This article is a bit of a technical one, but no less important than any other I’ve posted so far. Maybe even more important as it’s THAT insidious!

Subscribe now

His name is Peter Stokes, and for a hacker, he did mostly everything right.

He had his VPN up the whole time. Traffic was tunnelled through ngrok. IP addresses were hopping between Tallinn, New York and Bangkok like a man working three frequent-flyer schemes at once.

Nineteen years old, dual US-Estonian, and allegedly running with Scattered Spider, an extortion crew that’s pulled in over $100 million across a hundred-plus breaches.

Didn’t matter. one. single. bit.

Maybe first a few technical terms out of the way for the people unaware of those:

IP: See this as your home-address, but online. If the gov has your IP, they know who you are (more or less - not going into too much detail here so stop nitpicking - yes yes, talking to my fellow nerds here :wink:).

VPN: this is (mostly) a software solution that encrypts your traffic and shoves it through someone else’s server first, so whoever’s watching sees that server, not you.

ngrok: a legitimate tool developers use to expose a local server to the internet. Also, apparently, popular with people running extortion schemes who need their traffic to look like it’s coming from nowhere in particular. Purely coincidental, I’m sure.

IP hopping: bouncing your connection through different countries so each request looks like it came from a different place.

On May 12 last year, at 19:21 UTC, someone opened ngrok’s signup page and created the account later used to break into a US jeweller for an $8 million ransom.

Microsoft’s own logs, quoted in the federal complaint, show which machine opened that page, down to the minute. NOT the address the VPN was busy disguising. The machine itself.

That’s more or less the whole article.
So you can stop reading now if you want.

The why and how, THAT is what got me all wired up today.

If you’re using a VPN, you’re supposed to be protected as your real IP isn’t known. So the FBI didn’t know it. VPN is still secure. It’s equally useless now this secret is out in the open.

So pray tell… How did they get to this guy’s name?

They called Microsoft.

Windows has something called a GDID - the Global Device Identifier. It comes straight from Microsoft’s telemetry, and if you have Windows 10 or 11, you have been quietly reporting your own details this whole time. No matter where you are, or hop to in this case.

So pray tell… What IS this GDID?

Glad you asked… I would have never told you otherwise /s

A GDID is, without diving into that acronym soup, is something that every Windows installation gets. It’s not a hardware ID, because hardware can change, it’s passed down the first time your computer reports back to Windows (and oh boy, they REALLY like to call back!!).

Each fresh Windows installation gets a new GDID. Which stays with you forever and ever until the end of time (or until you erase that spyware masking as an operating system).

Think about it like a membership card you never asked for and can’t send back.

And no matter what you do, updates, change a harddrive, add more memory, whatever… It sticks. ONLY that clean reinstall will get you a new one. And even then Microsoft’s side of the ledger still keeps the old one, history attached. So if your reinstallation happens to be from the same IP as the old history? It still can get traced back to you.

Now every time you boot into Windows, a background service registers your device into Microsoft’s internal directory. One user’s own support thread has that service shovelling 250 to 300 megabytes home on a single startup.

Per boot. For a name tag. I’m pretty sure it’s more than a name tag which gets sent.

Separately, there is this update-sharing service that reports the exact same number next to your IP and rough location. Another diagnostics pipeline uploads batches on its own schedule. And if your telemetry sits anywhere that is not equal to “turned completely off”, those batches can carry the web addresses of your browser and the URLs your Defender has been checking against Microsoft in real time.

The GDID rides along with every lookup.

Which brings me back to our (unfortunate) hacker… Those background services are almost certainly how “opened ngrok’s signup page” got a timestamp accurate to the minute. They didn’t even had to guess. Windows knew who you were all along.

Nobody asked you to opt in to any of those channels.

There’s not even an off-switch for this, and no, it’s not what the “Diagnostic data” slider controls. That slider is the digital equivalent of asking the universe to pretty please be quiet. The universe remains annoyingly chatty anyway. Much like Windows.

Normally when you install Windows they ask you to register with a Microsoft account, but there is a workaround: a local account.

However, this doesn’t save you either. There’s a fallback baked in that registers the device anyhow. No human interaction necessary.

Now if you’re curious, you can find this via regedit at HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties.

That value converts to the exact format that turned up in the indictment.

Good you know that it’s there. But don’t go pasting this anywhere public: that specific number, plus your account, plus a device detail or two, is PRECISELY the combination that gets someone found.

You don’t go posting your ID card either right?

None of this is hidden, exactly. It’s in Microsoft’s own Azure documentation, described in one flat sentence as an identifier “used by Microsoft internally”.

Technically true. Technically a shark is a fish.

Stokes handed over the rest for free. So maybe not the smartest guy in the room, but give him some slack, he’s only 19…

Snapchat photos of cash, watches and a diamond chain spelling “HACK THE PLANET”.

A selfie from an Estonian police station, captioned about how the feds had no idea what they’d just let walk.

He did great with the VPN, and ngrok. But then couldn’t help but post his own location to the internet with a taunt attached.

Once the GDID tied his device to that ngrok account, the rest was bookkeeping: Apple, Facebook, Snapchat, even a Growtopia login, all lining up on the same IPs, cross-checked against his State Department travel records. Tallinn in one window. New York in another. Thailand after that.

The VPN hid where the traffic came from. But it never mattered.

I think it’s good riddance as those people are not innocent. I mean, they drained businesses for millions!

But the tool that caught him doesn’t check anyone’s intentions. It’s always-on on every Windows 10 and 11 machine on the planet.

There’s no published policy on when Microsoft hands that data to a government, no opt-out for anyone who’d rather not be found, and no report telling you how often this already happened quietly, to people who never make the news.

Oh, and before you go rushing off to the nearest Apple Store. Mac ain’t a refuge.

Because GDID was already taken, they called it DSID (Directory Services Identifier). Similarly, it’s a permanent number welded to your Apple ID. And Apple has your full name, phone number, birth date, email address, …

Their analytics send this number to the home turf every tap you make in the App Store or Music, even when told not to send it. “Share Analytics” is basically lipstick on a pig. Doesn’t do jack shit.

If you’re interested: search for Tommy Mysk.

The only place that can help you is Linux. It DOES have an ID too (/etc/machine-id), but the difference is fundamental. That machine ID is generated from a random source during system installation or first boot - on your box, not handed down by a vendor’s server, and no company keeps a copy.

The manual itself says it should be considered “confidential”, and must not be exposed in untrusted environments, in particular on the network.

Don’t like it? rm the file, reboot, and you got a new one.

No OS-level phone-home by default.

Caveat though: the OS isn’t watching in this case, but the apps you install (Chrome, Spotify, a Google login) still phone home on any OS.

Which ties me to my article from yesterday, as this becomes so much more than a self-incriminating teenager. And where things go with the EU, so they go with the US. Just you wait!

A persistent identifier tied to a real person is personal data under EU law.

There’s no debate even anymore about that. The European Court of Justice settled it years ago, ruling that even a dynamic IP address counts, as long as whoever holds it has a realistic way to link it back to you.

A device ID, plus years of IP history, plus three linked accounts, is well past realistic.

Windows telemetry has already lost this fight here.

Twice.

The Dutch regulator found the collection unlawful in 2017, forced changes, then came back a year later and found Microsoft still running “new, potentially unlawful” processing.

They did updates. Turned out they were doing the wrong homework. I’m sure it’s all a conspiracy theory…

Another government-commissioned assessment went even further: there’s absolutely NO legal basis for most of the diagnostic data, and even worse if you’re forced to use Windows at work, you can’t say the employee consented, because an employee can’t very well tell their employer they’d rather not use Windows today.

Hesse banned Office 365 from its schools outright. Seems children can’t consent to being exposed to possible access by US officials.

So the collection is already on thin ice in the EU. But nothing changed in the decade since this came to light.

But wait… There’s more… There’s always more… This gathered data doesn’t even stay in the EU. It goes straight to the servers in the United States. I mean, I trust the US more than I would trust China or Russia, but it’s a very close competition…

In 2015 the EU struck down “Safe Harbor” because data in the US was gobbled up immediately by the intelligence services once the data landed.

Now they’re calling it “Privacy Shield”. Sounds fancy. Sounds trustable. Struck down in 2020, same reasonings. (and I paraphrase: “the US is not trustworthy with our plebs data”)

So not to be deterred - and to employ at least some creative talent - they came up with a new name: “the EU-US Data Privacy Framework” (born 2023). Copy/pasted the whole damn thing, adjusted the font.

It’s basically Microsoft self-certifying, promising that the American body overseeing this, the FTC, is independent enough that Europe can trust it.

I’m guessing Peter has some objections right about now.

The US Supreme Court ruled a bit ago that the president can fire FTC commissioners whenever he likes, no cause required.

That decision that the US’ protection is “adequate” leans on that independence. Repeatedly. Which is kind of awkward when the decision is in the hands of just one person.

Max Schrems noticed. He tends to. The Austrian who killed the previous two frameworks wrote to the Commission the day after, arguing the ground under this one had gone the way of the dodo.

He’s now filing a third challenge. People are already calling it Schrems III, at this point less a lawsuit than a release cycle.

The redress side is even worse.

The thing meant to let an ordinary European complain when their data is misused runs through a “Data Protection Review Court”, which sounds pretty judicial but ain’t.

It’s just an office inside the US Justice Department, set up by executive order, and its judges are appointed by the Attorney General and removable by the president. Yup, the same one that can fire FTC commissioners.

“Independent”, right?

The current administration already fired all Democratic members early last year, leaving it short of the numbers to rule on anything at all.

The complaints desk was already broken for over a year before the enforcement desk tripped over its own laces this week.

None of this will be switched off tomorrow.

Adequacy decisions die slowly, in court, over time, much like the last two.

The lawyers are now saying what they said before the last two failed: don’t panic, keep the paperwork current. Courts in the meantime, start to notice those recurring plots. Even they get it by version three.

Stokes wasn’t caught because the system has a flaw. He was caught because it works exactly as built, and it was never built to ask first. It was built to know.

That GDID is the ONE identifier that survives a VPN, a proxy, a new IP, a new country… It was carefully built on illusions.

It survives right up until you wipe the disk. And even then Microsoft keeps the old number, because deleting history is hard and keeping it is easy.

The hacker was only the first name on the list.

I’m pretty sure Microsoft will get busy with court requests after govs find out about this VPN-busting method of pinpointing dissidents.

Niemöller never had a device ID.

Lucky bastard.

Subscribe now

My other publications:
[Daily Digest] → The news in 5 minutes, without the forty open tabs.
[Portfolio] → What I do with my own money

A recent report in the Wall Street Journal describes a tense meeting among European leaders early this year, convened after Donald Trump threatened to use military force to seize Greenland from Denmark. According to the Journal,

heads of government were venting so emotionally about the 47th president that some of the nearly 30 leaders present would later call the session “therapy night.”

Yesterday, soon after he arrived in Ankara for the NATO Summit, Trump reiterated his demand that Denmark hand him control of Greenland. But reactions were subdued. As far as I can tell, our erstwhile allies are now treating Trump as the senile uncle who says crazy, outrageous things, but shouldn’t be taken seriously.

What has changed? According to the Journal, European leaders have largely given up on hopes that they can bring back the America they used to know, and are quietly, in effect, declaring independence:

American allies have begun pushing the gas pedal on an unprecedented experiment in de-Americanization. Authorities from France to the Netherlands are quietly removing American tech from their systems, adopting European open-source software and urging civil servants to no longer use Microsoft Teams or Office. Belatedly, they are spending hundreds of billions of dollars to try to boost Europe’s own private space firms, AI companies, and data centers, to avoid leaning on U.S. juggernauts.

Europeans are running studies on where they would store their data or process their payments should friction with the U.S. escalate, and how well their American-made weaponry would operate without Washington’s authorization. Nations whose empires once spanned the globe are now stuck trying to extricate themselves from their humbling dependency on American technology and military power, without provoking the U.S.

Their willingness to de-Americanize partly reflects recognition that reconciliation is hopeless: Trump is who he is, and a nation that elected him twice simply can’t be trusted.

However, Europe’s turn away from Trump also reflects plummeting perceptions of his power. At one time the world feared Trump although it never respected him. The silence that met his renewed demand for Greenland shows that the world no longer takes him seriously.

America remains an economic superpower with an enormous military budget. And the combination of a supine Republican Party, along with a Supreme Court that shamelessly greenlights Trump’s authoritarianism, has given this president more control over U.S. policy than any president has ever had, or ever should have. But while Trump is able to run roughshod over Americans, he can no longer bully the rest of the world. Thanks to Trump, the U.S. has seen its global influence plunge.

There are three big reasons for that precipitous decline.

First, there is the debacle in Iran. Not only did Trump’s war of choice fail in all its objectives, it revealed that U.S. military power is far more limited than almost anyone realized. The insistence by Trump and his lackeys that this humiliating defeat was a great victory shows that American foreign policy only serves to pander to Trump’s fragile ego. And when his ego meets reality, it slithers away.

In addition to showing the limits of U.S. military power, the war also showed the limits of U.S. financial power: It is increasingly easy for nations to bypass U.S. banks and the dollar using cryptocurrency — and Chinese yuan.

A second, in its way equally important, blow to U.S. prestige and influence has been Trump’s failure to deliver Ukraine to Vladimir Putin.

For make no mistake: everyone at that summit in Ankara knows that Trump, JD Vance and company both expected and hoped that their betrayal of Ukraine would lead to Russian victory. Surely, they imagined, Ukraine would be unable to hold off the onslaught from its much bigger neighbor without U.S. aid. To America’s everlasting shame, Trump told Volodymyr Zelenskyy that he didn’t “have the cards.”

Yet after Trump cut U.S. aid to Ukraine by 99 percent, Ukraine not only survived but began gaining the upper hand. Europe has stepped up financially, more or less replacing the lost American dollars. And Ukrainian military innovation has largely made up for the loss of American weapons.

The result has been to make the U.S. increasingly irrelevant. Put it this way: Iran taught foreign governments not to fear American might; China, along with the crypto industry, has taught rogue countries that they needn’t fear American financial control; and Ukraine has taught foreign governments that they don’t need American support.

Finally, Trump’s global power play rested on economics even more than on military force, above all on his belief that other nations would cower in fear at the prospect of facing U.S. tariffs. But Trump’s attempt to weaponize international trade has been a bust. Most notably, China’s economy has powered right through the Trump tariffs. Furthermore, it turns out that China has escalation dominance in the trade war: we need their rare earths more than they need access to our consumers.

And other nations — even Canada and Mexico, which have historically been highly dependent on the U.S. market — are moving to reduce their dependence. Canada’s move to build a new pipeline that will let it sell Alberta oil to Asia rather than the Midwest is just a highly visible symbol of a general world move toward bypassing America now that we have become an unstable, unreliable economic partner.

The combined effect of these humiliations for Trump and his minions has been a drastic reordering of America’s place in the world. For most of last year foreign leaders kept trying, desperately, to appease Trump. These days they’re mostly just humoring him, building a world in which his sundowning won’t matter.

It’s extremely unlikely that anything substantive will come out of this NATO meeting. And a year ago the prospect of a failed summit would have been a source of deep concern. Now it will be met with a shrug: Nobody expects anything but chaotic bluster from Trump, and what he does matters less and less.

Note: I’ll be doing a Substack Live at noon with Heather Cox Richardson

This here is not a personal diatribe about Taylor Swift and Travis Kelce. I got no beef with either of these two crazy kids. Swift is one of the hardest-working entertainers in show business, and Kelce is one of the greatest tight ends to ever play pro football. They’re more than welcome to fall in love, and Swift is more than welcome to pen songs about her man’s girthy member. The pair are also free to tie the knot anytime, and anywhere, they like. Except for …

One of the biggest events of the summer has been a mystery: When and where are Taylor Swift and Travis Kelce getting married? And when does everyone get to celebrate?

New details confirmed by The New York Times suggest a multiple-day event at Madison Square Garden, which an entertainment industry executive said Ms. Swift had rented.

The entertainment industry executive and another person with knowledge of the matter described the anticipated festivities: On July 2, the plans call for an intimate gathering of about 100 people at the Garden. The next day on July 3, about 1,000 guests would gather there for a splashier celebration, with possible stage appearances.

Seriously? You two are getting married at Madison Square fucking Garden? YOU FUCKING ASSHOLES.

Never mind the Supreme Court upholding birthright citizenship — that was a foregone conclusion given that it is a totally unambiguous provision of the Constitution (although three Republican justices voted against it!). The important decision was handed down yesterday, when the Court, ruling on the Slaughter case — brought on behalf of an FTC commissioner arbitrarily fired by Donald Trump — overturned 90 years of precedent to give Trump dictatorial power over the regulatory machinery of the US government. The Court has now stripped regulatory agencies of their independence from Trump’s whims and corrupt practices. Even for an agency created by Congress with a specific mandate and responsibilities, Trump is now free to direct that agency to do something completely different, to fire any civil servants who don’t do whatever he wants, or to completely gut it so that it is unable to serve its function.

Notice that I said that Trump has been given dictatorial power. There have been many comments to the effect that a future Democratic president could make extensive use of these new powers, but this Court is utterly partisan. The moment a Democrat takes office, it will instantly decide that he or she has almost no discretionary power.

Various MAGA-adjacent parties, along with willfully blind centrists, are trying to sweep this ruling under the rug, hoping that the public doesn’t understand its meaning. In fact, even I am startled that the Wall Street Journal, whose reporting is normally excellent, barely mentions this astonishing act of Trump empowerment in its news section. Instead, it has posted only a misleading editorial, repeating the tendentious legal arguments of the Roberts radicals.

But you don’t have to take my word for how much this travesty matters. As the screenshot at the top of this post shows, the wannabe dictator is fully aware of how much the Roberts Court has undermined democracy in his favor. And he’s celebrating.

What I want to do in today’s post is enlarge on why Slaughter matters — and just how bad it is.

First, this decision is (almost) all about enabling corruption. Yes, there are ideological and policy aspects. But this Court decision is fundamentally about empowering Trump, not the presidency in general. And we know who and what Trump is. The normally soft-spoken Jared Bernstein says it clearly:

[G]iving this president such carte blanche is crazy. Name one firing or removal he’s made or attempted to make that was motivated by anything other than personal retribution, prejudice (it is not a coincidence that Lisa Cook is a Black woman), or personal greed.

The Court’s decision effectively eliminates government by professional civil servants who do their best to implement the law with government by henchmen and lackeys who will do whatever Dear Leader wants. And what he wants depends, above all, on who is most willing and able to enrich him, his family, and his cronies.

In my conversation with Lisa Graves posted yesterday, she gave the example of Jeff Yass, a billionaire who clearly purchased a complete reversal of Trump’s position on TikTok. The same has been true, on an even bigger scale, for policy toward cryptocurrency — which Trump denounced until it became clear that crypto was a way for corporations and super-rich individuals to funnel billions of dollars directly to him and his family.

Second, the Court’s sort-of carve-out for the Federal Reserve — for which, for the moment, the Court has preserved some of the protections the whole government had until now — looks even more hypocritical once we recognize the centrality of the issue of corruption.

As many people have noted, there is no conceivable argument under which the independence of monetary policy is somehow more sacred than the independence of regulation of critical areas such as antitrust policy, environmental policy, food and drug standards, and air safety.

Beyond that, Fed policy stands out as an arena in which the scope for corruption is relatively limited. While the Fed does play a role as a financial regulator, its key job is interest rate policy — and that’s basically choosing the setting on a single dial, with no room for favoritism. When the Fed raises rates, it raises rates for everyone, when it cuts rates it cuts them for everyone, with no way to exempt Trump cronies from rate hikes or give them selective rate cuts.

By contrast, the Federal Trade Commission can selectively reward some corporations by granting approval for the mergers they want while selectively punishing some corporations by denying approval for mergers. The Environmental Protection Agency can waive pollution regulations for some companies while enforcing them for others. And so on. And we know exactly what will determine which companies get favored treatment: It will be all about who greases Trump’s palm and puffs up his ego.

Why, then, give the Fed special treatment? Probably because the Court feared the market reaction if it allowed Trump to take immediate control. The Wall Street Journal editorial openly acknowledged this concern, explaining the carve-out for the Fed by saying: “the Chief and Justice Kavanaugh made the pragmatic judgment that they simply don’t trust Mr. Trump to run monetary policy.” But the last time I looked at the Constitution there wasn’t a special “unless it adversely affects the stock market” clause. Evidently, the Journal editorial board thinks it is only the little people who will be victims of Trump’s destruction of America’s regulatory institutions, while those who have big stock portfolios will be A-okay.

And they might be right given the trends in our economy. A headline in yesterday’s Journal:

“Resilient” is one way to put it. But who pays for this “resilience”? Profits have been soaring even as many workers’ wages fail to keep up with inflation. Indeed, profits as a share of national income keep rising:

It’s highly likely that a significant fraction of this rise reflects increased monopoly profits in an age of enshittification and the destruction of workers’ rights. And a major share of the rise in monopoly profits has, in turn, gone to enrich America’s oligarch class — the same class that is generously sharing some of its wealth with Trump and his family, in return for the favors. Now, thanks to the Supreme Court, he can grant those favors free from legal restraint, as he completes his evisceration of the Federal Trade Commission — which is supposed to limit monopoly power — and the National Labor Relations Board, which is supposed to protect workers’ rights.

The stench of corruption and dictator-worship is overpowering.

NONMUSICAL CODA

The next three days are the anniversary of the battle of Gettysburg — days that deserve to be remembered. July 1:

SpaceX had its initial public offering last week. Now Elon Musk is a trillionaire on paper. But what is SpaceX? On one level, of course, SpaceX is a company that builds rockets and spacecraft and launches them into space. (Occasionally the rockets explode.) It is also the company that birthed Starlink, a satellite-internet business that generated more than $11 billion in revenue last year.

But the company can be defined in many ways. SpaceX is a financial instrument for Musk. Before the IPO, SpaceX acquired xAI, Musk’s artificial-intelligence company, which itself acquired X, the social-media site, back in 2025. The maneuver allowed SpaceX to claim that it believed it had “the largest actionable total addressable market in human history”: $28.5 trillion, to be precise. $26.5 trillion of that, according to the filing, would come from AI infrastructure and applications, meaning not from SpaceX’s core business of aerospace engineering and satellites.

Maybe most important, SpaceX is a story, even a meme. Musk is arguably a better salesman than an inventor, and what he began selling early on was a techno-utopian dream—of himself as a Tony Stark–style genius, of an environment-saving EV revolution, of securing a future for humanity by getting us all to Mars. He intuitively understands the warped dynamics of the attention economy. Ben Tarnoff and Quinn Slobodian, the authors of the book Muskism, describe his strategy on social media as “trolling is infrastructure”: “Every joke, every poll is a stress test of responsiveness,” they argue. “Can he still move markets with a post?” Dogecoin, the cryptocurrency based on a 13-year-old meme of a shiba inu, is the shining example of Musk’s ability to lavish attention on something—in this case, a fake asset whose entire joke was that it was worthless—and make it worth more to others as a result.

SpaceX is obviously not Dogecoin. Its rocket business is a genuine success story, as is Starlink. But the company’s appeal, particularly in the face of setbacks, is also reliant on a combination of story and Musk’s own image in ways that are not necessarily connected to reality. Musk has frequently set unrealistic timelines for projects, including putting a spacecraft on Mars by 2018. Last year, SpaceX’s flagship rocket underwent a “rapid unscheduled disassembly” on three test flights (it blew up). But SpaceX’s IPO filing was more oriented around its future ambitions and assumed triumphs, such as its desire to mine asteroids, promote space tourism, and “extend the light of consciousness to the stars.” An adviser to the deal told the Financial Times last month: “From a strict corporate finance perspective, the valuation makes no sense. But Elon is great at getting people to dream.”

What do you get when you combine SpaceX the business with the financial instrument and the meme? An unfathomable amount of money, it seems. Last week SpaceX opened trading at a market capitalization of $1.7 trillion. The scale of Musk’s own net worth is now almost impossible to comprehend, such that, on Monday, SpaceX’s stock rallied, and Musk’s one-day gain was more than the net worth of Bill Gates, once the richest person in the world. In short order, SpaceX has become the sixth-most valuable public company despite the fact that it posted a net loss of $4.94 billion last year on $18.7 billion in revenue.

On Tuesday, SpaceX announced it is using some of that value to purchase Cursor, the AI-coding start-up, for $60 billion, all in stock. In reaction to the news, Bill Ackman, the hedge-fund manager (and inveterate poster), wrote on X: “One of the things that makes SpaceX so valuable is how valuable it is.” Ackman’s reasoning rings true in a financial sense: According to the deal, the price that SpaceX will pay for Cursor will be set by its own share price in the seven trading days before closing, which in effect will mean that the more valuable SpaceX is, the less Cursor will cost it. But Ackman’s koan is also correct in a more absurdist way. It highlights the irrationality of the modern stock market and reflects a lesson of the past decade: If a person or group of people is able to marshal enough genuine attention toward an idea—no matter how ridiculous it might seem—they can usually bend reality toward their preferred outcome.

Other than perhaps Donald Trump, it’s difficult to argue anyone has been more successful at this than Musk. Musk excels not because he can’t stop winning, but because he understands that, in the financialized logic of our age, winning is less important than the perception that you will win. Speculation beats fundamentals. One way to look at Musk’s personal brand is as somebody who has borrowed obsessively against his own reputation, each loan used to invest in and service the debt of the last, until it becomes impossible to follow the money. One of the things that makes Elon Musk so valuable is how valuable he is.

With SpaceX’s IPO, you could argue that Musk has either won or broken capitalism. His wealth, in our current system, makes him a chaos agent with no real comparison. He is virtually impervious to fines. His money, should he wish to spend it, has the potential to drastically influence the outcome of elections. That leverage could be used to benefit Musk’s businesses, securing further contracts with the government and entrenching him deeper into the infrastructure of everyone’s lives. This power isn’t theoretical; Musk’s dominance in satellite connectivity has already made him geopolitically relevant in places including Ukraine and Iran.

SpaceX and Musk are, of course, not inevitable. Analysts are predicting volatility for the  stock as lockup periods end and people sell shares. The AI bubble could pop. Musk could mismanage the company as he did with X, or he could become so radioactive that institutions stop associating with him. But you can also imagine the SpaceX flywheel spinning out of control, perpetuating itself as Musk and SpaceX become fully untethered from reality. On X, Will Manidis, a start-up founder and investor, argued recently that, given the dynamics of SpaceX’s stock, it could continue to purchase some of the internet’s foundational software companies at a cost of basically nothing. Neither Musk nor SpaceX responded to a request for comment on SpaceX’s direction, and such tweets, at this moment, are little more than fan fiction. But they represent the absurdity of Musk’s current position in the modern economy. Musk has long fantasized about creating a massive, vertically integrated constellation of services—from banking to social networking—he once dubbed “the everything app.” So far, he’s failed in that quest (the phrase trust Elon Musk with your routing number would still strike fear in the hearts of most people). But it’s not difficult to see Musk using his cheap and abundant money to build toward the Everything Holding Company.

Is any of this possible? Would it even be legal? That’s unclear. But as Bloomberg’s Matt Levine once noted, it seems like “Elon Musk’s recent career is a long experiment to prove that, if you are successful enough, the regular laws do not apply to you.”

In the aftermath of the 2008 financial crisis, Rolling Stone’s Matt Taibbi memorably described Goldman Sachs as “a great vampire squid wrapped around the face of humanity, relentlessly jamming its blood funnel into anything that smells like money.” Goldman Sachs, he wrote, “positions itself in the middle of a speculative bubble,” enabled by “a crippled and corrupt state that allows it to rewrite the rules.” Revisiting that article in the age of Musk the trillionaire feels almost quaint. Musk and SpaceX have a true nose for money, including sniffing out government infusions and contracts. The aerospace company has figured out how to position itself firmly in the middle of the speculative hype of the AI cycle, and numerous financial organizations have amended rules designed to protect retail investors.

The vampiric Goldman Sachs that Taibbi describes is an institution, a system that became too big to fail, and thus ungovernable. Musk is a person, not a system or institution, but he owns more than 40 percent of SpaceX and controls more than 80 percent of its voting shares. According to Reuters, in the lead-up to SpaceX’s IPO Musk was dictating terms to Goldman Sachs and other banks.

If Goldman Sachs is the vampire squid, what does that make SpaceX and Musk? The natural world offers few good comparisons. What we’re seeing in terms of hype, valuation, and fortune is without precedent, even when stacked up against the wealth concentration of the Gilded Age. SpaceX and Musk are better served by a mythological comparison, in part because the entire enterprise is built on a story told over and over until it transcends reality. SpaceX is a rocket company, a complex financial instrument, a meme, a monument to a broken financial system. It is the seven-headed Hydra at the end of finance, the teleological endpoint of money. It is a myth kept alive by blind faith, devotion, and even aggression, which makes it dangerous whether you believe in it or not.