The Hard Sell

Read now

IRC Legal Business Brief — Block No. 10: The Hard Sell

Date:

August 6, 2026

Author:

Ian R. Cohen

Founder & Principal Attorney

Block No. 10 - The Hard Sell

Nobody is coming to build your business for you. Nobody is coming to secure your AI stack, hold your keys, or hand you a playbook. This week I’m writing about what it actually looks like to do it all, from picking a credit card to protecting 3.8 million BTC in a New York courtroom.

Business - The Tedious Stuff

I’ve closed over 500 deals. I’ve guided companies through formation, fundraises, acquisitions, and exits. I’ve sat across the table from PE firms, strategic acquirers, and founders who had no idea what they were signing.

None of that prepared me for picking a business credit card.

When you launch a firm, or any business, the work that matters most in the first six months has almost nothing to do with your core craft. It’s bank accounts. It’s comparing merchant processors so you can actually get paid. It’s finding office space that doesn’t require a five-year lease when you’re six months in. It’s configuring books, choosing an entity structure, registering with the state bar, securing insurance coverage, and figuring out which expenses hit this month versus next quarter.

It’s tedious. It’s necessary. And nobody is going to do it for you.

Having built businesses before doesn’t make the grind easier. It makes you more honest about what’s coming. IRC Legal is moving fast. Clients are landing, deals are closing, and the pipeline is building. But every business faces this same foundational grind. The difference is whether you respect it or try to skip it.

I respect it. And if you know someone who needs a deal lawyer who’s sat on both sides of the table and actively building a business, tell them to call me. I pick up the phone.

AI - The Machines Are Getting Out

Two stories this summer should have your attention.

OpenAI disclosed that a rogue AI agent escaped its sealed evaluation environment, broke into Hugging Face’s production systems, and compromised multiple third-party accounts. It wasn’t instructed to do any of this. It found its way out on its own. Hugging Face used an “open” Chinese model to defend itself, continuing the debate about whether to place limits on AI or let it cook.
Thousands of Instagram accounts were hijacked over several months because people figured out how to abuse Meta’s own AI chatbot to reset account passwords. The exploit went unnoticed until word started leaking online. Months of account takeovers, powered by a chatbot that was supposed to help you recover your account, not hand it to someone else.

AI-enabled attacks are up 89% year-over-year. A threat actor using AI tools compromised over 600 firewalls across 55 countries with almost no ongoing human input.

I’ve said it before: AI is a performance-enhancing drug. But performance-enhancing drugs have side effects. The tools are getting more powerful, more autonomous, and more unpredictable. If you’re integrating AI into your workflows, good. You should be. But you are responsible for what you plug into your operations. Audit the access. Read the terms. Know where your data goes. Nobody is going to monitor your stack for you.

The companies building these tools are still figuring out how to contain them. That’s not a reason to stop using AI. It’s a reason to take ownership of how you use it.

Bitcoin - Your Keys, Your Responsibility

The Coldcard hack is in the news, but you may not have heard of it. Roughly $130 million in Bitcoin drained from 7,300 addresses across multiple attack waves starting July 30th. The cause: a firmware bug dating back to March 2021 that routed seed generation to a weak software pseudorandom number generator instead of the hardware RNG.

This was not a Bitcoin failure. The protocol is fine. The blockchain is fine. This was a five-year-old firmware mistake that sat undetected until attackers found it.

Self-custody is still the way. But self-custody is a responsibility, not a set-it-and-forget-it solution. You chose to hold your own keys. That means you own the security and maintenance too. Check your firmware. If you generated a seed on affected Coldcard firmware, migrate your funds to a new seed on patched hardware. Don’t wait.

And don’t let this scare you into handing your keys to a custodian. The whole point of Bitcoin is that you control your money. A firmware bug on one device doesn’t change the math. 21 million. No counterparty risk on the protocol level. No middleman deciding whether you can access your own property.

I run my own firm. I secure my own tools. I hold my own keys. The responsibility is the point.

IRC - The Life and Times

If you’ve been following the Noah Doe case, the lawsuit seeking to claim 3.8 million dormant BTC under New York’s lost property statute, you know I filed an amicus brief back in May. I argued that the legal theory was baseless, that the statute covers tangible property, not blockchain addresses, and that inactivity doesn’t equal abandonment.

The court initially stayed proceedings after my filing. Then Noah Doe’s attorney moved to deny my amicus standing and lift the stay. The court denied the amicus request, though the stay remains in place ahead of the September 8th hearing. The Digital Chamber and the Bitcoin Policy Institute have both since filed their own amicus briefs reinforcing these arguments. That’s encouraging. This fight isn’t over, and I’m evaluating next steps.

On a different note, I’ll be joining BeyondCPG as a mentor this fall. BeyondCPG is a premier accelerator for emerging consumer packaged goods brands. I’ll be working with growing CPG companies, bringing my business and legal experience to help founders scale their brands. More on that in the fall.

Nobody handed me a playbook. Nobody is handing them one either. That’s why I’m in the room and keep showing up. I’ll keep trying to figure it out and help others do the same.