On 31 October 2024, a laptop left with a repair technician our founder did not know became the starting point of a security breach. MetaMask, Trust Wallet and OKX were emptied: about $2,000 in total, including 1.088 BNB. One exchange account held. The attacker got in and converted the assets, but the withdrawal stopped at an SMS confirmation sent to a separate phone number.

One ordinary security control made the difference. It raised a question far bigger than one theft: how much of the infrastructure we depend on is secure by design, and how much survives by accident?

The Cirqus Register exists to investigate that question, and others like it.

The night one exchange’s security held

Our founder, Vitalii Chekalin, who writes as Otto Myst, had handed his laptop over for repair. It was running an unlicensed copy of Windows with no antivirus protection. Everything we know points to that machine as the entry point.

On HTX, formerly Huobi, the attacker converted the assets into BNB and tried to withdraw them. The withdrawal stopped at an SMS confirmation tied to a separate number. Nothing left the account.

A caveat matters here, because our readers know how SIM swaps work: SMS is not strong two-factor authentication on its own. What held was that the second factor lived outside the compromised machine.

Cirqus Heresy runs an institute called the Arsenal, which tests the tools people use to protect their assets. The breach was a real test, the kind nobody volunteers for. HTX passed it, and that is why it carries the Arsenal’s first C·H·A·O· hallmark. The rule has not changed since: a hallmark is never bought and never assumed. A person issues it, and only after a real, documented test. Hallmarked, not reviewed.

The sum was modest. The lesson was not. The weak link wasn’t code. It was an assumption: that a repair shop is just a repair shop. The lesson was simple: don’t trust. Verify.

A publication, not a feed

Cirqus Heresy is The Order of Choice. Its institute, Cirqus Intelligence, runs intelligence, research, analysis and forecasting on how technology, rules and money are changing the work of independent builders. The Cirqus Register is the institute’s publishing arm: a record of what changes, what matters, and what the evidence supports.

We don’t compete to be first with the news. We work to understand what changes mean for the people building on top of them.

Every serious publication needs to know what it stands against. In its prospectus of August 1843, The Economist described its purpose as taking part in “a severe contest between intelligence, which presses forward, and an unworthy, timid ignorance obstructing our progress.” (source) We borrow that tradition, not that stature.

Ours stands against the comfortable assumption: the one that treats a draft rule as law, a loud event as an important one, and the repair shop as safe.

The Q is not a typo. It’s the lens.

The q in Cirqus is deliberate. In The Cirqus Register mark, it becomes a magnifying glass. Beneath the lens, the letter shifts out of alignment: out of register.

In printing, registration is the precise alignment of the layers that form an image. When those layers drift, the image falls out of register, and registration marks reveal the discrepancy.

We use the same idea as an editorial principle: look closely, identify where the accepted picture no longer matches reality, and record the difference. That is also why the publication is called a register: a book of records, where our conclusions are written down so they can be checked later.

The method: watchpoints

Every analysis is built around watchpoints: specific thresholds and events after which the picture changes. We don’t just describe a shift. We state in advance what would have to happen, and by when, for us to know whether it was real.

Here is what that looks like in practice. A platform announces a new rule. We don’t stop at the announcement. We ask who is affected, what changes in practice, what remains uncertain, and which evidence will tell us whether the change really matters. Then we set the watchpoint and come back to it.

Every regular issue ends with a Trickster’s question: which accepted assumption does this change challenge? Urgent security alerts skip it. They tell you what happened and what to do.

How we publish

These rules are our editorial charter.

• Shifts, not news. Every issue answers three questions: what changed, why it matters to you, and which watchpoint will test our conclusion.

• Facts, interpretation and hypotheses are kept apart. You should always be able to tell which is which.

• Sources first. Material claims link to their sources. Primary sources come first wherever they exist, and uncertainty is stated, not hidden.

• Forecasts we can be held to. Every forecast has a deadline and a condition for success, both defined in advance and stated publicly in the issue, so anyone can check them. We forecast events, decisions, incidents and rules. We do not forecast prices or rates. There are no buy signals, and there never will be.

• We keep score. Every forecast is timestamped and recorded in our Ledger. Nothing is removed or rewritten after the fact. The Ledger will open to the public once enough entries have been checked; until then it is kept internally. Once a month, starting after our first six weeks, The Reckoning sets what we said against what happened.

• We never rewrite history. When we get something wrong, we say so. Any correction or revision is recorded as a separate entry, with its reason.

• No allegations on thin evidence. We do not make allegations based on a single on-chain connection, and we do not publish lists of “suspicious” addresses. A hypothesis stays a hypothesis.

• A quiet day is called quiet. If nothing real has shifted, we say so and name one point we are watching.

• We are open about our method. AI agents assist with research, analysis and first drafts. Every issue is checked by a verifier and approved by a human editor. The agents extend what we can do. They do not replace human judgment.

Formats and verdicts

We publish in four formats:

• The Signal: one change, read in 60 to 90 seconds. Monday, Wednesday and Friday.

• The Orbit: a deeper look at the week’s central developments, with a clear thesis and its evidence. Five to eight minutes, on Wednesday and Sunday.

• Inquisition Alert: an urgent warning about a hack, a drainer, a scam or a sudden change in the rules. Published when it happens.

• The Reckoning: a monthly audit of our own forecasts.

Verdicts apply to a single claim, never to a whole project or company:

• PROVEN: the claim is confirmed by reliable evidence.

• IN ORBIT: there are credible grounds, but verification is still under way. It does not mean “probably true”.

• UNPROVEN: there is not yet enough evidence to support the claim.

• DEBUNKED: reliable evidence contradicts the claim.

Confidence is recorded separately, as high or medium. Where the evidence supports only a working hypothesis, we label it explicitly as a hypothesis rather than assign a confidence level we cannot justify. A verdict is also not the outcome of a forecast: PROVEN means a claim is backed by evidence, not that a prediction came true. The Ledger tracks forecast outcomes separately, as hit, miss or void.

We watch four orbits:

• Infrastructure & Security: hacks, drainers, vulnerabilities, wallets, bridges, and the infrastructure creators depend on.

• AI & Leverage: tools and models that change what one person can do alone.

• Power & Rules: regulators, platforms, court rulings and terms of service; in short, who sets the rules of the game.

• Capital Flows: how money moves to the people who build, from grants and funds to creator revenue and new business models. Not price movements.

We choose stories by their consequences for our readers, not by how loud they are.

What you can expect

The Cirqus Register is for independent creators and builders in Web3 and AI: people who need to understand the risks in the infrastructure they build on, notice when platform rules change, judge new AI tools on evidence, and see where real opportunities are forming, without the noise. It is not written for traders.

Five minutes to know what actually shifted. Deeper analysis when the shift demands it. Every forecast recorded. Every mistake visible.

The first issues are coming soon. Subscribe to The Cirqus Register to get them as they appear.

One question before then, the kind every issue will end with: what assumption in your own setup have you never actually tested? Tell us. The most useful answers may become our first watchpoints.

And tell us what you actually want the institute to look into: a topic, a format, a question nobody has given you a straight answer to. Reply in the comments or message us directly. We read every message, and the best questions become issues.

Nihil sine probatione. Nothing without proof.

Further reading: The Founder’s Call · Cirqus Heresy: The Canonical Lore · Cirqus Mundi, the operating world of the Order