Candle Code

The world has put ~$2T into AI. That’s about 3x what the US spent on the Moon landing, the Marshall Plan and the Manhattan Project combined. Most of it is borrowed. Here’s what I found digging into the money: GPUs and data centers are bought on credit, with the same GPUs and data centers as collateral. Everyone wants to get paid, and nobody can say where the real revenue is. Oracle borrowed a fortune to build Stargate for one client, OpenAI. OpenAI loses money and nobody knows when it pays. Oracle’s bills are due now, and lenders are done lending. Nvidia sells the shovels in the gold rush. It also lends customers money to keep buying its GPUs, including ones that haven’t shipped yet. OpenAI wanted to raise $30B. It got $11B. Anthropic is going public with a ~$80B loss. Both labs lose money, and both are valued at $1T+. The tech itself is real. Opus 5.5 is smarter than the average employee, and a good dev using it can outwork 99% of their peers. So what does this mean for the Nasdaq? The index leans on AI: Nvidia, Microsoft, Google, Meta, Amazon, Broadcom. When the market doubts AI spending will pay back, everything goes down together. That’s already happening. In early November the Nasdaq-100 fell more than 10% from its Oct 6 record, which is an official correction. Then it bounced. Chipmakers led first, and on Nov 4 the Nasdaq gained almost 2% after Democrats won Congress. AI still lagged: Nvidia closed red, CoreWeave dropped ~9%, and some data center builders are down 20%+. Part of that is fear of tighter data center rules from the new Congress. My read: the market has stopped buying anything with “AI” in the name. Money is leaving “build on debt, profit later” for companies with real revenue. If the payback doubts grow, the Nasdaq keeps shaking. The tech isn’t what’s popping. It’s the belief that AI pays off fast. By 2030 AI needs to earn $8.5T. Best case, it earns $3.6T. That’s a miss of more than 2x. Are you trimming AI exposure or buying the dip?

If your iPhone is older than iOS 18.7.7, a single link can empty your Trust Wallet. Last week one guy lost $2.7M. He got lucky: it was USDT, so Tether froze the hacker’s wallet. ETH, BTC or SOL can’t be frozen. Most people won’t be that lucky. It’s called DarkSword. It works on iOS 18.4 through 18.7, and it’s been used in the wild for about a year. Why do hacks keep going up? Simple economics. Hackers have their own market. A ready-made kit is being sold right now for $15K to $30K. It’s delivered as an HTML file, a link or a “document” sent in a chat. One tap and the whole phone is open: Trust Wallet, MetaMask, even your notes. And the buyers aren’t only hackers. Anyone with no morals who knows a friend keeping crypto on their phone can buy it. Most of these hacks are plain social engineering. A link from someone you trust. A file in a group chat. It used to be shady ads on adult sites. Now it’s your DMs. This won’t stop until everyone updates. Update your iPhone now Move your main holdings off your phone Don’t open files or links in chats, even from friends

Democrats are preparing an investigation into the crypto-business of Trump and his family - Bloomberg against this background Trump Media transferred 4,259 BTC worth about $ 344 million to the Crypto Com exchange. This may indicate preparation for the sale of some bitcoins of the company.

Hedge funds count cars in parking lots from space to trade earnings. You can do it now with $15 and an AI. How it works: Pick a retailer and 20 of its stores Pull a satellite photo of each lot. Some providers sell existing images from about $15 each Have an AI count the cars, same week this year vs last year Fuller lots before earnings could mean more sales. Emptier lots could mean a miss The same trick works on car factories. Packed lots at quarter end can mean unsold inventory, and prediction markets already let you bet on delivery numbers. Most people get the comparison wrong, though: Match the weekday and the time of day. A Saturday lot vs a Wednesday lot tells you nothing Skip holiday weeks, or compare them only with the same holiday last year Count enough stores that one empty lot doesn’t move the average The data is cheap now. The discipline isn’t.

My friend had $70k+ in a crypto wallet on an iPhone still running iOS 18. One wrong link in Safari could have emptied it (yes, that one website with hot girls could steal your money). The exploit is called DarkSword. Google found it working on iOS 18.4 to 18.7: you open a link, nothing to download it takes full control of the phone it pulls wallet keys and scans your Photos and Notes for seed phrases What to do: Update to the latest iOS today Don’t open links from strangers in DMs Never keep a seed phrase in Photos or Notes Check your phone, then send this to the friend who never updates.

Took a be and 2 sl on $EURUSD. At the session close, the price fell just a few pips short of the target; consequently, at the London Open, I attempted to catch a pullback to the levels I was interested in. Unfortunately, the Euro moved away right at the open without any prior manipulation.

The #1 AI trading repo on GitHub this week makes its bots argue before every trade. Fastest growing finance + AI repos, last 7 days: 1. TradingAgents (+5,315 ★) Analysts, researchers, a trader and a risk team debate every trade. Almost 3x last week's growth, now 118K stars. 2. day-trader-skill (+2,832 ★) 11 Claude skills for day trading. Its "time machine" replays the session 10,000 times before you trade. 11 days old. 3. last30days-skill (+809 ★) Researches any topic across Reddit, X, YouTube, HN and Polymarket, then ranks it by upvotes, likes and real money. 4. Vibe-Trading (+779 ★) Research, backtests and paper trading through chat. MCP support, fixes shipping almost daily. 5. Kronos (+773 ★) Open source foundation model for candlestick charts, trained on 45+ exchanges. Last week's #1, code untouched since April. 6. trader-skill (+479 ★) Same author as #2. Copies an investor's 13F and tracks Congress trades. Never places an order without your yes. 7. freqtrade (+341 ★) The OG open source crypto bot, with a built-in ML module (FreqAI). Dry-run first. 8. daily_stock_analysis (+337 ★) LLM analysis for 6 stock markets, sent as a daily dashboard to Telegram, Discord, Slack or email. 9. OpenBB (+323 ★) Connect your data once, use it in Python, Excel or an AI copilot. 10. tick-stock-panel (+322 ★) Self-hosted quant workbench for China A-shares. An LLM helps build the strategy. The pattern: 4 of these 10 lean on paper trading, dry-run or an approval step. Even the builders don't hand a bot real money on day one. Video is my own simulation of the idea, not TradingAgents' UI. Save this. Which one are you running first?

A Polymarket wallet made $61,200 without one big win. berlinskies has traded since July: 13,140 markets, $1.8M in volume, $61.2k profit. That’s 3.4% of volume, about 3x what most wallets I’ve broken down earn. The pattern: Positions of $70 to $500, never bigger Dozens of markets a day: Counter-Strike, Dota, League of Legends, Indonesian football totals, Bellingham in the Ballon d’Or top 10, an Iran blockade, a new AI model release Best trade ever: $5,457, under 9% of total profit So the profit isn’t one lucky hit. It’s small size repeated across many markets. Worth studying, not blindly copying. A copier gets worse entry prices, and in thin markets slippage can eat the edge. Past results aren’t proof of a future edge. Would you copy a wallet like this, or only study it?

An approve drainer takes one token. A 7702 signature takes the whole wallet. Approve: you let one address pull one token. EIP-7702 authorization: your wallet starts running someone else’s contract. Why that’s worse: One signature can empty everything, not one token. It’s an authorization, not a transaction, so many people don’t treat it like a risky action. The delegation stays on your wallet. If the contract is malicious, it keeps taking whatever arrives later, until you reset it with a new type-4 transaction. Same lesson as the Binance case: the protocol did what it should. The damage comes from what you let sign it. Before you sign any 7702 authorization, check which contract it delegates to.

Everyone is blaming EIP-7702 for the reported $6.4B Binance drain. It worked exactly to spec. The hole was somewhere else. A normal drainer abuses an approval: one address, one token. A 7702 authorization is a signature, not even a transaction, that makes a wallet run someone else’s contract. That hands over the whole wallet at once. So the real question is why Binance’s signing service signed it. By Binance’s own account (their claim, not confirmed fact), an operator’s laptop reached a service container with signing access. The key never leaked. The attacker just told the signer what to sign. How the drain reportedly went: A 7702 delegation was signed on one hot wallet. It held 50 authorizations, and only the one matching the account nonce is valid. The rest fail silently. One sweep() call took 167,464 ETH plus 63 tokens. Through that same wallet, a call into a Circle smart account moved 823M USDC more. You need to know the exchange’s internal wallet layout to do that. On other chains, plain signed transfers were enough (about 28k more ETH). New deposits kept getting swept, roughly 200M USDT more. What failed: The withdrawal signer accepted everything: transfers, a delegation, an arbitrary call. It should never be able to sign a delegation. Everything went privately straight to blocks, so there was no public mempool warning. Signing was cut after about two hours. The delegation was removed after 3h50m. A delegated hot wallet wasn’t blocked, or even alerted on. The weak point was what the signer was allowed to sign, not the protocol.