his market resolves based on the first cyberattack that causes one of the institutions listed below to lose access to, corrupt, or otherwise become unable to rely on its own authoritative records of some meaningful set of customer cash balances or securities holdings.

For purposes of this market, the institutions are fixed as of August 2026.

Banks

• JPMorgan Chase

• Bank of America

• Citibank

• Wells Fargo

• U.S. Bank

Brokerages

• Fidelity

• Charles Schwab

• Vanguard

• Morgan Stanley

• Merrill

Because Merrill is owned by Bank of America, this represents nine distinct financial institutions.

What counts?

A cyberattack counts if it causes the institution itself to temporarily or permanently lose the records necessary to determine who owns some meaningful amount of customer money or securities. This must affect at least 10% of customers.

For example, this would count if ransomware or another cyberattack corrupts or encrypts the institution's production customer ledger and its immediately available replicas, such that the institution has to:

• restore customer balances or positions from a cold/offline backup;

• reconstruct positions or transactions from clearinghouses, custodians, counterparties, trade confirmations, transaction logs, or other external/internal records; or

• otherwise perform a substantive recovery process because its normally authoritative records of customer ownership are unavailable or cannot be trusted.

The loss does not have to be permanent. If a brokerage loses its authoritative customer-position database for several hours and ultimately restores it perfectly from an offline backup, that counts.

The attack also does not need to cause customers to actually lose money. The relevant event is the loss or corruption of the institution's records of ownership, not the eventual financial loss.

What does NOT count?

A customer-facing outage by itself does not count.

For example, if Fidelity's website and app are unavailable for a week but Fidelity's internal systems still accurately know that Alice owns 1,000 shares of AAPL and Bob has $100,000 in cash, this does not count.

Similarly, these do not count unless the underlying books and records are themselves lost or rendered unreliable:

• online banking or brokerage website outages;

• customers temporarily being unable to view balances;

• inability to trade;

• payment-system outages;

• stolen customer login credentials;

• fraudulent transfers;

• theft of customer personal information;

• ransomware affecting peripheral systems while the authoritative customer ledger remains intact; or

• a normal failover from one live database to an intact replica.

The key distinction is: did the financial institution itself temporarily cease to possess a reliable, operational record of who owned some customer assets, forcing it to restore or reconstruct those records?

A cyberattack must be the proximate cause. Ordinary hardware failures, software bugs, human errors, natural disasters, or non-cyber operational failures do not count.

Resolution should be based on credible reporting from the affected institution, regulators, court filings, major news organizations, or cybersecurity researchers with sufficiently strong evidence to establish that the above threshold was met.