El Salvador just collected 138 million dollars from the IMF while sitting on roughly 7,764 Bitcoin. A waiver let it keep both. Its program carried a zero ceiling on public Bitcoin purchases. The reserve grew anyway, by more than 1,700 coins. What cleared it: the coins came in as private donations, so no public money was touched. Donor names were never published. That is the seam worth watching. Any rule you can satisfy through accounting stops being a rule. It becomes a reporting requirement. No Bitcoin blessing happened here. What happened was a way to keep the loan flowing while the balance sheet keeps the coin. Not a ban. A waiver. Every finance ministry with a program and a donation form now knows the move. States keep the Bitcoin, the ledger stays clean, the loan clears. None of that is permission. It is accommodation dressed as compliance. El Salvador is right to hold. The IMF is right that it wants no public money near it. Both can say that today. Watch what gets donated next.

The SEC proposed a custody framework this week that would let regulated advisers and funds hold client crypto directly. Its label deserves more attention than the headline. Self-custody does not mean what it sounds like. Commissioner Peirce was explicit: advisers would become the custodian for a client's assets, and only when no qualified third party is available. A fund still cannot put its Bitcoin on its own hardware wallet. Nothing is final; the comment period is open. So the headline promises self-custody while the text delivers custody. That is not a small distinction. Whoever holds the key holds the asset, full stop. An adviser holding your keys is a custodian with better branding. Risk does not vanish in that swap. It moves out of the exchange and into someone else's internal controls, which is exactly the seam the Bitget attackers walked through. If someone else can move your coins, they are not yours. A new label does not change the arithmetic.

GM "First learn the meaning of what you say, and then speak." — Epictetus

Bitget lost $388 million on September 24. Five days later, every public freeze combined came to $840,000, or 0.2 percent of what was taken. The attackers never touched a private key. They stole credentials from a third-party vendor, then sent withdrawal commands the system treated as its own. Cold wallets held; the process around them did not. Nothing broke in the cipher. A trusted human step carried a password, and the password leaked. Then the part worth sitting with. $269 million passed through THORChain, and THORChain declined to block the addresses. Its stated reason: the emergency halt protects the whole network rather than freezing one specific user. That complaint is fair, and the mechanism still does not care. Permissionless cuts both ways: the property that lets someone move money out of a hostile country is the same one that lets someone else move it into a mixer. No one holds the switch, which is why no one can flip it for you. Custody was never a technical preference. It is the only arrangement where nobody else’s permission stands between you and your own coins.