Analysis

Coupang’s Data Breach: From Seoul’s Courtrooms to Washington’s Trade War

Published

4 months ago

March 7, 2026

When a former employee quietly began extracting data from Coupang’s servers on June 24, 2025, the act looked, on its face, like a textbook insider-threat case—disgruntled, technically savvy, geographically mobile. What nobody in Seoul or Seattle anticipated was that the Coupang data breach would, within six months, detonate inside one of the most consequential bilateral trade relationships in the Asia-Pacific.

By early 2026, the episode had dragged in the White House, the U.S. Trade Representative, a bipartisan congressional hearing, five American hedge funds, and a potential tariff hike that rattled South Korea’s fragile currency. The Coupang South Korea data breach exposed not merely the personal information of 33.7 million customers—nearly two-thirds of the country’s entire population—but a structural fault line in how democratic allies govern data, enforce privacy law, and resolve disputes when corporate accountability crosses national borders.

That fault line, it turns out, is deep enough to swallow a trade relationship.

The Anatomy of a Breach: Five Months of Silence, One Smashed MacBook

The intrusion, as reconstructed by South Korean government investigators and third-party forensic firms Mandiant and Palo Alto Networks, was neither sophisticated nor spectacular. A former Coupang engineer—later identified as a Chinese national who had worked on the company’s authentication systems—used unrevoked access credentials to connect to customer data repositories through overseas servers. The breach continued, undetected, from late June to November 8, 2025: approximately 137 days of unauthorized access to names, phone numbers, email addresses, delivery addresses, and partial order histories belonging to 33.7 million Korean accounts.

The discovery came not from Coupang’s own security monitoring but because the perpetrator sent threatening, anonymous emails to the company and individual users. Only then did internal teams identify the compromise—initially estimating just 4,500 affected accounts. The true scale, confirmed via forensic investigation, was roughly 7,500 times larger.

Key Timeline of Events

Date	Event
June 24, 2025	Unauthorized access begins via overseas servers
November 6, 2025	Coupang detects unusual access at 6:38 PM KST
November 8, 2025	Last date of unauthorized access
November 18, 2025	Full identification; KISA, PIPC, and National Police Agency notified—53+ hours after internal detection, violating the 24-hour reporting rule
November 29, 2025	Coupang publicly discloses the breach
December 15, 2025	Coupang files SEC 8-K; former CEO Park Dae-jun resigns
December 29, 2025	Company announces 1.685 trillion won ($1.17B) compensation plan
January 13, 2026	U.S. House Ways and Means Trade Subcommittee holds bipartisan hearing
January 23, 2026	Greenoaks and Altimeter file ISDS notice with South Korea’s Ministry of Justice
January 26, 2026	Trump administration raises tariffs on South Korea from 15% to 25%
February 12, 2026	Three more U.S. investors—Abrams Capital, Durable Capital, Foxhaven—join ISDS action

The cover-up attempt was equally cinematic: authorities recovered a MacBook Air the perpetrator had submerged in a canvas bag weighted with bricks. Forensic analysis of the retrieved device confirmed that while data from over 33 million accounts had been accessed, only approximately 3,000 records were retained, none of which appear to have circulated on the dark web. That distinction—between access and retention—would become one of the most contested technical arguments in the ensuing international dispute.

Management Failure, Not Sophisticated Attack: Seoul’s Damning Verdict

South Korean regulators delivered a judgment that was unsparing in its directness. The Coupang management failure data breach finding, published in a government-led investigation in February 2026, concluded that the breach was not the product of a nation-state cyberattack or advanced persistent threat. It was, in the investigators’ framing, an organizational failure: a company that had not properly revoked authentication credentials upon an employee’s departure, had failed to encrypt non-payment customer data despite having the capacity to do so, and had not fully implemented a data preservation order issued upon breach disclosure—resulting in the deletion of critical web and app access logs before outside parties could examine them.

The Personal Information Protection Commission (PIPC), South Korea’s principal privacy watchdog, further demanded that Coupang correct its public communications: the company had described the incident as data “exposure,” a characterization regulators rejected in favor of “leak”—a distinction laden with legal consequence under the country’s information network law.

For a company that had spent years presenting itself as the crown jewel of Korean e-commerce—an Amazon-equivalent with $34.5 billion in 2025 revenue and a NYSE listing that generated euphoric headlines in 2021—the regulatory verdict was stinging. South Korean President Lee Jae-myung publicly called for heavy penalties, describing personal data protection as “a key asset in the age of AI and digitalization” during a cabinet meeting. One Democratic Party lawmaker floated the possibility of punitive fines through special parliamentary legislation, an idea the PIPC endorsed publicly.

Under existing law, penalties are capped at 3% of annual revenue—a figure that, for a company of Coupang’s scale, could exceed $800 million. Some lawmakers were seeking to raise that ceiling to 10%.

Why the Coupang Breach Became an International Trade Issue

The escalation from domestic regulatory matter to international flashpoint followed a logic that, in retrospect, looks almost inevitable—though it required a specific convergence of corporate structure, investor geography, and geopolitical temperature.

Coupang’s corporate identity is inherently binational. Although the company operates as South Korea’s largest e-commerce platform—employing 95,000 people and serving consumers through its celebrated “Rocket Delivery” logistics network—its global headquarters sits in Seattle, Washington. It trades on the NYSE. Its largest shareholders are American. When South Korean regulators moved against the company, they were, from the investors’ perspective, effectively moving against a U.S.-headquartered enterprise operating in a foreign market.

U.S. investors activated treaty mechanisms that Seoul had not anticipated. On January 23, 2026, investment firms Greenoaks and Altimeter—together holding approximately $1.5 billion in Coupang stock—filed a formal notice of intent with South Korea’s Ministry of Justice, invoking the investor-state dispute settlement (ISDS) provisions of the U.S.-Korea Free Trade Agreement (KORUS FTA). Their central claim: that the Korean government’s response to the Coupang data breach was disproportionate, discriminatory, and designed to benefit domestic and Chinese competitors at the expense of an American company. By February 12, 2026, three additional U.S. investors—Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management—had joined the action, according to a report by TechCrunch.

ISDS arbitration, for the uninitiated, is a provision embedded in most modern trade agreements that allows foreign investors to sue sovereign governments before international arbitral tribunals—bypassing domestic courts entirely. The mechanism was designed to protect cross-border investment from arbitrary government interference. In the Coupang case, the investors are alleging that South Korea violated the treaty’s guarantees of fair and equitable treatment, most-favored-nation status, and protection against expropriation. If the mandatory 90-day consultation period fails to produce resolution, the dispute proceeds to formal arbitration, with damages potentially running into billions of dollars charged against Seoul’s government.

Washington amplified the pressure through multiple channels. The U.S. investors also petitioned the U.S. Trade Representative to investigate under Section 301 of the Trade Act of 1974, requesting that “appropriate trade remedies”—including tariffs—be applied if Korea’s conduct was found to constitute discriminatory enforcement. The Korea Herald reported that U.S. Vice President J.D. Vance personally warned South Korean Prime Minister Kim Min-seok that the investigation appeared discriminatory. At a January 13 House Ways and Means Trade Subcommittee hearing, Republican Chair Adrian Smith characterized Korean regulators as pursuing “legislative efforts explicitly targeting U.S. companies,” with fellow lawmaker Rep. Scott Fitzgerald describing the government’s conduct as a “politically motivated witch hunt.”

On January 26, 2026, the Trump administration announced a tariff increase on South Korean goods from 15% to 25%—officially attributed to Seoul’s slow ratification of the bilateral trade deal reached the previous year. But the timing was precise enough that the official House Judiciary Committee account posted on X: “This is what happens when you unfairly target American companies like Coupang.” The Diplomat’s analysis concluded that while Trump’s tariff calculus encompasses broader investment commitments, the Coupang episode had provided political and rhetorical scaffolding for the escalation.

The Discrimination Argument: A Contested Ledger

The investors’ discrimination claim hinges on comparative enforcement: they argue that Korean and Chinese companies involved in comparable data incidents faced significantly lighter regulatory responses. This contention deserves scrutiny rather than uncritical acceptance, because the record is genuinely mixed.

CPO Magazine documented that South Korea’s largest mobile carrier, SK Telecom, received a record ₩134.5 billion ($97 million) fine following a breach of USIM identity data for approximately 27 million subscribers—a penalty that regulators imposed only after finding that SK Telecom “did not even implement basic access controls.” The SK Telecom enforcement, then, was itself unprecedented for a Korean incumbent. The Coupang investors counter that the scope of regulatory intervention—including executive travel restrictions, operational suspension threats, and parliamentary summons—far exceeded what any domestic Korean company had faced for equivalent or larger breaches.

There is no clean answer here. Regulatory severity is shaped by political context, media coverage, the identity of the company, and the temperament of individual legislators. What is demonstrably true is that Coupang’s delayed reporting (53-plus hours against a 24-hour requirement), its failure to implement the data preservation order, and the sheer demographic scale of the breach (affecting 65% of the national population) would have attracted intense scrutiny in any jurisdiction operating under modern data protection law.

The Data Governance Gap: Comparing South Korea to Its Peers

The Coupang episode has crystallized a conversation that South Korean policymakers have deferred for years: their data protection framework, while nominally robust, contains structural gaps that both enabled the breach and complicated the regulatory response.

Comparative Data Governance Frameworks

Jurisdiction	Law	Max Penalty	Encryption Mandate	Breach Notification
European Union	GDPR (2018)	4% of global revenue	Risk-based requirement	72 hours to authority
China	PIPL (2021)	¥50 million / 5% revenue	Mandatory for sensitive data	Immediate notification
California, USA	CPRA (2020)	$7,500 per intentional violation	Required for sensitive data	“Expedient” notification
South Korea	PIPA (2011, amended)	3% of revenue	Required for financial data only	24 hours

The gap is instructive: South Korea does not mandate encryption for non-payment personal data. Had Coupang been operating under GDPR, the absence of encryption for names, addresses, and order histories would have constituted an aggravating factor attracting enhanced penalties—and a legal requirement, not merely a best-practice recommendation. The PIPC’s investigation explicitly cited this absence as a contributing factor to the breach’s impact.

The South Korea data privacy law reform after Coupang is now a live legislative debate. President Lee’s call for stronger penalties, the PIPC’s support for punitive fines, and the 3%-to-10% penalty ceiling proposal all represent pressure for alignment with international norms. But the investors’ ISDS action complicates that reform: any retroactive application of harsher penalties would, in the investors’ view, compound the treaty violation rather than resolve it.

Coupang’s Washington Wager

The company’s political footprint in Washington has added a dimension that South Korean civic groups find troubling—and that American trade lawyers find legally consequential. Since its 2021 NYSE listing, Coupang has reportedly spent more than $10.75 million on federal lobbying, targeting agencies across the executive branch and Congress. Following Donald Trump’s reelection in November 2024, the company donated $1 million to the Trump-Vance inaugural committee and positioned itself as a conduit for American export interests through a partnership with the Commerce Department’s International Trade Administration.

Coupang has publicly stated it has no connection to the investors’ ISDS filings, insisting it has been “fully complying with the Korean government’s requests.” Yet the political infrastructure built over five years has, at minimum, created the architecture through which investor grievances could be amplified into government-level intervention. Whether this constitutes sophisticated stakeholder management or a structural conflict of interest for a company operating under Korean regulatory jurisdiction is a question Seoul’s policymakers are beginning to ask with increasing urgency.

Financial Fallout: A $8 Billion Market Cap Erasure

The breach’s financial consequences have been severe. Following public disclosure in late November 2025, Coupang’s stock (NYSE: CPNG) fell sharply, erasing more than $8 billion in market capitalization, with shares declining roughly 50% from their pre-breach highs. The company swung from a Q4 2024 net income of $156 million to a Q4 2025 net loss of $26 million, missing analyst consensus estimates, as active customers slipped and December growth decelerated to approximately 4% in constant currency terms—down from 16% in the prior three months.

The 1.685 trillion won ($1.17 billion) compensation package—issued as 50,000-won platform-use vouchers to all 33.7 million affected users—has been criticized by lawmakers as a mechanism that recirculates money within Coupang’s own ecosystem rather than providing genuine restitution. It is, simultaneously, the largest corporate data breach compensation in South Korean history. Coupang’s full-year 2025 revenue nonetheless reached $34.5 billion, and the company retains over $7 billion in cash—a balance sheet that provides resilience, if not immunity, from the regulatory and legal storm surrounding it.

In Taiwan, where Coupang has been aggressively expanding, the forensic investigation confirmed that one user account was accessed—though earlier reports suggested a spillover affecting approximately 200,000 Taiwanese accounts, a figure Coupang has disputed.

What Reform Looks Like: A Policy Agenda for Seoul and Beyond

The Coupang case offers several policy imperatives that extend beyond Korea’s borders:

First, South Korea must close the encryption gap. The absence of a mandatory encryption standard for non-financial personal data is an anachronism in a country that hosts some of the world’s most sophisticated digital infrastructure. Alignment with GDPR-equivalent standards is not merely a trade relations gesture—it is an essential infrastructure investment in the age of AI data dependency.

Second, ISDS provisions must be examined for fitness-of-purpose in the digital economy context. The original ISDS architecture was designed to protect physical-asset investments—factories, mines, infrastructure—from expropriation by host governments. Applying that framework to data enforcement actions against technology companies creates perverse incentives: it effectively allows investors to convert regulatory pressure into trade litigation, circumventing the very domestic accountability mechanisms that consumers require. The KORUS FTA’s digital trade provisions were cited in both investor filings and congressional testimony; renegotiating their scope deserves attention from both trade ministries.

Third, breach notification timelines must have teeth. Coupang reported the breach to authorities more than 53 hours after internal identification—more than double the 24-hour requirement. That delay destroyed evidentiary logs. Any reformed framework should mandate automated, cryptographically verifiable notification to regulators at the moment of internal breach confirmation, not at the company’s discretion.

Fourth, the distinction between “access” and “harm” requires legislative clarity. The central factual dispute in the Coupang case—33.7 million accounts accessed versus approximately 3,000 records retained—has no clean resolution under current Korean law. A mature data governance framework would define the spectrum between these poles and prescribe proportionate enforcement accordingly, reducing both regulatory overreach and corporate minimization.

The Broader Geopolitical Resonance

The Coupang episode is not an isolated incident. It belongs to a wider pattern in which digital companies—structurally transnational but operationally concentrated in single markets—are caught between the sovereign enforcement prerogatives of their host nations and the financial interests of their investor base, which is increasingly cross-border, treaty-protected, and politically connected.

South Korea is not alone in navigating this terrain. France has faced analogous tensions over GDPR enforcement against American platforms. India’s data localization rules have generated investor concern under its bilateral investment treaties. China’s PIPL, despite its severity on paper, has been selectively enforced in ways that draw diplomatic complaints. The Coupang data governance reform South Korea conversation is, at its core, a version of a global argument: in a world where data is the primary asset of the digital economy, whose law governs it, who enforces that law, and what recourse exists when the answers conflict?

Seoul has a specific reason to resolve this question urgently. Its status as a trusted partner for foreign investment—particularly American capital—depends on the perception of consistent, proportionate, and non-discriminatory enforcement. President Lee’s calls for heavy penalties may play well in domestic politics. But if they are perceived internationally as retroactive, targeted, or politically motivated, the reputational cost will be measured not only in arbitration awards but in the long-term trajectory of foreign direct investment into one of Asia’s most dynamic economies.

Conclusion: The Governance Dividend

The Coupang case will likely be resolved through negotiation—the 90-day consultation period, political back-channels, and the mutual interest both governments have in de-escalation suggest that formal ISDS arbitration, with its multi-year timeline and uncertain outcomes, is a last resort rather than a destination. The tariff issue is governed by economics larger than any single company. Trade ministers on both sides have urged restraint.

But resolution of the immediate dispute should not be confused with resolution of the underlying problem. South Korea has a data governance framework that is partially adequate for the digital economy it has built. It lacks mandatory encryption standards for the most commonly collected personal data. It has penalty caps that, paradoxically, invite both regulatory maximalism and investor challenges. It has notification timelines that exist on paper and evaporate under corporate pressure.

The citizens whose data was accessed—not sold, perhaps, but accessed without consent, for 137 days, by someone who then submerged a laptop in a river to escape accountability—did not generate this geopolitical drama. They were its precondition. Any reform that emerges from the Coupang episode owes its first obligation to them: not to Washington, not to Seoul’s trade ministry, and certainly not to the shareholders whose portfolio values informed the language of “expropriation.”

Data governance, in the end, is not a trade issue. It is a social contract. South Korea, one of the world’s most digitally sophisticated societies, has the institutional capacity to write that contract properly. The Coupang breach made the cost of delay unmistakably visible.

Discover more from The Economy

Subscribe to get the latest posts sent to your email.

Up Next

Hong Kong Is Beijing’s New ‘Vanguard’ in the Contest for Financial Sovereignty

Don't Miss

As Tehran Burns, South Asia Trembles: The Hidden Cost of the Iran War

Click to comment

Analysis

Strait of Hormuz 2026: Why Markets Still Don’t Trust It’s Open

Published

10 hours ago

July 11, 2026

Abdul Rahman

If you’ve followed headlines about the Strait of Hormuz over the past several months, you’d be forgiven for losing track of whether it’s actually open. That confusion isn’t a media failure — it genuinely has opened, closed, and reopened multiple times since the conflict began, and the pattern itself is the real story markets need to understand, far more than any single day’s price move.

A Timeline That Explains the Market’s Persistent Skepticism

The crisis began February 28, 2026, when US and Israeli military operations against Iran triggered Iranian retaliation, including drone, ballistic missile, and small-boat attacks on vessels attempting to transit the Strait (Brookings). By March 4, Iranian forces formally declared the Strait “closed.” Insurance for transiting vessels became unavailable or prohibitively expensive, and seafarers largely refused the journey — meaning the Strait was effectively shut even without a formal blockade in the technical sense (Brookings).

What followed was a genuinely chaotic sequence that explains why traders remain reluctant to fully price in a resolution even now. On April 9, there was no sign an earlier agreement to lift the blockade was actually being implemented — ships were once again prevented from passing. Abu Dhabi National Oil Company’s CEO confirmed the Strait remained closed despite an announced ceasefire, noting 230 loaded oil tankers were waiting inside the Gulf (Wikipedia — 2026 Strait of Hormuz crisis). On April 17, Iran’s foreign minister announced the Strait was open to all shipping — oil prices dropped 11% immediately following the announcement. The very next day, April 18, Iran closed it again, citing the US refusal to lift its own naval blockade in response.

Even the June 17 memorandum of understanding between Trump and Iranian President Masoud Pezeshkian to formally end the war and the blockades didn’t hold cleanly: on June 20, Iran said it had closed the Strait again, citing continued Israeli strikes in southern Lebanon as a violation of the broader ceasefire agreement — a claim the US military denied (Wikipedia). By June 27, the US Navy’s Joint Maritime Information Center announced a widened shipping route through the Strait near Oman, an action explicitly framed as challenging Iran’s control over the waterway rather than a clean bilateral resolution.

Why This Chokepoint Matters More Than Any Other Piece of Global Infrastructure

Approximately 20 million barrels of oil per day move through the Strait of Hormuz — roughly 20% of global seaborne oil trade and about 27% of the world’s maritime crude oil and petroleum product trade combined (Congressional Research Service). At its narrowest point, the Strait is just 33-34 kilometers wide, split into two unidirectional two-mile-wide shipping lanes separated by a two-mile buffer zone sitting entirely within Iranian and Omani territorial waters (Congressional Research Service).

Critically, no rerouting option exists that can replace this volume at comparable cost. An extended full closure would remove 17-21 million barrels from daily global supply against total world consumption of roughly 100 million barrels per day — a supply shock with no readily available substitute (Ziro Market).

The Damage Already Done, Even With Partial Reopening

The International Energy Agency characterized the disruption as the largest supply disruption in the history of the global oil market (Wikipedia — Economic impact of the 2026 Iran war). At peak conflict intensity in February-March 2026, Brent crude surged well above $120 per barrel. As ceasefire talks progressed through May and June, prices retreated significantly — falling to around $95-100 per barrel by early June, and briefly dipping to $78.24 per barrel by mid-June, the lowest level since March 3, before the framework agreement was formally signed (Al Jazeera).

But the ripple effects extend well beyond crude oil pricing. The Strait closure disrupted roughly 45% of global sulfur supply — critical for fertilizer production, copper industry metal leaching, and sulfuric acid manufacturing — and constrained helium supply, a commodity essential to semiconductor manufacturing (Wikipedia — Economic impact). Shipping companies including Maersk, CMA CGM, and Hapag-Lloyd suspended transits through the Strait and related routes like the Red Sea entirely, forcing rerouting around the Cape of Good Hope that added two to three weeks to journey times and increased per-shipment costs by 30-50% (Ziro Market).

Europe’s Quieter But Deeper Crisis

While oil price headlines dominated coverage, Europe faced an arguably more severe parallel crisis through the suspension of Qatari liquefied natural gas exports combined with the Strait closure — hitting at the worst possible moment, with European gas storage sitting at just 30% capacity following a harsh 2025-2026 winter. Dutch TTF gas benchmarks nearly doubled to over €60/MWh by mid-March (Wikipedia — Economic impact).

The European Central Bank responded by postponing planned interest rate reductions on March 19, simultaneously raising its 2026 inflation forecast and cutting GDP growth projections, with UK inflation specifically projected to breach 5% during 2026. Chemical and steel manufacturers across the UK and EU imposed surcharges of up to 30% to offset surging electricity costs, and the ECB explicitly warned that a prolonged conflict risked pushing major energy-dependent economies, including Germany and Italy, into technical recession by year-end.

Why OPEC+ Couldn’t Simply Fill the Gap

A natural question is why Saudi Arabia and the UAE — the two largest Gulf Cooperation Council producers with meaningful spare capacity — didn’t simply increase output to compensate. The answer is logistical rather than a lack of willingness: the Strait closure itself limited their ability to actually export any increased production volumes, even when pumping more oil, because the export bottleneck was the same chokepoint causing the broader crisis (Ziro Market). Total OPEC country production fell more than 30% since the start of the war, and the region’s spare capacity — the traditional shock absorber for global oil markets — proved largely irrelevant when the actual export route itself was under attack (Brookings).

US shale producers, meanwhile, responded more slowly to the price signal than historical patterns would predict. Rig counts stayed largely steady through April 2026, though well-completion activity in the Permian Basin did rise roughly 20% over several weeks as previously drilled wells came into production — still below pre-pandemic activity levels overall (Brookings).

The Market Is Still Pricing a Discount for Uncertainty, and Analysts Say That’s Correct

Vandana Hari, founder of Singapore-based Vanda Insights, offered perhaps the most useful framing for understanding current market behavior: crude’s slide following the memorandum of understanding is “entirely sentiment-driven,” with markets front-running the prospective reopening and likely pricing in a best-case scenario for normalized flows — meaning potential hiccups, from logistics to renewed geopolitical tensions, aren’t being adequately factored in (Al Jazeera).

Given the actual track record — multiple announced reopenings followed by renewed closures throughout April and June — that skepticism looks well-founded rather than excessive.

What This Means for Businesses and Investors Going Forward

For companies with Gulf-dependent supply chains: Treat any single reopening announcement as provisional rather than a genuine all-clear, given the pattern of reversals throughout the spring. Maintaining rerouting contingency plans and insurance flexibility remains prudent even after formal ceasefire signings.

For inflation-sensitive investors and central bank watchers: The relationship Ziro Market’s analysis highlights is worth internalizing directly: whether oil settles near $80-85 (supporting rate cuts, lower CPI, stronger oil-importing currencies) or spikes back toward $120 (elevated inflation, delayed rate cuts) functions as a genuine macro regime switch — not a marginal input, but potentially the single largest swing factor for 2026 global monetary policy.

For commodity-exposed sectors beyond energy: The sulfur, fertilizer, and helium supply disruptions are underappreciated second-order effects that specifically hit agriculture and semiconductor manufacturing — sectors not typically associated with Middle East conflict risk but directly exposed through this specific chokepoint.

The Bottom Line

The Strait of Hormuz crisis of 2026 has been less a single supply shock than a recurring pattern of partial resolutions and renewed disruptions, and that pattern itself is the most important thing for markets and businesses to understand going forward. Prices have retreated substantially from their conflict-peak highs, and the June 17 memorandum of understanding represents genuine diplomatic progress. But given that the Strait has been declared “open” and then closed again multiple times within the same several-week windows, treating the current relative calm as a durable resolution — rather than the latest phase in an ongoing negotiation — would be a mistake that both markets and policymakers seem determined not to repeat.

Discover more from The Economy

Subscribe to get the latest posts sent to your email.

AI

AI Capex Bubble 2026: The Hidden $662B Debt Nobody Reports

Published

10 hours ago

July 11, 2026

Abdul Rahman

Every earnings season now brings a fresh wave of headlines about hyperscaler AI capital expenditure hitting a new record. The “big four” — Amazon, Microsoft, Alphabet, and Meta — are on track to spend roughly $725 billion combined in 2026, a 77% jump from the $410 billion deployed in 2025 (UnboxFuture). That number gets reported constantly. What almost nobody is reporting with the same prominence is a separate figure that may matter more: roughly $662 billion in data center lease commitments that hyperscalers have already signed but not yet begun — obligations that currently sit entirely off balance sheet.

Why the Off-Balance-Sheet Number Changes the Whole Picture

Under GAAP accounting rules governing when a lease “commences,” these signed-but-not-started commitments don’t appear in the capital expenditure figures analysts and investors typically scrutinize when assessing hyperscaler financial health. According to reporting citing Moody’s early-2026 analysis, this shadow liability is larger than the combined on-balance-sheet debt of the same companies (Anomaly Investments).

That detail matters enormously for one specific argument AI infrastructure bulls have relied on: the claim that this buildout is being conservatively self-funded from operating cash flow rather than risky leverage. Once the full picture of committed-but-unrecognized obligations is accounted for, that defense becomes much harder to sustain.

The Debt Is Already Showing Up, Not Just Theoretical

This isn’t a purely hypothetical concern about future liabilities. Big tech companies have already issued more than $100 billion of bonds in 2026 specifically to help fund AI capital expenditure, and investors have responded by demanding record levels of protection against potential defaults through credit default swaps — essentially insurance policies against bond default (IEEE ComSoc).

Individual company examples illustrate the shift toward leverage: Oracle issued an $18 billion bond specifically tied to its data center expansion; CoreWeave secured a $2.6 billion loan alongside a $1.75 billion bond package; and OpenAI and Oracle reportedly entered into a $100 billion vendor financing arrangement (Anomaly Investments). At Amazon specifically, capital expenditure over the trailing twelve months has reached $151 billion — a figure that now exceeds the company’s entire operating cash flow, pushing free cash flow into negative territory.

The Depreciation Assumption Almost No Coverage Questions

Here’s an angle genuinely underexplored across most financial media: the depreciation schedules hyperscalers use for AI hardware assume a five-to-six-year useful life. But given how rapidly GPU generations are turning over and how intensively AI workloads are pushing hardware utilization, critics argue the real economic life of this equipment is closer to two to three years. That gap between assumed and actual depreciation is estimated to understate true asset depletion by roughly $176 billion between 2026 and 2028 alone — a figure that grows as accelerating token consumption pushes hardware utilization beyond the assumptions built into current depreciation schedules (Anomaly Investments).

Layered on top of that is the energy cost curve: running the current roughly 30-gigawatt installed base of AI infrastructure costs approximately $27 billion annually today, but that figure is projected to climb to between $45 and $90 billion per year as capacity scales toward 2029 — and crucially, these are first charges against revenue, not optional or deferrable costs.

The Revenue Gap: Who’s Actually Paying for All This?

The most commonly cited justification for the capex surge is that the pure-play AI vendors — OpenAI, Anthropic, and others — represent a massive and rapidly growing revenue opportunity. The reality is more nuanced. OpenAI’s roughly $20 billion annualized revenue run rate, while genuinely impressive for a company with barely any consumer products three years ago, represents only about 3% of projected 2026 hyperscaler capex. Anthropic’s roughly $9 billion run rate, despite showing 9x year-over-year growth, occupies a similarly small share. The entire cohort of pure-play AI vendors combined — including Cohere, Mistral, Perplexity, and others — likely accounts for less than $35 billion in projected combined 2026 revenue against a hyperscaler capex figure exceeding $700 billion (Futurum Group).

That gap is the crux of the bubble debate: hyperscalers are betting the infrastructure will ultimately serve enterprise adoption and their own AI services broadly, not just third-party AI vendor revenue — but that bet requires enterprise AI monetization to arrive at a scale that, as of mid-2026, remains largely unproven outside of code generation and basic customer service automation.

The Skeptic’s Case, From Inside Goldman Sachs Itself

The most prominent voice of institutional skepticism doesn’t come from an outside critic — it comes from within Goldman Sachs itself. Jim Covello, the bank’s Head of Global Equity Research, has consistently argued the economics of the generative AI transition are fundamentally flawed, stating in mid-2026 that the industry has moved “further away” from justifying the scale of capital expenditure compared to two years prior (UnboxFuture). Covello has specifically flagged circular capital flows between cloud providers and AI startups — where hyperscalers invest in AI companies that then spend that same capital purchasing compute from those same hyperscalers — as a red flag reminiscent of vendor financing patterns seen in the dot-com era.

The valuation comparison to that era is explicit and increasingly common among strategists: US technology and AI equities carry EV/EBITDA multiples near 25x, close to historical extremes and above the telecom valuations that preceded the 2000 dot-com peak. More specifically, capex is currently expanding roughly 46 percentage points faster than revenue growth — a gap that exceeds the 32-point divergence observed during the 2001 telecom excess cycle (Allianz Research). Separately, Bank of America strategists have pointed out that AI stock concentration has reached levels matching prior bubble peaks, with the “AI Big 10” (Nvidia, Microsoft, Alphabet, Amazon, Meta, Apple, Tesla, Broadcom, Micron, and AMD) now making up 41% of the S&P 500 — comparable to the concentration of tech and telecom stocks during the actual dot-com bubble (Yahoo Finance).

The Bull Case Isn’t Naive Either

It would be inaccurate to frame this purely as informed skeptics versus blind enthusiasm. Goldman Sachs’ own broader research (distinct from Covello’s individual view) models roughly $7.6 trillion in cumulative AI capital expenditure between 2026 and 2031, built on the expectation that token consumption will increase 24-fold by 2030, driven largely by enterprise AI agents becoming embedded in production workflows rather than remaining experimental (Sesame Disk / Goldman commentary). Microsoft has disclosed an $80 billion backlog of Azure orders it currently cannot fulfill due to power constraints — genuine evidence that demand, at least for existing capacity, is outpacing even the current aggressive build-out pace (Futurum Group).

Leverage levels also remain more conservative than headlines suggest in absolute terms: the top five US capex providers reported a combined $385 billion in debt at the end of 2025, with leverage ratios still roughly 20% below the “high spender” cohort from the 2000 dot-com peak, according to Allianz Research analysis — meaning rising debt levels are a trend worth monitoring closely, not yet an acute crisis.

What Happens If the Bubble Skeptics Are Right

Historical infrastructure cycles offer a specific and somewhat counterintuitive lesson: the investors who fund the initial frenzied build-out phase rarely capture the long-term rewards. If the AI capex cycle follows the pattern of the 1998-2001 fiber optic buildout, hyperscalers may eventually be forced to write down the value of data centers and GPUs purchased at today’s prices and utilization assumptions. But that collapse in computing costs, paradoxically, could pave the way for a new generation of leaner, genuinely profitable software companies to build on top of the resulting cheap, overbuilt infrastructure — much as fiber-optic overbuild eventually enabled the 2000s streaming and cloud computing boom, even after the original telecom investors were wiped out.

What This Means for Investors and Businesses

For equity investors, the practical signal to watch isn’t the headline capex number — it’s the widening gap between capex growth and revenue growth, and whether that gap begins narrowing through 2027 as enterprise adoption either accelerates or disappoints. For businesses evaluating AI vendor relationships, the circular-financing pattern flagged by Covello is worth diligence: understanding whether an AI vendor’s revenue depends partly on capital originally supplied by the same hyperscaler providing its compute is a legitimate red flag for assessing that vendor’s underlying financial independence. For fixed-income investors, the rising credit default swap pricing on hyperscaler-linked debt is itself a market signal worth tracking as an early indicator of shifting sentiment, independent of equity price action.

The Bottom Line

The AI infrastructure buildout genuinely is the largest corporate capital expenditure cycle in recorded history, and it’s happening for real, defensible reasons tied to a genuine technology shift. But the debate over whether it constitutes a bubble isn’t really about whether AI technology is useful — it’s about whether the timing of returns can keep pace with public equity markets’ patience, and whether the $662 billion in off-balance-sheet lease commitments, aggressive depreciation assumptions, and circular vendor financing arrangements represent manageable financial engineering or the early architecture of a genuinely serious correction. Both cases have real evidence behind them. What’s clear is that the headline capex figure everyone quotes is no longer the most important number in this story.

Discover more from The Economy

Subscribe to get the latest posts sent to your email.

Markets & Finance

Gold Overtakes US Treasuries in Reserves: What It Means

Published

11 hours ago

July 11, 2026

Abdul Rahman

Most gold coverage in 2026 has fixated on the price chart — the spectacular run from roughly $2,633 an ounce at the start of the year to fresh record highs above $5,400 by mid-year (Intellectia). That’s a legitimate story. But it’s not the most important one. The more consequential shift is structural, not seasonal: gold has overtaken US Treasuries as the largest share of global central bank reserves for the first time in three decades (BlackRock).

That’s not a headline about a commodity rally. It’s a headline about the architecture of the global monetary system quietly shifting under everyone’s feet.

The Trigger Most Coverage Undersells

The pivotal moment behind this shift traces back to 2022, when roughly $300 billion of Russian central bank foreign exchange reserves were frozen as part of international sanctions following the invasion of Ukraine (ISA Bullion). For reserve managers around the world — not just in Russia — that event functioned as a wake-up call: dollar-denominated assets held abroad are not unconditionally safe from geopolitical sanctions risk. Gold, by contrast, carries no counterparty risk; nobody can freeze a gold bar sitting in a country’s own vault.

That single realization has reshaped reserve management strategy globally. Central bank gold purchases averaged 225 tonnes per quarter between 2021 and 2025 — roughly double the pace seen from 2016 to 2020 (J.P. Morgan Global Research). BRICS+ nations now hold 17.4% of global gold reserves, up sharply from just 11.2% in 2019 (ISA Bullion).

Who’s Actually Buying, and Why the List Matters

Poland has been the standout accumulator, adding 20.2 tonnes in February 2026 alone, another 11.2 tonnes in March, and 14 tonnes in April — extending a rapid buildup that has added more than 360 tonnes to its reserves since 2023 (BestBrokers). China’s central bank maintained consecutive monthly gold purchases for 19 straight months through May 2026, even though much of this buying goes officially unreported to the IMF — analysts widely believe the People’s Bank of China continues accumulating gold “off the books” (ISA Bullion).

China’s motivation appears explicitly strategic rather than opportunistic. Chinese net gold imports jumped to 317 tonnes in the first quarter of 2026 alone — nearly triple the prior quarter — while the People’s Bank of China’s own reported purchases accelerated from roughly one tonne per month through February to eight tonnes in April (J.P. Morgan Global Research). J.P. Morgan’s own analysts frame this as part of a long-term Chinese project to build gold reserves as a foundation for establishing the renminbi as a credible alternative reserve currency.

A World Gold Council survey found a striking 95% of central banks expect to increase their gold holdings in 2026, up from 81% in 2024 and just 52% in 2021 — a trajectory showing accelerating, not plateauing, institutional conviction (BlackRock).

The Part of the Story Most Coverage Misses: Not Everyone Is Buying

Here’s an angle that gets consistently underplayed: this isn’t a uniform global stampede into gold. Several countries, including Singapore, Jordan, Mexico, and the Solomon Islands, actually reduced their gold reserves in 2025 — Singapore in particular emerged as a notable seller, likely driven by portfolio rebalancing decisions and a desire to realize gains after gold’s historic surge, rather than any lack of confidence in the metal (BestBrokers). Germany, for its part, has reduced its gold holdings every year since at least 2002, though its 2024 sale of just 1.1 tonnes was the smallest annual reduction on record.

This nuance matters for anyone trying to build a genuinely accurate picture: the de-dollarization and gold-accumulation trend is heavily concentrated among specific emerging-market and non-aligned economies — not a universal central bank consensus. Understanding which countries are buying and why is more analytically useful than simply citing an aggregate global purchasing figure.

Where Forecasts Diverge — And Why the Spread Is So Wide

Institutional price forecasts for gold currently show a genuinely unusual spread. J.P. Morgan projects gold reaching $6,000 an ounce by the end of 2026, and potentially $6,300 by the end of 2027 (J.P. Morgan Global Research). Morgan Stanley’s more conservative 2026 forecast sits at $4,400 an ounce (Morgan Stanley), while State Street projects a range of $4,750 to $5,500, and DWS targets $5,400 by mid-2027 (Discovery Alert).

A spread exceeding $1,500 per ounce between the most bullish and most conservative institutional forecasts reflects a genuine, unresolved analytical disagreement — not just differing house styles. The bull case rests on the idea that central bank reserve diversification represents a structural, policy-level shift rather than opportunistic market timing, making it fundamentally different from prior gold cycles driven mainly by retail or momentum investors. The more cautious case notes that gold’s roughly 245% rally from September 2022 to January 2026 is the largest percentage advance in modern gold market history — and historically, rallies of that magnitude have eventually triggered significant, multi-year corrections (Discovery Alert).

The Under-Discussed New Buyer: Stablecoin Issuers

One of the least-covered developments in this entire gold story is the emergence of stablecoin issuers as a genuinely new category of gold demand. As crypto markets have matured, some stablecoin issuers have begun holding gold as part of their reserve backing strategy — a development BlackRock specifically flags as part of the “early stages” of a new demand wave that also includes central banks and the broader AI infrastructure buildout’s effect on institutional portfolio hedging behavior (BlackRock).

What This Means for Different Audiences

For everyday investors: Gold ETPs still make up only about 0.17% of total US private financial assets, remaining well below prior peaks seen in the early 2010s, while private wealth gold allocations globally sit roughly 50% below levels seen a decade ago (BlackRock). That suggests meaningful room for incremental Western retail and institutional demand to grow, even after the current rally, if the structural de-dollarization narrative continues to gain mainstream acceptance.

For businesses managing currency exposure: The scale and persistence of central bank gold buying is one of several signals (alongside Fed communication policy changes and fiscal deficit concerns) suggesting continued structural pressure on the US dollar’s long-term reserve currency dominance — a trend worth factoring into multi-year currency hedging strategies rather than treating as a short-term news cycle.

For portfolio allocators: The unusually wide spread between institutional forecasts is itself useful information — it suggests treating any single gold price target as a scenario input rather than a confident base case, and sizing gold allocations based on its role as a portfolio diversifier and inflation/geopolitical hedge rather than as a directional price bet.

The Bottom Line

The gold price chart is the story most people are watching. The reserve-composition shift is the story that actually matters for the long-term structure of global finance. Gold surpassing US Treasuries as the largest share of central bank reserves for the first time since 1996 is a genuinely historic threshold — one triggered specifically by the 2022 Russian asset freeze and now sustained by a broad, if uneven, cohort of emerging-market central banks pursuing deliberate de-dollarization strategies. Whether the price keeps climbing toward J.P. Morgan’s $6,000 target or cools toward Morgan Stanley’s more conservative range matters less, in the long run, than the structural fact that the world’s reserve managers have permanently changed how they think about gold’s role in the global financial system.