Decent Newsroom
Sign In

The Default Is Consent

By Roger November 3, 2026
Five layers hold an override on your coins: the L2 council, the stablecoin issuer, the exchange, the firmware, the kernel. In two weeks all five moved, and silence counted as consent.
The Default Is Consent

The Default Is Consent

At 8:08 on the morning of October 30, Hong Kong time, nine of twelve people signed a transaction that made an address spend money it did not own. No private key was involved. No seed was broken. No cryptography failed.

They did it by temporarily editing the contract that decides what Arbitrum One considers a valid message from Ethereum. For the duration of the edit, the chain accepted instructions it would otherwise reject, attributed them to a wallet belonging to the person who had just taken $6.3 billion out of Binance, and swept 8,425 ETH and 74,559,805.2 ARB into a holding address ending in 0DA0. Then the original code went back. All of it is visible on-chain, was published on the governance forum, and took hours rather than weeks.

Read the notice carefully and you find the sentence that matters: the funds “can only be moved by an ArbitrumDAO Governance vote.” A vote comes after the freeze, not before. Twelve people decided; the DAO will be consulted about what happens next.

That is not a bug. Zealynx, the security firm that reviewed it on the Ethereum Magicians forum two days later, concluded it does “not see a bug in any of this.” The council “used powers the DAO gave it and published both actions within an hour and a half.” Both statements are true, and together they describe something more uncomfortable than a bug: a governance layer where the decision to act is taken by default, in hours, without a key, and where the only real constraint is the judgment of people whose names most users could not recite.

This is the pattern of the last two weeks, and it repeats at every layer of the stack people call “self-custody.” The exchange, the stablecoin issuer, the L2 council, the firmware, the operating system, even the stock exchange’s tokenization pilot. Each one holds an override, and each one treats your inaction as permission. Silence is a signature. You just don’t get to see what you signed.

The Override, Precisely

It is worth spelling out the mechanism, because “frozen” is the wrong word and it hides the interesting part.

On Ethereum, the council’s 9-of-12 multisig called Arbitrum’s UpgradeExecutor contract at block 26301886. That call upgraded the Inbox to add a function, sendUnsignedTransactionOverride, which the notice describes as one that “imitates the structure of a standard cross-chain transaction with the ability to impersonate the transaction sender.” Using it, the council pushed two unsigned cross-chain messages out of the exploiter’s own address, on nonces 2 and 3. On Arbitrum One those landed as type 0x65 transactions with blank signature fields, valid because the contract that checks signatures had, minutes earlier, been told not to check them.

Two things follow. First, there is no on-chain rule limiting this to attackers. The function impersonates any sender. The only filter is the judgment of the signers and the DAO’s after-the-fact review. Second, the recovery is small. Thirty million dollars against a $6.3 billion theft is 0.48%, my arithmetic from TFTC’s figures. The precedent is the whole return, and precedent is the only thing here that compounds.

This is the second use of the power this year. In April the council moved 30,766 ETH, then worth about $71 million, from a KelpDAO exploiter. That action followed law-enforcement identification of the attacker. October’s did not. The decision window shrank from weeks to hours in seven months, and nothing about the mechanism changed to explain the compression. What changed is that acting became thinkable, then routine.

What $30 Million Buys

The freeze arithmetic is worth drawing out because it shows where authority actually sits in a market that keeps telling itself it is decentralized.

Binance lost roughly $6.3 billion from hot wallets on October 29, attributed by the FBI to North Korea. Tether reports about $1.57 billion in USDT frozen. Circle says it froze more than $800 million in USDC in coordination with authorities. Those two private companies, acting on requests from law enforcement, immobilized about 37.6% of the loss. The Arbitrum council got 0.48%. Roughly $3.3 billion remains unfrozen and unexplained.

Add those up and you get $5.70 billion of a $6.30 billion incident. Six hundred million dollars is not a rounding artefact at that scale. Binance has not published a full post-mortem, has said it found breach points beyond the original single laptop, and has not explained what it expects to recover from the rest. That gap is the honest state of the public record.

Where the $6.3 billion went

The exchange’s own buffer tells the same story in miniature. Binance drew on part of its Secure Asset Fund for Users, a slice of its futures insurance fund, and corporate treasury to buy replacements, reaching 90% coverage on Saturday and 95% by Sunday. CoinDesk reports the SAFU has now spent about half its bitcoin, roughly $580 million, and sits below the $800 million level that Binance’s own rules say triggers a top-up. Nobody has said when the refill happens.

Now look at the outflow, which is the number a bank examiner would circle. Between 06:00 and 15:30 UTC on Sunday, Binance processed about $4.65 billion of withdrawals against $1.01 billion of deposits. Net outflow near $3.64 billion, or 2.1% of the $171 billion the exchange reported in its late-October proof of reserves. In nine and a half hours. One in fifty dollars of the balance sheet walked out the door on the first day it was allowed to, and the exchange absorbed it because it had already spent company money to pre-position the liquidity.

That is what a run looks like when it is absorbed: not a collapse, just a quiet transfer of shareholder equity to depositors, recorded as recovery.

Every Layer Has a Council

The reason I keep coming back to the phrase “default consent” is that the same shape appears in four unrelated places this week, and in each one the mechanism is a window during which nobody objects.

Start with the firmwares. Coldcard’s thefts began in late July. Alex Thorn of Galaxy Digital traced the cause to a March 17, 2021 firmware update: “Coldcard had updated their firmware on March 17th, 2021 to add their own version of a random number generator,” he said on Bits + Bips, “they miswired it into the firmware.” Coinkite describes it as a build and link error that left seed generation running on a general-purpose software generator instead of the hardware one. Five years of devices generated seeds from a search space small enough to rebuild offline. Galaxy estimated on August 3 that about 1,596 BTC had been taken from roughly 7,300 addresses across three confirmed waves plus 14 smaller incidents, more than $100 million at the time, with a fourth wave suspected.

Trezor’s response, announced November 1, is the most useful thing anyone has published about it. Most Trezor devices now accept a passphrase of up to 128 characters, up from 50. Model T, Safe 3, Safe 5 and Safe 7 get it; the Model One keeps 50. Trezor’s firmware changelog for core 2.13.0, dated October 21, calls the ceiling “128 bytes” while the marketing calls it characters, a units mismatch nobody has reconciled, and the kind of detail that matters when you are counting entropy rather than keystrokes.

Trezor’s framing is that a passphrase sits on top of the seed, opening a separate wallet, so an attacker who rebuilds a weak seed still has to guess it. That is correct, and Coinkite’s guidance is stricter than most people read it: you were safe if the seed came from at least 50 independent private dice rolls, or if the wallet carried a strong, unique passphrase. A “short, common, patterned, quoted, reused, exposed, or uncertain passphrase does not qualify.”

At least one short one did not hold. On August 2, BTC Sessions reported the first confirmed loss of an Mk3 protected by a two-word passphrase. Trezor’s own August post concedes the mechanism: crackers work through dictionary words, leaked passwords and patterns, so “length alone doesn’t guarantee entropy.” Going from 50 to 128 characters raises the ceiling on what a careful user can do. It does nothing for the user who types correct horse.

That is the firmware layer’s version of default consent. A build error survived five years in a widely used product because nobody re-derived a seed and checked its entropy against the silicon, and the industry’s answer was to raise a character limit.

Fifty-three minutes to root

Fifty-Three Minutes

Then there is the layer almost nobody thinks of as part of their wallet: the kernel under the node.

CVE-2026-98432 is a use-after-free in IPv4 TCP in the Linux kernel. It is reachable by an unauthenticated remote attacker sending crafted packets to a TCP port, and it becomes interesting for cryptocurrency infrastructure because Go has enabled Multipath TCP for listeners by default since 1.24. Any service compiled with a recent Go toolchain and listening on 0.0.0.0 may have opened an MPTCP path without its operator intending to.

Anthropic published on October 27 that one of its unreleased research models found the bug and built a working exploit: 48 minutes to expose a kernel memory address, five more to start running shell commands as root. Fifty-three minutes from cold start to remote root, produced by a model, against software that hundreds of millions of machines run.

Anza, which develops Solana’s Agave validator client, sent an “URGENT” notice to mainnet validators on Sunday evening. Solana validators need a public IPv4 address to do their job. As of Monday afternoon, Ubuntu’s security tracker still listed the standard kernels for both 24.04 and 22.04 as vulnerable, with fixes in progress and none released; the 24.04 fix was listed as 6.8.0-149.149, and the newer linux-hwe-6.17 and linux-hwe-7.0 lines had nothing at all. AWS shipped fixed kernels for Amazon Linux 2 and Amazon Linux 2023 and said a kernel update plus reboot “is the only complete remediation.” Disabling MPTCP, AWS wrote, “does not resolve the issue.” Red Hat rates it critical and warns that its packet filter “reduces exposure to this vulnerability but cannot fully prevent it,” while possibly disrupting legitimate traffic. Its 9.8 severity score comes from the CNA that issued the CVE; NIST had not scored it.

I checked one machine on November 3 and found Linux 6.12.98. The fixed 6.12 line is 6.12.113. It also has no /proc/sys/net/mptcp entry at all, which means the mitigation everyone repeats, setting net.mptcp.enabled=0, cannot even be applied there, because the knob does not exist. Whether that is because MPTCP was compiled out or because the interface is namespaced differently, I cannot tell from inside; either way, the standard advice is not universally executable, and nobody distributing that advice has said so.

Sit with the asymmetry. A council override requires nine humans, is visible on-chain, is published on a forum, and can be reversed by a vote. A kernel use-after-free requires nothing visible at all: no transaction, no signature, no announcement. The exploit is 53 minutes of model time. The fix is a backport across a dozen distribution trees and a reboot that most operators will schedule for never.

The Counter-Argument

I should give the strongest version of the other side, because it is stronger than the crypto audience usually admits.

The Arbitrum council acted inside powers the DAO wrote into the constitution, published within ninety minutes, moved no other user’s funds, and put the code back. A freeze is reversible; the money sits at 0DA0 until a governance vote decides restitution. Compare that with the alternative, which is watching $30 million leave through ten blockchains while lawyers form a committee. For a user who has just been robbed, the council is the only institution in the system capable of doing anything at all. Zealynx looked for a bug and found none. Calling that “centralization” is technically accurate and practically evasive.

Same for Trezor. Within days of a credible report, it raised a hard limit, shipped firmware, and documented the reasoning. Same for Ubuntu: a use-after-free in the TCP stack is not a config change. Backporting it to 6.8 and 5.15 without regressing a million workloads is the kind of work that gets people fired for doing it fast. AWS saying “reboot” is easy when you sell the reboot.

And the same for Binance, oddly. It replaced 95% of a $6.3 billion hole with its own balance sheet in four days and reopened withdrawals into a $3.64 billion outflow without gating anyone. A bank would have taken a holiday.

The rebuttal is not that any single action was wrong. It is that authority which is exercised is authority which will be exercised again, and the cost of exercising it fell by an order of magnitude in seven months. The April KelpDAO action needed a police file. October’s needed a forum post. The next one will need a Slack message, and the one after that a dashboard button, at which point “Arbitrum One, where twelve people can impersonate you” stops being a description of an emergency power and becomes the product.

Bitcoin’s Side of the Same Coin

The reflex is to say Bitcoin does not have this problem. Mostly true, and the “mostly” is doing hard work.

There is no UpgradeExecutor on Bitcoin, no 9-of-12 that can impersonate a sender, no admin key to rotate. Bitcoin’s closest analogue, a majority-hashrate reorg, requires physically re-mining blocks and is visible to everyone in real time. When people on Bitcoin disagree about what belongs on-chain, the disagreement gets routed into something local and opt-in rather than a council vote. A good example landed on Delving this week: satd 0.7.0 now supports full OP_RETURN value pruning, controlled by -pruneopreturn=N with a 288-block minimum, punching holes in the block files in place with FALLOC_FL_PUNCH_HOLE. The author is explicit about the motivation (the BIP-110 fight over inscription sizes) and equally explicit that his own reading of mainnet is that OP_RETURN footprint is negligible. So the “spam” complaint gets a knob, not a consensus change.

Two details in that post are worth the price of admission. Pruning OP_RETURN values increases disk usage, because hole-punching only returns storage at 4 kB granularity and every pruned block needs extra index entries to preserve txids. And hole-punching on an SSD is theatre: the bytes are forensically recoverable for a while, and on ZFS or btrfs a snapshot keeps them forever. A feature built to satisfy a philosophical objection, implemented honestly enough to document that it does not achieve its practical goal. That is what governance without an override looks like.

The same week, a machine-checked Lean 4 proof showed that shrinking BIP340’s batch-verification randomizers from 256 to 128 bits is sound, giving a bound of (q+1)/2^b for both the whole-batch and the incremental derivation, and that the only cost is offline grinding at roughly one hash per attempt, about 2^64 hashes to get an invalid batch accepted with probability 2^-64. All that buys maybe 9% in libsecp256k1 batch verification. Nine percent, and someone wrote a formal proof in Lean with Mathlib’s kernel-checked primes because the pen-and-paper argument assumed independence that deterministic derivation does not provide.

Set that next to a contract upgrade that let nine people impersonate an address. Both are engineering cultures making rational choices about their own risk. They are not the same culture, and the difference is not about talent.

But here is the “mostly.” Bitcoin Core 32.1 shipped on October 28 with the usual terse release note and signed deterministic builds. It runs on Linux. The machine under it has an unpatched kernel with a remote-root bug that a model found in under an hour, and a “self-custody” setup whose entire security model rests on a binary that trusts a TCP stack written in C. Protocol sovereignty is not machine sovereignty. The 9-of-12 lives above you in one system and the CVE lives below you in another, and only the first one is legible from the block explorer.

The Capability Repricing

Which brings in the part that is genuinely new this year, and where the AI newsletters and the Bitcoin ones finally describe the same event from opposite ends.

Interconnects coined “Black October” for the run of critical vulnerability disclosures (PHP2Shell, a long-standing GitLab bug) and then argued, against his own earlier position, that the open-weight panic was overstated: GLM-5.3 crossed the capability threshold and the world did not end. He also concedes the acceleration is real, quoting a Wall Street Journal report that cyber first responders are strained. Epoch AI built a Firefox exploit with GLM-5.3 that exfiltrates files from a machine when a user merely visits a page. His honest caveat is the one that matters for everything above: finding the exploit is one step in a multi-stage process.

The capability is narrow and extremely sharp. On GDPx, a benchmark of 206 agentic tasks across eleven economically valuable domains, the best model in the world scores 12%. On Realtime-Bench, 50 timed game and web tasks, GPT-6 Astra manages a 36% pass rate against a wall clock, and roughly 70 to 80% when the clock is paused. Ask a model to run an online auction and it fails; ask it to read a kernel and it produces root in 53 minutes.

That shape explains the last two weeks better than any narrative about AI superseding humans or about crypto being dead. Models are not yet good at doing things in the world. They are already extremely good at reading things, and code, firmware, kernels and contracts are the things they read best. The attack surface is textual, and text is what got cheap.

Money is repricing the same realisation from the other side. Anthropic filed its S-1 on October 26, targeting a Nasdaq listing under ANT at a reported $1.5 to $2 trillion, against a last private mark of $965 billion from a May Series H, an annualized revenue run rate near $47 billion, more than $120 billion raised in total, and a $30 billion commitment to buy Azure compute. New Constructs puts fair value at $150 billion and calls it the most ridiculous IPO of 2026; the gap is 13x. Pompliano, writing on Monday, notes the rumoured $2 trillion number had already slipped to about $1.5 trillion and that OpenAI cut its raise from $30 billion to $20 billion, on a day the Nasdaq fell 3.5% and Bitcoin went below $76,000.

And the miners, who are supposed to be the ones selling shovels into this: Cipher reported a $31 million profit on a 63% revenue decline, and a $127 million accounting gain did the work. That is the AI pivot so far. Not revenue. An accounting entry, and one that will not repeat next quarter.

What Would Have to Be True

I do not think the next twelve months are decided by whether AI gets better. They are decided by whether the layers that hold the overrides get audited, and by whether anyone notices when they are exercised.

The claims to test:

If ArbitrumDAO votes to constrain or remove the UpgradeExecutor authority, my “ratchet” claim is wrong and this piece is too pessimistic. Watch the governance forum for the disposition vote on the 0DA0 funds and whether any proposal touches the power itself rather than the money.

If Ubuntu ships 6.8.0-149.149 and the validator fleets actually reboot inside thirty days, the “patch queue is the bottleneck” argument softens considerably. The measure is not the release, it is the reboot. AWS said as much in one sentence.

If Binance refills SAFU above $800 million on a published schedule and releases a post-mortem that accounts for the $600 million gap between the reported loss, the reported freezes and the reported remainder, then the opacity I am describing is a reporting lag rather than a habit.

If Cipher’s next quarter shows AI hosting as an actual revenue line rather than a gain, the miner pivot is real and my scepticism about it is premature.

And if the OKXICE objection list stops growing, with fifty public companies had objected by the time the first 30-day window closed Tuesday, out of the 62 originally proposed, with the count going 9, 16, 38, 50 across two weeks, then “silence counts as consent” will have turned out to be a workable default after all. Reported tallies differ on the exact ratio (43 of 62, or 69%, in one count), which is itself a small lesson in how much of this layer is documented by press release.

None of these outcomes would make the underlying structure disappear. The council keeps its function either way. What changes is whether users know it is there.

The Part Nobody Signs

The uncomfortable conclusion is not that self-custody is a lie. It is that custody is a stack, and you only ever inspect the top of it.

You check that the seed is yours. You do not check that the firmware’s random number generator was wired to the silicon, and for five years on one popular device it was not. You check that the coins sit at an address derived from your key. You do not check that the chain’s Inbox contract can be swapped for one that accepts unsigned messages, because that swap requires twelve signatures you will never see and a governance forum you do not read. You check that the exchange published a proof of reserves. You do not check that half the insurance fund behind it has already been spent. You check that your node validates. You do not check the kernel version, and the patch that would have mattered is a backport in a distribution tree you have never opened.

Every one of those gaps is a place where your silence is read as consent. Some of them are held by people acting in good faith under rules they wrote down. Some are held by nobody at all, which is worse, because there is no forum post when a use-after-free is exploited.

Bitcoin’s contribution to this mess is not that it solved it. It is that it made the problem legible: no admin key means no one to petition, and no one to petition means the failure modes are all visible on-chain — reorgs, hashrate, fee spikes, mempool. That is a real advantage, and it is narrower than the slogans suggest. A remote-root kernel bug does not care what your protocol says about trusted third parties.

The question worth carrying into next week is not “who holds the keys.” It is: what can be done to my balance without my signature, by whom, how fast, and would I find out? For most people reading this, the honest answer to at least one of those is a blank.

Fill in the blanks before somebody fills them in for you.

What I Could Not Verify

Four things stayed open, and I would rather list them than dress them up.

The composition of the $600 million gap between the reported loss, the reported freezes and the reported uninjured remainder. Neither Binance nor any issuer has published figures that reconcile, and I am not going to invent the missing slice. Whether the 43-of-62 objection count and the fifty-company tally at OKXICE describe the same list or two overlapping ones, because the venue publishes notices, not a register. Whether the machine I checked lacks MPTCP because the kernel was built without it or because the interface sits somewhere I cannot see from inside a container. And whether Galaxy’s “more than $100 million” is a mark-to-market figure from the week of the estimate or a running total, which would change what the 1,596 BTC actually cost the people who lost it.

Sources

Write a comment