On 12 September 2025, Latvia's prime minister stood before cameras and asked the European Union to hold the line against Russian hybrid threats. The statement arrived without figures, without a named incident, without a policy instrument. That emptiness is the signal.
I have spent the better part of a decade reading disclosures where the most important information is the thing not said. In 2017, at twenty-eight, I audited forty-five whitepapers for a $2.5 million allocation sitting on a fund's desk in Vienna. Three of them described consensus mechanisms in language that sounded novel and, on inspection, were re-wrapped open-source libraries with a proprietary label glued on. I wrote a divestment memo. The fund kept the positions. Ninety percent of that capital was gone in six months, and my silence during the subsequent panic did more for my reputation than the memo ever did.
The lesson was not that my analysis was correct. The lesson was structural: a warning is only as valuable as the reader's willingness to be inconvenienced by it. A call for European unity is a confession of disunity. A warning about hybrid threats is an admission that the threat has already crossed the perimeter and simply has not been priced yet.
Crypto does not appear anywhere in that Latvian statement. It does not need to. The rails that move the money are already running at full block time.
Context
Hybrid threats are defined by what they are not. They are not Article 5. They sit underneath the collective defense threshold — cyber intrusions, disinformation campaigns, energy coercion, engineered migration pressure, sabotage of undersea cables, and the quiet weaponization of financial plumbing. The doctrine's appeal is cost asymmetry: impose real damage on a target while staying below the line that triggers a conventional response. Attribution is deliberately ambiguous, and ambiguity is the product being sold.
The Baltic states know the mechanics better than anyone. Estonia lost banking, media, and government interfaces to a coordinated cyber campaign in 2007, and that event shaped a generation of European security thinking. Latvia maintains a Russian-speaking population that ranges between a quarter and roughly forty percent depending on how citizenship is counted, which makes its domestic information space a permanent attack surface rather than a seasonal one. Since 2021, Belarus has periodically funneled migrants toward the Lithuanian, Latvian, and Polish borders as pressure that costs Minsk almost nothing and consumes disproportionate resources on the receiving side.
For most of that history, the payment layer of hybrid operations was unglamorous: cash, informal value transfer networks, shell-company invoices, correspondent banking. That era is closing. Dollar-denominated stablecoins on high-throughput chains now carry a meaningful share of value moving through sanctions-exposed corridors. The headline volume is not the interesting part. The structure is.
This is where the crypto industry's own hype cycle becomes load-bearing. Through 2024 and into 2025, the dominant European narrative was arrival: ETF approvals, institutional custody mandates, the Markets in Crypto-Assets regulation, the phrase "regulated rails" deployed in every third pitch deck. That narrative has a real foundation and a real ceiling. The bear market has been useful precisely because it strips the narrative away and leaves the plumbing visible. When price stops paying for optimism, you find out which protocols were built and which were merely marketed.
If you hold assets in this market, the operative question is no longer what a project promises. It is whether the infrastructure holding your position can survive a week in which nobody is being polite. That question applies with unusual force to three asset classes: bridged assets, liquid staking derivatives, and anything whose security is rented from a shared pool.
Core
The payment layer of a below-threshold war
A hybrid operation needs three things. Money that moves without leaving a paper trail long enough to matter. Messages that scale faster than they can be debunked. Infrastructure that fails soft — that degrades, slows, and confuses rather than detonating.
Stablecoins solve the first problem elegantly for a mid-budget actor. A five-figure tranche buys a bot farm, three months of channel amplification, several domains, and a handful of shell-company front pages. Transaction costs on Tron or a low-fee rollup are trivial. Settlement is minutes, not days. There is no correspondent bank asking why an account in Riga is paying a contractor in Belgrade for undefined marketing services. Add ransomware as a revenue model and the same rails serve both the funding and the collection side of the ledger, which is a degree of vertical integration that traditional financial crime never achieved.
The counterargument is traceability, and it is a real one. Public ledgers are the most complete financial surveillance instrument ever deployed, and I say that as someone who uses them professionally. My 2022 work compiling on-chain transaction histories of three collapsed lending platforms — roughly $2 billion in user funds between them — depended entirely on the fact that a chain remembers what human memory edits out. Before each platform halted withdrawals, the pattern was consistent: outflows concentrated in the ninety-six hours preceding the announcement, routed through addresses that had been quietly funded weeks earlier, often across two or three chains.
But traceability is not interdiction. The choke point is the off-ramp, and the off-ramp is a compliance function performed by a small number of venues with wildly varying appetites for enforcement. When I found a price-feed aggregation flaw in a lending protocol carrying $50 million in TVL during DeFi Summer, I disclosed privately rather than publicly, hoping for an internal fix. The team was slow. Arbitrageurs were not. TVL fell 40% over two weeks, and nobody had to break a law to do it. An unpriced vulnerability is a subsidy to whoever finds it first. The same holds for a sanctions regime: it is a price signal, not a wall.
Cross-chain bridges remain the seam where this discipline breaks down. Value that moves between environments passes through a small number of validators, oracles, or messaging layers, each with its own trust assumptions and its own jurisdiction. A hybrid actor does not need to compromise a chain. It needs to find the one bridge whose operator answers to a regulator in a country with a flexible interpretation of urgency.
Strategic resilience versus protocol resilience
The Baltic vocabulary for this problem is resilience — the capacity to absorb a shock, recover function, and adapt without collapsing. It is a recognition that hard power symmetry is unavailable, so strategy becomes raising the cost of aggression until it exceeds the return.
Crypto has borrowed the word without borrowing the discipline. Protocol resilience is usually described in terms of audits, bug bounties, and multi-signature wallets. That is the aesthetic layer. The structural layer is geography, hosting, and governance latency, and it is far more fragile than any audit report suggests.
Consider validator distribution. Ethereum staking is mediated by a handful of liquid staking providers, one of which has historically held a share large enough to make its withdrawal queue a systemic variable rather than a product feature. Node hosting is worse. A substantial majority of execution and consensus clients run on a small set of cloud providers, concentrated in a small set of jurisdictions subject to a small set of legal orders. The chain is decentralized at the protocol layer and centralized at the physical layer. Those are different claims, and only one of them survives contact with a subpoena.
Oracles tell the same story with better marketing. A decentralized oracle network with dozens of node operators sounds robust until you note that the operators run on the same clouds, answer to the same regulators, and in many cases draw from the same upstream data vendors. Beauty is the mask; geometry is the bone. I watched a smaller version of this play out in 2020, when an elegant, minimalist Solidity codebase concealed a price-feed aggregation weakness that any patient arbitrageur could harvest at leisure. The code was beautiful. The structure was exploitable. Aesthetic perfection often hides ethical voids.
Now scale that observation to a national target. You do not need to destroy a blockchain to weaponize it. You need to degrade liveness for a defined window — during a bank run, an election, a border incident, a debt auction. Twenty minutes of RPC degradation, a bridge paused by a governance vote nobody anticipated, a major stablecoin issuer freezing a set of addresses at an inconvenient hour: each produces confusion disproportionate to the technical damage. That is the definition of a hybrid effect. It is cheap, deniable, and it does not require a single soldier.
Two structural risks deserve more attention than they receive. First, restaking and shared security pools create correlation that is invisible in a calm market and catastrophic in a stressed one; when the same collateral secures five protocols, a single slashing event propagates. Second, stablecoin issuers hold a de facto freeze switch over their token contracts. In the United States or the European Union, that switch is a compliance tool. In an adversary's threat model, it is a state lever, and its existence is known to everyone who reads the code.
Compliance as mask
Europe now has a formal surface: MiCA licensing, the Transfer of Funds Regulation, travel-rule obligations on virtual asset service providers. This is genuine progress and it is also a stage set. The regulatory frame asks who is licensed. It rarely asks who holds keys, in which jurisdiction, under what conditions, and with what relationship to the entity that issued the token.
Those are my working questions, and the answers are consistently less flattering than the pitch decks. Foundation and team allocations are traceable — that is the part of crypto that actually works. Vesting cliffs, unlock schedules, treasury multi-signature addresses: all visible on-chain, and all useful. What is not visible is the social structure behind the multi-signature. A three-of-five arrangement where two signers sit in the same jurisdiction, share a law firm, and were introduced by the same lead investor is a single point of failure with five public keys.
When I was asked in 2025 to review custody arrangements for institutions entering the space after the ETF approvals, the recurring finding was a gap between the promised multi-signature security model and the operational workflow that actually signed transactions. I estimated the exposure for one client in the nine-figure range. The remediation was procedural, inexpensive, and entirely unglamorous — which is precisely why it had been deferred in favor of a better security diagram.
DAOs occupy the same territory with more ceremony. Cayman foundations, Swiss associations, Marshall Islands liability structures: legal wrappers designed to give an unbounded group a bounded signature. Functionally, they are compliance shields — structures that allow a core team to control treasury and direction while presenting a distributed governance facade to regulators and holders alike. The code does not lie, but the contract can.
Governance tokens are non-dividend equity
Here the geopolitical frame and the token-economics frame converge, and the convergence is not flattering.
A governance token confers voting rights and no claim on cash flow. Its value therefore depends on the expectation that someone else will pay more later. Voting power without economic rights produces a market where price tracks narrative velocity rather than revenue, and where the marginal buyer is structurally the exit liquidity for the marginal seller. Buyback-and-burn programs are an attempt to simulate a dividend; they redistribute flow to float rather than returning earnings to holders, and they are funded from treasuries that were themselves sold into the market. Participation rates in DAO votes typically land in the single digits, and quorum is reached by delegation cartels that coordinate off-chain in private channels and execute on-chain for the record.
I made this argument about NFTs in 2021, when I audited the minting scripts of twelve generative collections with floor prices above 50 ETH. Royalty enforcement was opt-in, which meant wash trading could inflate volume metrics without consequence. The collection that most appealed to me aesthetically was structurally no better than the rest. When the market cooled, it lost roughly 85% of its value and the defenders simply stopped posting. Beneath the yield lies the rot.
The hybrid-threat implication is straightforward. An adversary does not need to capture a DAO. They need to rent it. Acquire or borrow enough tokens to reach quorum, pass a treasury or parameter change, and exit before the consequences settle. The cost of that operation is knowable in advance and can be modeled to the dollar. The damage is not.
Where the money actually moves
If you want a working indicator of stress rather than a narrative, watch cadence. Attestation frequency, disclosure timing, unlock reporting, the interval between governance posts. These are behavioral tells, and they decay before price does. In the 2022 collapse cycle, the reliable precursor was not a headline; it was a quiet change in reporting rhythm two to four weeks earlier. Silence is the loudest indicator of risk. The same principle applies to state-linked flows. The pattern is counterparty concentration, timing relative to geopolitical events, chain preference, and stablecoin issuer. Country attribution is often speculative. Behavioral change is not, and it is the only thing you can act on.
Bridge flow deserves a place in the same surveillance frame. When TVL migrates from one environment to another over a multi-day window, it telegraphs risk appetite more honestly than any commentary. In a bear market, that migration is the closest thing the space has to a smoke detector.
Contrarian
The bulls are more right than the pessimists admit, and it matters where they are right.
Public ledgers have done more for financial counter-intelligence than any single regulatory reform of the past decade. Sanctions enforcement on-chain is faster and more legible than through correspondent banking, which is precisely why sanctioning states have invested so heavily in analytics rather than outright prohibition. Estonia and Latvia are not anti-crypto jurisdictions in any meaningful sense; they are among Europe's most digitally forward states, with e-residency and advanced digital identity infrastructure. Their governments understand something that Brussels occasionally forgets: transparency is an asset in asymmetric conflict, not a liability.
The 2022 banking crisis is also underweighted in these discussions. While regional banks failed on a Friday-to-Monday timetable, public blockchains kept producing blocks. Liveness without permission is a real capability, and hybrid actors know it. The Baltic strategy of resilience — absorb, recover, adapt — implicitly assumes a substrate that cannot be shut down by a phone call. Whatever else is true of this industry, that substrate exists, and it has never halted for a weekend.
Most importantly, crypto has already been used as a defensive financing instrument at scale. Ukraine's donation infrastructure raised hundreds of millions of dollars in the first years of the full-scale invasion, across chains, in a fraction of the time traditional correspondent banking would have required. That is not a marketing claim; it is a case study in bypassing financial chokepoints under fire. Any honest analysis of this space and hybrid warfare has to hold both facts: the rails can carry a disinformation budget, and they can carry a defense budget. The technology is indifferent. The accountability lies with the humans configuring it.
Takeaway
Over the next eighteen months, the observable signals are specific and unglamorous. Watch whether attestation cadences hold through the next stress event. Watch validator and node geography rather than node counts. Watch whether institutional custody workflows match their own multi-signature documentation. Watch token unlock calendars as a forward schedule of sell pressure rather than a chart pattern to be dismissed. Watch bridge flows as the honest vote on risk appetite that price refuses to be.
The Latvian statement will be forgotten by Friday. The structural conditions it pointed at will not. And the next time a frontier state asks Europe for unity, the answer will depend less on communiqués than on who holds the keys, where the nodes run, and who can be compelled to answer a phone call at three in the morning. If you cannot name all three for your own position, you are not holding an asset. You are holding an assumption — and assumptions are the cheapest thing in this market to confiscate.