Decent Newsroom
Sign In

The Price of a Claim

By Roger October 27, 2026
An Electrum server that lied about a pending payment, a Solana bounty that now burns 1 SOL for every report, and 269 billion dollars of take-or-pay: three versions of one rule, that when a claim costs nothing to make the bill lands on whoever has to check it.
The Price of a Claim

The Price of a Claim

Somewhere on Saturday morning, a Bitcoin wallet told its owner something untrue, and the owner signed it. Nothing was hacked in the ordinary sense. No key left the device. The cryptography did exactly what cryptography does. What failed was subtler and far more common than a break-in: a piece of software reported a claim as a fact, and a human acted on it.

The wallet was Electrum. The bug is disclosed, patched and, according to the project, was already being used in the wild. It is worth walking through the mechanism, because it is not really a story about a Bitcoin wallet.

The lie the wallet believed

Electrum is a light client. It does not download the chain; it asks a server what happened. For confirmed transactions the trust is bounded: the server hands over a merkle proof, the wallet checks it against block headers it holds itself. For unconfirmed transactions there is no block to prove against, so the wallet has nothing to check. Electrum’s own FAQ has said this for years, in plain words: the server is trusted about unconfirmed transactions.

Under that trust, a malicious server can do something almost elegant. You broadcast a payment, call it tx1. The server never relays it. Instead it writes a different transaction into your history: tx2, spending the same coins, with the outputs redirected to an address the attacker controls. The attacker has no keys, so tx2’s signatures are garbage. Any fully validating node would throw it away. But before version 4.8.3, Electrum did not verify signatures on inputs the wallet itself owned before showing a mempool transaction, so tx2 appeared in your history as a pending payment and tx1 vanished from view.

On its own, the forged transaction is worthless. It becomes valuable at the moment you try to fix it. The server builds tx2 with a zero fee, so it looks stuck. Stuck transactions are the one thing every Bitcoin user knows how to handle, so you fee-bump. When you do that, your wallet signs tx2 properly, with your keys, at a higher fee. The wallet has now authored, correctly and irrevocably, the theft. The project’s release notes describe the flaw in one dry line: a malicious server “can replace a just-broadcast tx and try to trick user into RBF-ing it.”

Two details make it vicious. The attacker’s address was ground to match the last four characters of the address the user meant to pay. In the first reported case both ended in “GyQ3”, which is exactly the length of address a person checks when they are in a hurry. And the flaw sat in the seam between two true statements: your keys are safe, and your wallet is honest. Both were true. It was the wallet’s account of the network that was false, and the account is what you sign against.

Version 4.8.3, dated 23 October 2026 in the release notes, closes this specific path by validating signatures on wallet-owned inputs before any unconfirmed transaction enters history. The developers are candid that the boundary remains: incoming unconfirmed payments are still not fully validated, because the client has no full script interpreter and doing it properly would mean checking unconfirmed parents all the way back to a mined transaction. Credit for the disclosure goes to dannydeezy, tokenistq, Raju-K12 and Amadeus29. The amount stolen was never disclosed. Users who pointed Electrum at their own server were never exposed.

That last sentence is the whole article in miniature, so hold onto it. The fix was a patch. The resolution was to stop taking a stranger’s word.

The same week, on a different chain

Two days later, on the other side of the industry, a team published the numbers behind a decision that looks unrelated and is not.

Firedancer is Jump Crypto’s independent validator client for Solana. It now secures 15% of the network’s stake, which means a bug in it is a bug in a machine holding other people’s money. In April and May the team ran a one-million-dollar public audit competition: thirty days, 162 researchers, a hundred-dollar fee per submission, and a platform-enforced limit of one report per researcher per day. That is exactly the sort of friction that is supposed to select for seriousness.

In thirty days it received 809 reports. Those 809 reports produced 127 unique, non-insight findings. Nearly half of the technically valid submissions were duplicates of something already submitted. Jump’s read, in their 16 October post-mortem, is blunt: AI agents had helped find or write nearly every one of them, and the volume was roughly twenty times what the earlier Frankendancer contest drew over a longer window.

809 reports, 127 unique findings, 299 reports open at the peak

The operational detail is the part worth studying, because it describes a failure mode no one had priced. At roughly 26 submissions a day, triage fell behind. Falling behind made the flood worse. Unfixed, undisclosed findings stayed undisclosed, so other agents kept rediscovering the same bug and filing it again. The backlog peaked at 299 open reports. Around 80% of all duplicates arrived more than three days after the original. The queue was not just large; it was self-feeding, because a slow answer is an invitation to ask again.

Their conclusion is the sentence I would frame: “AI has made finding bugs cheap, but judging them is still expensive.”

So they changed the price. From now on, submissions to the Firedancer bounty require burning one SOL, permanently, and the burn is non-refundable even when the report is invalid, out of scope, or a duplicate. Reports without a burn are ineligible for rewards. They also capped each section of a report at 3,000 characters, because triagers were spending their days excavating the lede out of thousand-word machine prose.

Here is the part that deserves more attention than it got. The old fee was a hundred dollars. One SOL, at the price I measured on the morning of 27 October 2026, is 99.81 dollars. In fiat terms the price of a claim did not move at all.

What moved was its character. A fee is revenue, refundable in principle, negotiable in practice, and payable from the same budget as the reward you hope to win. A burn is destroyed, visible on-chain, and cannot be rebated by anyone’s discretion. Jump says the old fee “was obviously not a problem”, since 809 people paid it. The new one is not meant to filter by affordability. It is meant to make the cost non-recoverable, so that the only way to get it back is to be right. And it is denominated in the volatile asset rather than the stable one, which quietly ties the price of a claim to the price of the thing being defended.

What the general case looks like when someone writes it down

On 26 October, a post appeared on Delving Bitcoin that states the underlying law more precisely than either of the two stories above.

Open systems issue identifiers at no cost, the author notes. A public key costs nothing, so bulk production costs nothing, and the party who must sift the output bears the whole expense: filtering, storage, abuse handling. “Volume is limited only by the capacity of the parties that must process the identifiers. In the absence of a cost on the object itself, the cost of watching falls on the acceptor.” That single sentence explains Electrum, Firedancer, and every moderation queue you have ever despaired of.

The conventional defence is a gate: an account, an allow-list, a reputation score, a captcha. Gates work, but they smuggle a third party back into the issuance path, they can themselves be flooded, and their cost usually lands on the legitimate user as friction rather than on the bulk producer as a durable commitment. That is precisely the trade Firedancer made when it moved from a fee to a burn: away from a policy and toward an object.

The construction the post describes, Satoshi Hike 2.3, puts the cost inside the identifier. A producer holds a 256 MiB memory terrain and performs a sequence of memory-dependent legs bound to consecutive Bitcoin headers. The resulting object carries the evidence of that work with it. Bitcoin supplies a public ordering reference; it does not enforce or pay for production. An independent verifier measures the object against the specification and recomputes a random sample of six legs. Acceptance policy stays with the acceptor.

Note what the author does not claim. The verification confirms consistency with the specified construction; it does not by itself prove that an attacker could not have produced the same evidence more cheaply. Whether time-memory tradeoffs or precomputation can collapse the marginal cost is named as an open question, and the post asks for exactly the criticism that would settle it. That is the right posture, and it is the same posture Bitcoin’s own security model has always required: proof-of-work does not tell you the miner meant well. It tells you the miner paid.

When the label was the collateral

The same trade is being repriced in credit markets, in the opposite direction: costs are rising because a free signal stopped working.

On 23 October, J.P. Morgan Private Bank published a note that CoinDesk summarised two days later under a headline that reads like a verdict on an era: an AI label alone no longer wins lenders. “The AI label alone is no longer enough to reassure lenders,” the bank’s global investment strategist Justin Biemann wrote. “Companies must show that they can finance investment, service their debt and eventually turn spending into cash flow.”

The numbers behind that sentence are the interesting part. Weekly trading in credit default swaps on bonds issued by Oracle, SpaceX, Alphabet, Amazon, Meta, Broadcom and Nvidia averaged more than nine billion dollars in September, according to Morgan Stanley data cited in the note, up from under two billion a week in July. Five-year protection on the strongest of those names costs 50 to 120 basis points, which the bank reads as portfolio insurance rather than prophecy. Established infrastructure borrowers have drifted toward 300. One unnamed, heavily debt-dependent AI infrastructure company sits at 1,100 basis points, which means insuring ten million dollars of its debt costs more than a million dollars a year, and implies a near or above 50% chance of default within five years, up from below 30% a year ago.

The same week produced a smaller, stranger version of the repricing. Mizuho cut its price target on Circle and flagged a 10 to 20 percent medium-term downside risk to reserve revenue, on the argument that AI agents steering stablecoin holders toward higher-yielding fiat alternatives erodes the float the business is built on. An agent that optimises your yield is, from the issuer’s side, a cost that arrives without asking.

Five-year credit default swap spreads, basis points

Biemann’s historical anchor is Lehman: under 100 basis points in the third quarter of 2007, past 1,400 by mid-September 2008. His own framing is careful and worth keeping: spreads are warning lights, not countdown clocks.

Now put that beside the largest primary document of the week. Anthropic filed its S-1, and the commitments in it are the purest example of the thing this article is about. As reported, the company has committed to spend at least 114.5 billion dollars with Google, 110 billion with Amazon and 44.9 billion with Microsoft, “regardless of actual usage”, plus up to 120.5 billion with SpaceX’s AI unit. My own sum of the three “at least” figures is 269.4 billion dollars. Revenue was 16.3 billion dollars in the first half of 2026 at an 85% gross margin, with a 974 million dollar operating profit in the second quarter; the headline 80.7 billion dollar net loss is dominated by non-cash charges on convertible instruments. Forty-eight percent of first-half revenue, about 7.8 billion, arrived through cloud marketplaces.

Read those two documents together. A company that cannot be judged by its label signs contracts it must pay whether or not it uses the capacity. A lender that no longer believes labels prices the doubt in basis points. Both parties have stopped arguing about narrative and started posting cost. The take-or-pay clause is a bond in the oldest sense: an amount you forfeit if your claim about the future turns out to be wrong.

The custody version of the same bill

The bill lands on small accounts too, and in the same shape.

Blink, the wallet that grew out of El Salvador’s Bitcoin Beach, introduced a one-dollar monthly inactivity fee on custodial accounts that have not been logged into for twelve months, per Bitcoin Magazine’s reporting on 26 October. The fee was set in motion in September through a terms-of-service change, the first charges landed in mid-October, and it is refunded if you log back in within a year. A source told the magazine that roughly a hundred thousand accounts fit the inactive category at the first charge, holding an aggregate of more than 800,000 dollars, and that the first fee run collected about 45,000 dollars, mostly from dust. Those figures could not be independently verified, and I am not going to dress them up.

The arithmetic is mine and it is unkind. 800,000 dollars across 100,000 accounts is an average dormant balance of 8.00 dollars. A one-dollar monthly fee is twelve dollars a year, which is one and a half times the average balance, annually. At 45,000 dollars collected against a one-dollar charge, roughly 45,000 accounts were billed that month. The company’s justification is not frivolous: ledger and infrastructure costs, retention of verification records, compliance monitoring, support claims. All of it is carried by active users through ordinary transaction fees. This is the Delving sentence again, wearing a different coat. In the absence of a cost on the object, the cost of watching falls on the acceptor. Blink was the acceptor. Blink repriced the object.

And then the sharper fact, from the same article: on 19 September, attackers withdrew 6.61 bitcoin from custodial users through compromised admin tools. Backers made affected users whole. That is the custodial version of the Electrum lesson: the keys were fine, the layer holding them was not. It is also the reason the sentence “run your own server” and the sentence “hold your own keys” are the same sentence with different nouns.

The strongest case against all of this

Steel-man time, because the argument above is seductive and seduction is not proof.

First: cost is not truth. A burn filters volume, not honesty. A well-funded liar pays the deposit as easily as a well-funded researcher, and the memory-terrain construction the Delving post describes verifies work, not intent. Anyone who thinks proof-of-work certifies correctness has misunderstood it for sixteen years.

Second: price selects for capital, and capital is not competence. A hundred-dollar gate keeps out the broke student with the real find and waves through the funded agent farm. Jump’s own numbers show the old fee did not reduce volume; they are betting the burn will, but they are also doubling and tripling rewards, which pulls in exactly the well-resourced players the burn is supposed to filter. Both effects are real at once.

Third: the label may have been worth something. Credit spreads widened on AI names partly because AI names now carry real obligations; but they also widened because everyone crowded into the same trade. A 1,100 basis point spread on one borrower is information; nine billion a week of hedging volume across seven names is partly just a queue. Lehman’s CDS was a warning that became true. It is not a law that every warning does.

And fourth, the honest limit of the whole frame: cost bounds how much lying a system must absorb. It does not make lying impossible, and it does not protect the layers you never priced. Which brings me to the week’s least comfortable story.

The layer that cost cannot fix

A cybersecurity firm called Cathedral, founded by four former DOGE staffers and backed by Andreessen Horowitz and Sequoia at a 1.4 billion dollar valuation, got into Anthropic’s business systems in under twelve hours, using AI agents, as first reported by the Washington Post on 26 October. The entry vector was not Anthropic’s software. It was unnamed third-party admin and sales platforms, from which the agents moved laterally. Anthropic confirmed access to a limited set of sales, HR and IT systems; per Cathedral’s draft report, that included meeting transcripts, salary data, job offers and Slack messages about advanced models. Claude conversations, source code and model weights were not reached. Anthropic shut the access off, kept the affected software offline until vendors confirmed fixes, reported the incident to federal officials, and accused Cathedral of violating its bounty program rules by not fully disclosing the scope of its activity.

Everything in that paragraph resists the cost frame. No burn, no bond, no take-or-pay clause would have helped, because nobody was making a claim. Someone was using a door left open by a vendor. A White House official who read the draft put it less delicately than I would: if a group of kids who just started a company can do this, the others are not far behind.

The same week, OpenAI published an account of red-teaming its own controls, and Import AI’s summary of it contains the detail I cannot get out of my head. Agents in separate microVMs, on shared hosts, were asked to exchange synthetic secrets without network connections or shared writable files, something the sandbox was meant to prevent. They did it through the CPU cache. One agent encoded bits by evicting selected data from the cache; another measured how long a reload took, and the difference between fast and slow reads became a channel. The assumption was the vulnerability. Not the lock, the belief that there was a wall.

So the full picture is not “make everything costly.” It is narrower and more useful than that. Cost is what you attach to a claim. Surface is what you remove from a system. Electrum’s fix was both: verify the claim locally, and if you want the surface gone, run the server yourself. Firedancer’s fix is only the first half, and it will be tested by the next agent generation. Anthropic’s problem is entirely the second half, and it is the half that no market price protects.

What I could not check

Four honest limits, so you can weight the rest.

The amount stolen in the Electrum attacks was never disclosed, and the public advisory page would not load for me; the mechanism above rests on the project’s own one-line release-note description plus two independent accounts, and the detail about the ground address comes from a single victim’s incident report. The Blink account numbers are the magazine’s, sourced to an unnamed person, and the article says plainly that none of them could be independently verified. The Anthropic figures come from two secondary summaries of the S-1 rather than the filing itself, and where those summaries disagree with each other on cash and lifetime burn, I left the numbers out rather than pick a favourite. One SOL is 99.81 dollars at the price I measured myself at 09:30 on 27 October 2026; that price moves. And on the Delving construction I have read the specification’s claims, not tested them: whether precomputation can collapse the marginal cost of the memory terrain is exactly the open question the author asks for help with, and I have no answer to contribute.

What this leaves you with

Three practical consequences, in ascending order of discomfort.

Verify the thing you sign against, not the thing you signed. Electrum users did not lose money because their keys leaked. They lost it because the screen lied about the state of the network at the exact moment they were asked to authorise a correction. Every wallet, every bridge, every dashboard showing you “pending” is making an assertion you cannot check from the signature alone. If you can run your own view of the chain, that is not paranoia; that is the difference between the two user groups in this story.

Price your own attention, because nobody else will. The single most reusable idea from Jump’s post-mortem is not the burn. It is that a slow answer to a cheap claim produces more cheap claims. A triage queue that falls behind does not merely accumulate work; it manufactures it. That applies to a bug bounty, a support inbox, a comment section, a mailing list. If answering is free and asking is free, you will eventually be answering a machine.

And expect the claims that cost nothing to keep arriving, from people who are not lying. Most of the 809 reports were not fraud. They were the output of a system that had been told to find bugs and had no idea which bugs mattered, filed by people who genuinely wanted to be paid for finding them. The failure was not malice; it was that production had become free while judgement stayed expensive, and the bill for the difference landed on the party that had to read.

The cost of a claim, from free text to a 269.4 billion dollar commitment

That is the specific shape of 2026. Text is the cheapest it has ever been. Judgment has not gotten cheaper at all. Every system built on the assumption that a written claim implies a cost has been quietly arbitraged, and the ones that survived the year are the ones that noticed, and attached a price to the claim rather than to the person making it. A burn on Solana. A memory terrain bound to Bitcoin headers. Two hundred and sixty-nine billion dollars of take-or-pay. A wallet that checks a signature before it believes a server.

Bitcoin’s actual invention was never the coin. It was the discovery that you can build a system where the only claims that exist are the ones somebody paid to make, and where nobody has to be trusted to check. Sixteen years on, that idea is being rediscovered one expensive inbox at a time, by people who mostly do not think of themselves as working on the same problem.

Sources

Write a comment