French Brazilian Hospitality Hit Maker Entrepreneur / Since 2014 Bitcoin investor and from 2017 Digital Assets entrepreneur / newco: Southwind Digital Capital
👉For 4 years, 1 day, and 10 hours, anyone who understood the Orchard circuit could have minted ZEC out of thin air, silently, with no on-chain signature. The bug was disclosed this week. It was found by an AI-driven audit running Opus 4.8, not by an attacker.
1. Call the bug what it is
Two lines in halo2's variable-base scalar multiplication gadget used assign_advice() where copy_advice() was required. As a result, the diversified-address integrity check pk_d = [ivk]·g_d could be satisfied for arbitrary inputs. A malicious prover could spend the same note multiple times with different nullifiers, i.e. counterfeit ZEC inside the Orchard pool, undetectable on-chain because the privacy of the ZK proof hides exactly the inputs that would reveal the attack.
We do not know whether it was exploited. We will probably never know.
2. Four years. Multiple audits. Top-tier reviewers.
Orchard was reviewed by some of the strongest cryptographers in the field before activation. They missed it. Earlier automated audits with Opus 4.7 missed it. Opus 4.8 catches it in roughly 1 in 4 runs when prompted generically. The bug is hard.
And ZK inflation bugs are not new. Zcash itself shipped a counterfeiting vulnerability in Sprout (BCTV14) that survived years before being silently neutralized during Sapling. Similar soundness issues have appeared in circom, halo2, and rollup verifiers since. The pattern is consistent: when the protocol is private, exploitation is undetectable. You patch the bug and hope.
3. What Zcash did right
This was a textbook decentralized incident response:
▶️Audit: a full AI-assisted soundness audit of halo2 + Orchard, scoped end-to-end.
▶️Discover: the agent flagged the missing constraint and worked out the algebra to turn it into an exploit. A working RPC-level PoC in ~6 hours, mostly waiting on tokens.
▶️Coordinate: a soft fork disabling Orchard, prepared and distributed without leaking the bug, activated 2 days and 15 hours after acknowledgement. Coordinating a soft fork across miners, exchanges, and nodes without disclosing why is genuinely hard. They did it.
▶️Disclose: timeline, code lines, math, open questions. No spin.
Worth naming explicitly: Zcash's turnstile invariant caps the value that can ever leave a shielded pool by the value that entered it. Privacy and verifiability inside the same protocol. That is not an accident. That is good engineering, and it is what kept the worst case bounded.
4. The economics of security just changed
AI does not change whether bugs like this exist. It changes the cost of finding them. I wrote about this https://t.co/AeurraJXhB: a missing constraint in a 4-year-old production ZK circuit used to require a top-tier cryptographer with months of context. It now requires a few tokens, an API key, and a well-framed prompt.
The defender benefits. The attacker benefits more, they only need to find it once, and they never disclose.
Orchard is the optimistic version of this story: defense got there first. The pessimistic version is the one we cannot rule out, because the chain is private by design.
5. The only real exit
You do not patch your way out of this asymmetry. You raise the floor.
Formal verification of consensus-critical circuits, every assign_advice audited by SAT solvers and AI for under-constraint, as the reporter himself recommends. Proof-grade engineering that used to be too expensive is now cheap enough to be mandatory.
Hardware roots of trust, secure enclaves, certified secure elements, WYSIWYS. Cryptographic guarantees the user can actually verify, not promises a host can lie about.
Continuous AI-assisted audit of every consensus-critical commit, re-run immediately on the release of any new frontier model.
Zcash didn't just patch a bug. They demonstrated the new defensive playbook: AI-driven audits, decentralized coordination, radical transparency, verifiable invariants. That is the direction the rest of the industry needs to follow.
And those who don't raise the bar for security will be rekt in this new world.
Stay safe. Stay honest about your trust assumptions.
BRAZIL RECORDS $6.9 BILLION IN CRYPTO PURCHASES IN Q1
The Central Bank of Brazil reports that Brazilians purchased $6.9 billion in crypto abroad during Q1 2026, more than doubling the figure from the same period last year.
Stablecoins drove the wave. Of the total volume, $6.8 billion (over 98%) came from stablecoin purchases, which have become a preferred rail for payments and remittances since they aren't subject to the financial taxes that apply to traditional currencies.
The data signals fast-growing crypto adoption in Latin America's largest economy, with stablecoins clearly leading the way as both a dollar-access tool and a cross-border payments layer.
Italy’s richest man is a ghost.
No interviews. Almost no photos.
Yet Giancarlo Devasini is worth $89.3 billion and quietly controls the largest stablecoin on earth.
Here’s who actually runs Tether:
🧵
Passive LPing is pretty fun
When v3 deployed on Optimism 4 yrs ago I made a concentrated position on eth/dai from 1400-3200
I've never rebalanced, it was out of range ~30% of the time
It earned $5400 in LP fees on $4700 position size so far
Brad Pitt’s favorite Adam Sandler story:
Sandler’s acting professor didn’t think he was good enough for acting, so he took him out for a beer to tell him gently.
“You just don’t have it.”
Then one day, Sandler was with his friends in a bar at the height of his career. He was getting big paychecks and all that.
He looked over at a table and realized it was his professor.
He had the perfect chance to rub it in his face.
But he didn’t.
He just introduced his friends to him and simply said:
“That’s the only teacher who ever bought me a beer.”
CURSO COMPLETO DE CLAUDE DE 4 HORAS
Esta es la guía más detallada de Claude que he visto en línea.
Guarda esta página antes de que se te olvide.
Construye herramientas.
Automatiza el trabajo.
Aprende cómo las personas construyen bots y sistemas.
GitLab's founder was told he has bone cancer.
No trials would take him. Doctors signed off.
So he went founder mode on his own survival.
- Built his own treatments
- Used AI to analyze his own tumor data
- Open-sourced 25TB of his medical records for any researcher on earth
Relapse-free since 2025.
The system said he was out of options.
He made his own.
Li as 68 páginas do Release 33-11412 da SEC.
O que ninguém está falando ainda:
1. A SEC nomeou 16 tokens como Digital Commodities. Na página 14, por nome.
Bitcoin, Ether, Solana, XRP, Cardano, Avalanche, Chainlink, Polkadot, Litecoin, Dogecoin, Shiba Inu, Stellar, Tezos, Hedera, Bitcoin Cash, Aptos. Algorand e LBRY Credits.
Mas o mais importante não é a lista. É o critério: ativo cujo valor deriva da operação programática de um sistema funcional e de oferta e demanda. Qualquer token que cumpra esse critério pode entrar. A lista vai crescer.
2. Stablecoins: a SEC deu proteção imediata, antes mesmo do GENIUS Act entrar em vigor.
O GENIUS Act só entra em vigor em janeiro de 2027. Mas a SEC não esperou. Publicou uma interpretação dizendo que "Covered Stablecoins" (USDT, USDC e equivalentes) já não são securities agora.
Detalhe importante: o GENIUS Act proíbe emissores de stablecoins de pagar yield aos holders. Stablecoins que pagam rendimento ou que funcionam como investment contracts (lembram da UST/Terra?) continuam sob jurisdição da SEC.
A separação é limpa: stablecoins que funcionam como dinheiro estão protegidas. Stablecoins que funcionam como investimento, não.
Para o Brasil, maior mercado de stablecoins da América Latina, isso consolida a infraestrutura de dolarização via crypto. USDT e USDC ganham respaldo regulatório formal nos EUA antes mesmo da lei entrar em vigor. Não sei se isso é bom ou ruim.
3. Tokens agora podem "se graduar".
Esse é o conceito mais importante do documento e o que menos vai circular. Até ontem, se um token era vendido como parte de um investment contract, ficava sujeito às leis de securities para sempre. Sem saída.
A SEC criou uma saída. Dois cenários: (a) o emissor entrega o que prometeu (funcionalidade, roadmap, open-source), ou (b) o emissor abandona o projeto e comunica publicamente. Em ambos os casos, o token se separa do investment contract e a SEC perde jurisdição.
Na prática, a SEC criou um lifecycle regulatório: um token pode nascer como security e se tornar commodity. Projetos agora têm um caminho claro: entregue o que prometeu e você sai da jurisdição da SEC.
4. Staking, mining, wrapping e airdrops: quatro safe harbors de uma vez.
O documento dedica 30 páginas a explicar por que essas atividades não são oferta de securities. A lógica é a mesma em todas: são atividades "administrativas ou ministeriais", não envolvem "esforços gerenciais essenciais" de terceiros, e portanto não passam no teste de Howey.
Isso destrói retroativamente a base jurídica de dezenas de ações de enforcement da era Gensler. Validadores, mineradores e protocolos de liquid staking operam agora com certeza jurídica total nos EUA.
5. O Framework de 2019 foi formalmente revogado.
Em 2019, a SEC publicou o "Framework for Investment Contract Analysis of Digital Assets", o documento usado como base jurídica para processar dezenas de projetos cripto. A nota 21 do novo documento diz que essa interpretação o substitui. As regras do jogo mudaram.
6. O que tudo isso significa para o Bitcoin.
Dos 16 tokens nomeados, o Bitcoin é o único que não precisava de nada disso. Não houve ICO. Não há emissor. Não há roadmap prometido. Não há equipe central. Não há investment contract do qual "se graduar".
Os outros 15 tokens ganharam clareza regulatória. O Bitcoin apenas teve confirmado o que sempre foi: o ativo mais limpo, mais descentralizado e mais resistente do ecossistema.
Para quem acompanha economia austríaca: os outros tokens precisaram de um decreto da SEC para serem reconhecidos como commodities. O Bitcoin já havia emergido como commodity pelo mercado, espontaneamente, exatamente como Menger descreveu.
We're accelerating into the Singularity:
> Claude/Anthropic → Fastest to ~$20B revenue ever
> ChatGPT → Fastest ever from 0 to 1B users
> OpenClaw → Fastest GitHub repo ever to 250K+ stars
> Vibe Coding → Adopted by 90% of US coders in shortest time ever
> Cursor → Fastest SaaS to $1B+ ARR
> Lovable, Bolt & Replit → Fastest to $100M ARR
> Tesla FSD → Fully autonomous driving 99% intervention-free
> SpaceX brought more tons on orbit than 4 past years combined
> OpenAI → Targeting $20B+ in 2026
> Suno → $200M ARR, viral top music hits generated by AI
> OpenAI, Scale AI, Anthropic, Project Prometheus, xAI raised almost $100B combined
> Mercor AI → $1M to $500M ARR in ~17 months
> Gamma → Profitable at $100M ARR
> ElevenLabs → $90M to $281M ARR in under a year
> Granny Spills, Lil Miquela & thousands of AI influencers scoring over 1B views
> Google Willow → Solved in 5 minutes what the fastest supercomputer would take 10 septillion years
> AI drug discovery → First fully AI-designed drug in 18 months vs 3–6 years
> AI inference cost → Down 280x in 2 years for the same performance level
> AI context window → from 4k to 1m token in just 2 years
> David Sinclair's longevity experiments in weeks vs 100,000 years
> DNA sequencing 80x+ faster
> AlphaFold went beyond proteins to full genome interaction
> Humanoid robots entering factory floors at scale
> Supercomputing surges
> Startups going from 0 to 1 billion valuation in less than a year
The next 3 years gonna by the most insane years in human history. I'll have my last mega locked in run until 2030 to retire and go offgrid to live a farm life without internet. I dont think we're gonna invent a way to be mentally healthy in the post-ai world. I dont know any mentally healthy person now, everyone is struggling in some form
I just took this screen recording and turned it into a full product demo video in 20 minutes, using only one app.
3D animations, text, AI voiceover, music, and 3D gradient callouts to draw attention to the important parts.
But sure, keep posting Loom videos.