BTC to $81K on gold's coattails, but the shorts are the ones paying the bill

Bitcoin ripped from about $75,600 to above $81,000 on Nov. 4, hitching a ride on gold's 3.4% jump to $4,061.10 while the crowd screamed debasement trade. Peel back the layers and this wasn't a fresh wave of believers. It was shorts getting shoved into buying back, and the dumb money is calling it a thesis.

▪️ Gold futures posted their biggest daily gain in three months after the dollar weakened on the Democrats' sweeping US midterm win
▪️ Stocks joined the party too: S&P 500 +1.6%, Dow +3%, and the 10-year Treasury yield slid from about 4.95% to 4.89%
▪️ Shorts were the fuel: about 81% of the bearish positions liquidated within one hour were shorts, and every forced buyback pushed price higher
▪️ Bitfinex's Nov. 4 analysis found the recovery was driven largely by short covering, with limited aggressive buying in the spot market
▪️ Spot ETFs bled about $1.16B over the three sessions before the bounce, their biggest outflow since late June
▪️ Nov. 4 brought $74.6M back, but Fidelity's FBTC took in $236.7M while BlackRock's IBIT lost another $201.2M

📊 Short-term holder BTC in profit, now: ~38%
📊 Short-term holder BTC in profit, early October: at least 97.5%
📊 CBO federal deficit projection, 2026: $1.9T

Long the debasement story? Then the data is telling you the bid is paper-thin. ETF money still hasn't clawed back what it bled, and most short-term holders are underwater. Lower yields and a stock relief rally explain this candle way better than some currency-doom sermon. The CBO's $1.9T deficit path is great ammo for the narrative, but it didn't pay for this move. Shorts run out, and the support walks out with them.

🔮 Gold and BTC holding hands in a short squeeze. Who's buying once the shorts are gone? Good luck finding them.

@rmpltg

🤖 AI-hacker CRAFTY FALCON is draining exchange wallets while India's CERT-In yells fire and nobody listens

India's CERT-In is warning that CRAFTY FALCON, an AI-assisted financial threat actor, is going after banks, fintechs, payment providers and crypto exchanges to steal wallet keys and siphon funds. NBFCs and fintech firms have already reported successful hits. It kept going after earlier warnings, because these guys keep coming back to whoever patched halfway. A half-done patch is just a welcome mat.

▪️ Targets get scanned by machine intelligence and hit at machine speed. Nobody's clicking through this by hand, so your 'we'll look into it Monday' plan is dead on arrival.
▪️ Timing is the trick: holidays, weekends, the low-monitoring windows when the SOC is asleep. Detection and response show up late, when the money's already gone.
▪️ Repeat customers: the actor deliberately re-hits entities that already got restricted advisories where remediation was incomplete. A loyalty program for hackers, basically.
▪️ Entry points are internet-exposed testing and staging environments. Reverse-engineered app codebases give tailored exploits, and modified app packages make unauthorized API calls.
▪️ Cloud abuse: AWS Systems Manager and Lambda run commands and deploy malicious files inside the victim's infrastructure. Your own cloud tools, working for the other side.
▪️ IP allow-listing gets bypassed through whitelisted third-party fetcher IP pools. The whitelist is the door.

📊 Test transaction: 1 INR (~$0.011)

If your coins sit on an exchange, a fintech wallet or a payment app, the weak spot isn't your password. It's the operator's forgotten staging box and its payout API. CERT-In already warned these firms once, and the campaign rolled on anyway. So those 'we fixed it' press releases are worth exactly as much as the patch levels behind them. Expect more re-hits on the ones that patched halfway.

💬 «AI tools can now find vulnerabilities faster than teams can patch them, which is why we've seen a string of major incidents in recent months.» — Bernardo Brites

🔮 Which exchange is still running a staging server nobody remembers to shut off?

@rmpltg