Faking a rich life used to be a paid industry. In 2017 a Moscow company rented out a grounded private jet for photo shoots at $240 a session. By 2020, LA influencers were booking a fake jet-cabin studio on Peerspace for $64 an hour, until a viral thread exposed the set. Now guys are generating the Dubai rooftop, the Monaco marina, and five models draped around them for free. Luxury photos worked as proof for one reason. The backdrop was expensive. A rooftop table in Monaco runs hundreds. Bottle service in Dubai runs thousands. Everyone looking at the photo priced that in without thinking about it. Biologists call this costly signaling. A peacock's tail counts as evidence of health precisely because a sick peacock can't afford to grow one. AI dropped the cost of the tail to zero. And a signal that costs nothing to fake carries no information. The cheat code has a side effect the fakers haven't priced. When fake bills become perfect and free, cash stops working for everyone who holds it, and the same collapse is now hitting the luxury photo. Every AI party picture devalues the real ones too, including the guy who genuinely dropped $30K on that Monaco weekend. "Pics or it didn't happen" held up as the internet's proof standard for twenty years. It ended this year, and status is already migrating back to the one thing a model can't generate. Being somewhere in person.

Big day at PennyWorks: our public dashboard is live! DeFi funds & RWAs can now publicly disclose their NAV and backing data, built from the bottom up. Every transaction parsed, journaled, and rolled into a balance sheet and income statement. No self-reported numbers. No unsubstantiated headline figures. IYKYK To the DeFi community: you asked for a higher bar on transparency. This is it. Accountability starts here. nav.pennyworks.com/vaults/de…

Fees + Volume + Traders + Open Interest are all up and to the right 🚀

If you fear the worst for @neutrl, here's my hypothesis on what's happening. Disclaimer: I do not know the team nor do I have information outside of what's public on X. TLDR: - Their core hedged locked/discounted OTC token strategy involves massive risks. We've seen other strats fail even with the best intentions. see xitter.cf/piggybank_fi/status/20… - Even without with proper hedging, marking these strategies is tricky, details below. - It's possible these issues existed months ago judging by the slow grind down in TVL, transaction level financial records could have uncovered these issues. Hedged Token Strategy Risks You buy tokens OTC at a "discount", money goes out the door. you never "get anything" other than a promise. Right there you can see the issue. How much is that promise worth? How long until the promise gets paid back? and how do you value it before a good spot market exists? Add in the fact that now you are hedging it by putting up even more money as margin to short the PERP, any series of funding games or pumps (especially since these tokens are illiquid) can take you out of the position, as it has for Piggy Bank just a few months before (even with a 2% portfolio allocation). Basically, the losses on the short side could be UNBOUNDED until you get the tokens and close out your hedge. So imagine when Neutrl's position is supposedly 20% of their book (neutrl-recovered.accountable…), the cost of maintaining those hedges can be anywhere from 2% to 200% of the portfolio value. Even if they group the OTC Aggregate and hedges together, you are only a 5x move away from blowing up your entire portfolio, i.e. not 20% losses, but 100%+ losses. Marking to Market The other issue for this strategy is how to mark the book to the most "economically" coherent valuation. The OTC tokens that were bought have no market price, but the PERPs are liquid, so now you are faced with these (all reasonable choices): - Marking the token promise at book value, i.e. value doesn't move until you receive the tokens. This is bad if the hedge moves a lot, because theoretically you don't care about the price (as long as you can cover the margin), you'd make the spread minus funding costs. - Marking the token promise to a fixed spread vs the PERPs. This makes the "market value" of your book stop moving regardless of the PERP valuation changes. It's great in practice, but can't insulate you from actual P&L of the PERPs if the token unlock is still months in the future. Even if the PERPs didn't move much, you'd be paying funding costs, so it'd look like a negative drag on your performance until the unlock. - Mark the token promise to slowly accrue towards the PERP price. This will make it look like the fund is slowly making money by accruing the OTC discount gradually over the course of the unlock period. Again, these are all choices that have to be made at the end of the day and there's no "right" answer, depending on what you want to show. If we assume they had a smooth performance gain over the last few months, then it's likely they did option 3. Now the worst part of option 3 is people end up redeeming, and the vault has to pay out based on the mark with cash they haven't received, since they need to first get the token, and then sell it. On top of it all, this doesn't make them immune to the actual volatility of the PERPs, and if they blow out of their hedge, or if the token promise is not met, all of a sudden you'd have to recognize a massive loss, token promise -> 0. Even More Transparency Ironically, this could all have probably been avoided if there was even more transparency. If they had line item balance sheets that had individual marks, or the reason they decided to use a specific token price (similar to how VCs must mark their illiquid tokens), then we wouldn't be in this situation, or this would have been uncovered months ago. Instead of debating whether the actual cash is there today, the debate months ago would have been about risks, whether they should have existed the position given the mismatch of their cash vs the actual accrued P&L. And perhaps it could have turned into a collaborative debate on the appropriate level of risks, potentially allowing the team to unwind their positions much earlier, instead of trying to plug a hole that kept getting bigger. As a NAV provider, we are not claiming that accounting could solve any of the issues above, but having a robust framework on getting detailed balance sheet and transaction level data in front of all those involved (the depositors are fundamentally underwriting the risks) forms the basis for a sustainable yield strategy. Otherwise, simply kicking the can down the road is how we land into situations like these.

NOVITÀ DELL’ULTIMA ORA SU REVOLUT Iniziamo dall’elemento mancante fino a ieri: la casella di posta certificata violata appartiene alla Prefettura di Reggio Calabria (nello specifico, l'ufficio Enti Locali, che fa capo al Ministero dell'Interno). Ma c’è un aspetto grottesco, sollevato oggi da testate specializzate, di natura prettamente giuridico-procedurale. Infatti formalmente la Prefettura coordina l'ordine pubblico, ma non ha la competenza penale per emettere ordini di acquisizione di dati bancari all'estero (i quali spettano alle Procure della Repubblica tramite canali giudiziari dedicati). Il team legale di Revolut ha quindi accettato un finto Ordine Europeo di Indagine (OEI) formalmente inviato da un ufficio amministrativo che non avrebbe mai dovuto emetterlo. E qui a mio avviso la responsabilità di Revolut diventa palese, al netto dei legittimi tentativi della banca fintech di ridimensionare le proprie omissioni, È cosa ben nota infatti che gli accessi PEC governativi siano in vendita sul dark web da anni. Per questo motivo, molti analisti di cyber-risk sostengono che la responsabilità non sia affatto da dividere al 50%, ma che Revolut abbia mostrato una grave "negligenza procedurale". E su questo punto concordo totalmente. Infatti qui siamo davanti al classico conflitto tra Conferma del server vs Conferma del mittente. Come evidenziato dagli esperti di AML intelligence, i sistemi di conformità delle fintech spesso verificano solo che la mail arrivi da un dominio certificato (il server), senza accertarsi se la persona fisica che scrive sia un investigatore realmente autorizzato a richiedere quei dati. E qui passiamo all’errore fatale commesso da Revolut: la mancata verifica "Out-of-Band" Trattandosi di dati sensibilissimi di circa 700 clienti (selezionati chirurgicamente dai criminali tra i profili con i più ingenti portafogli di criptovalute) lo standard di sicurezza avrebbe imposto un controllo incrociato "fuori banda" (es. una telefonata di verifica ai canali istituzionali centrali del Ministero o a Europol), anziché limitarsi a rispondere alla stessa catena di email controllata dagli hacker. E a tal proposito, un dettaglio emerso oggi rende tutta la vicenda ancora più grottesca: è stata la stessa Revolut ad accorgersi dell'inganno dopo ben 5 mesi (un'eternità in termini di cybersecurity). Gli analisti della banca (alla buon’ora) si sono insospettiti per via di alcune anomalie e hanno contattato la Prefettura per altre vie, scoprendo che l'ufficio non sapeva nulla di quelle richieste. Naturalmente adesso il Ministero dell'Interno italiano si trova al centro di un polverone politico, poiché l'account PEC è rimasto in mano ai criminali da marzo a luglio senza che i sistemi di monitoraggio statali se ne accorgessero. In tale ambito, siamo ancora in attesa di una nota del ministero che giustifichi la falla sulla PEC (insistere sulla linea del silenzio sarebbe oltremodo imbarazzante). Per concludere, dibattito ora si sta spostando sui rimborsi e sulle sanzioni dei Garanti della Privacy (italiano ed europeo), che ragionevolmente commineranno delle multe a Revolut, per aver consegnato i dati dei clienti senza adeguate verifiche, come previsto dal GDPR. Una cosa è certa: questa storia ha scoperchiato il vaso di Pandora sulle enormi criticità delle attuali procedure di anti riciclaggio, alla luce dell’incapacità di garantire la sicurezza dei dati personali di milioni di persone. La concentrazione crescente di dati identificativi e finanziari nei sistemi AML e KYC, si sta rivelando fallace. Infatti, più informazioni vengono aggregate e interconnesse, più questi archivi diventano bersagli ad altissimo valore per cybercriminali e furti di identità. #Revolut #Hack

every day around midnight UTC:

🚨Blockaid exploit detection system detected an exploit on an unidentified user's Safe on Ethereum. ~$7.73M confirmed rsETH loss so far. An attacker used a public keeper multicall to drive a custom Uni V4 LP Safe module into an attacker-created hooked pool; the hook unwrapped aEthrsETH to rsETH. Yoink MEV-extracted in-block. 🧵

🚨 BREAKING: Defense Secretary Pete Hegseth’s driver’s license has leaked. A new dark-web service is selling scans of his and 153M+ U.S. and Canadian driver’s licenses. Timestamps on the scans match victims’ visits to Hertz rental counters and cannabis dispensaries. Evidence points to idscan[.]net, an ID-verification vendor used by Hertz, Target, FedEx and 1,000+ dispensaries. The FBI opened an investigation on Tuesday. Nexus claims it has been exfiltrating for over a year and added ~400,000 licenses in 24 hours.

Moonwell just got drained for over $9 MILLION, and its own token is pumping while the attack is still happening. > Moonwell is a lending protocol on Base where users deposit crypto as collateral to borrow other assets against it. > One of its markets accepted a token called $MAMO as collateral, priced using an oracle that reads MAMO's value straight off the open market. > That's the flaw, an attacker didn't need to hack anything, they just needed to move MAMO's price. > They pushed the price of $MAMO up roughly 8x, from $0.0105 to about $0.088, entirely artificially. > That inflated the value of $MAMO sitting in the attacker's own wallet as collateral, on paper, far beyond what it was actually worth. > Against that inflated collateral, they borrowed real assets out of Moonwell's other markets, $cbBTC, $USDC, $wstETH, and $ETH, again and again. > According to on-chain monitoring firm ExVul SkyEye, the single largest transaction alone moved 14.34 cbBTC, worth roughly $1.15 million. > Total drained across cbBTC alone: 71.36 cbBTC, worth approximately $5.7 million > With the broader attack across all four assets reported at over $9 million and reportedly still ongoing. > Every transaction is sitting in plain sight on Basescan, moving into a single wallet. > And somehow, in the middle of all this, Moonwell's own governance token was up 25% in the past hour. The attacker didn't break in through code. They just moved one number on the open market, and the protocol's own rules did the rest.

Sorry, @fundstrat. There is no second best.

Let's tokenize everything. Tokenization is one of the best ways for countries to "raise money", or attract FDI (Foreign Direct Investment). Which country/company won't want to sell their (tokenized) stocks to everyone in the world? I support tokenization on all blockchains. While this creates the "fragmented liquidity" problem, it is the fastest way to grow the sector, with multiple players pushing. Fragmentation can be somewhat addressed if there is high interchangeability amongst different issuers, which is important.