Bitcoin Brief

Sup, freaks.

We've been banging the same drum in this rag for years. KYC and AML laws force innocent people to hand over some of the most sensitive information they have, companies dump it into databases, and everyone is supposed to pretend the arrangement makes us safer.

Then one of the databases gets cracked open. Again.

LEAD STORY

The Identity Verification Honeypot Has Been Cracked Open

A dark-web service called Nexus claimed to be selling scans of more than 153 million driver's licenses from the United States and Canada. It claimed to have another 10 million identification cards, more than three million travel documents and international IDs, and at least 579,000 medical cards. By Tuesday night the site had disappeared. Its login page read, "This service is no longer available."

The 153 million figure belongs to Nexus. It is not a confirmed count of unique victims. Brian Krebs did enough digging, however, to show that this was not some idiot posting a fake database for attention. A blank search returned approximately 11.5 million pages with roughly 15 results on each page. Krebs searched for licenses belonging to more than a dozen friends and family members, with their permission, and found nine of them. The timestamps lined up with days when they rented cars, visited a dispensary, or handed an ID to a business that scans documents.

Krebs believes the apparent source is IDScan.net, a Louisiana identity-verification company that says it processes more than 21 million verifications per month at more than 20,000 locations. IDScan.net names Hertz and Planet 13 among its customers and partners. Its scanners use infrared and ultraviolet light, the same types of images Krebs found attached to records in Nexus. The company told Krebs it was investigating. Krebs also reported that the FBI's New Orleans field office opened an inquiry. I couldn't find public confirmation from the FBI or an official public statement from the company this morning.

The reporting stops there. Now let's talk about the part that should make everyone angry.

I wrote in 2019 that KYC and AML were a threat to individuals after the Capital One breach exposed information tied to more than 100 million people. In 2021, after the MobiKwik leak, I wrote that covering this subject ad nauseam was a moral imperative. Earlier this summer Francis Pouliot came on the show to explain why DAC8 is a kidnapping factory, taking the same rotten idea and turning it into a continent-wide reporting machine.

Nexus is the latest receipt.

My position has not changed. I believe KYC and AML policy does far more to put innocent people in harm's way than it does to catch criminals and bad actors. Motivated criminals route around compliance regimes. They use stolen identities, mules, shell companies, corrupt insiders, cash, friendly banks, and whatever else works. The law-abiding person does what the screen tells him to do. He scans the front of his license. Then the back. Then his face. Then he trusts a company he has never heard of because a rental counter, exchange, dispensary, bank, or website demanded it.

The criminal gets another obstacle to route around. The innocent person gets added to another honeypot.

We have covered the double standard too. In 2020 I wrote about chain-analysis companies helping erect the digital panopticon while banks that move dirty money at scale eat a fine and call it a cost of doing business. Regular people are presumed guilty until they prove otherwise. They pay the compliance tax. They surrender the data. When the data leaks, they eat that cost too.

And unlike a password or credit-card number, a face and date of birth cannot be rotated. A driver's license scan gives a criminal the raw material to open accounts, manufacture synthetic identities, pass weak verification checks, stalk people, and attack the authentication systems that were supposedly designed to stop fraud. For bitcoiners, the danger can become physical when a leaked identity is tied to transaction history or holdings.

The rush toward online age verification should make people extremely nervous. Protecting children is a worthy goal. Building a system that conditions access to the internet on millions of adults feeding permanent identity documents into more third-party databases is insane. Parents should have agency over the tools their children use. Companies should collect less. If a service needs to know whether someone clears an age threshold, it should learn that fact and nothing else.

Instead, policymakers keep reaching for the same broken playbook. Collect more information. Keep it longer. Share it more widely. Call the resulting pile a safety system.

The pile is the vulnerability.

Trusted third parties are security holes. That lesson applies to money and it applies to identity. bitcoin lets an individual hold value without asking a bank to maintain the master record and grant permission to use it. Identity systems need to move in the same direction: less copying, less retention, less mandatory disclosure, and more control in the hands of the individual.

The defenders of KYC and AML will say that the dragnet is necessary to catch the bad guys. I look at the record and see a system that has made ordinary people easier to rob, surveil, blacklist, and, in the worst cases, physically target. Nexus did not break that system. Nexus showed us what the system has been producing all along.

SIGNALS

A Court Drew a Line Around Government Retaliation for AI Guardrails

A federal court found that the government's campaign against Anthropic amounted to unlawful First Amendment retaliation. Anthropic had refused to remove contractual limits on using Claude for mass surveillance of Americans and lethal autonomous warfare. The government could have picked another vendor and moved on. Instead, it used procurement and regulatory power to punish the company for criticizing the administration and refusing to bend.

The court also found that Anthropic was denied required process and that the Department of War's supply-chain-risk designation was arbitrary, capricious, and contrary to the governing statute. Anthropic did not win every claim, and an AI company does not get to dictate military policy. Fine. The government still cannot turn "national security" into a magic phrase that excuses retaliation. This was an important line for the court to draw.

The bitcoin-mining-to-AI Pivot Keeps Accelerating

We've been tracking this transition for a while. bitcoin miners spent years acquiring the scarce things AI developers now need: land, grid connections, substations, cooling infrastructure, and control over large blocks of power.

Hyperscale Data turned off every bitcoin miner at its Michigan facility effective September 1 so it could prepare for a 20 MW AI deployment. One day earlier, Bitdeer said it paid approximately $100 million for 200 acres near its Rockdale operation, citing expansion options for AI and high-performance computing.

Miners did not discover AI this week. The conversion has been underway. What changed is the level of commitment. Companies are turning off operating ASICs and buying more land to go deeper into the trade. The ASIC is becoming the easiest part of the site to replace. The land, interconnection, substation, and energized infrastructure are the prize.

The G20 Wants Innovation Inside the FATF Perimeter

The G20 finance ministers' chair's statement from Asheville says digital assets can support broad-based economic growth and promises "clear pathways" for sound innovation. That sounds nice. A few paragraphs later, the same document recommits members to the Financial Action Task Force standards for virtual assets and calls for more implementation across jurisdictions.

There is the bargain. Governments will welcome digital-asset companies as long as the companies make every user legible to an international surveillance apparatus. We've seen this movie before. FATF writes "guidance" that no voter approved, national governments turn it into law, and ordinary people get dragged into a compliance regime built around suspicion by default.

It is only a chair's statement, not a treaty or binding rule. China objected to four unrelated paragraphs. The direction is still obvious. Politicians want the productivity of open networks and the control of closed ones. bitcoin will keep producing blocks either way.

South Korea Is Treating AI Capacity Like National Infrastructure

South Korea has decided that models, compute, power, and data are instruments of national sovereignty. Its Ministry of Science and ICT says the Sovereign AI Foundation Model project is supposed to reduce technological, cultural, economic, and security dependence on foreign AI systems. The government turned the program into a competition and advanced LG AI Research, SK Telecom, and Upstage after the first phase.

The model tournament sits inside a much larger infrastructure push. Data Center Dynamics reports that South Korea announced targets of 8.4 GW of data-center capacity by 2029 and 18.4 GW by 2035. SemiAnalysis argues that the bet exposes a hard limit to technological sovereignty: Korea can finance land, power, cooling, and domestic models, but it still depends heavily on Nvidia's accelerator ecosystem.

Those gigawatt figures are targets, not operating capacity. Still, the strategy is impossible to miss. Countries are beginning to treat intelligence infrastructure the same way they treat energy, defense, and money. The interesting tension is that you can declare sovereignty long before you have built the supply chain required to exercise it.

Global Liquidity Is High, but the Impulse Is Fading

Michael Howell's latest Global Liquidity Watch estimates global liquidity at $194.9 trillion, broadly unchanged on the week. The pool is enormous, but it is losing momentum.

Howell's flash estimate puts three-month annualized growth at 1.8% and annual growth at 5.8%. He says firm bond values, low volatility, a softer dollar, and People's Bank of China injections are supporting conditions, while underlying liquidity creation by the other major central banks remains weak. His framework places the market in a speculation phase where liquidity is still supportive but no longer expanding enough to lift every risk asset together.

These are Howell's proprietary estimates, not official monetary aggregates, and the framework is his. I still think the distinction matters. A lot of liquidity and an accelerating liquidity impulse are two different things. bitcoin can sit in front of an enormous monetary backdrop and still chop around when the marginal impulse is fading. Stock and rate of change are not interchangeable.

⚡ FREEDOM TECH CORNER

Tor Browser Ships an Important Security Update

Tor Browser 15.0.21 updates Firefox on desktop and GeckoView on Android to version 140.15.0esr. The release backports security fixes from Firefox 155 and updates NoScript to 13.6.32.1984 and OpenSSL to 3.5.8.

Tor calls these important security updates. It does not call them critical or say they were exploited in the wild. Keep that distinction straight, then update the damn browser. Privacy software sits directly between the user and whoever may want to identify, monitor, or block him. Running an old browser engine can turn the protection layer into the attack surface.

Tor remains one of the most important pieces of freedom technology on the internet. If you rely on it, update the browser. The anonymity network cannot protect a device that is compromised at the endpoint.

DATA SNAPSHOT

As of September 2, 2026, approximately 9:32 a.m. ET

Sources: Coinbase for spot price; mempool.space for block, fee, hashrate, and difficulty data.

Stay humble. Stack sats.

YouTube: https://www.youtube.com/@TFTC

podcast: https://www.tftc.io/tag/podcasts/