The OCC documented five years of political debanking across all nine megabanks and imposed nothing. FinCEN fined Bank of America more than $1.2bn for seven years of unreported suspicious activity, and no executive was charged. Two Samourai developers, whose software never held a customer's coin, are in prison. Then a Ledger device arrived with an implant that read the seed during setup. A week about gates, prices, and what a holder can verify.

The Rulebook Has Two Prices

On Tuesday afternoon the Treasury Department announced more than $1.2 billion in penalties against Bank of America. The bank had admitted that it willfully violated the Bank Secrecy Act, and the release describes a compliance function that knew and stayed quiet. From the start of 2018 through the middle of 2025, Bank of America failed to report more than $5 billion in suspicious transactions to FinCEN on time. More than $1 billion of that flow touched Chinese money laundering networks, fraud and trade-based laundering along the south-west border. Treasury's own summary says the bank "prioritized its revenues and minimized the impact on its required compliance resources."

Nobody was charged.

A day later the Office of the Comptroller of the Currency published a 47-page report that examined the same banking system from the other side. The OCC found that all nine of America's largest national banks ran policies capable of denying accounts on the basis of political belief, religious affiliation or lawful business activity. The window runs from 2020 through September 2025. The agency called its own evidence irrefutable. It imposed no fine.

Those two documents are the week's real story, and the interesting question is not who behaved badly. It is where the gates are, who sets their price, and which of those prices a customer can verify rather than negotiate. The same question runs through a hardware wallet implant in South-East Asia, and through an ownership chart that leaves most of bitcoin unlabelled. It runs as well through two federal awards that decide who pays for the wire that artificial intelligence needs.

The regulator's own receipts#

The report is titled "Guaranteeing Fair Banking for All Americans" and was released on Wednesday under a mandate from Executive Order 14331. The nine banks in scope are JPMorgan Chase, Bank of America, Citibank, Wells Fargo, U.S. Bank, Capital One, PNC Bank, TD Bank and BMO Bank. Together they hold $12.7 trillion, or 76 percent of the assets in all OCC-regulated institutions, which is why nine names can stand in for the American banking system.

The review covered 2020 through September 2025 and drew on nearly 100,000 complaints and roughly 50,000 documents. Those documents run to about 420,000 pages, which is four pages of internal record for every customer who wrote in. That division is mine.

The finding itself is narrow and technical, and that is what makes it worth reading. The banks "largely lacked clear and measurable standards and objective risk-based criteria for assessing the reputation risks of customers or prospective customers." A rule needs a threshold. A reputation judgement needs only a room with a view of the news cycle.

Six industries appear by name in the policies the OCC reviewed: oil and gas exploration, coal mining, firearms and ammunition, detention facilities, tobacco and e-cigarettes, and digital asset activity. Bitcoin businesses sit in that list, in the same sentence as the gun shops and the coal plants.

The examples are specific. JPMorgan's WePay subsidiary terminated a merchant that sold MAGA merchandise, and the bank's internal screening flagged the phrases "MAGA," "Make America Great" and "America First" in merchant profiles. PNC declined credit to a media company whose owners held prominent conservative political and religious associations. Capital One turned down a gun-rights group and cited "optics," then declined an abortion-supporting group as outside its "risk appetite."

Comptroller Jonathan V. Gould put the conclusion plainly. The report "provides irrefutable evidence that the nation's largest banks have denied, debanked and discriminated against customers and lawful businesses." He then said he was not confident that the banks' own reforms "will be enough." The OCC will assess further changes to its regulatory and supervisory framework, he added.

The OCC imposed no fines and brought no enforcement action. It has removed reputation risk from its own examination framework, which governs the next round of reviews and changes nothing about the last five years. The Consumer Financial Protection Bureau announced that it would open investigations, which is a statement of intent rather than a penalty.

Read that as a description of a gate. Access to the dollar system moved on judgements that no statute defines, taken by committees that answer to their own boards. Across the same period a named list of industries was marked. Nothing about that gate is priced in public. The second document of the week, by contrast, has a number attached to it.

Two prices for one rulebook#

FinCEN's penalty against Bank of America runs past $1.2 billion, and it is the largest the agency has levied for reporting failures under the Bank Secrecy Act. Marty Bent of TFTC read the quarter's results that same morning and drew the comparison that matters. With the one-off charge stripped out, the bank reported about $8.1 billion of profit for the three months. It returned $8.3 billion to shareholders in the same quarter, $6 billion of that through buybacks.

Divide the penalty by either figure and it lands near 15 percent, roughly a seventh of one quarter's profit. I made those divisions on the newsletter's numbers rather than on the filed statement, and I mark them as such.

Now place the other defendant in the same dock. Six months before the Southern District of New York indicted the founders of Samourai Wallet, prosecutors asked FinCEN whether the wallet was a money transmitting business. FinCEN said that it was not. The guidance was long-standing. A money transmitter takes custody and control of customer funds, and the agency restated in 2019 that software providers which never touch those funds sit outside the definition.

Samourai launched in 2015 with that reading in hand and never took custody of a customer's coin. Keonne Rodriguez and Bill Hill pleaded guilty to operating an unlicensed money transmitting business and were sentenced to five years and four years in federal prison. The government called the full $2 billion that had moved through the software unlawful for lack of KYC, then priced $237 million of that flow as criminal proceeds. Samourai earned roughly $6 million in fees across a decade, all of it forfeited. The government's claim runs at about forty times the lifetime revenue of the business, on my own multiplication.

Rodriguez described the ratio himself: "that's like 10%. JPMorgan Chase, HSBC would kill for 10%."

Roman Storm was convicted in August 2025 of conspiring to run an unlicensed money transmitting business for Tornado Cash. He still faces a retrial in April 2027 on the counts the jury could not agree on.

The conduct in the two cases differs, and the treatment differs considerably more. A bank that sits on $5 billion of suspicious activity for seven years keeps its charter and books a charge. Two developers who never held a coin lose their company, their savings and years of their lives. One defendant could pay, and the other could not. Where one statute governs both, the ability to settle sets the sentence, and the ability to settle is a function of size.

Two prices for one rulebook. Left: Bank of America paid more than $1.2bn and booked about $8.1bn of profit in the same quarter, so the penalty is roughly 15 percent of it. Right: the two Samourai developers face a $237M claim against $6M of fees earned in ten years, a factor of about 40. Sources: FinCEN and US Treasury, 13 October 2026; TFTC, 14 October 2026. Own chart, own divisions.

The gate you cannot open#

In August a software bug at Coldcard produced keys with weak entropy, and holders of vulnerable wallets had to move their coins in a hurry. Some of them were advised to drive to an electronics store and buy a replacement signing device rather than wait two days for a parcel.

On 9 October losses were reported that Ledger has still not totalled. Estimates in circulation run into the tens of millions of dollars. Ledger's Donjon team found an unauthorised hardware implant inside a device sold through CryptoBilis, the company's authorised reseller in South-East Asia. The implant read the 24 recovery words as the device displayed them during setup and sent them out over a mobile network using an eSIM. The secure element itself was never broken.

The mechanism explains why the usual checks return a green light. The attack does not ask a buyer to trust a counterfeit manufacturer. It asks the buyer to trust every hand between the factory and the doorstep: the reseller, the warehouse, the courier, and whoever resealed the box. Genuine Check authenticates the parts that should be present. An extra board is not a part of the design, so the design does not flag it.

The same failure mode showed up three more times this month. A breach at Trezor's shipping partner ShipMonk exposed 80,689 customers, and names and shipping addresses were among the records, which turns a customer list into a target list. Reports of tampered devices have appeared in Singapore and Germany, and those reports need to be kept separate from the confirmed CryptoBilis thefts.

In France the Interior Ministry counted 90 crypto-related cases of kidnapping, abduction, extortion, threats and violent theft between 1 January and mid-August 2026. That is the number behind the phrase wrench attack, and it does not depend on a single line of code.

The social layer fails in the same direction. A bitcoiner who posts as @astupidmoose described a call from what his phone identified as the North Vancouver RCMP, using the detachment's real number. The constable on the line said that police had arrested someone carrying a USB stick with his licence, his passport and his recovery phrases. The call ran for about 45 minutes. When that call dropped, "Trezor" rang to warn that his seed might be compromised and offered a recovery service. His wife asked whether this was real. He called the RCMP's main line and learned that the constable did not exist. Caller ID can be spoofed, and nobody legitimate recovers a seed phrase for a customer.

Two releases this month answer that with engineering rather than advice. Bull Bitcoin Mobile 6.14.0 takes recovery phrases through an in-app keyboard, so the words never pass through a third-party keyboard. The release also rebuilds its Tor integration, with isolated sessions for encrypted vault backups. Both changes pull the trust boundary inward, to the smallest surface the owner still controls.

Nik Bhatia of The Bitcoin Layer framed the month with a sentence worth keeping: "self-custody isn't a product you buy. It is a practice you build." A device is a purchase with an invoice and a return window. A practice covers where the device came from, how many words stand behind it, and which keyboard sees those words. It also covers who knows the address, and what happens when the owner is unavailable for a month.

Where the coins actually are#

Galaxy Research counted 20,097,788 bitcoin unspent at block 971,382 and labelled the holders. Exchanges hold 17.9 percent of that supply, ETFs and funds 6.0 percent, custodians 3.9 percent, miners 3.8 percent, companies 3.6 percent and governments 1.9 percent. Satoshi's Patoshi coins account for a further 5.6 percent. The largest slice of all carries no label: 55.1 percent, or about 11.1 million bitcoin.

Add the named slices and they come to 42.7 percent of unspent supply. The unidentified share stands at 55.1 percent, which leaves roughly two points unaccounted for in categories the summary does not name or in rounding. The sum is mine.

Where the bitcoin sits. Galaxy Research counted 20,097,788 bitcoin unspent at block 971,382: 55.1 percent carries no owner label, exchanges hold 17.9 percent, ETFs and funds 6.0 percent, Satoshi's coins 5.6 percent, and governments 1.9 percent. Source: Galaxy Research via Alex Thorn, published in TFTC's data snapshot of 14 October 2026. Own chart.

Alex Thorn, who runs firmwide research at Galaxy, drew the honest conclusion from his own chart. "Despite all the institutionalization and centralized ownership over the years, still a ton of bitcoin (maybe even most) is held by individuals in self-custody." An absent label is not proof of self-custody. Some of those coins are lost, and some belong to entities nobody has bothered to name. The point survives either way. After a decade of institutional accumulation, the largest single category of bitcoin is unlabelled, and unlabelled is another word for private.

The market ran its own arithmetic while these stories landed. My dashboard, read at 09:30 CEST on 15 October, put bitcoin at $81,023, down $549 on the day, and Brent crude at $104.21. Nik Bhatia's letter the previous evening was built around the same level, with bitcoin "defending $81,000" while derivative positioning weakened quietly underneath. TFTC's snapshot from the morning before had spot at $82,729.10 and the short-term holder cost basis at $74,547. At today's price the average recent buyer sits about 9 percent in profit, by my division.

Wires, barrels and the price of a choke point#

The same pattern runs through the physical layer, where the gates are made of copper and water.

On 13 October the Department of Energy formalised a $581 million award to the Tennessee Valley Authority. The money covers 84 transmission and distribution projects across eight states, expected to add about 2.5 gigawatts of capacity. The money splits into $250 million of federal funds and roughly $331 million of TVA cost-share. The projects were first selected in October 2024, and final agreements remain unsigned two years later.

A second award stacks on top of it. About $80 million of federal money will reconductor some 125 miles of existing line in Tennessee, Alabama and North Carolina with advanced conductors, which adds about 1,900 megawatts. Combined, the TVA holds nearly $741 million for more than 4,300 megawatts. Both awards come from GRIP, the $10.5 billion grid programme created by the 2021 infrastructure law.

Divide each award by the capacity it buys and the prices separate sharply. New transmission and distribution costs $232 million per added gigawatt. Reconductoring wire that already exists costs about $42 million per gigawatt, a factor of five and a half in favour of the second approach. My divisions again, made on the announced figures.

The cheap megawatts are the ones hidden in the line that is already strung, which is why the smaller award deserves more attention than the larger one.

Goldman Sachs Research named Tennessee as one of the markets "likely to see constrained data center additions since the market is already critically tight." The same desk puts grid interconnection waits at two to seven years, depending on the region. It also projects that behind-the-meter generation will power about a quarter of global data centre demand by 2030. A quarter of an industry is giving up on the shared wire. That decision carries information about what the industry expects the wire to cost, and how long it expects to wait.

Who pays for that wire is where the argument sits. The $581 million comes from federal taxpayers and TVA ratepayers. The capacity will be used by whichever loads connect first. In policy conversations the hyperscalers have argued that shared grid upgrades deliver a system benefit and that ratepayers should absorb the cost broadly. Tuesday's announcement is that argument winning in public. Projections of tens of trillions of dollars in AI data-centre capital spending to mid-century rest on the assumption that somebody else strings the wire.

The second choke point is measured in barrels. Before the war the Congressional Research Service put Strait of Hormuz throughput at about 20 million barrels a day. That is roughly a quarter of global maritime oil trade and 19 percent of liquefied natural gas. Kpler, as cited by CNBC, measured about 8.5 million barrels a day in the week ending 9 October. My dashboard had Brent at $104.21 on 15 October.

Here the sources disagree, and it is worth saying so out loud. TFTC describes the 8.5 million figure as "roughly 40% below pre-war levels." Yet 8.5 against 20 is 42.5 percent of the baseline, which is a fall of about 58 percent. The ratio I can compute is the larger one. Either the pre-war baseline for that measurement sat nearer 14 million barrels a day, or the two numbers describe different windows. The direction is not in doubt, and the size is bigger than the phrase suggests.

Attacks continue underneath the weekly averages. The International Maritime Organization counted 11 tanker attacks in the week ending 4 October, a wartime high. Iran struck roughly two ships per 100 transiting the strait in the third quarter. On 14 October the Singapore-flagged GFS Pride, a 2,824-TEU container ship, sank south of the strait after striking a naval mine. It is the second vessel lost since the war began on 28 February. Mohsen Rezaei, secretary of Iran's Supreme National Security Council, said on 11 October that Revolutionary Guard forces target five or six vessels a night.

Rezaei has also threatened the connectivity layer directly. In a Press TV interview he said that undersea cables, data centres and artificial intelligence facilities in the Gulf would be destroyed if the United States resumes major bombing. The Wall Street Journal reported on 13 October that Tehran had warned Gulf states privately about ground incursions. The cables through the Gulf of Oman corridor carry a large share of Europe-to-Asia traffic. Damage there would leave Bitcoin's consensus rules untouched, and it would slow nodes and Lightning routing across the region. That is the practical form of a question usually asked in the abstract, and it has the same answer as the hardware wallet. The parts you can replace yourself are the parts that keep working.

The case against my own argument#

The strongest case against this reading starts with a mismatch. I have placed a fair-access report, a criminal sentencing and a supply-chain theft side by side because they rhyme, and rhyming is not causation.

Take the OCC first. Its report was produced under an executive order, by an agency whose new comptroller is rebuilding supervisory policy. A regulator that has already decided reputation risk was a mistake has an interest in showing how badly it was used. Banks will answer that anti-money-laundering rules closed those accounts, and that politics played no part. The report itself does not prove that any particular account was shut for a political reason. That is part of why no penalty followed. Proving motive in a single case is hard, and a documented pattern is not the same thing as a documented decision. The CFPB investigations may produce nothing at all.

The two-tier argument has a counter as well. Bank of America's failure was a reporting and monitoring failure rather than theft of customer money, and $1.2 billion is real capital that leaves the building. Rodriguez and Hill pleaded guilty to a charge the government won, and their decision to plead reflects a judge and an exposure range. A guilty plea is not a proven scheme to launder anything. Serious lawyers disagree about whether non-custodial software can be a money transmitting business, and FinCEN's guidance is guidance rather than statute. A prosecutor who wins a case is not automatically a prosecutor who was wrong.

Self-custody deserves its own counter-case, and Bhatia makes it in the same letter. A multisig wallet does not remove coercion, mistakes or a compromised device. It adds steps that a holder must perform correctly for years, and it fails quietly when the holder stops maintaining it. For a large share of owners a well-run custodian with a strong account and a hardware key is the safer arrangement. Advice to the contrary has cost people their coins. The share of wealth kept in self-custody should track the owner's knowledge and willingness to maintain the setup. Telling every reader to run a node is bad advice dressed as principle.

The grid argument has a counter too. Ratepayer money for wire does not transfer value to hyperscalers alone. Every load on an upgraded line can use it, including the hospital and the machine shop on the same feeder. Letting each data centre build its own generation does not make the public cheaper. It leaves the public with an older grid and no new capacity. Finally, the choke-point framing has been wrong before. Hormuz has closed and reopened, oil has sailed around the Cape of Good Hope, and the catastrophe priced into the barrels did not arrive.

What I could not verify#

I could not confirm the size of the Ledger losses. The figure in circulation is "tens of millions," and Ledger has published no total.

I could not check the Bank of America profit figure against the filed statement. The $8.1 billion and $8.3 billion numbers come from TFTC's reading of the quarter, and the accounting of a one-off regulatory charge against reported profit needs the statement itself. My ratios rest on those figures as given.

I could not reconcile the two Hormuz numbers, as set out above, and I did not find a primary Kpler table to settle the difference.

I have no independent confirmation of the Galaxy ownership split beyond Galaxy's own chart, and my sum of the labelled slices leaves about two points unaccounted for.

Reports of tampered Ledger devices in Singapore and Germany may belong to a different campaign, and treating them as one story would be a guess.

What the week actually prices#

Pull the week's stories into one line and the difference is mechanical. A licence to move money rests on a judgement, and a judgement can be negotiated. Nine banks kept their charters because the conduct was documented and left unpriced. Two developers went to prison because they had nothing with which to settle, and the government priced their software at forty times what it ever earned.

Bitcoin's rulebook runs the other way, and the difference is not moral. Every node checks the same consensus rules, whatever the operator's size, and a fee is paid to whoever mines next. The chain does not weigh reputation, it does not read a customer's politics, and it cannot be persuaded by a filing. The price arrives as work instead. It arrives in confirmations, in fees that rise when blocks fill, and in the maintenance a self-custodial setup demands of the person who holds the keys.

The second half of the week's news shows what that price looks like in practice. Exit to self-custody does not remove intermediaries. It moves them onto a reseller's bench, into a courier's van, onto a keyboard, and onto the line of a phone call from a number you recognise. Those are gates a holder can inspect, and inspection is the only part of the arrangement that scales with knowledge rather than with size. It is also the part most holders never do.

Which leaves the number that matters most in this week's data. More than 11 million bitcoin carry no owner label, and the labelled institutions together hold less than half the supply. Nobody can verify what that unlabelled block is, and it is the only audit in this week's news that any person can run without asking permission. That is the consequence worth carrying out of the week. The rules are enforced in public, and the proof is the part you do yourself.

The Rulebook Has Two Prices

The Rulebook Has Two Prices

The regulator's own receipts#

Two prices for one rulebook#

The gate you cannot open#

Where the coins actually are#

Wires, barrels and the price of a choke point#

The case against my own argument#

What I could not verify#

What the week actually prices#

Sources#

Comments0