Last week a number surfaced on a crypto newswire and then, as these things do, began to travel. Anthropic — the company behind Claude — claimed that new safeguards had reduced "distillation attacks" against its models by 90 to 99 percent. No methodology published. No third-party replication. No on-chain attestation. No chain at all. And yet there it sat on Crypto Briefing, filed under the same taxonomy as token launches and layer-2 upgrades, as though a machine-learning defense had anything to do with consensus, custody, or code.
I read the item three times, the way I once read Alameda's cross-collateralization tables in the winter of 2022 — not for what it said, but for what it was arranged to conceal. Three information points. A company name. A self-reported range. The absence was the signal. When a disclosure is this thin, the thinness is the disclosure.
I want to be honest up front, because the honesty is the analysis. This is not, in any structural sense, a blockchain story. It is an artificial-intelligence story carried into crypto's feed by the accident of its publisher. The ledger bleeds red when trust decays into code — but here there is no ledger at all, only a press release wearing one.
So what is a distillation attack, and why should anyone outside a machine-learning lab care?
Distillation is a technique as old as the desire to steal a teacher's knowledge without paying tuition. You take a large, expensive model — one trained on tens of millions of dollars of compute — and you query it relentlessly. You collect input-output pairs. You feed those pairs into a smaller, cheaper model of your own until your student begins to mimic the master. You never touch the weights. You never breach a server. You simply ask a great many questions and keep the answers.
This is model theft — intellectual property extraction conducted through the front door, in the language of legitimate use. And it sits at the exact center of the tension I have spent years documenting: the collision between openness as a value and openness as a vulnerability.
My path here was not linear. In 2024 I pulled apart roughly 50,000 lines of the digital euro prototype's contract interface and found that offline transaction limits were capped at €300 — a design choice that quietly restricted the currency's usefulness at the edge of the network. That discovery pushed me from observer to critic, and it taught me a habit I have never shaken: when a system tells you what it protects, always ask what it is protecting itself from, and who pays for the protection.
Then, in 2026, I spent four months analyzing a dataset of ten million micro-transactions executed between autonomous AI agents. Sixty percent had no human in the loop. What unsettled me was not the automation. It was that the agents were trading access to inference — buying and selling model outputs the way earlier generations traded bandwidth. Once intelligence becomes a metered commodity, its leakage becomes an economic event, not merely a technical one.
That is the frame in which Anthropic's claim should be read. Not as a security bulletin. As a tariff.
Why did it land in crypto's feed at all? Because the editorial logic of the crypto newswire is not domain relevance but narrative adjacency. AI is the story that has been pulling capital and attention for two years running, and any item touching it — even one about a lab's internal red-teaming — is cheap traffic. The domain label is a filing decision, not an analytical one. If you have ever watched a token rally on news that mentioned neither the token nor its chain, you already understand the mechanism.
Let me do what I do. Let me look at the load-bearing walls.
The claim: distillation attacks reduced by 90 to 99 percent. Three problems present themselves immediately, and each deserves the care an auditor gives a balance sheet.
First, the range itself is a tell. A genuinely measured result is a point estimate with a confidence interval — "reduced by 94.2 percent across a sample of N adversarial sessions, ±2.1 points." What we were given is a corridor wide enough to drive a freight train through. A 90 percent reduction and a 99 percent reduction are not the same claim. One is meaningful hardening. The other is categorical near-elimination. Collapsing them into a single hyphenated range is not precision. It is the aesthetics of precision applied to the absence of it.
Second, the denominator is invisible. Reduced relative to what? Against a red-team baseline the company itself designed? Against observed production traffic? Against the wild, adversarial internet where the most motivated extractors actually operate? In my years reconstructing hidden leverage, the most important number is almost never the one on the slide — it is the denominator nobody bothered to print. Anthropic gave us the numerator. The denominator stayed home.
Third, and most damning, there is no independent replication. This is where my FTX scar tissue speaks. In late 2022 I identified a discrepancy of roughly $1.2 billion in unallocated stablecoin reserves by rebuilding Alameda's cross-collateralization ratios from the outside. I could do that because the data was on-chain — public, timestamped, adversarial. Anyone with patience could check my work. That property — verifiability without permission — is the only thing crypto ever genuinely contributed to finance.
Here, that property is absent. The 90-99 percent figure is self-reported, unaudited, and structurally uncheckable by anyone outside Anthropic. We are asked to trust a closed model's claim about its own defenses. We are auditing the ghost in the machine's soul, and the ghost has declined to submit to examination.
Now — and this is where most crypto commentators get it exactly backwards — none of this makes the underlying technology unserious. The opposite. Distillation defense is one of the genuinely hard problems in commercial AI, and hardening it matters enormously to anyone whose business rests on proprietary weights. The technique, whatever it is, is almost certainly real. What is unverified is not the engineering. It is the marketing of the engineering.
Consider the competitive geometry. Anthropic's defense, if it holds, strengthens its position against OpenAI and Google DeepMind — two rivals with comparable moats and comparable incentives. Every one of them is racing to fence the same commons, and none of them will publish a number a competitor could falsify. The entire frontier-lab sector has a structural interest in unverifiable safety claims, because verifiable claims are checkable, and checkable claims can lose. This is not cynicism. It is the incentive structure, stated plainly.
Let me model the economics, because the economics is where the crypto crossover actually lives.
A frontier model is a capital asset with an unusual decay profile. It costs a fortune to build and almost nothing to copy — if copying is permitted. Distillation is the copying mechanism. So a defense against distillation is, functionally, a fence around a capital asset. It converts an open commons into a gated one.
And here is the insight I want to plant, because I have not seen it stated clearly anywhere: the value of a distillation defense scales not with a model's quality but with its uniqueness. A mediocre model has nothing worth stealing, so defending it is theater. A frontier model has everything worth stealing, so defending it is existential. This means distillation defenses are inherently moat-deepening technology — they protect the leaders and do nothing for the followers. They are, structurally, an anti-competition instrument dressed as a safety measure.
Which brings us to the crossover Crypto Briefing was actually, if clumsily, reaching for.
There is a real and growing AI×Crypto sector built on a single premise: that intelligence should be verifiable, permissionless, and owned by no one. Decentralized inference networks. Model-provenance registries. On-chain attestation of training data and model lineage. These projects exist because the closed-model paradigm has a trust problem — the same trust problem I just described. Their pitch is essentially: don't ask a company to prove its model is safe; let cryptography prove it.
Anthropic's announcement, read cynically, is rocket fuel for that pitch. Every time a closed lab says "trust our number," it advertises the case for verifiable alternatives. The stronger the walls of the closed commons, the louder the argument for the open one. I flagged this dynamic in my 2025 work on composable liquidity, and it has only sharpened since.
But — and I will not soften this — the transmission is narrative, not fundamental. A crypto token does not become more valuable because Anthropic hardened its API. The AI×Crypto projects that benefit from this story are benefiting from attention, and attention is the most fickle input in any model. If you are holding an AI-themed token because a machine-learning safety bulletin crossed your feed, you are not trading information. You are trading mood. Trust is the only collateral that cannot be audited from the outside.
Here is where I part company with the consensus reading, on both sides.
The crypto optimists see this news and think: closed AI is under pressure, therefore open AI wins, therefore my decentralized-inference bags are vindicated. The AI insiders see it and think: good, the moat is holding.
Both are missing the deeper current. This is not fundamentally a story about AI safety, and it is not a story about crypto. It is a story about sovereignty — about who gets to decide what a machine is allowed to remember.
Consider what a distillation defense actually does at the systems level. It does not merely prevent copying. It prevents exit. A model that cannot be distilled is a model you cannot leave. You cannot take your accumulated interactions and build an independent alternative. You are locked into the provider's terms, the provider's pricing, the provider's jurisdiction. In the language I use for central bank digital currencies, this is the difference between a currency you can hold and a currency you can only be issued. The digital euro pilot capped offline transactions at €300 — a small number that told a large story about who controls the edge of the network. Anthropic's distillation wall is the same story told in a different accent.
We are watching the same pattern emerge across both domains at once: the enclosure of what was briefly a commons. In AI, the commons was open weights and permissive querying. In money, the commons was the unmediated peer-to-peer transfer of value. Both are being fenced. Both fences are justified in the language of safety.
The contrarian claim I want to leave standing is this: the safety framing is not false, but it is not the whole truth, and the difference between those two things is where power is being quietly transferred. Every genuine protection is also a genuine moat. Every moat is a place where a user's exit grows a little more expensive. The question is never whether the fence keeps out thieves. The question is who holds the key, and whether you were ever asked.
And on that question, Anthropic's three-line disclosure — the numerator without the denominator, the range without the methodology — answers loudly by refusing to answer at all.
So where does this leave someone standing in a sideways market, watching a story that is neither blockchain nor investable drift across their feed?
It leaves you with a signal about direction, not a signal about price. The direction is toward enclosure — of models, of money, of the verifiable layer beneath both. The 90-99 percent will never be independently confirmed, and in a sense that is the point. The claim's unverifiability is itself the thesis.
What I am watching now is not the number. It is the fence. Watch whether the next generation of AI×Crypto infrastructure gets built outside these walls — genuinely verifiable, genuinely exit-friendly — or whether it quietly becomes a reseller of the very gates it claimed to tear down. Because if the open alternative ends up renting its compute from the closed commons, then the fence won. And we will have spent a decade building a door only to discover it opens inward.
