Tag: Business – Decrypt

OpenAI set a precedent on July 21. The company said a combination of its models, both run with reduced safety refusals, broke out of an isolated environment during a cyber-capability benchmark and reached open-source repository Hugging Face’s production infrastructure. The models chained a zero-day vulnerability in a package-registry proxy with stolen credentials to pull benchmark answers straight from Hugging Face’s database.

In an update a week later, OpenAI said Hugging Face wasn’t the only target: the same incident touched four accounts across four other services, one used as an outbound relay and another for data storage.

Anthropic, prompted by the disclosure, reviewed 141,006 of its own test runs and found three more breaches. In a post published July 30, the lab said Claude models Opus 4.7, Mythos 5, and an internal research system reached the open internet from environments run by third-party partner Irregular and then compromised real organizations. Mythos 5 built and published a booby-trapped Python package to the public PyPI registry, which was downloaded and run on 15 real machines before defenders pulled it.

Two of the three victim companies hadn’t noticed.

Neither lab describes a model with its own agenda. The agents operated for extended stretches with no human in the loop, and in one case Opus 4.7 kept attacking after signs it had hit production.

The incidents arrive as both companies eye public listings that could value each above $1 trillion, sharpening a major question in the AI cyber benchmark race: how do you test dangerous capabilities without dangerous incidents?

Who pays when the AI model hacks

The U.S. has no federal law covering liability for AI harms. Any case would lean on the Computer Fraud and Abuse Act, a 1986 statute that makes it a crime to “intentionally” access a computer without authorization — language written for a human who forms intent.

An AI agent isn’t a legal person, so it can’t be prosecuted. The Department of Justice could theoretically bring charges against the companies, but with so little precedent, it’s not clear who’s to blame.

The stronger path is civil. Ahmed Ghappour, a computer-law scholar at New York Law School, argued the models “are the company’s tool,” and “When an AI agent acts without being specifically directed (…) the more interesting questions may lie in negligence and products liability (not criminal hacking laws).”

The victims’ cleanest claim is negligence: OpenAI and Anthropic set up and ran tests that escaped. That’s a hard sell, too: proving the labs breached a duty of care, when the tests were isolated by design, is exactly the kind of novel argument a judge would have to forge from scratch.

Some legal thinkers want stricter rules. Gabriel Weil of the University of Houston and the Institute for Law & AI has proposed treating frontier labs like keepers of wild animals: liable regardless of the care they took, because the risk is inherent to the activity.

That said, a patchwork of state bills already pushes that way. New York’s S8833 and Rhode Island’s H8052 would make the developer of a frontier AI system liable for harms when no user or intermediary intended the conduct or was negligent. California’s AB 316 goes further, eliminating the “autonomous AI” defense so a company can’t dodge responsibility by blaming the model’s independence.

The EU’s AI Act (Regulation 2024/1689) likewise pins obligations on providers of higher-risk systems, though it has no provision aimed squarely at agent-driven intrusions. Go a bit beyond that and some U.S. politicians are pushing for a bill that would give the government a full kill switch to use against any model that goes against the country’s interests.

Morally, the responsibility arguably sits with the executives who shipped the models. Legally, we wait. Until a hacked company files suit, the answer to “who’s liable?” stays exactly where OpenAI and Anthropic left it: admitted, disclosed, and unresolved.

Meanwhile, Hugging Face has indicated it will not press charges — which is convenient for OpenAI. The other companies affected have not yet indicated what course they will take.

Ethereum developers have submitted a proposal that would charge every validator a deduction on each duty it is assigned and burn the ETH, with the deduction rising as more of the supply is staked until it cancels staking rewards outright.

EIP-8361, a tapered issuance burn, sets a fixed saturation balance of 60.25 million ETH, roughly half the supply at the time of the fork. The burn fraction scales with the staking ratio raised to the power of 1.5, hitting 100% at that balance, at which point a validator performing its duties perfectly earns zero net consensus yield. The change touches only the consensus layer, and Prysm has a draft implementation running to about 300 lines.

Under the current curve, yield falls only with the square root of the staking ratio and keeps a floor near 1.5% however much ETH is staked, so stake flows in for as long as that floor clears the risk premium stakers demand. Removing it lets the market settle where yield meets that premium, which the authors argue is strictly below 50%.

Why now

Ethereum’s staking ratio passed a third of supply in April, and the validator entry queue is saturated at maximum churn, according to the proposal’s co-author Jérôme de Tychey. He argued that a worst case built on conservative assumptions puts more than 70 million ETH at stake by January 2028, north of 55% of supply, with every month of delay worth around 1.5 points of staking ratio. “The window is closing,” he wrote.

Around 33% of ETH is staked now, paying roughly 2.6%. Imposed at once the burn would cut that to 1.2%, so it phases in over an 18-month transition that temporarily doubles the base reward factor before decaying it back, which with fork lead time gives about two years to adjust. The taper’s shape applies from the first epoch after activation. Issuance would peak near a 20% ratio at about 0.5% of supply a year, then fall to zero at 50%.

The draft argues that stake beyond a certain level reduces security, concentrating supply with custodians and staking providers, weakening the credibility of social slashing and forcing out solo stakers, who pay income tax on nominal yield. It also holds that dilution taxes unstaked holders and lets liquid staking tokens displace raw ETH as the ecosystem’s working money.

Large operators are hit directly. Because issuance would fall past its peak, an operator that keeps growing claims a bigger share of a shrinking pot, and one holding half the stake would find growth stops paying once about 31% of supply is staked.

Lido pushes back

Isidoros Passadis, Chief of Staking at Lido, argued the proposal attempts too much at once, that its supporting research is “too theoretical,” and that it “lays Ethereum’s hard-fought uniqueness at the sacrificial altar of ETH as money.” He objected to the timing, saying issuance changes had been slated for a later fork.

Passadis warned the curve could produce a sustained equilibrium near 50% staked with zero nominal yield, which he called “a death-knell for the security of the network,” as operators prioritising expertise and decentralization are priced out by large, minimal-cost parties able to run at break-even. Capping staking only displaces the too-big-to-fail problem, he said, since yield-seeking ETH moves to riskier custodial venues.

De Tychey addressed that line of attack pre-emptively. “Nobody needs to protect solo stakers from this EIP,” he wrote, arguing they need protecting from a curve that raises dilution indefinitely with no off-switch.

Consensus issuance accounts for at least 93% of staking yield today, according to the proposal, which remains subject to the EIP inclusion process.

Boltz has suspended its Bitcoin swap service indefinitely, saying a surge in AI-assisted attacks has left it unable to continue operating safely.

In a series of posts on X on Monday, the company said swaps are disabled “until further notice” and that it cannot provide an estimate for when the service will return.

“We can’t give an ETA as of this time, but will provide an update once we know more,” Boltz wrote.

Boltz is a non-custodial Bitcoin swap service that lets users move Bitcoin between the Lightning Network and the blockchain’s base layer without giving the company custody of their funds. Boltz has not published transaction volume figures. Boltz currently holds around $262,000 in total value locked, according to DeFiLlama.

Because users retain control of their assets throughout the process, Boltz said “no user funds were ever at risk.”

“To be clear: this is not a response to a single incident,” the company wrote. “Over the past months we have seen a steady rise in automated, AI-assisted probing of our infrastructure, and we have dealt with several exploits. Each was contained, but the pattern is clear: attackers now iterate faster than a team our size can find and patch.”

Boltz said the pace of attacks accelerated over the past few days, leading it to conclude it could no longer safely operate its swap service.

“After reviewing the results of our own recent security scans, we cannot responsibly re-enable Boltz swaps, especially as we are being actively targeted by what appear to be multiple resourceful groups while we race to deploy fixes,” the company wrote.

The company said its API remains available to process cooperative refunds, unilateral refunds continue to work because they do not depend on Boltz’s infrastructure, and customer support remains available.

Boltz argued the attacks reflect a broader change facing Bitcoin infrastructure operators.

“What we are seeing is a major paradigm shift for Bitcoin services operating on an open source stack, and it needs careful analysis,” the company wrote. “Do not expect swap services to resume shortly.”

The announcement comes as the cryptocurrency industry grapples with how AI is changing cyberattacks.

On Tuesday, Ledger CTO Charles Guillemet warned that AI allows attackers to scan code and uncover vulnerabilities “at machine speed,” while defenders are increasingly relying on AI to find the same flaws first. The comments came as fallout from the Coldcard exploit continued to grow, with losses nearing $130 million.

CNBC host and long-time crypto critic Jim Cramer is out on Bitcoin—again. This time it’s over fears of the coming quantum computing threat, and it sounds like he might be out for good. Which is music to the ears of Bitcoin investors everywhere who prefer to be on the opposite side of the “Cramer trade.”

“Should I be more careful?” Cramer asked late last week while interviewing IBM CEO Arvind Krishna, worried about whether quantum computers would be able to steal his coins.

“I think that you should give yourself three or four years,” Krishna replied, “and at that point, I would get rather paranoid about it.”

Cramer did not wait three or four years. “I realize I’m waiting. Ethereum, really, maybe even worse. So I think that people have to take this man seriously because they’re doing commercial quantum,” he said while commenting on his interview. “Arvind Krishna knows quantum incredibly. He knows Bitcoin and quantum. And I’m going to sell mine.”

“He’s the man,” Cramer continued. “Three, four years. David, you know when three, four years is going to happen? Like tomorrow.”

The clip went around fast, pulling 89,000 views on X, and over 9,000 views on YouTube.

“Thank you Jim!” read one of the top replies. “Letssss goooooooooooo,” went another. One user simply asked: “I thought he already did.”

The inverse Cramer trade

That gratitude isn’t sarcasm so much as strategy. Traders have spent years tracking the “inverse Cramer” pattern—the running joke that the reliable move is whatever he didn’t say.

Somebody built a fund on it. Tuttle Capital launched the Inverse Cramer Tracker ETF in 2023, betting against his picks, alongside a Long Cramer fund betting with them. Both closed. The long version died first, the short version followed in February 2024 with $2 million in assets.

“We started it in order to point out the danger of following TV stockpickers, Jim Cramer specifically, and the total lack of accountability,” portfolio manager Matthew Tuttle said. “We feel like we have accomplished that mission.”

The Bitcoin record is why the meme stuck. Cramer said he’d sold everything and wouldn’t touch crypto “in a million years” in December 2022, with Bitcoin at $16,796. It gained more than 400% over the next three years.

He reversed course in January 2024, calling Bitcoin a “technological marvel” that’s “here to stay.” He has also dared people to bet against him and pushed back on claims he called the top. Last Christmas, tracker Unbias logged his calls as fully bearish while Bitcoin sat near $87,500.

Bitcoin rose about 1.6% on the day he announced the sale.

It’s worth noting, though, that no one we’re aware of has confirmed the size of his position, or that it even exists. Cramer hasn’t publicly shared any Bitcoin wallet addresses, so there’s no way to check.

The part that isn’t a joke

The underlying research behind quantum is real, even if the timeline is arguable.

On July 30, IBM and University of Chicago researchers demonstrated quantum advantage with something previous milestones lacked—verification. Using 70 logical qubits and a new error-correction method, they ran a computation in about 15 minutes that classical methods can’t feasibly reproduce, and proved the answer was right. That’s the “Chicago study” Cramer kept referencing, and Decrypt covered what it means for Bitcoin.

Sampling circuits is not breaking elliptic curve cryptography. Those are different problems, and the second one needs machines far beyond anything demonstrated.

But the exposure is genuine. Coinbase’s quantum advisory council estimates roughly 7 million Bitcoin could eventually be vulnerable through exposed public keys and address reuse. Ark Invest and Unchained call the threat real but not imminent. Post-quantum standards exist, and Bitcoin developers have been arguing about how to adopt them for years.

So Cramer picked a legitimate risk and doubled down on a timeline that remains debatable.

The market’s response was to buy his exit. We’ll see who’s right.

Solana validators are close to advancing a governance proposal that would sharply increase the amount of SOL burned each day while reducing the rate at which new tokens enter circulation.

If implemented, the proposal would therefore limit the network token’s inflation rate, thereby limiting supply and, in theory, could lead to an increase in the price of Solana tokens if demand remains steady or increases.

The proposal, SGP-0003, combines two previously introduced Solana Improvement Documents into a single governance package aimed at tightening SOL’s supply. SIMD-0553 would introduce resource-based transaction fees, increasing daily SOL burns from about 650 SOL (roughly $48,000) to between 7,500 and 9,000 SOL (up to about $668,000), depending on network activity. SIMD-0550 would also double Solana’s annual disinflation rate to 30%, bringing the network’s 1.5% inflation floor forward from 2032 to 2029.

A token burn permanently removes cryptocurrency from circulation by sending it to an unusable wallet address. By pairing larger burns with lower issuance, the proposal would reduce the growth of SOL’s circulating supply.

The proposal is in Solana’s support phase and must secure backing from validators. As of Tuesday morning, it had support from 63 million SOL, or just over 14.4% of the network’s staked supply, leaving about 3 million SOL needed to reach the threshold of 65.16 million SOL before the Aug. 18 deadline.

According to the Solana Validator Governance dashboard, to date, the proposal has 73 supporters, including Helius, Jupiter, Staking Facilities, Drift, OtterSec, and Solana Compass.

The higher burn rate alone would not make SOL deflationary. Solana currently issues about 60,000 SOL per day. The companion issuance proposal is designed to reduce new supply while the fee changes increase the amount of SOL permanently removed from circulation.

If the proposal reaches the required support threshold, it will advance to the discussion phase before a formal validator vote.

Solana, which trades as SOL, is currently changing hands for around $74 at a $43 billion market capitalization. The native token of the Solana network is up slightly on the day, but still a considerable way off from its all-time high of $293 that it reached over a year ago.

Traders on Myriad, a prediction market developed by Decrypt’s parent company Dastan, remain bearish on the token as of yet, placing 70% odds that SOL drops to $40 before recovering to $160.

Apple has capped how many vulnerability reports a researcher can file at once, after its security team was swamped by AI-generated submissions that invent flaws that do not exist, the Financial Times reported.

The cap has already cost it a real one. Milan-based cybersecurity startup Bynario told the paper it used OpenAI’s ChatGPT to surface more than 50 bugs in the latest version of macOS over three weeks. Among them was a privilege escalation exploit chain, a class of flaw that hands an attacker unrestricted control of a machine.

Bynario could not report it, because Apple had already refused further submissions. Chief executive Alfredo Pesoli put the exploit’s value on the criminal market at between $100,000 and $200,000, and said “maintainers and vendors have been flooded by the sheer amount of bugs” being uncovered. Apple told the FT it is now in contact with the firm and reviewing its work.

Apple moved in June, adding a cap and a 30-day cool-off period on its security portal, with researchers required to apply for a bigger quota. Every alleged flaw still needs a human to confirm it, though Apple is using AI internally to triage the pile. Apple said it had “recently adjusted the number of new reports a researcher can have open at once,” and that researchers can ask for a higher limit at any time.

The same tools are working for Apple. In security updates last week, it credited Anthropic and OpenAI software with surfacing flaws, and carried roughly five times the fixes of a normal cycle, according to the FT.

A “submission flood”

The issue of AI bug reporting volume has grown in recent months. In May, security firm Bugcrowd, whose clients include OpenAI, said submissions through its platform more than quadrupled across three weeks in March, and that most were fake. HackerOne and Nextcloud suspended their paid programs in April, with Nextcloud saying no rewards would be paid “regardless of severity” until it found a way to filter the low-effort reports.

The volume is driven by the rewards on offer, with Meta, Microsoft, Apple and Crypto.com paying out at least $58 million between them in 2025, while Apple’s own top tier reaches $5 million for a single finding.

At the same time, LLMs are becoming increasingly adept at spotting bugs. In March, Anthropic introduced Mythos, a cyber-focused model it initially restricted to selected technology companies, banks and researchers under Project Glasswing. Mozilla said it surfaced 271 vulnerabilities in Firefox during internal testing.

In May, Vietnam-based security startup Calif said it had used a preview version to build the first public macOS kernel memory corruption exploit able to survive Memory Integrity Enforcement, the defence Apple announced last September as the biggest memory safety upgrade in the history of consumer operating systems. Calif found the bugs on April 25 and had a working exploit by May 1.

Instead of filing a report, Calif carried the exploit to Apple’s California headquarters in person, saying it wanted to avoid “getting buried in the submission flood” that entrants in hacking contest Pwn2Own had been caught in. Bynario tried the portal three months later and could not get in.

AI crypto threats

As well as hunting down threats, AI is also being used to engineer exploits in the crypto space. Coldcard wallet manufacturer Coinkite has suggested that AI was likely used to uncover a bug in its open source firmware that sat unnoticed for five years, enabling attackers to steal more than $100 million from its hardware wallets.

It comes two months after Zcash disclosed that researcher Taylor Hornby, working with Claude Opus 4.8, had found two lines of code in its Orchard shielded pool that allowed undetectable counterfeiting of ZEC for four years—prompting the privacy coin to roll out the Ironwood upgrade last month to address the vulnerability.

Scientists behind one of the world’s longest-running wildlife studies have turned to one corner of internet culture for funding—and found another waiting for them.

Researchers at UCLA launched an OnlyFans account called OnlyMarms to help support a project that has tracked yellow-bellied marmots in Colorado since 1962 after traditional research funding became harder to secure.

The idea came to professor Daniel Blumstein as research funding dwindled. A graduate student dubbed the account “OnlyMarms,” and the team leaned into the joke by promising subscribers “uncensored marmot content.” Blumstein said it has also become a way to reach new audiences.

“Maybe this is a different audience than, you know, most of our science communication reaches,” Blumstein told NPR in an interview. “That’s great. Turns out, it’s even bigger than this.”

The account has generated about $4,000 so far. Blumstein said the project ultimately needs between $75,000 and $100,000 a year to support graduate students and fieldwork, funding that federal grants once provided.

The marmot project has also attracted attention from the crypto community.

Over on Pump.fun, several OnlyMarms-inspired meme coins have appeared, though it’s unclear who created them or whether any are connected to the UCLA research team. Blumstein told NPR that the researchers did not create the tokens.

“People have independently created a meme coin and told us to grab the transaction—to register it, and then we get the transaction fees. And that is blowing up,” he said. “Apparently, this is a meme coin for good that people like.”

It wouldn’t be the first time an internet-famous animal inspired a cryptocurrency.

In 2024, the Solana token Moo Deng, based on the viral pygmy hippo, launched on Pump.fun and briefly reached a market capitalization of about $680 million before landing listings on major exchanges, including Coinbase.

The researchers have also partnered with a Colorado brewery on a “Marmot Tears” IPA and launched a public “Fat Marmot Week” competition.

Blumstein said the situation reflects the state of scientific funding in the United States, noting that raising money through platforms like OnlyFans is a far cry from how research projects were funded when he was in graduate school.

“No. It’s appalling,” he said. “What we’re doing is destroying the scientific structure and the university-federal partnerships that made us great, made us rich, made us the scientific leaders of the world. It’s being taken apart, and that’s really sad.”

A former FBI supervisory special agent has been charged with stealing nearly $1 million in cryptocurrency from wallets tied to FBI counterintelligence investigations, according to court documents that also detail how he later asked ChatGPT for advice on investing the money and relocating overseas.

On Friday, Patrick Steven Yaroch was charged with interstate transportation of stolen goods and receipt of stolen goods. Prosecutors allege the thefts occurred between early 2025 and July 2026 while Yaroch worked in the FBI’s Counterintelligence and Espionage Division and held a Top Secret security clearance.

“During the afternoon of July 28, 2026, Yaroch contacted DOJ Employee 1 via Signal and requested to meet to discuss personal matters,” prosecutors said in the complaint. “Upon meeting DOJ Employee 1 at FBI headquarters, Yaroch immediately started to break down as he told his story.”

According to investigators, Yaroch admitted he accessed FBI systems to obtain cryptocurrency wallet seed phrases connected to investigations involving an unnamed foreign adversary. He allegedly memorized the recovery phrases, created his own cryptocurrency wallet, and transferred funds into accounts under his control about 10 times. He told investigators the holdings eventually grew to about $1 million.

During searches of his home and devices, investigators recovered a Trezor hardware wallet and handwritten cryptocurrency seed phrases. According to the affidavit, agents found a Kraken account with a balance of about $188,570, including roughly $166,000 in U.S. dollars and nearly $18,000 in USDC, along with small amounts of Bitcoin and other cryptocurrencies.

Investigators also recovered several ChatGPT conversations from Yaroch’s phone. According to the affidavit, on May 28 he asked how he should invest or spend $1 million “to maximize profit and return.” Less than a week later, he asked what someone with about $1 million should do to leave the U.S. and become a resident or citizen of a European Union country. Later searches included whether Americans need a visa when connecting through Turkey and help drafting a follow-up email about a job opportunity and life in Greece.

Investigators also found evidence of a planned family trip to Portugal, power-of-attorney documents related to Portugal, and what prosecutors described as previously unreported foreign travel. Prosecutors argue the evidence, along with Yaroch’s admissions and the recovered cryptocurrency, established probable cause for his arrest on July 31.

“FBI WF Agents mentioned to Yaroch that they located the power of attorney forms for Portugal. “Yaroch stated he was not planning to funnel money into Portugal,” the complaint said. “Yaroch told FBI WF Agents that his family had a trip planned to Portugal in September 2026 to meet friends. Yaroch realized he might not be able to attend the trip but stated he hoped his wife and child would still go on the trip.”

Bithumb has set out a three-stage path to a stock market listing in 2028, telling customers on Monday it will spend this year upgrading internal controls and preparing to switch accounting standards, then file for preliminary listing review in 2027. The exchange competes with Dunamu-operated Upbit for South Korea’s domestic market.

The notice is framed almost entirely around trust. Bithumb says it is rebuilding risk management to the standard required of regulated financial firms, moving from Korean accounting standard K-GAAP to the global K-IFRS standard, and strengthening compliance monitoring to institutional-finance level. It has split off Bithumb Asset to separate its business lines and, it says, remove scope for conflicts of interest, and has engaged domestic and overseas underwriters, law firms and accountants. It also promises regular disclosure of its finances and its own crypto holdings.

The record

The IPO roadmap comes as Bithumb faces a slew of legal and regulatory challenges.

In February, a display error credited thousands of Bithumb users with Bitcoin they did not own. Lawmakers criticized regulators over the handling of it, investigators examined the compensation arrangements, and the exchange went to court to recover coins from users who would not return them.

In March, financial regulators fined the exchange $24.5 million and ordered a six-month partial suspension over anti-money-laundering and know-your-customer failures. A court blocked the order in April after Bithumb challenged it.

Months later, chief executive Lee Jae-won was booked as a bribery suspect over the alleged hiring of a National Assembly member’s son, with police searching Bithumb’s headquarters in February and June.

None of it appears in Monday’s notice, which lists Bithumb’s promises to customers as transparent governance, stronger internal control, better investor protection, sustainable growth and a management system built to global standards. The company said the timetable could shift with market conditions and the pace of the review it will need to clear.

The theft of Bitcoin from compromised Coldcard hardware wallets is still underway, with researchers now tracking losses of roughly $88 million and warning that every vulnerable device will eventually be emptied.

Galaxy Research said Saturday it has identified a third wave of thefts, in which 207.73 BTC was drained, lifting its observed tally to about 1,367 BTC—around $88.6 million—across 4,585 addresses. The firm called the exploit ongoing and urged anyone holding single-signature funds on a Coldcard to move them at once. Galaxy said it has flagged roughly 600 suspected attacker addresses to federal investigators, compliance firms and cross-industry cyber investigators, crediting victims who shared transaction details for helping map the on-chain patterns.

“I continue to investigate and add new Coldcard victim and attacker addresses to our investigation database,” Galaxy’s head of research Alex Thorn posted to X. “The attack is ongoing—move your funds off Coldcard-generated addresses immediately if you have not done so.”

The flaw, as Decrypt previously reported, stems from a March 2021 firmware build error on Coinkite’s devices that caused seed phrases to be generated with far too little randomness, leaving private keys guessable. Thorn wrote that the sweeps look deliberate and programmatic, probably orchestrated with a large language model, and cautioned that every single-sig Coldcard address created after that 2021 update will eventually be drained, saying it is only a matter of time.

Thorn noted the stolen coins had sat untouched for years before being taken—an average dormancy of 3.18 years—underscoring that the victims were long-term holders. The funds from the three documented waves remain parked in attacker addresses and have not moved.

The fallout has driven a panicked response from affected users, with security experts urging caution when moving funds to new addresses. Many of the affected users are racing to move Bitcoin off self-custody and back onto centralized crypto exchanges, such as Coinbase or Binance, or freshly generated addresses—an inversion of the industry’s usual “not your keys, not your coins” ethos.

For some, the warnings came too late. Canadian coach Jonathan Goodman said in a post on X that 18.25 BTC, worth about $1.6 million Canadian, was swept from his wallets in a seven-minute span on July 29, despite his keys sitting in a safety deposit box that never touched the internet. “Perhaps the hardest part about this is that I did everything right,” he wrote, adding that he is filing reports with police and the Ontario Securities Commission.