AI Castles & Moats; Is a China Cyberwar Coming?
"And so castles made of sand
Fall in the sea eventually"
Jimi Hendrix (1967)
November 2, 2026 | In this issue of The Institutional Risk Analyst, we ponder the aftermath of last week’s AI selloff. Who are the winners and losers? We also ask what the $6.3 billion Binance hack tells us about possible future cyber attacks by North Korea and China. China's surrogate state North Korea is widely believed to be behind the Binance attack last week.
Tomorrow we update subscribers to our Premium Service on the results for the WGA Bank Top 50 for Q4 2026 and the financial sector more broadly. Large cap banks continue to significantly underperform as smaller names fill leadership positions this quarter. None of the largest US banks were in the top 10 at all this quarter.
Only six of our 24 Finance Group stocks were up last week. Crypto related names such as Coinbase (COIN) (-10.62%) led the declines, followed by Circle (CRCL) (-9.31%) and Upstart (UPST) (-7.33%). Fintech and lending-focused names saw the steepest selloffs across the Finance stock watchlist.
AI Stocks: Castles & Moats
The deflation of the AI bubble we've been awaiting finally arrived. Last week, Michael Novogratz said anxiety in global credit markets over AI spending is on the verge of easing, citing the raising of equity by Meta Platforms (META) and the planned initial public offering by Anthropic as “signs of relief.” Sadly, Novogratz was a tad early in his optimistic prognostication on Bloomberg and the selloff only accelerated as last week ended.
A couple of readers asked whether some of the AI stocks that have been taken down in the selloff last week are not a buy. Good question. Our contributor Ralph Delguidice offered this take on the carnage last week: 5 reasons the TECH SELLOFF is the ”moat” Zuk, Dario and Sam have been praying for:
Rates will rally—but ONLY for fortress balance sheets. The smaller “Neo-clouds” are toast
Sub-Trillion IPO valuations will democratize returns
Slower data-center buildouts flatter and are flattered by chip innovation
Ditto the social/political narrative
Open source models that require homegrown cap-ex are much harder to pencil out
We like Ralph’s perspective because the imagery of the castle and moat is well established in many industries. Whether we talk about banks or consumer products or new media or energy, the large established players have access to capital and massive barriers to entry that protect their monopoly market positions. But does Anthropic really qualify as a castle?
New entrants into the world of AI depend upon massive private valuations to catapult them into monopoly status, but the Anthropics of the world may have waited too long. Ponder the fall of CoreWeave (CRWV), which traded 32x revenue in mid-2025 but today is trading at 10x slowing revenue and falling fast. Can Anthropic get out of the IPO gate before gravity further degrades its implied valuation?
The top five hyperscalers in cloud infrastructure and AI compute are Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Meta Platforms, and Oracle Cloud Infrastructure (OCI). All of these players have significant assets and balance sheets that could make them LT winners in the AI race, especially if the new users of compute are forced to slow down because of rising capital costs.
Ponder the fate of Anthropic, for example, which just dropped its weighty S-1 with the SEC and promptly saw the market value of its public comps plummet. The god of AI does have a sense of humor. The prospective initial public offering (IPO) valuation of Anthropic has fallen by roughly $500 billion (a 25% drop) over the past week, according to US News and World Report.
But the big problems for AI may lie ahead, as millions of investors and insiders attempt to protect the sky high valuations in a declining market. A wave of virtual selling by AI insiders could accelerate losses seen last week, even though macro concerns about spend and credit continue to be the largest source of selling pressure.
“Some tech employees have made so much money from the AI boom that they’re quitting their jobs. Not to retire or pursue a passion project, but to hedge their company stock,” notes Emma Tucker at WSJ. “They’re turning to options and credit-default swaps, while trading firms are developing new derivatives tied to the price of computing power.”
But the biggest problem facing Anthropic and some of the newer entrants to the AI race is credit. Investment giant Blackstone (BX) informed investors that Anthropic is likely to land in the double-B (BB) tier for credit rating, which represents the highest tier of speculative or "junk" grade debt. Spreads for non-investment grade debt are widening as stocks sell off.
CoreWeave is a "B-" credit without customer guarantees. Mighty Oracle Corporation's (ORCL) long-term issuer credit rating is "BBB-" from S&P, the lowest level in the investment-grade spectrum, sitting just one notch above "junk" or speculative-grade status with a stable outlook. Meta holds an "AA-" credit rating from S&P, though its outlook was revised from stable to negative in October 2026.
Microsoft (MSFT) holds a top-tier "AAA" long-term credit rating from S&P and an "Aaa" rating from Moody's Investors Service, both with a stable outlook. Amazon (AMZN) is a "AA" credit from the three major agencies. Nvidia (NVDA) holds an "AA" long-term issuer credit rating from S&P with a stable outlook, having been upgraded from "AA-". For now. Get the idea? Buy the castles with big moats and investment grade ratings that are not built upon sand.
In China Preparing for Cyberwar?
Some worry about an attack from Russia in a widening war in the Ukraine, but is China not a bigger threat? Is an ailing Xi Jinping preparing a surprise cyber attack on the US to retaliate for President Trump’s consistent pressure to push China out of the Americas, Asia and Africa? US defense agencies are currently working on contingency plans for extended interruption of key infrastructure.
"Starting in 2014, Xi Jinping began ambitiously envisioning China as a 'cyber great power' capable of defending critical infrastructure from cyber intrusions, ensuring internal stability, and launching offensive operations against foreign adversaries," notes Nathan Lee of Foreign Policy Research Institute. "Critically, this shift affected People’s Liberation Army (PLA) military doctrine on cyber warfare."
US pressure on Japan in the 1930s led to the “surprise” bombing of Peal Harbor in 1941 and the Pacific war. Because the US had cracked Japan’s codes, however, FDR knew in advance of the Japanese attack. Is China preparing to launch a cyberwar on the US? Does the US government already have pre-warning of a Chinese attack? There are a number of indications that the answer to both questions is yes.
China has been engaged in a massive covert intelligence and infiltration effort focused on the US was many years. China’s covert infiltration, espionage, and influence operations in the United States have expanded significantly over several decades, with a dramatic escalation occurring over the past 10 to 15 years, particularly following the rise of Xi Jinping to power in 2012.
"Chinese hackers have gained and retained access to U.S. communications, energy, and transportation infrastructure," writes Anne Nueberger in Foreign Affairs. "The goal of these intrusions is more than intelligence gathering; it is laying the groundwork for sabotage. Just as Iran’s closure of a vital waterway has been extremely disruptive and hard to get around, China’s penetration of critical networks could cause blackouts, make water unsafe to drink, or delay military mobilization."
• Pre-Positioning in Infrastructure: According to the CISA China Threat Overview, Chinese-linked groups like Volt Typhoon and Salt Typhoon have moved past simple espionage. They are embedding themselves in operational technology (OT) and information technology (IT) networks—targeting the energy, water, communications, and transportation sectors.
• Disruption Capabilities: U.S. officials state that these access points are designed to allow China to disrupt essential services or delay the U.S. military's response in the event of a geopolitical crisis (such as over Taiwan).
• Botnet and Hacking Platform Disruption: In August 2026, the U.S. Department of Justice and the FBI executed court-authorized operations to seize and dismantle Chinese-operated infrastructure—such as the QTFY botnet and platforms like QScan and QTRouter—which had targeted NASA, the Federal Reserve, and defense-related laboratories.
• Use of Artificial Intelligence: Recent threat intelligence reports from firms like CrowdStrike indicate that Chinese state-linked actors are rapidly scaling their cyber operations by integrating AI tools (including DeepSeek) to automate and accelerate attacks across hundreds of global targets.
Of note, the U.S. military is actively preparing for potential disruptions of essential services through a major strategic initiative known as FORTRESS (Federal Operations for Resilience, Troop Resources, Energy, Supply, and Survivability).
US defense officials have emphasized that FORTRESS is not a reaction to any specific, imminent attack, but rather a long-term insurance policy and modernization effort designed to address multi-domain threats, cyber risks, and potential conflicts that could strain public utilities and global logistics networks.
But the fact remains that military organizations in the Americas and also in Europe have been making extraordinary efforts to prepare for military conflict and disruptions of essential services. Our contacts in the military have been telling us of preparations for potential cyber attacks for several years. So here's the question: why are governments from Washington to Continental Europe putting so much emphasis on being prepared now?
The Institutional Risk Analyst (ISSN 2692-1812) is published by Whalen Global Advisors LLC and is provided for general informational purposes only and is not intended for trading purposes or financial advice. By making use of The Institutional Risk Analyst web site and content, the recipient thereof acknowledges and agrees to our copyright and the matters set forth below in this disclaimer. Whalen Global Advisors LLC makes no representation or warranty (express or implied) regarding the adequacy, accuracy or completeness of any information in The Institutional Risk Analyst. Information contained herein is obtained from public and private sources deemed reliable. Any analysis or statements contained in The Institutional Risk Analyst are preliminary and are not intended to be complete, and such information is qualified in its entirety. Any opinions or estimates contained in The Institutional Risk Analyst represent the judgment of Whalen Global Advisors LLC at this time, and is subject to change without notice. The Institutional Risk Analyst is not an offer to sell, or a solicitation of an offer to buy, any securities or instruments named or described herein. The Institutional Risk Analyst is not intended to provide, and must not be relied on for, accounting, legal, regulatory, tax, business, financial or related advice or investment recommendations. Whalen Global Advisors LLC is not acting as fiduciary or advisor with respect to the information contained herein. You must consult with your own advisors as to the legal, regulatory, tax, business, financial, investment and other aspects of the subjects addressed in The Institutional Risk Analyst. Interested parties are advised to contact Whalen Global Advisors LLC for more information.
Comments