a user of a 2-of-3 multisig had verified the payment on two hardware devices and later found a different outgoing transaction in his history. In the second, a user raised the fee on a substituted transaction and lost money. Version 4.8.3 shipped on October 24 with signature checks for exactly that case. Users connected only to their own server were never exposed. The invariant that was missing: verify the signature, not the story.

Third, closer to anyone building on top of models rather than beneath them: the guardrails. A pre-registered study published this week shows that guards which paste content into a plain-text prompt grade the last complete task in their input, not the worst part of it. Append a forged query and a harmless decoy after a harmful request and the guard answers the decoy. With that trick, all 75 held-out AdvBench requests that Shieldstral-1.0-3B flags got through. Across five popular guards, each had an attack family that cleared at least 93 percent of its flagged items. Training the guard to score content no lower than its most harmful part cuts attack success from 75 percent to between 0.8 and 1.6 percent on held-out families, with clean-data accuracy barely moving. And yet a score-guided search still beat the retrained guard on 47 of 50 items — and on about half of those, the same search found entirely benign text that cleared the guard too. A companion benchmark of 183,000 samples drawn from 35 sources found the wider class of omni-modal guards showing what its authors call substantial safety hallucination and over-sensitivity to textual patterns. A guard is a filter, not a boundary, and the fix is again a comparison: maximum harm over segments, not harm of the last segment.

Three systems, three missing inequalities. The attacker’s marginal cost in each case was one output, one server, one appended paragraph. The defender’s cost was an invariant nobody wrote down, because everyone assumed it was implied by the specification, the interface, or the common sense of the previous ten years.

Operations failed in a harder-to-patch way the same week. Keystone, a hardware wallet maker, disclosed that an intruder reached its Shopify-backed store and took names, contact details, shipping addresses and order records. No keys, no cards — the company was clear about that. But it has also claimed for months that it removes shipping data 180 days after an order, and several customers said on X that their information surfaced anyway from orders older than that. “You trusted us with those details, and we’re sorry we didn’t keep them safe” is an honest sentence. It is also the sentence that a retention promise was supposed to make unnecessary. Meanwhile CoinDCX confirmed a $16 million loss tied to retired wallets and an internal process failure, days after its chief executive described earlier reports of a breach as sounding like “a false alarm.” The exchange absorbed the loss. The detail worth keeping is not the number: the wallets were retired, which means they sat outside the perimeter anyone was still watching.

What any of that has to do with bitcoin

Everything, if you take the security budget seriously.

My own node, fully synced and pruned, sat at block 973,214 on the morning of October 26, with 21,471 transactions in a 4.08-megabyte mempool and a minimum relay fee of one satoshi per virtual byte. I pulled the statistics for the previous 1,008 blocks — six and a half days, 19 to 26 October — and added them up. Miners collected 3,150 bitcoin in subsidies and 15.13 bitcoin in fees. Fees were 0.48 percent of revenue. The average block carried 4,953 transactions in 1,614 kilobytes, and the median fiftieth-percentile feerate was 1.4 satoshis per virtual byte. Hashrate implied by difficulty over the same window works out to about 1,261 exahashes per second, and network revenue at $80,012 per coin is roughly $36.2 million a day, of which $173,000 is fees.
Bitcoin transaction fees per day and fee share of miner revenue, 1,008 blocks, 19 to 26 October 2026

Now do the halving. Block 1,050,000 is 76,786 blocks away, about 533 days, which puts it in the middle of April 2028. At that block the subsidy falls to 1.5625 bitcoin. If price and hashrate are unchanged on that day, holding miners’ revenue per block at today’s 3.14 bitcoin requires fees of 1.5775 bitcoin — a hundred and five times the 0.015 bitcoin they actually earn today. In dollars, fee revenue would have to climb from roughly $63 million a year to roughly $6.6 billion a year. That is not a forecast, and it is not a prediction of doom; fee markets are reflexive and a higher price changes who uses the chain. It is the arithmetic of the promise that Bitcoin’s security eventually rests on fees rather than issuance. At present, in a week with a nearly empty mempool, the promise is 99.5 percent unfulfilled.

Against that, the ownership data corrects the institutionalisation story. Galaxy Research’s October snapshot classifies about 11.1 million bitcoin — roughly 55 percent of the 20.1 million mined — as unattributed: not linked to an exchange, a fund, a government or any other known entity. Alex Thorn reads it as evidence that self-custody remains the dominant holding pattern. Cory Klippsten argues the complementary case from the other direction. Stopping at an ETF share means paying a fee that shrinks the bitcoin behind each share, holding an asset you cannot send on a Saturday night, and depending on an institution’s permission to move your own wealth. Both claims are unglamorous and both are checkable. More than half the supply sits in wallets nobody has labelled, and every one of those wallets is a user who has to be right about seed storage, address checking and fee dialogs — the exact three places where this week’s failures occurred.

That is the connection I keep coming back to. The AI trade is discovering that the price of intelligence is set by capital and electricity, not by cleverness. Bitcoin has been in that business for fifteen years: its security is bought with joules, priced in dollars, and settled every ten minutes. What both are short of is not intelligence or hashing power. It is verification that costs less than the attack.

The case that I am wrong

There is a strong version of the bull argument, and it does not require anyone to be polite about Musk.

Hyperscalers can absorb neocloud capacity with balance-sheet money. If they do, the GPUs keep running, the power contracts keep clearing, and the credit event becomes a transfer of assets from levered operators to unlevered ones. Musk’s own clarification points that way: callable debt, deliveries in the first half of 2027, not a factor this quarter. Gartner’s 80 percent is a forecast, not a filing. And a funding freeze raises the cost of new capacity, which is bullish for whoever already owns some — including, awkwardly for my thesis, the incumbents whose capital expenditure is holding up the index.

On the model side the same caution applies. Kimi’s index score is three points behind the leader; on Terminal-Bench Science it is twenty points behind. Its cyber score is five points behind a trusted-access system that is not publicly downloadable. Its weights are a promise with a date, and its licence is unknown. If the weights slip, or arrive under terms that forbid commercial serving, the one-month headline becomes a press release rather than a fact about the world. Lambert’s own summary of the reaction was that on some tasks the model felt fine and on others not great, with post-training that looked a little underdone — the opposite of a step change.

And I should be honest about the fee arithmetic too. Six days of a near-empty mempool at a bitcoin price of $80,000 is close to the worst case for fee revenue, not a representative sample. Blocks are not full; the median feerate is 1.4 satoshis per byte; the chain processes 4,953 transactions per block out of a capacity far higher. A fee share of 0.48 percent describes a quiet week in a bear market, not the terminal state of the network. What survives scrutiny is narrower: at today’s activity levels the halving triples the share of miner revenue that must come from somewhere other than issuance, and nobody has yet demonstrated the demand that pays for it.

On the trust side the defence is also industrialising, which cuts against the gloom. This week brought a construction for unconditionally secure multi-verifier signatures in which a finality certificate verifies in 2.4 microseconds. At a thousand validators, threshold notarisation costs 71 kibibytes per validator per block, 22 times less authentication traffic than a post-quantum alternative. A Rust prototype commits 2.8 times more transactions per second with 67 times less cryptographic CPU. Adam Gibson’s Lichen proposal, summarised by Bitcoin Optech, attacks a related problem from the other end. It is a single-issuer layer two where each user holds a 2-of-2 contract that lets them redeem even if the issuer refuses or goes offline. A Groth16 claim, and if the hub disputes it a BitVMX dispute, narrows the disagreement to one execution step that Script can check. Gibson is explicit about what remains trust: a sequencer that omits a user’s return can still cost funds, and the hub’s own locked collateral caps how much a user can redeem from others, much like inbound liquidity. That is what honest engineering looks like — a named residual, not a slogan.

What I would watch

Four numbers, all cheap to check, decide whether this week was a turning point or a headline.

First, November 4. Either the weights ship, with a licence that permits commercial serving, or the open-weights story loses a month of credibility. Download versus licence is the difference between a benchmark and a market.

Second, the first half of 2027, when those callable GPU deliveries land. If hyperscaler capital expenditure guidance in the January and April earnings calls absorbs the capacity, the credit event is a transfer. If it does not, the stranded assets are somebody’s power contracts, and power gets cheap for everyone who can still pay for it — miners included, which is the one channel through which a neocloud collapse is straightforwardly good for bitcoin.

Third, patch adoption: the least glamorous and most consequential number in this article. An Electrum install that never updates remains exploitable against any malicious server. Bitcoin Core 32.0 went final on October 21; the node I measured is still reporting itself as 31.1.0, which is a small and unremarkable example of the gap between a release and a population. A Core Lightning node that crashed, was cleaned by hand and not upgraded stays armed, and the attacker can resend the same announcement for free as long as the funding output sits unspent. A guardrail model that grades the last task instead of the worst one keeps approving text it was never asked about. Security advisories are not events; the event is the day the vulnerable population reaches zero, and nobody publishes that number.

Fourth, the fee share, which should be watched on a boring week rather than a dramatic one. At the halving the chain needs a hundred and five times today’s fee take to stand still. Whether that is impossible or merely improbable is the single most important open question in bitcoin, and it will not be answered by a chart of the price.

What the week actually taught is smaller and harder to monetise. Two prices moved: the price of a unit of intelligence fell, and the price of the capital that serves it rose. A third price — the cost of proving that a message is what it claims to be, that a channel announcement is well formed, that a pending payment sends your coins where it says, that the text a guard just approved was the text it was asked about — did not fall at all. Every failure above was a single missing comparison, and every one was exploitable for less than the cost of a coffee. Markets are excellent at repricing abundance. They are slow at repricing the thing that makes abundance usable.

What I could not check

Four things in this article rest on a single party’s account, and I want them separated from the parts I measured.

Musk’s description of the credit market is a post on X, and his forty-billion-dollar figure has no post-close press release from SpaceX or its banks behind it. The lenders are unnamed. I could not verify the terms, only that Reuters relayed the follow-up about callable debt and 2027 deliveries.

The Kimi numbers are vendor and third-party benchmark scores taken at launch. I did not run the model, I do not have its weights, and I cannot tell you what it costs per million tokens through any provider. Its licence conditions, checkpoint precision and full serving footprint were not published as I wrote this.

The Galaxy attribution is a snapshot, and I do not know how it classifies exchange cold storage, custodial multisig or unreachable coins — which is exactly where the difference between “self-custody” and “nobody knows” lives. The 11.1 million figure should be read as a residual, not as a census of private holders.

My own measurements cover one week of a quiet mempool on one node, and the price readings are one dashboard snapshot at a given minute. They describe the week, not the regime. And on the security advisories, nobody publishes how many installs of Electrum or Core Lightning are actually exposed, so “patched” will remain an assumption until the vulnerable population shows up as an incident.

Sources

Write a comment