Everyone is waiting for the zero-day. They should be terrified of the default password.
The Unitronics Vision1210 ships with "1111" as its default administrative credential. It is a programmable logic controller, or PLC, that runs water pumps, chlorine dosing systems, and filtration controls inside tens of thousands of water utilities across the United States. It was never designed to face the internet. It was designed to sit inside a locked cabinet in a chemical room that smelled like chlorine, connected to a serial cable, minding its own business. Then someone, somewhere, decided it would be efficient if operators could log in remotely. So they put it online. And the password was still 1111.
When water systems in seven US states were hit by coordinated cyberattacks, the intelligence community did not reveal a surgical, zero-day exploitation of flawlessly hardened industrial software. The early indicators point to something far more mundane and far more damaging: default credentials, internet-exposed human-machine interfaces, and an adversary who understood that the most successful penetration is the one that doesn't require a breakthrough. Iran is suspected. Seven states. Synchronized timing. And the crypto market did not move.
Bitcoin traded sideways. Ether traded sideways. The implied volatility surface barely twitched. That non-response is the real story. I have spent nearly three decades watching markets and breaking code, and the moments everyone ignores are the moments when structural cracks widen. The crack here is not in the water system. It is in the way we price security itself.
The Grid Behind the Grid
Let me lay out the landscape, because most coverage of this event has been dangerously shallow.
The United States has approximately fifty thousand community water systems. The vast majority serve populations under ten thousand people. They are operated by understaffed municipal departments or small private firms that treat cybersecurity as an IT problem and IT as a cost center. The federal government, through the Environmental Protection Agency and the Cybersecurity and Infrastructure Security Agency, has published voluntary performance goals. Voluntary is the keyword. CISA's Water and Wastewater Sector Action Plan is a good-faith effort, but it has no teeth. The regulatory reality is a patchwork: some states require basic assessments, most do not, and the federal government cannot force a rural Kansas water district with an annual budget of four hundred thousand dollars to hire a security engineer.
This is the fragmentation that adversaries have learned to love. The electric sector got lucky: it is highly regulated, the bulk electric system has mandatory standards, and its operators have actual security budgets. Water is the opposite. Water is the security-equivalent of a DeFi protocol with a governance token that pays dividends in promises. It runs on old equipment, connected to exposed ports, maintained by the same three-person IT staff that also handles city payroll.
The supply-chain wrinkles matter here. American water systems are disproportionately dependent on ICS/SCADA equipment manufactured overseas. Unitronics PLCs, the Israeli-made controllers at the center of this attack pattern, have been documented with serious vulnerabilities and public exposure for years. CISA issued advisories. Researchers at Mandiant and Dragos flagged the risks. In late 2023 and early 2024, an Iranian-linked group known as CyberAv3ngers compromised water utilities in multiple states, in some cases posting photos of the control screens to Telegram. The group's stated mission was to target Israeli-made equipment, but the victims were American municipalities. The PLC at the center of those incidents had a documented exposed port and default credentials. It was not a sophisticated operation. It was the equivalent of walking through an unlocked door where the key is taped to the frame.
Let me be precise about what sophistication is and is not required in this domain. An attacker needs four things to hit a water utility: a Shodan search for internet-exposed Unitronics devices; a password list containing default credentials; a control session over a remote human-machine interface; and an understanding of what a chlorine dose looks like when it is wrong. The first three are commodity resources. The last one is the only place where a nation-state's operational experience creates genuine advantage. That is what makes the seven-state event different from the 2023 incidents. The 2023 events were largely seized as proof-of-exploit exercises: hackers posting screenshots. Seven states simultaneously implies coordination, planning, and a strategic decision to escalate targeting. It remains a low-skill attack, but it is a high-organization one.
The strategic choice of target tells you something important about the adversary's doctrine. Water is not the hardest target. It is not the most deadly for lack of competence. But it is the most intimate. Electricity goes out and you light a candle. Water goes bad and you cannot cook, cannot bathe, cannot trust the tap. A coordinated attack on water in seven states is a message that no American household is technically outside the battlespace. In the grey-zone warfare playbook, you do not attack the armored divisions. You attack the fire hydrant. You make the population feel the state's weakness in the most immediate way possible, while staying so far below the threshold of armed conflict that the response options all look disproportionate.
The Playbook, and the Mirror
MITRE ATT&CK for ICS divides an intrusion into phases: initial access, execution, persistence, privilege escalation, evasion, discovery, lateral movement, collection, command and control, inhibit response function, and impair process control. The water attacks only needed the first few phases, compressed into a single session. Initial access: an internet-exposed human-machine interface with default credentials. Execution: native system commands. The attackers do not need persistence when they can come back through the same door. They do not need lateral movement when the target is the PLC itself. The entire attack chain fits on a Post-it note.
I have been staring at attack chains like these since before it was a formal discipline. In 2017, at the height of the ICO frenzy, I audited ERC-20 tokens for a living, or at least for a side income that started to look like a living. I found an integer overflow vulnerability in a token called CryptoGem, a project that had raised $2.4 million on the promise of gem-backed digital assets. The contract used unchecked arithmetic. A malicious caller could mint infinite tokens with the right calldata. The market did not care when I published the technical write-up. The token traded at a premium. I shorted it through Bitfinex's lending market, published the analysis, and watched the inevitable collapse. I made $150,000 and learned the lesson that has defined my career: the market prices narratives, not code. The code is always the last thing priced in.
The water-system attacks are CryptoGem at national scale. The vulnerabilities were documented. The advisories were published. The default credential was in the manual. Nobody priced it in. Nobody except the attacker.
This is why I keep saying that code is law, but bugs are justice. The law is the architecture as written. The justice is reality as executed. In the water domain, the architecture says a PLC will dose chlorine at the prescribed level. The bug says it will do whatever an authenticated user tells it to do, and the default password is 1111. Justice arrives in seven states at once.
The mirror to DeFi is uncomfortable but exact. Go through the forensic reports of the major crypto hacks of the last four years. The Ronin Bridge: private keys for the validator network were stored on a Google drive, and the attacker lifted them in a single session. The Euler Finance exploit: a single bad parameter validation on a flash loan. Wormhole: a validator key left exposed. The common thread is not sophistication. The common thread is a default assumption that the infrastructure will protect you, that the environment is trusted, that the password does not matter, that the admin key can live in a warm wallet. Attackers do not need zero-days when the ecosystem hands them the keys.
There is a reason cyberattacks on water systems and hacks of DeFi protocols exhibit the same pattern. Both domains are governed by a philosophy that security is an overlay, additive to an existing design rather than intrinsic to it. A PLC was built to control pumps. A smart contract was built to move tokens. Neither was built for an adversarial environment. The internet was retrofitted onto the PLC, and the blockchain was retrofitted with security tooling after the first billion was stolen. The result is the same everywhere: the attacker does not need to be smarter than the designer. The attacker only needs to be earlier to the discrepancy between intended behavior and actual behavior.
The Asymmetry Engine
Here is the market structure that matters. A coordinated cyberattack on water systems in seven states has a marginal cost to the attacker of essentially nothing. The marginal cost is the labor of the operators, the electricity to run the scanning infrastructure, and the operational security required to avoid attribution. The best estimates I have seen put the cost of a state-sponsored attack on this scale at low six figures, and much of that is the overhead of maintaining surrogate actors. The defense costs are dramatically different. Industry bodies have estimated that bringing the water sector to a minimum cyber-hygiene standard would require tens of billions of dollars. Each utility faces independent expenses: replace or harden obsolete PLCs, segment networks, implement continuous monitoring, hire or contract security talent, train operators, buy cyber insurance, and plan for incident response. The asymmetry is not one-to-ten. It is closer to one-to-thousand.
This is what military strategists call cost imposition. The attacker imposes costs far in excess of the expenditure, forcing the defender into a permanent defensive posture that consumes resources. Iran has a long history of using this lever in the grey zone below the threshold of armed conflict, the domain where attacks retain plausible deniability, escalatory control is maximized, and a response in kind risks crossing a line the attacker never crossed. The entire doctrine is built on making every American defensive dollar feel wasted while every attack dollar feels like maximum-impact leverage.
Now here is the ugly part for crypto. The same asymmetry, the same cost-imposition logic, is what keeps the exploitation of blockchain infrastructure alive. A DeFi protocol spends millions on audits and threat modeling; an attacker spends one afternoon writing a malicious flash-loan sequence that takes advantage of a reentrancy bug the auditors missed. A bridge operator spends months building validator redundancy; an attacker spends a single afternoon recovering a key from an old server log. The balance of who bears the cost of failure is catastrophically similar.
I ran my own version of this asymmetry trade during DeFi Summer in 2020. I put $300,000 into a delta-neutral farming strategy, borrowing stablecoins against ETH collateral on Compound, farming the COMP rewards, and hedging price exposure with short futures. The macro consensus was hold forever. The protocol's COMP emissions schedule had a hidden dilution kicker, and I could see the dilution signal in the code before the APR crashed. I was out within 48 hours of the inflation model's collapse, with a 22% return secured despite the market correction. The lesson was not that I am smarter than anyone else. The lesson was that the crowd had priced the narrative, not the code. The person who reads the code is the one who gets paid when the narrative crumbles.
That is the same edge, in the same shape, as a state-sponsored actor who reads the Unitronics manual. The manual says password 1111. The narrative says America's water is protected. The difference between the manual and the narrative is profit. Or, if you are a nation-state, geopolitical influence.
The water attack also exposes a market failure that exists in both domains: the people who are least able to pay for security are the most exposed to the consequences. A small water utility cannot afford a security operations center, just as a small DeFi project cannot afford a full-time security team and five separate audits. The cost-imposition asymmetry is fundamentally regressive. It punishes the marginal participants, the ones at the edge of the network, and their failure becomes a systemic event transmitted through shared infrastructure. In crypto, a small protocol gets exploited and the entire ecosystem faces contagion fear. In water, a small utility gets breached and the entire sector faces a regulatory crackdown. Same logic, same transmission mechanism, same victims.
The Volatility That Never Came
Let us talk about the market response, because the market's indifference is a phenomenon, and phenomena are tradable.
At approximately the moment the attacks became public knowledge, the crypto derivatives market had a choice. It could price a geopolitical tail-risk event, a coordinated attack on US critical infrastructure attributed to a hostile state actor, by bidding up Bitcoin and Ether implied volatility, skewing out-of-the-money puts, and widening the basis between spot and futures. It did none of those things. Implied volatility stayed rangebound. Skew stayed near its baseline. The front-month term structure barely moved.
Why? Because the market is saturated with geopolitical narrative fatigue. Since the 2024 spot Bitcoin ETF approvals, institutional flows created a new volatility regime, one where each world-changing event gets absorbed with a yawn. The 2022 Terra collapse, the 2023 banking crisis, the 2024 ETF itself, the endless Fed drama: each of these supposedly moved the market less than the one before. Institutions have reflexively concluded that geopolitical events in crypto are buying opportunities or non-events. That conclusion is correct until the moment it is catastrophically incorrect.
Greeks don't lie, but they also don't catch up by themselves. The Greeks, delta, gamma, theta, vega, are the first-order language of how the market prices the future. When the market refuses to price a tail, the Greeks are telling you that the market's expected distribution of macro outcomes is narrower than the distribution of actually possible outcomes. The gap between those two distributions is where I have made my best trades.
Let me be concrete about 2024. After the spot Bitcoin ETF approvals, I noticed institutional inflows were creating a new and subtle layer of options pricing. The retail swings that used to drive implied volatility up to 100 percent in a weekend were replaced by a smoother, rotation-driven flow that left IV underpriced for event weekends. I designed a volatility arbitrage strategy using CME Bitcoin futures against Coinbase Prime options, capturing the mispricing of implied volatility during the first month of ETF trading. It was an $800,000 premium-decay harvest. The position worked because the market's volatility model was narrower than reality. Reality included institutional outflows, macro shifts, and ETF creations, events the model had not encoded because the model had never seen this regime before.
I am telling you this because the same phenomenon is unfolding in macro risk. The water-system attack is a known-unknown. We know the threat exists. We know the playbook. We know the adversary. What we do not know is when formal attribution lands. A joint FBI and CISA advisory naming Iran's Islamic Revolutionary Guard Corps directly, not "suspected" but "assessed with high confidence," would be a different animal. It would trigger the kind of geopolitical risk event that the crypto market has not priced in years: the potential for new sanctions on crypto infrastructure, the possible designation of Iranian-affiliated wallets, another round of crypto-funds-terrorism hearings in Congress, and a broader risk-off repricing that could compress liquidity exactly when it hurts.
Here is the trade framing. The attack itself was a non-event for markets because it did not interrupt the marginal unit of crypto demand. The marginal unit of crypto demand is speculative carry, not social utility. Water systems are irrelevant to speculative carry. Iran's formal attribution is relevant, because it changes the political coverage ratio of crypto, the probability of a legislative response that interferes with the carry. The market is currently pricing that probability at zero. If you share my sense that it is not zero, the trade is not spot. The trade is the volatility surface and the cheap out-of-the-money put skew. It is the same trade I ran heading into the Terra collapse: buy long-dated downside options when everyone believes this time is different. I protected $1.2 million of capital in May 2022 that way. The hedge was expensive. It paid for itself twenty times over.
The deeper issue is that the crypto options market is structurally biased toward underpricing tail risk right now. The ETF-era speculators are net sellers of volatility, harvesting premium in a regime that has rewarded short-volatility positioning month after month. This is the same money that, in equities, got destroyed repeatedly when the VIX’s baseline lulled them into forgetting that tails are fat. In crypto, the events that should reset the baseline keep getting negotiated down. The seven-state water attack is the latest and most dramatic data point confirming that the market has chosen complacency. I intend to be on the opposite side of that choice, at a price the complacent are willing to offer.
On-Chain Forensics
The other part of this story that has not been written is the on-chain forensics. If Iran is behind the seven-state water attack, the attackers may not appear in the intelligence reporting as a uniformed state operator. They are almost certainly operating with the knowledge and tacit direction of a state actor. That means the fiscal trail and the intelligence trail intersect the crypto ecosystem in ways the market has not priced.
Let me be honest about the numbers, because sobriety is a form of respect for reality. Iranian state-linked cyber operations are not funded primarily through crypto. They are funded through the Iranian state budget, which is funded by oil exports, which run through a complex offshore network that predates Bitcoin. Crypto is a rounding error in that flow. But the flow exists, and the sanctions regulator's attention has already found it. The 2022 Tornado Cash designation was the first time the Office of Foreign Assets Control sanctioned a decentralized protocol. The 2023 designations of Iranian-linked wallets holding small balances were a trial run. What the water attack changes, if it lands as an official attribution, is that the designations get bigger and the enforcement framework gets angrier.
The reverse directional flow is equally interesting. The US intelligence community is reliant on blockchain intelligence to track Iranian cyber actors. Chainalysis and Elliptic have reported for years that Iranian APT groups, including those operating under the IRGC umbrella, have set up their own mining operations and over-the-counter exchange networks. In the event of a formal attribution, the on-chain component will be public, comprehensive, and used to justify the next tranche of sanctions. The open ledger is comfortable with that role. That is the point.
The reason I bring this up is that the crypto market's prevailing response to state-sponsored attacks is the assumption that the story is external, irrelevant, or both. It is none of the above. A formal attribution will produce a sanctions wave. A sanctions wave will produce a compliance crackdown. A compliance crackdown will produce a short-term liquidity squeeze for the same trading desks that just shrugged at the water attack. That squeeze will be priced nowhere in the current term structure.
And here is where the smart-contract layers get involved in ways most analysts ignore. The more DeFi integrates composability across lending markets, derivatives protocols, and tokenized real-world assets, the more the enforcement infrastructure becomes automated. Once OFAC designates a wallet address, the compliance layer of every centralized exchange and every institutional DeFi integrator has to block that address retroactively. If that wallet has interacted with a lending protocol, liquidation cascades can propagate through the ecosystem in ways that have nothing to do with the geopolitical rationale. Nobody prices that because nobody can model it. But I have seen enough liquidation cascades in the last four years to know that they always come from the direction nobody was watching.
The Insurance and the Security Tax
Let me look at the second-order economics, because the first-order market response is boring. The second-order effects are where the volatility actually lives.
The seven-state water attack will force a repricing in the cyber liability insurance market. Municipal water utilities have historically paid small premiums for coverage that includes loss from cyber incidents. After a coordinated attack on seven states with a suspected nation-state sponsor, underwriters will do one of three things: exclude state-sponsored attack from policy language, require specific security controls like no internet-exposed PLCs, default credential removal, and multi-factor authentication, as a precondition for coverage, or raise premiums. The first two are already happening in the industrial-control sector. The third is a lagging indicator.
The aggregate cost is not the immediate damages. It is the permanent security tax on a sector with no margin to absorb it. In the same way a single DeFi hack pushes a marginal protocol to triple its audit spend and buy every monitoring product on the market, the water attacks push the municipal sector toward a permanent cost increase. That tax is distributed across every American ratepayer. It shows up in budgets. It shows up in procurement. And it shows up as a compounding expense in the inflationary backdrop that crypto markets keep pretending does not matter.
There is a macro link here that I rarely see discussed. The bull market of 2024 through 2026 has been a trade on the repricing of liquidity and the resilience of consumer demand. The water-attack security tax is a demand-side tax with a capital-expenditure multiplier. Every dollar spent on cyber hardening a water utility is a dollar not spent on something else. More importantly, it is a dollar that increases the cost floor of a basic service. If these attacks become a quarterly event, the security tax compounds, and the no-inflation narrative that some crypto pundits cling to gets another structural headwind. I do not have a direct trade on that, but I know this: an asset whose value is premised on being digital gold cannot ignore a world where the analog water supply becomes intermittently untrustworthy. The market is supposed to be the best place to price all of this. The market is currently pricing none of it.
The comparison to insurance in crypto is instructive. When protocols started getting hacked with regularity, insurance providers emerged, then failed, then re-emerged with much tighter covenants. The market for on-chain insurance is still marginal because the premiums are too high for the perceived risk, and the perceived risk is too low because the frequency and severity of hacks are not systematically indexed. The water sector will follow the same path. It will acquire insurance products with heavy covenant structures, and the covenants will push the behavior change that regulation failed to produce. That is not a criticism of the market. It is a praise of the mechanism. But it is also a warning: the mechanism prices risk only after the events happen, never before.
The Contrarian Angle
The narrative forming around this event is predictable and, in its own way, corrupt. The cybersecurity industrial complex will call for a Manhattan Project for critical infrastructure defense. The crypto-policy crowd will argue that the attack proves the need for stricter compliance, greater surveillance, and better integration between blockchains and government, as if the solution to centralization risk were more centralization. The Iran-hawk faction will use the attack to justify military escalation. Somewhere in the noise, a VC-backed startup will raise fifty million dollars to build decentralized infrastructure security with a token.
I want to counter this with a colder take.
The attack was not a display of sophistication. It was a display of contempt. Contempt for the idea that American municipalities would ever bother to change a default password. Contempt for the idea that the private sector could self-regulate. Contempt for the gap between the cybersecurity resilience narratives in boardroom decks and the reality of a four-hundred-thousand-dollar budget at a rural water district.
The same contempt is visible in crypto. The same gap between narrative and reality. DeFi protocols with audited smart contracts that get exploited within weeks. NFT collections with floor price protection mechanisms that collapse under a single wash-trading campaign. The water attack and the NFT floor are the same phenomenon at different scales. I say this as someone who detected and profited from both. In 2021, I tracked wash-trading patterns in the Bored Ape Yacht Club ecosystem, identified wallets artificially inflating floor prices to trigger liquidations in lending protocols, and shorted the associated governance tokens, ENS and AAVE, based on on-chain data. The market dismissed the analysis as conspiracy theory. Then the exchanges got fined, and the narrative changed. NFT floor is a feeling, not a number. And a water system's security state is not a feeling either. It is a set of default passwords.
The contrarian position for the crypto market is not defensive. It is not buy cybersecurity tokens. It is to recognize that the attack on water is an attack on trust in infrastructure, and trust is the underlying asset of the entire digital-asset complex. If Bitcoin is a bet on the human tendency to seek sound money in broken institutions, then the breaking of water institutions in seven states is not a crypto story at all. It is a confirmation that institutions are breakable. The market's non-response reflects not strength but a form of learned helplessness. We have priced so much chaos that chaos is now the baseline, and the baseline is a discount rate no one is willing to articulate.
There is another uncomfortable possibility worth naming. Everyone says Iran attacked the water. What if the framing itself is the operation? Attribution is part of the cognitive battlefield. If a third party wanted the US to spend its full attention on Iran, what better way than seven simultaneous water attacks that pattern-match to Iranian tradecraft? I do not have the technical forensic evidence to discern this. But I have been around long enough to know that the first narrative is often the deflection, not the direction. The fact that the reporting is media-led and lacks IOC-level technical detail means the Iran-suspected line is doing analytical work it has not earned. The uncertainty is the story, and the market is not pricing it because no one has the patience to hold the uncertainty like a loaded position.
This connects to a structural point I have been making about crypto's governance tokens for years. A DAO governance token is essentially a non-dividend stock: its only value derives from the belief that a later buyer will take the bag at a higher price. The water-attack narrative operates the same way. The price of the Iran story is not supported by any current yield. It is supported entirely by the next buyer's fear, or the next political cycle's demand for a villain. Both are momentum instruments, and both eventually go to zero if the underlying reality does not pay out. Until the technical attribution evidence arrives, the Iran story is a governance token with a strong narrative and zero fundamentals.
There is also the layer-2 lens, because it is worth noting where the industry's attention should be directed after this event. The real difference between OP Stack and ZK Stack has never been technical; it has been about who can convince more projects to deploy chains first. The same dynamic governs infrastructure security in the water sector versus the crypto sector. The industry argues about which proof system is more rigorous while the water utility runs a PLC with a password of 1111. The debate is about adoption, not engineering. And the adversary is already on the side of engineering.
What I Am Watching
Let me get practical, because the analytical work without a trade is just editorializing.
First, I am watching CISA advisories and joint FBI, NSA, and CISA bulletins with the same urgency I watch options chains. The moment a formal attribution advisory is released, the market structure will change in a predictable sequence: risk-off repricing in the first hours, then a policy response in the following weeks, then a compliance squeeze in the following months. I will be positioned for the first and the third, which are the moments where the mispricing is largest.
Second, I am watching the Iran narrative collaterals, specifically whether OFAC designates any new addresses connected to Iranian cyber operations. The designations will trigger automated compliance actions across the ecosystem. If the designations involve a wallet that touched DeFi protocols, the cascade effect will be nontrivial. I will watch the sanctioned address lists the way bond traders watch credit events.
Third, I am watching the derivatives flow into the water infrastructure security complex. The cyber insurance repricing will generate a demand for risk transfer that crypto can serve very well, through tokenized insurance products and parametric catastrophe instruments that pay out when ICS incidents are confirmed. The market for these instruments is embryonic, but every major attack accelerates its development. The seven-state event is the kind of catalyst that moves a nascent market from pilot to production. I am paying attention to whether the protocols building them can actually execute under incident conditions.
Fourth, I am watching the election cycle calendar. A formal attribution landing in a politically sensitive window amplifies the policy response. The combination of a focused public threat, an election-driven need to demonstrate toughness, and a crypto market that still polls poorly with the median voter creates the conditions for precisely the kind of regulatory overreach that compresses liquidity. The timing of the attacks is unlikely to be random. Adversaries read calendars.
Takeaway
The trade is not in the water. The trade is in the volatility surface that refused to move.
Hold the uncertainty like a position. If formal attribution lands, a joint FBI and CISA advisory, OFAC designations, a Treasury action, the market will reprice tail risk in a single session, and the repricing will be violent because the current IV is so low. Buy the panic. Sell the complacency. And in the meantime, remember the lesson: the attacker will use the default password. Every day we fail to act on that truth is a day we finance the adversary's next operation, whether the adversary is in Tehran or in a Telegram group sharing the next NFT mint.
The market does not care about water. But the market will care about the liquidity squeeze that follows attribution. I will be positioned for that. I am holding long-dated downside, and I am watching the ICS advisories like they are options chains. Code is law, but bugs are justice, and justice, like volatility, always arrives at the most inconvenient time.
