A data-center real estate investment trust is not simply a landlord collecting rent on a warehouse. It owns or finances specialized buildings, electrical infrastructure, cooling systems, land, and development rights. AI demand can make those assets more valuable, but it can also make them more expensive and more concentrated.

The central analytical mistake is to treat a signed AI lease as the same thing as a stabilized, cash-producing property. The lease may be for future capacity. The building may still need power, construction, and tenant equipment. The tenant may have termination rights, expansion options, or conditions that shift risk back to the landlord.

What an AI lease pays for

Traditional colocation leases often charge for dedicated power, space, connectivity, and operating services. An AI lease can require much higher power density, liquid-cooling infrastructure, network capacity, and construction work.

The landlord may fund a shell, electrical plant, cooling distribution, and tenant improvements. The tenant may fund servers and specialized equipment. The contract should say who pays for transformers, generators, coolant loops, repairs, taxes, insurance, and upgrades.

Rent can be quoted by kilowatt, cabinet, square foot, or a combination. A quoted price per kilowatt is not comparable across leases unless the reader knows whether it includes power, cooling, cross-connects, taxes, and operating expenses.

Contracted capacity is not the same as energized capacity

An AI tenant can contract for 100 MW and initially use only 20 MW. The remaining capacity may be scheduled for later phases, subject to utility delivery and construction.

The analyst should separate signed capacity, commenced leases, rent-bearing capacity, energized capacity, and occupied IT load. Each step reduces risk. A property may have attractive contracted demand but little current cash flow if the tenant has not accepted the space.

Digital Realty’s 2025 annual filing describes customer lease payments, operating leases, and arrangements involving data centers contributed to funds. It also notes that many leases reimburse the landlord for some property operating expenses and real estate taxes. That reimbursement structure matters because rising power and maintenance costs may be passed through or absorbed depending on the contract.

Tenant quality and concentration

Hyperscalers offer strong credit, but a lease to a single large customer can create concentration risk. If one tenant controls a large share of a building’s power, a delay or redesign can affect the development schedule.

The contract’s term is only one part of the story. Analyze rent escalators, renewal rights, early termination provisions, security deposits, parent guarantees, expansion options, and the tenant’s ability to defer phases.

A long lease with a creditworthy tenant can support financing. It does not eliminate construction or power risk. The REIT still has to deliver the facility at the agreed specifications and schedule.

AI changes the cost base

High-density AI rooms need more electrical distribution, cooling, and maintenance than conventional cabinets. Liquid cooling adds valves, pumps, heat exchangers, controls, leak detection, and service procedures. Electrical equipment may be oversized to support redundancy and rapid load growth.

The property owner must earn a return on that capital. A lease with a high dollar-per-kilowatt rate may still be unattractive if the landlord spends too much per delivered megawatt or bears the cost of future density upgrades.

The best underwriting shows total development cost per energized megawatt, stabilized rent, operating expense recovery, construction period, financing cost, and tenant-funded equipment. It also shows what happens if the building is delivered six or twelve months late.

Backlog can be a useful but imperfect signal

REITs often report bookings, backlog, leasing activity, or development pipeline. These indicators show demand, but they are not all revenue. A backlog may include options or future phases, and a pipeline may include land that has no utility approval.

Read the definition carefully. Is backlog signed and binding? Is it subject to conditions? Is it counted in megawatts, revenue, or square feet? Does it include contracts that begin in future years?

The most valuable evidence is conversion: signed leases becoming rent commencement, rent commencement becoming occupancy, and occupancy becoming recurring cash flow.

Power is the asset behind the building

A data-center REIT can own a fine building that is commercially stranded if the utility cannot deliver the contracted load. The investor should inspect substation status, interconnection agreements, transformer procurement, utility milestones, and the site’s ability to operate at the promised density.

That is why AI real estate analysis needs an infrastructure lens. The competitive property is not the one with the biggest rendering. It is the one with deliverable power, appropriate cooling, credible tenants, and a lease that allocates risk clearly.

A lease can also change the landlord’s financing profile. If the tenant pays for improvements, the owner may reduce upfront capital but give up some control over future reuse. If the owner funds the full electrical and cooling plant, it may earn a larger return but carry more construction and residual-value risk. The contract should identify acceptance tests, liquidated damages, expansion deadlines, and the treatment of unused power. These clauses determine whether a signed lease is a durable asset or an expensive reservation.

The tenant may also request a future-density option. That option is valuable only if the landlord has enough electrical and cooling headroom to honor it. A good lease records the upgrade trigger, the cost allocation, the delivery date, and the consequences if the utility cannot supply the added load. Without those details, future capacity is an aspiration rather than contracted infrastructure.

That is why lease quality should be tested against milestones, not labels. “AI-ready” is only useful when it means power, cooling, and acceptance criteria have been demonstrated.

When a cloud company raises capex guidance, the headline number often travels farther than the explanation. Investors, suppliers, and data-center developers want to know whether the increase means more servers, more buildings, more leases, or simply a faster payment schedule.

The answer is usually a combination. Hyperscaler capex can include servers, networking, land, building construction, power equipment, data-center fit-outs, and facilities that will not be placed in service for months or years. A good reader separates spending from capacity, capacity from revenue, and revenue from cash return.

Start with the filing, not the headline

Public companies describe capital expenditures in quarterly releases, earnings calls, 10-Q filings, and annual reports. The filing is the best place to find the accounting definition and timing.

Alphabet said in its 2025 second-quarter results that it was increasing 2025 capex to approximately $85 billion. Its filing also explained that technical infrastructure includes servers and network equipment as well as data-center land and buildings, and that the period from purchase to placement in service can extend from months to years.

Meta reported $69.69 billion of property and equipment purchases in 2025 and expected approximately $115 billion to $135 billion of 2026 capital expenditures for AI and core business. Alphabet’s 2025 annual report later reported $91.4 billion in capital expenditures, primarily technical infrastructure. These numbers are large, but they do not map one-for-one to energized megawatts.

Guidance is a range with conditions

Companies usually provide a range or a directional statement. The range expresses management’s current plan under assumptions about demand, supply, product road maps, and construction timing.

The number can change because a chip shipment moves from one quarter to another, a project is delayed, a lease is signed, or a new customer demand forecast changes. A higher capex figure is not automatically bullish. It may signal strong demand, but it can also signal an expensive race to stay current.

The reader should record the date of the guidance, the fiscal period it covers, and whether it is a new plan or an update to a prior one. Comparing a 2026 annual range with a 2025 nine-month spending total without matching periods creates false precision.

Capex has at least four buckets

The first bucket is compute hardware: GPUs, custom accelerators, CPUs, memory, and servers. The second is networking and storage: switches, optics, storage systems, and interconnects. The third is site infrastructure: land, buildings, electrical systems, cooling, generators, and security. The fourth is lease and construction commitments that may not yet appear as current-period property purchases.

The accounting can blur the operating picture. A company may purchase equipment before it is installed. A building may be under construction while rent or interest is recorded separately. A lease may create future payment obligations even when the related capacity is not energized.

Alphabet disclosed $23.9 billion of future lease payments primarily related to data centers that had not yet commenced as of June 30, 2025. That is useful evidence of commitments, but it is not equivalent to current operating revenue.

What the guidance says about suppliers

Capex guidance is a demand signal for equipment makers, contractors, utilities, and landlords. But the signal passes through lead times. A server purchase can turn into near-term revenue for a manufacturer. A substation, transformer, or power plant may not create revenue or capacity for years.

The backlog question is therefore separate. A supplier can report orders that are contractually committed but not yet shipped. A cloud company can guide to more capex while equipment remains constrained. Conversely, a supplier can have a full order book while a customer delays the data center where the equipment was meant to operate.

Use physical milestones as a check

The strongest cross-checks are power and construction milestones: land acquired, permits issued, utility interconnection accepted, substation ordered, building topped out, switchgear installed, commissioning started, and racks energized.

A company may spend billions and still have less available compute than investors expect if power and facilities lag. The reverse can also happen: a leased building may be ready while accelerator supply is late.

Look at returns, not only growth

The final question is whether the spending creates productive capacity. Watch revenue growth, cloud backlog, utilization, gross margins, depreciation, power costs, and the useful life of the equipment.

Capex guidance is best used as a map of management’s intent. It becomes an investment thesis only when paired with evidence that hardware, power, buildings, customers, and software are arriving on compatible schedules.

There is a second timing issue: depreciation starts when equipment is placed in service, not when the headline announcement is made. If a company buys accelerators early but cannot energize the building, it may carry inventory, construction, and financing costs before the assets contribute revenue. If it delays purchases until power is ready, it may miss a product cycle. Management’s capex guidance is therefore also a statement about risk tolerance across procurement and construction. Investors should compare guidance with the company’s stated depreciation outlook, lease commitments, and expected capacity additions.

Guidance can also be compared with cash flow. A company may fund capex from operating cash, debt, equity, or a mix. Rising spending paired with strong operating cash flow is different from rising spending paired with heavy borrowing. The balance sheet does not determine whether AI investment succeeds, but it determines how long management can sustain a capacity race before returns must appear.

One final check is the difference between a spending plan and a capacity plan. Management can guide to $100 billion of capex while a smaller amount of equipment is installed and usable in the near term. The gap is not necessarily a problem; it is the normal timing of construction. It becomes a problem when valuation assumes all spending is immediately productive.

Late on Thursday, October 29, 2026, money started leaving Binance. Not a little. Blockchain forensics firm TRM Labs says an attacker moved roughly $6.36 billion out of Binance wallets on ten blockchains, most of it in about twenty minutes. By Friday morning the world’s largest cryptocurrency exchange had suspended deposits and withdrawals, three separate analytics firms had pointed at North Korea, and the industry was in a race to freeze whatever it could before the money disappeared into mixers and over-the-counter desks.

It is, by a wide margin, the largest theft in the history of digital assets. The previous record, the $1.5 billion taken from Bybit in February 2025, is now a footnote at roughly a quarter of the size.

What happened, as far as anyone knows

Binance’s first statement, posted late Thursday, said an initial investigation pointed to an engineer’s laptop. Access to that machine let the attacker reach a service container and submit unauthorized withdrawal transactions. By Friday the company said its investigation had found additional points of breach, which is a careful way of saying the laptop was a door, not the whole story.

Mark Karpeles, who ran the Mt. Gox exchange before its 2014 collapse, told Reuters the attackers most likely obtained signing keys for at least two Binance wallets. That squares with what the forensics firms describe: signatures gathered in advance, staging that began well before the theft, and then everything executed in a single burst. Funds left wallets on Ethereum, Bitcoin, Tron, Solana, the XRP Ledger and others at nearly the same moment.

Binance CEO Richard Teng said the company’s technology and security teams were still deep in the investigation on Friday. Changpeng Zhao, the co-founder who stepped down as CEO in 2023, said he expected user funds to be protected.

Who did it

TRM Labs attributes the attack, with what it calls high confidence, to TraderTraitor, a North Korean state-sponsored unit that focuses almost entirely on stealing cryptocurrency from large companies and exchanges. Chainalysis reached the same conclusion independently. Elliptic noted that some of the stolen funds landed in a wallet used in a $351 million attack on the exchange Bitget earlier this year.

The pattern matters because it is a pattern. The FBI named the same group for the Bybit theft. TRM points to a KelpDAO hack in April 2026 with matching fingerprints: small Tornado Cash withdrawals used to fund an operator wallet, long preparation, then a fast exit. North Korea has been running this playbook since at least 2017, when its hackers hit four South Korean exchanges. Chainalysis and Elliptic estimate the regime’s hackers had stolen around $6 billion in total from 2017 through 2025. In one night they roughly doubled it.

How much is actually gone

Less than the headline, and this is the part worth watching. Security researchers say about half the stolen value was frozen as it moved across chains, because issuers of stablecoins and other centrally controlled tokens can and did blacklist addresses in real time. Binance said Friday it had begun recovering affected assets and was working with law enforcement and the forensics firms to trace more.

The other half is the hard part. Bitcoin and Ether cannot be frozen by an issuer. The attackers will try to split it, mix it, bridge it and eventually convert it through over-the-counter brokers in jurisdictions that do not ask questions. That process took the Bybit thieves weeks, and a large share of that money was never recovered.

What this means for exchanges, custody and the people who use them

Three things, in order of how directly they touch you.

Not your keys, not your coins, again. Every large exchange theft produces the same lesson and most people ignore it because exchanges are convenient. Assets you leave on a platform are an unsecured claim on that platform. Binance says user funds are safe, and its size makes that plausible, but the statement is a promise from a company, not a property of the asset.

Insurance will not save anyone. Most crime and cyber policies exclude stolen cryptocurrency outright. Crypto-specific coverage exists but is small, expensive and written by a handful of specialist underwriters. Exchanges self-insure through reserve funds, and a reserve fund sized for a $100 million incident is not sized for $6 billion.

The attack surface was a person, not a protocol. This was not a flaw in a blockchain. It was a compromised employee device, obtained signing keys and an internal service that trusted them. That is a corporate security failure of the kind that hits banks, hospitals and defense contractors, and it will push exchanges toward the same controls those industries adopted after their own breaches: hardware-isolated signing, multi-party approval with human delays, and treating every engineer’s laptop as hostile.

The BOSSTOX view

We cover the AI build-out: power, cooling, chips, networks and the capital behind them. This story belongs here for a simple reason. Both industries are racing to move enormous value through systems built faster than they have been hardened, and both are discovering that the weakest component is almost always operational, not technical. The forensics and security firms that traced this money in real time, TRM, Chainalysis, Elliptic and their peers, are the picks-and-shovels of digital finance in the same way the cooling and power companies are for AI. When the headline is a disaster, the quiet businesses that make the disaster survivable are where the durable demand sits.

Hackers stole roughly $2.7 billion in crypto across all of 2025, according to TRM’s 2026 Crypto Crime Report. One exchange lost more than twice that in a single evening. Whatever you believe about digital assets, the arithmetic of this week deserves your attention.

BOSSTOX publishes research and explainers. Nothing here is investment advice. Figures are drawn from public statements by Binance and from TRM Labs, Chainalysis and Elliptic as reported October 30–31, 2026, and may change as the investigation continues.