OpenAI's Testnet Wallet Incident Shows Why Agents Need External Limits

Crypto theft reached $1.18 billion across 107 incidents in the third quarter, according to Hacken, up 55% from the second quarter. The increase came with a sharp change in the mix of losses: smart-contract exploits represented 48% of the total, compared with roughly 12% in the prior quarter.

The published totals imply an average recorded loss of about $11 million per incident in both periods. That calculation is only descriptive because a few large attacks can dominate a quarter, and Hacken's categories are broad. Still, it shows that the aggregate increase reflected more incidents and a different failure mix, not simply a higher average loss.

Two September cases illustrate the control problem. Bitget said attackers used compromised high-privilege credentials to inject unauthorized withdrawal instructions even though private keys were not stolen. In the Liquid incident, invalid assets passed a validation check before an automated process released genuine bitcoin. One failure occurred upstream of the signing key, while the other combined a validation defect with insufficient withdrawal friction.

The lesson for exchanges, custodians and investors is that no single control is enough. Key security, transaction authorization, smart-contract validation, withdrawal limits and manual escalation protect different parts of the path. Customer reimbursement can reduce user losses without proving the control failure has been fixed.

Quarterly categories should not become a checklist ranked only by last period's losses. The more useful test is whether independent controls can stop an asset transfer after an earlier safeguard fails.

Strive bought 3,311 bitcoin between October 5 and October 9 for roughly $280 million, according to its SEC filing. The average cost was about $84,500 per bitcoin, including fees and expenses, and the purchase lifted the company's holdings to 32,773 bitcoin.

The acquisition was large enough to move Strive closer to MARA among public-company bitcoin holders, but the ranking is less important than the financing. Strive's Class A share count increased by about 9.5 million during the reported period, and its SATA preferred share count rose by 532,094. Treasury growth therefore came with dilution and a larger preferred-dividend obligation.

Strive has used common stock, follow-on offerings and its variable-rate perpetual preferred stock to finance bitcoin purchases. SATA currently carries a high annualized dividend rate. That structure can preserve common cash in the short term, but it creates a recurring claim that must be supported by capital markets access or operating resources.

The company reported $310.3 million in cash and equivalents after the purchase, up from $284.7 million in the prior weekly disclosure. That figure provides liquidity, yet it should not be treated as proof the bitcoin purchase funded itself. Investors need to track the complete bridge between security issuance, cash movements and asset purchases.

The SEC filing confirms the purchase and its average price. The investment question is whether bitcoin per diluted share grows faster than the claims issued to acquire it. A larger treasury alone does not answer that question.

BitFuFu produced 167 bitcoin in September, 4% fewer than in August, even as self-mining output rose to 98 bitcoin. The decline came from cloud mining, where output fell to 69 bitcoin, and from lower third-party computing capacity.

Managed hashrate fell to 19.4 exahashes per second from 20.6, while power capacity declined to 324 megawatts from 344. Self-owned hashrate stayed at 3.8 exahashes per second, making the reduction a reminder that BitFuFu's operating scale depends partly on suppliers and hosting customers it does not fully control.

The more important risk sits in Ethiopia. BitFuFu agreed in 2024 to acquire a majority stake in a company operating an 80-megawatt mining site. It has paid sellers $4.1 million and placed about 13,700 Antminer S19 machines there, representing roughly 1.57 exahashes per second and a reported net book value of $1.74 million.

The target is in a dispute with its power supplier, which threatened to seize collateralized equipment and assets if payment was not made. BitFuFu said it could terminate the deal, pursue arbitration and try to recover its payments and machines. Management described the exposure as a small part of total assets and said current production already reflects local curtailment.

September holdings still rose by 15 bitcoin to 1,388. That cushions the production decline, but it does not resolve the acquisition risk. Investors need evidence on ownership of the deployed machines, any recovery of the $4.1 million payment and whether the target's power contract remains viable.

Strategy bought 267 bitcoin for $22.1 million during the latest reported week, paying an average of about $82,900 per coin. The purchase lifted total holdings to 848,517 bitcoin at an aggregate reported average cost of $75,446.

The addition is small relative to Strategy's existing treasury, amounting to roughly 0.03% of its holdings. Its significance is therefore not a sudden change in bitcoin exposure. It is another example of the company's continuing capital-allocation model: issue securities or use cash, then add bitcoin while managing debt, preferred dividends and liquidity.

The company said the latest purchase was funded with proceeds from sales of Class A common stock. That matters to common shareholders because a treasury increase does not automatically increase bitcoin per share. The result depends on the number of shares issued, the sale price and the price paid for bitcoin.

Strategy also maintains separate dollar reserves and cash balances to support preferred dividends, interest and other obligations. Those resources reduce immediate liquidity pressure, but they sit alongside a complex capital structure whose claims must be considered before treating gross bitcoin holdings as common-equity value.

Bitcoin traded below Strategy's latest purchase price during parts of the week, illustrating the short-term volatility of the approach. The next useful disclosure is not simply another purchase total. Investors should compare changes in bitcoin holdings with fully diluted shares, preferred obligations and cash committed to buybacks or dividends.

Ondo Finance's USDY token has overtaken BlackRock's BUIDL in reported size, but that ranking says little about the value of ONDO. The source report put USDY at about $2.33 billion and BUIDL at about $2.2 billion on October 18, a narrow lead that one institutional allocation could reverse.

USDY gives holders economic exposure to a portfolio built around short-term U.S. Treasuries and bank deposits. Ondo says the token is not itself a Treasury security and gives holders no right to receive the underlying Treasuries. ONDO is different again: it is a governance token, not ownership in Ondo Finance, and has no direct claim on USDY reserves, fees or cash flow.

The source report estimated that 4.87 billion of ONDO's 10 billion maximum supply was circulating. A prior discussion about revenue-funded buybacks was only a temperature check, not a binding vote. BlackRock can also earn fees from products used in Ondo's reserve structure. The key question is whether ONDO ever gains an enforceable economic link to the business. Until then, USDY adoption and ONDO value can diverge.