Candle Code

The world has put ~$2T into AI. That’s about 3x what the US spent on the Moon landing, the Marshall Plan and the Manhattan Project combined. Most of it is borrowed. Here’s what I found digging into the money: GPUs and data centers are bought on credit, with the same GPUs and data centers as collateral. Everyone wants to get paid, and nobody can say where the real revenue is. Oracle borrowed a fortune to build Stargate for one client, OpenAI. OpenAI loses money and nobody knows when it pays. Oracle’s bills are due now, and lenders are done lending. Nvidia sells the shovels in the gold rush. It also lends customers money to keep buying its GPUs, including ones that haven’t shipped yet. OpenAI wanted to raise $30B. It got $11B. Anthropic is going public with a ~$80B loss. Both labs lose money, and both are valued at $1T+. The tech itself is real. Opus 5.5 is smarter than the average employee, and a good dev using it can outwork 99% of their peers. So what does this mean for the Nasdaq? The index leans on AI: Nvidia, Microsoft, Google, Meta, Amazon, Broadcom. When the market doubts AI spending will pay back, everything goes down together. That’s already happening. In early November the Nasdaq-100 fell more than 10% from its Oct 6 record, which is an official correction. Then it bounced. Chipmakers led first, and on Nov 4 the Nasdaq gained almost 2% after Democrats won Congress. AI still lagged: Nvidia closed red, CoreWeave dropped ~9%, and some data center builders are down 20%+. Part of that is fear of tighter data center rules from the new Congress. My read: the market has stopped buying anything with “AI” in the name. Money is leaving “build on debt, profit later” for companies with real revenue. If the payback doubts grow, the Nasdaq keeps shaking. The tech isn’t what’s popping. It’s the belief that AI pays off fast. By 2030 AI needs to earn $8.5T. Best case, it earns $3.6T. That’s a miss of more than 2x. Are you trimming AI exposure or buying the dip?

If your iPhone is older than iOS 18.7.7, a single link can empty your Trust Wallet. Last week one guy lost $2.7M. He got lucky: it was USDT, so Tether froze the hacker’s wallet. ETH, BTC or SOL can’t be frozen. Most people won’t be that lucky. It’s called DarkSword. It works on iOS 18.4 through 18.7, and it’s been used in the wild for about a year. Why do hacks keep going up? Simple economics. Hackers have their own market. A ready-made kit is being sold right now for $15K to $30K. It’s delivered as an HTML file, a link or a “document” sent in a chat. One tap and the whole phone is open: Trust Wallet, MetaMask, even your notes. And the buyers aren’t only hackers. Anyone with no morals who knows a friend keeping crypto on their phone can buy it. Most of these hacks are plain social engineering. A link from someone you trust. A file in a group chat. It used to be shady ads on adult sites. Now it’s your DMs. This won’t stop until everyone updates. Update your iPhone now Move your main holdings off your phone Don’t open files or links in chats, even from friends

Democrats are preparing an investigation into the crypto-business of Trump and his family - Bloomberg against this background Trump Media transferred 4,259 BTC worth about $ 344 million to the Crypto Com exchange. This may indicate preparation for the sale of some bitcoins of the company.

My friend had $70k+ in a crypto wallet on an iPhone still running iOS 18. One wrong link in Safari could have emptied it (yes, that one website with hot girls could steal your money). The exploit is called DarkSword. Google found it working on iOS 18.4 to 18.7: you open a link, nothing to download it takes full control of the phone it pulls wallet keys and scans your Photos and Notes for seed phrases What to do: Update to the latest iOS today Don’t open links from strangers in DMs Never keep a seed phrase in Photos or Notes Check your phone, then send this to the friend who never updates.

Took a be and 2 sl on $EURUSD. At the session close, the price fell just a few pips short of the target; consequently, at the London Open, I attempted to catch a pullback to the levels I was interested in. Unfortunately, the Euro moved away right at the open without any prior manipulation.

An approve drainer takes one token. A 7702 signature takes the whole wallet. Approve: you let one address pull one token. EIP-7702 authorization: your wallet starts running someone else’s contract. Why that’s worse: One signature can empty everything, not one token. It’s an authorization, not a transaction, so many people don’t treat it like a risky action. The delegation stays on your wallet. If the contract is malicious, it keeps taking whatever arrives later, until you reset it with a new type-4 transaction. Same lesson as the Binance case: the protocol did what it should. The damage comes from what you let sign it. Before you sign any 7702 authorization, check which contract it delegates to.

Everyone is blaming EIP-7702 for the reported $6.4B Binance drain. It worked exactly to spec. The hole was somewhere else. A normal drainer abuses an approval: one address, one token. A 7702 authorization is a signature, not even a transaction, that makes a wallet run someone else’s contract. That hands over the whole wallet at once. So the real question is why Binance’s signing service signed it. By Binance’s own account (their claim, not confirmed fact), an operator’s laptop reached a service container with signing access. The key never leaked. The attacker just told the signer what to sign. How the drain reportedly went: A 7702 delegation was signed on one hot wallet. It held 50 authorizations, and only the one matching the account nonce is valid. The rest fail silently. One sweep() call took 167,464 ETH plus 63 tokens. Through that same wallet, a call into a Circle smart account moved 823M USDC more. You need to know the exchange’s internal wallet layout to do that. On other chains, plain signed transfers were enough (about 28k more ETH). New deposits kept getting swept, roughly 200M USDT more. What failed: The withdrawal signer accepted everything: transfers, a delegation, an arbitrary call. It should never be able to sign a delegation. Everything went privately straight to blocks, so there was no public mempool warning. Signing was cut after about two hours. The delegation was removed after 3h50m. A delegated hot wallet wasn’t blocked, or even alerted on. The weak point was what the signer was allowed to sign, not the protocol.

Karpathy’s original LLM wiki idea file, the thing to give your AI in step 4: gist.github.com/karpathy/442…