Bitcoin is close to becoming worthless.

Now what's the Bitcoin? Bitcoin's like rat poison. Yeah. Oh. The greatest scam in history. Let's get it. Bitcoin will go to fucking zero.

Welcome back to the Bitcoin Brief, the show where me and q and a talk about Bitcoin, privacy, open source, keeping your Bitcoin secure, and the news and software updates that matter. I just wanted to say a mass thank you to everyone who's been supporting Ungovernable Misfits, and a big thank you to Foundation

for supporting the show. If you haven't already checked them out, go to foundation.xyzed. They make cypherpunk tools for fuckwits,

and anyone can use this, even me. If you have any questions or you want to reach out, feel free, and I'll be happy to go through things with you. For anything super technical, I'll pass you on to queue. If you wanna buy one of these incredible passports, use the code ungovernable.

It will get you a discount, and it will let them know that I'm shilling. I'd also like to say a huge thank you to the Cake Wallet team. Not only are they supporting this show, but they're also bringing out some incredible features.

For those of you who actually use Bitcoin and actually care about their privacy and security, Cake Wallet make it incredibly simple for you to live outside of the traditional financial system.

You can use CakePay within the app to buy gift cards for food, petrol, and whatever else you might need day to day. You can use silent payments, and, of course, you can use Monero. You can connect both Bitcoin and Monero nodes, use coin control, and this team are constantly innovating.

And I'm really excited to be working with them. If you have any questions, you can reach out to me, but check them out at cakewallet.com. Download the APK or start using this today on Mac, Windows, Linux, iPhone, or, of course, your Android device.

Enjoy the show.

Hello. Good morning, and welcome back to the Bitcoin Brief, a live and interactive show taking place every Monday at 9AM eastern or 2PM UK time across the ungovernable network. Each week, we go through the news, the releases, and the developments that actually matter in Bitcoin.

This includes, of course, self custody, privacy, the tools you run yourself, and the people that are trying to make all of that harder. If it affects your ability to hold and spend your own money without asking permission, then we wanna talk about it.

This show and the topics we cover are powered by freedom.tech, a daily news desk that uses AI to monitor hundreds of sources so we can continue to bring you the signal each and every week.

We'd love to have you help steer the conversation by commenting live, asking questions, boosting the show, or just sharing it with your friends. My name is Q and A. I'm head of customer experience at Foundation. And as always, I am joined by my good friend Max, the headhunt show over at the Ungovernable Network.

Max, it's been it's been a week. How are you, mate? It's not been a week. It's been a fucking three months or whatever it's been. It's been absolutely

mental. Before we get into our mental layers, I wonder whether your mic has switched to your laptop mic or something because our pre show chat was better quality than our current chat. It's a little bit robotic.

Don't know whether it might have switched or something. Just messing around with it now. Test test one two. How is that now? It's better. Yeah. Yeah. Yeah. Yeah. You're good now. Yeah. We're good now.

Yeah. So, yeah, back to the the equation. I I don't even know what to say anymore. I'd like... I... We're gonna... I think we're gonna have to, in today's episode, be a bit less news heavy and update heavy and just get to the fundamentals of, like, holding your own coins because forever, it's been,

you know, get your coins off extra... Exchange. Like, if you're not holding your own coins, you... You're a fucking retard. And Mhmm. This last three months hasn't made me rethink that in any way. Like, if you if you don't hold your coins, you don't own them. It's as simple as that. But if you get hacked, you also don't fucking own them.

So I think people have to be treading really carefully. We both know smart people who have been in the space for a long time, some of them longer than us, who have been affected over the last few months. And

it's not a simple case now these days of, like, being like, oh, they were just a fucking retard. Like, they did something really stupid. They they went on Telegram, and they put their seed words in there, like, to send to some attacker because they told them that they're gonna inherit some money from a Nigerian prince.

It's not that sort of shit anymore. It's like... It's bad. It's scary. It's like, I'm... You know you know I'm not the most technical person. I'm a bit like, fuck it. Oh, alright. Okay.

Yeah. Yeah. It's... The landscape's changed, and and I think... Well, we'll we'll dive into it when we cover off the the headline article about ledger very shortly. My my general advice has been drifting one way,

and this weekend seems to be the the straw that broke the camel's back for me to, you know, lean even more heavily into that. We will get into that in a second. We've already got some spicy comments coming through from from YouTube.

Norman Wilson, basically saying that multi vendor, multi sig, I think he's trying to shit on it. He said it's... There he is. He's saying multi vendor, sig at this point is just dipping your toes into shit. You can't trust any hardware wallet company. Generic hardware is the future. I don't necessarily disagree

with what he's saying to some extent. You know, the multis... The multivendor... We're gonna get into this properly. But the multivendor multisig thing is the whole point is that if if one breaks your trust or there's some some issue in that process of getting it from

the the hardware wallet being created to actually it being in your hands, then you hope that the other two or the other four or however you have it set up are not. Putting full trust in one device, obviously bad.

But any device, even if it's not actually a hardware hardware device, generic shit can be attacked as well. So Yep. It's it's not as simple as that, but I get his point. I don't think he's just being a dick. Like, I actually don't fully disagree with what he's saying.

Yeah. Good morning to to people in the livestream, by the way. Good morning, Bon. Good morning, Russell, and good morning, Norman. Yeah. We'd love to get your takes when we when we do dive into this. But just a quick bit of AOB before we hit the news for me.

KeyOS version one point four point one has been released, and the amateur in me has not got the not got the show note... The blog notes up for that one. So I'll let you fill and call me an idiot. Maybe press some buttons for for just a second.

Yeah. Okay. What about let's talk about why I left The UK. It's got too many mingle.

Oh, that's the best reason to leave The UK. Thank you for filling. I... Yeah. So QoS Vision one point four point one maintenance release. The reason it wasn't at foot... Front and center in my brain was because it is a small maintenance release.

We've just got some battery related fixes, some crash related fixes, just general quality of life improvements that under normal circumstances you you kind of won't kind of even notice as long as your device is functioning properly.

Main one is much speedier firmware updates as well. So make sure to update to that whenever it becomes a a full main release. I don't know whether I said at the top of the show, but it's it's out in public beta right now. And by the end of this week, we'll be we'll be as a public release if there's no showstoppers.

And we also have key... Sorry, Passport Core version 2.4. It go through internal beta testing, not public yet. But I wanted to mention it because this is the, well, it's a big release because it's been cooking for ages and some of it's been on the back burner with passport primers, the main focus.

Mini script mini script is coming guys. And that's very Oh. Very topical after what we're gonna be talking about today. So

just wanted to highlight it. I I've been teasing up my socials with some videos and stuff over the past month or so. But yeah, it's going through internal QA right now. And again, depending on how the internal QA goes,

we should hopefully have a public beta out in the next one to two weeks. Again, as long as we don't find any showstoppers internally. So very topical, very timely, and, yeah, looking forward to that one. Outside of that, for me, AOB prepping for Freedom Fest UK. Don't forget if you'll come into that, it's in Manchester

in November, you can use code on GovernaBall for a discounted ticket. We do not earn any money for you using that code. And I'll... Well, stop fucking chilling it then. If you're not earning money, we're not interested. Yeah. We're that, Nathan. And also

prepping for for Amsterdam as well. I'm heading out there in November for the the the big kind of European version of the the Bitcoin Magazine conference, where I will be doing a talk

on Oh. Human authority hardware. I'm actually doing the same one at both. So if you can't make make it to Amsterdam and you're a Brit or... Well, even if you're not a Brit, try and get out to Freedom Fest and you you can hear me do the the talk about human authority hardware.

A little teaser, basically, the clue is that securing your Bitcoin just isn't enough these days. We live our lives online, and we can do better elsewhere, and we should. Yeah. What about you, mate? What you've been what you've up to?

Nothing that interesting, mate. Nothing at all. We're done. It's always the same, really. Just fucking fixing shit at the house, basically, covered in dust and just grimy little bastard, and then I just shower myself off for the Monday and Friday shows, and that's it.

That's it. That's it, honestly. Yeah. Okay. Fair enough. Well, keep the comments coming, guys. I love to see a a really active live chat even if it is calling us out or calling other people out. But this is gonna be an interesting topic, so I'm keen to get all the conflicting opinions out there. So keep coming. Keep coming at us.

Right. Let's hit the headlines, shall we? I'm sure we're probably gonna spend most of the show on this one. So over the weekend,

there has been compromise of many ledger hardware wallets to the tune of an estimated $93,000,000 that have been drained across six different blockchains from people who thought they were nice and safe in self custody with an offline wallet, a ledger.

Unfortunately, on the October 9, hundreds of wallets belonging to ledger customers generally in the Southeast Asia area were emptied within minutes of one another. At around 5AM, the drains of several of these wallets hit the Tron chain, BNB, the Binance chain, Polygon, Ethereum,

all within seconds of each other. And then Solana followed around half an hour later, and also 111 Bitcoin wallets were also emptied within a single block. On chain analysis by BitQuery also shows test transfers that date back to the September 26, indicating that this might have been planned for quite some time.

Every victim that's fallen prey to this has bought their device from a ledger authorized reseller called Crypto Billis, who is based in Malaysia, but they also service Indonesia and The Philippines as well.

At half twelve on the... An on chain investigator who goes by Spectre posted the first collection addresses and an estimate of more than $86,000,000 got missing. Shortly thereafter, Ledger support account said it was investigating

and that it had told Crypto Billis, the reseller, to pause all sales and shipments And that anybody who bought from it in the last ninety days should not set up a device that they hadn't yet used.

Meanwhile, Tether froze around $10,000,000 of the stolen USDT across 37 addresses on the very same day. What else have we got? On on the October 10, Ledger came out and confirmed that a quote, unauthorized hardware implant inside an effect that users device. And that was the cause of the theft.

That afternoon, Crypto Billis, the reseller suspended all hardware while it's sales in all three countries and closed its stores. The day after on the October 11, Ledger's seventy two hour update said that the number of affected devices is limited and that every confirmed case can be traced back to crypto billless device

from from the reseller. And that... Just... And the... Sorry. Before we go... Before we move on, just one... Wondering. This USDT 10,000,000 that's frozen, is that that they have stolen the USDT that is stored on Ledger, or is it that they've swapped into USDT and then it's been frozen?

It's not confirmed either way. I've... It says it's across multiple chains, so I'm guessing that probably the Tether has been stolen, not... Rather than it's been swapped into it. Because if you are the person behind this... It'd be a result of it. Well, yeah, you know that Tether is a centralized mess. So, like, taking your...

Would be dumb. Yeah. Exactly. Yeah. That's why I just... That's why I wondered. I was like, if you... If you're smart enough... I mean, and let me just add, cunty enough to do what you've done Mhmm. Then you should probably not be stupid enough to put into USDT, but I just wondered.

Yeah. So continuing down the the timeline, how much was taken depends on who's counted. Some people are saying 86,000,000, some people are saying 93,000,000 from 315 wallets across six chains.

But, obviously, this is still unfolding as we we speak. Like, this is only a matter of days old. So that number, you know, we're never gonna get an accurate one. But it's... Yeah. They they could be more.

Ledger, to my knowledge, has not yet described the implant found. But what we know is ironically come from Mark Carpellas, the the former CEO who now runs a hardware lab called Tibane Labs.

He had already taken one apart and he posted some photos on the October 9. He said inside a Ledger Nano X, where the foam padding behind the screen should be, there's a small extra board, a microcontroller with its markings scraped off.

It's a Nordic cellular modem, an eSIM, and a custom antenna. It is it is wired into the lines that carry data to the screen. When the device shows your 24 words during setup, the implant reads them off that connection and sends them out over its own mobile data connection to the attacker.

It never goes anywhere near the secure chip, so the device still passes Ledger's genuine check when you onboard, And Ledger's own security documentation says that the check can't detect this kind of implant.

Carpellers also said that the shrink-wrap that was on his unit was absolutely flawless and there was no indications that this is, you know, not as it rolled out of the factory from from Ledger.

Well, that's the hardest part as well, the shrink-wrap. Forget all the other clever techie stuff and supply chain attack stuff, like actually putting shrink-wrap around a device is is hard. Mhmm.

Yeah. So nobody knows yet who put the implants in. Although there's lots of conjecture around, obviously, people putting fingers at the resell here. I believe the the reseller changed hands only this year.

Right. It's former cofounder Aravind Rabun says that the handover finished in March and registered screenshots, which are obviously yet to be verified, show a single owner with an address somewhere in China.

That started on the August 3. Nobody has yet shown a link between the new owner and the theft, although there seems to be a lot of fingers pointing that way.

Yeah. This is scary. Very, very scary. All of these devices passed the genuine ledger check. There was no indication when it was shipped. You know, when you opened it, it it appeared completely normal.

It passes the genuine check. You go through the onboarding. Everything seems tickety boo. And then there's somebody literally seeing your seed words in real time and just waiting for you to basically deposit some funds before pulling the trigger and sweeping the whole lot.

Yeah. I'm gonna pause for your thoughts, mate, because this this is, like, unprecedented and something that people have theorized around for quite some time in terms of, like, supply chain risk and stuff. But Yeah. We've seen it. It's happening in the real world.

Well, two things. Firstly, I want to jump into the chat and, like, say thank you to people messaging and, you know, have some dialogue with them in a minute as well. And thank you also to expatriotic for your boost. I can't see it now, but one came through. So thank you to everyone in the chat.

The... My thoughts... I don't know. Like, I'm not shocked by this given what's happened over the last couple of months. It seems like everything and anything is slash will be attacked.

It's been nearly a decade we've been in and around Bitcoin and doing these shows and stuff, and this is the craziest few months. We said it literally on Freedom Tech Friday. It was the craziest few months any of us have ever seen. Roy agreed with that.

So everything seems possible.

One funny, but not funny at the same time thing is I was having a conversation, like, two days before this ledger attack with a friend of mine, a little Asian friend, and he absolutely loves ledgers. Like, oh, yeah. With all this cold card stuff and everything that's going on, you know, just use a fucking ledger.

And, you know, now there's this happening, and I hope you're out... You're right out there, mate. I hope it hasn't affected you. But, yeah, it just sort of feels like nothing's really safe.

You know, my thoughts and what I keep saying and boring everyone with is don't keep all your eggs in one basket. Don't keep it all in one asset. Don't keep it all on one device. Don't have just one storage method.

We can get into multisig. We can get into all those kind of things as well. But spreading risk apart from all the, like, technical ways to solve it, just spreading risk is a a very wise thing to do when you don't know when the floor is lava.

Yeah. Absolutely.

Where do I start?

I I would say... Well, as I as I lean to, I think it was before we we started recording. My general advice has been trending towards favoring multisig most of the time, especially in the last six months or so.

And to be clear here, I'm talking about, like, long term storage. I've just seen that. It's that kind of day. It's a Coke Zero, just FYI, BTC Wrestle. Yeah. Yeah. Yeah. Yeah. Of course.

I've been trying this towards multisake for for long term storage of of your Bitcoin. Because it's the only thing that has stood the test of time and and would have survived all of the attacks that we've seen this year, bar none.

Yes. I would be the first person to call myself out to be like, well, you know, this time last year you were saying that it's probably not for everybody. And, yeah, absolutely. I did say that. And the the landscape as we've covered on a weekly basis has significantly shifted now.

And for your larger amounts of funds, I just don't think single sig or even single sig with a passphrase is enough. And the the ledger one is... This ledger attack is is proof of that. And

there there could be some pushback to be like, well, you know, this this isn't a reflection of Ledger themselves because it doesn't originate from their factory, so to speak. This is basically a reseller buying a load of devices, presumably implanting all of the the malicious shit in there and then going from there.

But... And, yes, you can protect yourself by buying direct, and you should always buy direct wherever you can from the manufacturer if you're gonna buy a hardware wallet. But ultimately, I keep coming back full circle. The only thing that would have protected you from all of these attacks is multi vendor, multi sig.

Yeah. The only thing I would... I I agree with all of that. The only thing I would sort of push back on slightly is this idea of multisig being better than a strong pass phrase. And I get that in theory and multivendor and blah blah blah, like, yeah. I get it. But...

And, yes, if you had a strong pass phrase on your ledger device that, you know, been tampered with, it's still gonna call home with whatever you put into this. You're still fucked. But I would say that at least how I see it, a strong passphrase

on a device, especially device maybe you've had for a few years and you've already had funds on and you're pretty confident isn't tampered with, I would say that a strong passphrase... And by a strong passphrase, I do mean, like, strong, not like one two three a b c or something like stupid like that. It's like a proper, like,

six words, 12 words, like, decent thing. Got... I just need take out of pocket now. He's on fire today. He is on fire today. He's had a few cold ones, I reckon. But you know what I'm saying? It's like, it's not so complex, and there's not as many ways to shoot yourself in the foot.

And it is kind of, in my eyes, sort of like a multisig because if you have a very strong passphrase, a, you're not gonna remember it. So someone puts a gun to your head. They're breaking your house. Put a gun to your head. Wash your fucking...

Unlock it. Wash your passphrase if they knew at all. I can't. I need to fly to x country to go and get fucking 12 or 24 words or whatever my passphrase is. I can't do it without. So there's that. And then there's also just the simplicity of it where you aren't having to buy extra hardware,

which is probably more risky now to buy new hardware than it was for stuff you've had for many years or using, yeah, use... Using, like... I don't know. I I just sort of... The multisig thing for me, I get it on a technical basis.

I like things like mini scripts. I like all this clever stuff that's being done. I just think that there is a huge learning curve for people. And I'm not saying you shouldn't have to learn to hold your funds and, yeah, it's hard and it should be in blah blah, all that shit.

But for nontechnical people, I do worry that people rushing into multisig and trying to set something up could fuck themselves. Yes. And I'm glad you walked down that path because I had a bit of back and forth on x last night with a few people around this basic conversation.

You said... And I'm gonna be a bit literal here. I know what you meant really, but I'm gonna spell out for people listening. You said you said it's kinda like multisig. Yes. You've got two things that you need to remember and you need to spend.

And yes, is... In in that sense, it's kinda like multisig, but I would push back and say it's kinda like multisig, but with zero fault tolerance and zero redundancy. You could argue there is fewer moving parts.

But the second thing I was gonna mention is that... And this is the part I was trying to spell out to people on Twitter, you know, the the the usual crowd, the pass phrase maxi crowd.

I have never heard... I've I've been doing Bitcoin support now in an official capacity with foundation for over five years and in an unofficial capacity on Telegram for many, you know, at least two years before that. So I've spoken to quite a few people about about self custody.

And I'm not saying that to kind of pick myself up and think, you know, I am the authority here. But I'm setting the scene here to say, like, I've got a big cross section of what people are good at, what people are bad at, and what normally fucks people over.

Yeah. You've dealt with people of all capabilities.

You've got, like, the complete mongs like me that you've helped over the years, and then you've got more technical people that you still help. So, yeah, I'll I'll give you that. Like, you you have experience in this. And and I set that up to say, the single biggest cause of people losing funds or having a panic thinking they've lost funds

is passphrases by a country mile. And that's... I'm not saying that to say that passphrases in the right hand can't be very secure because that's obviously true.

But people are quick to point fingers at multisig, and I have been one of those people in the past to say too complex. And it is definitely more complex. I ain't gonna hide behind that. But passphrase is done wrong, you can very, very easy fuck yourself over. And I've seen it time and time again where people don't understand the

the implications. They don't understand what fingerprints are. They they don't understand like case sensitive spaces, special characters, blah blah blah. All of the stuff that most people listen to this are familiar with. Yeah.

And you just have zero fault tolerance. So, yeah, my my general advice has shifted. Does that mean that single sig plus passphrase doesn't have a place in, you know, it... Can it be right for some people? Yeah. Absolutely.

A 100%. And that passphrase, if you handle it correctly and store it correctly, can give you some... A very good level of security. But this led you thing was the tipping point to be like, it it wouldn't have protected you here in this specific scenario.

No. It would not. Again, I'm talking about your long term stories. This is this... I'm talking about amounts that you wanna give to your kids. Yes. It's difficult. Yes. You've got more things to look after.

But would it have survived all of these attacks? Yes. Fair. Yeah. Fair. I would also say, like, we shall say on every single show, just do consider not having everything in Bitcoin. I, from a nontechnical perspective, looking at the last few months, am concerned to a point where I think

the way that some of us lived our lives and the advice that some of us have given over the years of be all in. And I'm guilty of this, like, not guilty, but, like, be all in, be a 110 in, put your fucking life savings in, rent, don't buy. Like,

live live in a way that if Bitcoin goes to zero, you are fucked unless you're young and you can earn it back. Like, I I wouldn't give that same advice to myself or people I love and care about at this point. I would say, follow all the guidance queues giving you here, but also, like, just have some things in other assets and don't

don't put all your eggs in one basket here. It's it's fucking scary. Even with multisig, I'm like, oh, okay. Yeah. You know, multisig is what you're advising now. Until what? Until some fucking maths problem maybe, you know, isn't isn't so unsolvable, until there's some random issue that we haven't seen

that... You know, like like with the the liquid stuff, it's like, oh, yeah. You know, you got these these 12 people who have to sign or whatever it was. But it's like... But, no. Actually, it wasn't. It's this other sneaky little cunt side swipe way. And so I don't know. I I... I'm gonna keep saying every single week, please,

if if you see these hacks and if your heart drops through the the MVK stuff and this ledger stuff and whatever else, if you've gone through a point where your heart has dropped and you thought, fuck.

This could be the end. I'm fucked. If you've had that feeling, I think you've got too much money in Bitcoin at the moment. Yeah. Or you haven't practiced, you know, your your your self custody setup is inadequate.

Yep. Yep. Okay. I won't I won't bang on anymore on that. Comment in the chat from from random on x, you said... Just says BitKey. Might be a surprise to most people listening to this, but I think it's a good solution.

I really like their architecture. It makes some trade offs that I am not that happy with personally, but for for a lot of people, I think it's a good first step towards moving away from single sig. But again, you're you're kind of... You're you're putting yourself into a walled garden. And yes, they have the

the break glass APK thing, which we've actually got in the show notes later on to talk about briefly, cause they've got an updated version. But they need to kind of open it up a little bit more and and make themselves more compatible.

And if they can do that whilst keeping their architecture, because it is very noob proof, then I I think it's not bad. And yes, BTC Wrestlelight, you're absolutely right. No privacy is is...

You've hit the nail on the head there. And that's one of the the hard stops for me is that you, you know, you can't really utilize this thing without them seeing all of your UTXOs and stuff, which for... Is a nonstarter for me.

But again, for most people, in terms of keeping their coins safe, they're gonna do much better in that ecosystem than they are, you know, like buying a ledger from a Malaysian reseller or having a cold card or something like that.

So it's... Should we should we also go through some of the other comments in the chat? I don't wanna, like, not answer questions and bits we've had from... I've lost it now. There was people in YouTube sort of talking about...

Well, like, slacking off foundation. I don't wanna shy away from those sort of things because they're a sponsor and you work for them. I think we should be, an open platform. So Yeah. What we see, I'm just scrolling back through the chat now.

I can't see them anymore. Yeah. I'm showing a brand new Raspberry Blitz. Raspberry Blitz. That has been a long time since I've thought about Raspberry Blitz.

Yeah. Good to see that it's still going. Oh, it was Norman saying he doesn't like our foundation is shitting on Chinese hardware world companies. What makes USA made hardware better than Chinese?

I think, again, I don't speak for Zach. He's talking talking about Zach's recent comments, and I don't speak to Zach. He's his own man, but what I can infer from it is that Zach's point is that we

we can be... Well, not can be. We are literally on the the factory floor. Whenever we want, we can just walk in, inspect what's going on. When we do big production runs, we have people who actually work for us, not just people that are, you know, factory operators that we go and oversee operations.

But we... In in fairness, that's not to say that other manufacturers can't, but, you know, if you're a European manufacturer and you're, well, Ledger, for example, and you're getting your your units manufactured by Foxconn in China, then

I know which device I'd rather buy personally. And I think that's the point that Zach is trying to make. But that's not to say that, you know, there aren't other manufacturers that can do this, but we are an American company.

We're proud that we are an American company, that we manufacture in The US, and we literally have boots on the ground to go and inspect stuff whenever we want. Yeah. Fair enough. Was there some other ones in there? Like I said, I can't actually scroll back through this chat anymore. There was another guy.

Oh, set... Same... Oh, no. Different guy. Why would anybody use these hardware wallets? Why not use Bitcoin Core or some offline old phone to keep your keys? Yeah. I mean, Bitcoin Core, obviously, it runs on a laptop. You've gotta know what you're doing to make a laptop secure.

Yes. You can go and rip out the the network cards and all that sort of stuff. But as soon as you start get... You know, diving into that, you've lost 99% of the population. Like, nobody's gonna nobody who's sane is gonna do that. Can you do it and have a secure wallet? Undoubtedly, if you know what you're doing.

Would I recommend it for most people entering Bitcoin? Absolutely not. In terms of the old phone, yeah, it's not a bad... Like, the problem is you have things like the dark sword exploit and things like that where remote exfiltration is possible, no matter how secure the operating system.

And there's documented reports or or findings that, you know, offline doesn't really mean offline depending on the type of phone and the operating system. So yes, again, could you do that in a way that is secure if you know what you're doing, you know, Friday cage and

blah blah blah. Then yay, absolutely. You could you could absolutely do that. But again, you've you've already lost most of the population. And I don't mean that in a sense of

obviously, it's a phone. Everybody knows knows how to use a phone and install a wallet on there. The problem is taking all of the additional mitigations that you need to get the same level of security as a good hardware wallet. That's the point I'm I'm making.

Yeah. Yeah. One thing I'll say, though, is I've not heard of many people being hacked or I think anyone in our circles using a phone. Like, just having a phone wallet, running Ashigaru, running cake, running whatever,

I've not personally heard of any problems. And that... That's not me saying I'd feel more comfortable doing that than using hardware because I don't... You know, I use a bit of everything for the reasons I've covered a billion times now. But I wonder whether there... And I'm sure there is a way to do this multisig where you have

one of the signers being a phone or, like, a couple of them being different phones. I'm sure you used to be able to do that on... Was it BlueWallet you could do that? You could, like, multisig?

Yeah. It's a good solution. So could you could you set up a multisig in Sparrow and have, like, you know, whatever, like, a passport call, a phone running graphene, and... I don't know. I think you said you'd like a Trezza or or a SeedSigner.

Could you do that and have phones rolled into it?

I don't know with Spyro, actually. I think you could probably you could probably hack that in so that BlueWallet could act as one of the signers if you, like, mimicked the mimic the configuration across on Spiral and on BlueWall, then, yeah, absolutely. And and that would be a good way to...

You can work in that kind of generic hardware, but also not put all of your eggs in one basket so that if the phone does get pwned, then it's it's... What's the word I'm looking for?

It's not the curtains because Yeah. Yeah. You know, it's only one of the signers. So yeah, you could do that and you you kinda get in the best of both worlds there where you've got, you know, maybe one or two hardware signers from different vendors, but also one of them is a very easy to use phone application that's free.

Yeah. And there's there's an element there of, like, especially with an old phone. You know what I mean? It's like, well, I know this is generic hardware. I know I've used it for multiple years before I've updated, and

then I run graphene on it. And I'm pretty pretty confident with this thing. You know? I've had mobile wallets on it. It's like, it's pretty good. And then older bits of hardware that you've got, like, you know, passport core, passport primer, a seed signer.

You've got a really nice mix.

Excuse me. Dying. You got a really nice mix there. And I think hardware wise, I'd be like, yeah. I'd be comfortable with that, especially with those ones that I've just mentioned. I think it just still comes down to the complexity of setting these things up. And I'm also

thinking out loud here. I'm kind of like, you know, if I was gonna make a jump to a multisig setup

and there's, like, the stress to go through it and, like, the learning curve to go through it, I kind of feel like I'd want to be using something like the Ana or something where it's got some extra functionality or time locks or things like that that, to me, are a real game changer.

I don't wanna, like, do it twice.

Yeah. That's fair. And I wish stuff like that had a bit more adoption, but, yeah, Bitcoin's slow, and, know, you the self custody side of Bitcoin is is is even slower. It's a it's a good option, but again, there's no perfect solutions because if you... Once you start going into that world,

you then have the other trade offs of, like, you need to be a lot more active with your wallet. Like, gotta do coin rotations every, like, I think it's a year and a half is the maximum time lock and stuff like that. Then you've got the privacy implications of doing that.

So, you know, it's not a panacea. You know, do you, you know, you fix one thing and then you introduce another problem. And

so... Fuck, hilarious. Hello to Orange Surf. Yeah. Nunchuk also great. They they do many script stuff as well. And definite... It's definitely getting easier. There's more and more wallets having it kind of accessible by by default. So it's... And I like a point that we haven't covered yet, and I think a lot of people probably

concerned with this as well, is the privacy implications of using multisig are slightly different to on chain. I think it's something, like, maybe you could walk through and explain to people so they're aware of the differences. And and then I have a rebuttal to, like, a way to flip the way of thinking as well, thanks to black coffee.

Yeah. So I actually think that this is kind of a little bit overblown and and and also mainly for the fact of people who are going to the the trouble of having a two zero three multisig or something like that.

The the... Clearly, primary use case is storing those funds securely for longer term. Like, privacy is less important to those people, generally speaking. I'm making... I'm I'm, you know, using broad strokes here.

The the point that a lot of these... A lot of the private advocates would say is that when you soon... As soon as you deposit into, you know, a different script type, when you spend from those funds, anybody that you spend to, you can see that it's coming from a multisig quorum.

You can easily mitigate that, and I might be stealing your thunder here, Max. But, like, if you just deposit into a Lightning Wallet and then use the Lightning Wallet to spend, then you can mitigate that and have kinda, like, the best of both worlds. No. You're not actually stealing my thunder.

What coffee came up with the... Not the other days. A couple of years ago, I was speaking to him about it. I was like,

yeah. I don't really like this. Obviously, you know, spend would be coming from multisig and there's privacy concerns. You'd be... You put yourself in a smaller pool and, you know, you go through all these extra steps to try and get privacy on Bitcoin, which is fucking hard.

And then you you sort of not ruin it, but you make it worse by doing this. And he was like, yeah. Except that if you have an attacker, you can very simply prove that you are using multisig.

So the example would be someone breaks in, they put a gun to your head, move the fucking funds. You're like, well, I actually can't because I've got a passphrase.

I'll have to fly to this other country to go and get it because I haven't memorized it because it's 24 words or whatever it is, and I can't actually do that. So I can give you what I've got on my mobile wallet. Just don't fucking shoot me, please. But I can't do it. And then what you're doing is you're relying on them believing you.

So you can't prove that you can't access it. Whereas if it's multisig, actually, you can say, look. I can't fucking do it, and here's why. And your chances of getting your kneecaps taken out are maybe slightly less. And I was like, I actually hadn't really thought about it that way.

Yeah. That's fair. Like I say, there's... There there are no panaceas. Like, there are only trade offs, and it's just about you deciding which trade offs you're comfortable with, balance with, you know, your inheritance plan, your next of kin's technical ability, the amount of secure locations you've got, your own technical ability, your

appetite for spending money, you know, if we're talking about buying hardware devices, like, there's so much to think about and there is no right or wrong answer. The only right answer is what works for you that you can comfortably and securely, you know, take care of essentially.

Comment comment from Troy James on YouTube here that says seedless is the way to go. Wallet..files are Yeah. Not for me. Mean, I I don't even know where to begin with that one. Like, thoughts, Max?

But like you said, there... There's no... I guess whatever makes someone sleep well at night. Like... Yeah. I I don't know. Like, I also don't think it's a good idea to judge or, like,

look down on anyone's choices of doing things anymore because I feel like it's just a bit of a fucking random, to some extent, who's gonna get hit next. And, like, he... You know, someone might do something that we don't agree with, and, actually, they're the one that's fine.

And the, like, perfect setup that

we're talking about might suddenly... There'd be some sort of weird critical bug that no one fucking seen coming, and then all the smart all the smart people on Twitter or supposedly smart people on Twitter were the ones using fucking cold card a few months ago. You know? All the shadowy super people, you know, whatever. Yeah.

And it's like, they didn't see that coming. And, like, I'm not I'm not confident on anything. So I don't know. Do whatever makes you feel comfortable. It's not for us to, like, tell people what to do. We're only here to, like, try and work out what's right for us and give options and,

like, just fucking good luck to everyone as this continues and all the attacks continue. Do what you feel comfortable with. Yeah. Absolutely. If if you're comfortable with stripping down a laptop and dealing I think that's all we can say. The Bitcoin Core wallet and saving a wallet dot dot file,

absolutely have at it. But I ain't gonna do it, I'm not gonna recommend it. But if it works for you, it works for you.

Right. Isn't it? Like Yeah. Otherwise, we start to be preachy and we start to, like, be shilling a certain way of doing things. And then if something goes wrong, we're we're the ones in the wrong. Like,

don't put all your wrecks in one basket, please. Mhmm. Yep. Alright. Next on on the list. I'm gonna whisk through these now because we've been we've been going for, like, forty five minutes, and we've only done one. That was the outline anyway. That was... We we intended to spend some time on that one.

As if it couldn't go from... Get much worse for for Callcard and and and our pal MVK, it appears that the Callcard official x account has been compromised. On the October 11, a post carrying official link went out from Coldcard's official x account, which was then deleted.

Coldcard told users not to visit the link and said that coldcard.com is the only official site. The company says it found no matching login or session record, its credentials, and offline two factor authentication remains secure and is asked x support to escalate.

How the post is published is not yet known. Secondary outlets think or say the link pushed the fake seed migration page, which Call Card has not confirmed. No losses have been reported, probably

because all the Call Card users have already lost everything. Or they're all blocked. Yeah. Actually, I'll take that. That was that was a bit of a low dig. Not everybody lost everything, but a lot of people did.

In the time... Well, as of this morning, it also appears that I've seen reports on x that MVK's Telegram account has been compromised as well and that he's hit or his account has been posting some dodgy stuff in the call card Telegram channel as well.

Whether or not these two things are related, again, I have no idea. But the reason that this is in here is not to... For me to kind of poke fun at a competitor. It's to remain... Or or remind you all, be careful about any links that you click.

Take very much care inside of Telegram because Telegram is just a cesspit of of scammers and stuff. And just remain vigilant. And the ironic piece about all of this is CallCards got half or the CallCards account has got half of Twitter blocked, so a lot of people wouldn't have seen this anyway.

Yeah. That... Yeah. That's the way to win is to be blocked. What is your talk about on the two upcoming events? Basically, telling the story of, like, Bitcoin is generally

good at securing their keys. Although, as we've seen in the last six months, maybe there's less truth to that. The fact that we need to now apply the same sort of principles and diligence to the rest of our lives.

Like two factor authentication and, like, securing your Twitter and your Telegram and that sort of stuff. Exactly. Yeah. So, NVK, if you are listening, I know you're a big fan of the show, maybe go to Q's talk and take some notes.

Thought you'd shit on and dunk on anyone else. We... Yeah. We'll we'll ship you a passport prime. Good idea. Yeah. Good idea. Yeah. Yeah. Obviously, dunking on him, everyone knows. I think he's a complete cock. We've we've said it for a long time way before the hacks, complete cock, complete sociopath.

And Troy James has said, you know, it says a lot about the Bitcoin industry that we are allowing the scammers to get away with it. Like, yeah, I think there's a lot of soft people in old. And

as we've said before, there's a lot of people that wanna go to the steak dinners and be in with a cool crowd and all that kind of stuff. But I think maybe that does start to slow down. People do start to see a bit of a mask off moment and realize that these people smiling in your face are actually fucking you. And it's

all... Like, this is a this is a serious thing to be controlling your own wealth and securing it and and being responsible for, like, for most people, for their families. And so you can't let people like this get away with it. You can't just just continue to allow them to survive, and it does need to be called out because

this is real life, real bullshit, real life changing, maybe even life ending stuff for people. So you don't have to, like, be an asshole like I am and, like, have little digs all the time. Like, I do that just because it's kind of funny.

But, yeah, you should block them. You should, like, never ever ever be buying from them again, especially with the way that they have acted with no real apologies. No. Just completely oblivious, basically, just carrying on as if nothing has happened, thinking their buddy's gonna bail them out. But...

Yeah. No. No. Yeah. I... To cap this off, I saw that they they had the audacity to, quote tweet the the ledger incident over the weekend basically saying, oh, well, we've got a clear case and you you might have seen this and they got absolutely decimated in the comments. So I I I So I'm self unaware.

Like Yeah. Completely... It's just, like, completely unaware of how they look. It's proper sociopath stuff, and he just stay the fuck away. It's like Bond just said, unbelievable. It literally is like I couldn't write a script. It's like David Brent.

It's what it is. It is fucking absolute Brent behavior. Yeah. Russell said, are we surprised he acted that way? Absolutely not. No. Does that mean we're gonna... We're not gonna call out? Absolutely not.

No. Right. Let's move on. Continue with the good news. Not. On Monday October 5, an attacker found a hole in the ARC server run by a company called Second, and it got away with 0.75 bitcoin of the Second, the company, their own money.

Second, for those of you that don't know, is a non custodial wallet built on ARC. Well, more specifically, Bark, which is the version of the Ark, their version of the Ark protocol. And they run a public Ark server that's kind of the wallets like Noah and Ark connect to.

Second says that it caught this bug within hours. They blocked the source briefly, took the server offline and deployed a fix. And apparently, the attacker kept probing into the following day.

A denial of service slowed down lightning received spark wallets, but they've merged and shipped the code the day after on the October 8. Just seeing here how they got into it. Okay. According

to a fix on seconds GitLab, the server checked the exit transaction but never checked that the locked out port actually needed its key. So the attacker swapped in a second key of its own, signed everything himself, and the server accepted the board as real.

He spent those balances over Lightning, so Seconds note paid out real stats, then swept the on chain coins back to his own wallet interest in. So it seems like only Second are the ones that have been hit here, and it's comparatively small.

But... And good that they caught it early, but, you know, still scary. Nonetheless, things are continuing to accelerate, Max.

Yeah. I'm not gonna repeat myself. My advice stays the same. Yeah. Absolutely. Max, I need you to fill for me for thirty seconds while I run to the bathroom. Maybe you can talk to the troll box.

Okay. What happened to Peter Gray? That dude seems like a state actor. Yeah. I didn't, like, go too much into all the kind of... I'm not gonna call it conspiracy stuff that people investigating.

It did seem really fucking weird.

The the, like, multiple names and the swift or whatever it was called. It all seemed a bit fucking weird. And, also, like, we've mentioned this on the show. This is getting a bit conspiracy theory now. But for a company that is not selling that many devices, like real world stuff.

Yeah. Their markup is gonna be good, but they're not selling that many. How they funded what they funded? I'd like... I know what they were paying podcasts. I know what they were paying people.

It was huge. And so I I can't see that that is ever a profitable company. So, yeah, I is it state level stuff? I don't know. Like, I don't have all the information, but I wouldn't fucking rule it out.

Yeah. I'm back. Thank you for filling. That's okay. Weird one. I just went down a little conspiracy conspiracy rabbit hole. I was listening. I got my headphones on. Right. That's so sweet. You were listening while pissing. Yes. Yeah.

FinCEN has formally withdrawn its two biggest pending rules aimed at self custody and CoinJoin users. On the October 5, the agency filed notices killing the December 2020 proposal that would have forced exchanges to collect names and addresses for any withdrawal over $10,000 to your own wallet and to keep records on transfers over $3,000.

It also withdrew the 2023 finding that labeled international coin mixing a primary money laundering concern. Both notices published in the federal register on the October 6, and FinCEN says it will take no further action on either.

Obviously, nothing changes for exchanges. KYC and Mixers are already under OFAC sanctions and they stay sanctions, specific addresses of course. Obviously, Samurai Wallet developers remain imprisoned for building a Mixer, a government according to in service, excuse me, that the government now stopped

stopped trying to regulate through these rules. So, I mean, this doesn't mean a lot because people are still in jail, but a Roman storm still being pursued. Too little, too late. On that on that kind of thread, on the October 5, the same day that FinCEN withdrew its mixed rule,

federal prosecutors in New York turned a brand new appeal ruling against tornado cash developer Roman Storm. This guy cannot catch a fucking break. Fucking hell. The ruling is about Bitcoin fob... Bitcoin fog, excuse me, which is concerning Roman Sterlingov, not Storm,

was convict... And he was convicted in March 2024 of running Bitcoin Fog, which was a custodial mixer, meaning that the users kind of handed their coins to the service and got different coins back.

The jury found him guilty of money laundering conspiracy and actual money laundering and running an unlicensed money transmitting business. Where have we heard that before? Mhmm. A federal crime under section nineteen sixty. He got twelve and a half years and a forfeiture judgment of $395,000,000.

On the September 25, the DC Circuit Court of Appeals upheld every single one of them. Most of the appeal was about venue, meaning whether Washington was right to place Too high. Was the right place to try him.

The link to Washington was an undercover agent who mixed around $250 of Bitcoin from his office, then messaged the service. $150. Yeah. They're doing it to get venue basically. Then messaged the service saying the coins came from selling ecstasy.

The court said that that was enough writing that moving funds in and out of the mixer, quote, furthered Bitcoin Fog's ability to launder the funds of all users. Fuck off. That is the most that is the most Weasley cunt ish thing.

$250 and then sending in a message after you've already done it, and that's how responded to, by the way. Absolutely fucking... That is KYC is the dragon that man must slay. Yeah. You fucking stupid dirty cunts.

Yep. So Roman Storm, back to Roman Storm, he was convicted in August 2035 of conspiracy... Conspiring to run an unlicensed money transmitting business. Yeah. The jury deadlocked on the money laundering and sanction charges, and his motion for acquittal has been waiting on a decision since

a hearing in April, and his retrial is set for 04/26/2027. He is also arguing venue as well. One Manhattan link the government relies on is a hacker who used the tornado cash service from his flat with funds sat in the pool for a couple of days.

Prosecutors say Sterling off settles that because basically they've got they've they've got a judgment now, basically, and they're gonna use that against Roman Storm essentially. Because even a short deposit grows the pool is their angle.

Storm's lawyers replied on the October 9, Bitcoin Fog took custody of user funds, Sterling have run it himself, and the agent told the service the money was dirty. Tornado Cash, on the other hand, is a set of smart contracts.

Storm never held anyone's coins, and the Manhattan user never spoke to him. So they're they're trying to... The the law is trying to draw parallels, and Storm and his defense are basically saying bullshit.

A DC circuit ruling does not bind a New York judge, and prosecutors only call it persuasive. But if you follow the logic, if adding coins to a pool advances conspiracy, then any district where one user mix becomes the place to charge the developer.

And that reaches CoinJoin and every other pool privacy tool. Withdrawing the FinCEN rule changes, the previous story we talked about, doesn't seem to have had any effect whatsoever. Judge failure failures decision on the acquittal is gonna be the next thing to watch on that.

Okay. Yeah. Logic stops when government starts. Great comment there. Buy Plastic on YouTube. Yeah. In the interest of time, I'm gonna skip the IRS any good news? Have we got one, like, good, like, yeah. We're all fucking doing something that's working. We're all here for a reason.

Not really. Let's tell you what. The troops. I tell you what. Let me let me give you the headlines and you tell me which one you wanna dive into. IRS argues holding keys made a self custodian owe tax on unclaimed forked coins.

The next one is Ethereum developer Justin Drake calling for bunker mode, Basically saying that we're... That the world is ending and the ECDSA and all of our coins are gonna get stolen. The next one is Europol also leaning into the quantum risk of Bitcoin and blockchain based keys.

The next one is the US government moves around 18,000 c's BTC with no explanation. Okay. Next one is Scott Bissent saying that The US is gonna seize 1,000,000,000 of Iran's crypto because they they quote know where it is. Okay. The next the next one is Brazil's police force seizing 1,700,000

from self custody wallets using seeds found on raided devices. Right. The next one is Empire Market co creator got four years in prison and forfeits 1,230. The next one... Already said stop stop. He's already dead dot png.

Fucking hell. I'll continue. I I am not done yet. The the next one is AI assisted hacked at seven South Korean banks with 66,000 customers exposed. The next one says India has pulled bit chat from the App Store and the Google Play Store. Then we've got Zac XBT infiltrating the Lazarus Laundering Network.

And then finally, we've got wizzes dot bitcoin application with Ican to basically build a... Well, not build, but rollout websites that end in the dot bitcoin t l d for... Talk to me about that. Talk to me about that.... Bitcoin builders only.

Just for a minute. Like, every other headline there is so fucking depressing. Like, so do it. Probably the least depressing one was that a bank got hit.

And I was like, well, it's not just us getting smashed. Like, it's it's banks as well. That made me feel not good, but not terrible. Talk to me about what is Wiz doing, what does it mean. I know we're basically at time, but, like, is the... Is this a cool thing? Is this something that's like, oh, we're doing something that's interesting?

Yeah. So on the October 7, ICANN, I c a n n, it's an acronym. Again, I'm... As you know, listeners, I don't know what acronyms mean. I generally don't research enough to get all of those. But basically, it's they run the internet naming system.

And they have published every application in its first new top level domain TLD. See, that's what I do know since 2012. There are 1,615 of them. And one of them is for dot bitcoin. It comes from our good friend, Wiz, who runs mempool.space.

And he also operates one of the seven DNS seeds that are built into Bitcoin Core to help bootstrap the network for new nodes. His company, Wizz and Associates, based in El Salvador, has filed this icon application for dot bitcoin as a community application, which apparently is a special category.

The registry promises to serve a defined community instead of selling names to anyone. And in return, it can claim priority over rival bids. His his community is the people who run, build, or provide Bitcoin's infrastructure.

To register a name, you would need to... You would need public evidence of one of five things. Running a reachable node, and I think my notes are a bit short there. That that means a DNS seed.

Mhmm. Contributing code or a BIP, being a wallet operator, being an exchange, operating an explorer or mining service, publishing educational work, or organizing meetups and conferences. Should we try and get an ungovernable dot bitcoin?

I would fucking love that. Ungovernable dot bitcoin does have a nice ring to it. I feel like we've got enough proof of work, like 500 plus episodes. Can go and check the tapes. I think we we stand a pretty good a

pretty good fight there. I think so. So to to continue with this, your name has to match what you run. Eligibility is rechecked at every renewal and altcoin projects are odd. There are no auctions or premium names and the registry commits 21% of gross revenue to Bitcoin open source development,

publishing the amounts and recipients each year. A committee of community bodies interprets the rules and which says he holds one seat with no veto. That's kind of a cool thing. So so, basically, you've got to say, I want dot bitcoin dot x y z dot whatever, and it's presumably hard to get one of these dot things.

And then what they're saying is, well, we're not selling it. It's not like we're doing dot x y zed, and then we're just selling it for, like, you know, silly money. We're actually doing this as community thing, and therefore, they've got a better chance of doing it.

Like, likely... Like, is this likely to happen?

Well, he's not the only applicant. There are... The... This contention list also shows a second dot bitcoin application from Oh. Bird Pepper LLC, which gives identity digital, one of the biggest domain registry operators as its website.

That one is an open standard application. To sell it. Just... Yeah. I I would imagine so. Yeah. Each one of these applications cost $227,000 just to file. Wow. Wow. Yeah, indeed. So it it seems like of the two, you know, obviously I'd wanted to sit with with Wiz and Associates based in El Salvador, but but we'll see. When...

Oh, here we go. The the final list of strings lands on the November 17, opening four months of public comments and objections. Wiz expects this to take years and hopes to launch by 2030. Fair play.

Fair play. That's that's a cool thing if it happens. Yeah. Absolutely. And if you were interested by any of the other doom that we... That I ran through earlier, I... They will... There will be full show notes. But until then, Max, let's hit the boost. I will let you kick us off. Okay.

Lonely pumpkins with 10,000 sats. Keep on stacking those skills. Two timely topics are replay protection and why responsible devs, them in planned hard forks, and why miners can't new... Can't spend newly mined coins for a 100 blocks.

One, provide value to others. Two, spend less than you earn. Three, save in a money no one is able to print for free. That's a great comment. It is. Lonely Pumpkins, shout out to you. I think it's, like, five or six shows in a row At least. That Lonely Pumpkins has has been doing these mega 10,000 sat boosts.

Really appreciate you, mate. It's it's very, kind. Well, it appears that it's not just us that's noticing Lonely Pumpkins because long term support of the show, late stage huddle, comes in next with 6,006 sats. He said, who the fuck are these pumpkins coming in with the high boosts?

Is it key fave or k fave. K fave gaslighting me into boosting more. You all keep up the good work. Maybe I'll change my default amount. It's not like you don't deserve it. Well, thank you for your unwavering support.

Thank you. Also, well, quick shout out to the best of the rest, Bon. Thank you very much. RevHuddle, Reed, user one one six nine four four seven two, and of course, not the gang. However, we did have a boost that named no show that sent in $70 worth of Bitcoin, 83,448

sats from Gabriel Brown, and they sent no message. Well, thank you, Gabriel. Really appreciate your support. Yeah. Thank you very much. We really appreciate that. But we don't get many

on chain, but you should gonna say, yeah, that was on chain as well. Yeah. I saw that as I was as I was making all the tweets and stuff like that. I saw it come through because, you know, in our dashboard, it says, like, how many sats in the last twenty four hours. I was like, fucking hell. That looks... And then I was like, oh, okay.

Who's this guy? So Gabriel Brown, appreciate you. I don't recognize the name. I feel like that's a new one. Yeah. I only know one Gabriel, and he hosts a podcast, a privacy podcast. So I don't think he's gonna be running around with his...

Brown is real.... Gabriel on there. Yes. Yeah. Exactly. Yeah. Okay.

Right. Let's wrap this baby up with some releases, mate. Nunchuk desktop two point nine point one, they fixed the in this one released on the October 10 that stopped the app from launching entirely on Apple silicon map... Maps. No. Maps. What am I talking about? Max with a c.

So if you are a Nunchuk desktop user and you have a Mac, make sure that you're up to date. Otherwise, you won't be able to open the Mac. BitKey app, which is obviously blocked self custody solution.

On the October 5, it published app release twenty twenty six point thirteen point zero, which basically updates their emergency exit kit APK. Not really much else to say about it other than, you know, if you are a BitKey user, this is an important piece of your puzzle. So make sure that you've got the most up to date version.

The idea here, if you're not familiar, is that whilst the BitKey solution is very slick, you are kind of locked in. And if the services go down and you can't access one of your other keys, this exit kit via an Android APK is your ticket out of their ecosystem to recover access to your funds.

Another release from the guys over at Am I Exposed. This one is version zero point four two point one.

They... They've shipped 10 versions between the fifth and eighth of October. Very nice. This one is very cool. They added a before you send feature which analyzes a PSPT or raw transaction including by reading it via QR and only broadcast once you choose to so that you can check the privacy implications

of your transaction before it hits the chain. That is nice, isn't it? I like how am I exposed. Do... Is it one of these we don't know who's behind it? They haven't exposed themselves. Is it a team that we know?

Could we have them on a Freedom Tech Friday? We've tried. It's it's the Spaniards behind it. I I... They they speak publicly from from their NIM. They speak public about it from their NIM accounts, but

they don't wanna go on without a voice changer, and we haven't been able to to kind of nail that... Oh, yeah. Yeah. I remember now. I remember now, and it wasn't it wasn't possible. We say it all the time, but shout out to the Spaniards. They are the Yeah. The shadowiest,

the most privacy conscious, the... Like, if I went back to drinking and I wanted to have a whiskey, I'd I'd wanna go and do it with the Spaniards, I think. I have met a couple of them at at a Madrid conference, and they are as as decent in real life as they are online.

Yeah. Well, hola to all of you. Indeed. Indeed. We got Wiz in the...... An anchor. We got Wiz in the chat as well with the rocket emoji. Hello, sir. Hope you're well. Hi, Wiz. And also a question from Troy James. Will Passport Prime allow no Bluetooth firmware like blockchain? Yes.

We have already designed and are building a version of the onboarding that basically has a gate in it. When you go past the specific screen, it overwrites the Bluetooth firmware basically to zeros, so it doesn't work. And then you can onboard without Envoy in a basically manual way so that Bluetooth doesn't work.

And you can just go and set it up without doing the security check on our server and without needing to touch Envoy in any way, shape, or form. There are some caveats to that. Obviously, you have to update the firmware manually via a file. You have to manually set the clock if you want your two FA codes to work.

But yes, it's... Oh, and the other caveat is that if you ever change your mind and you want Bluetooth to work again, then you need to do a firmware recovery. So it's it's not

it's not for everybody, but yes, you will have that option very soon. Optionality is what we like. Indeed. Yep. Flint from Seth version 1.3 been released. This is the node less lightning plug in for BTC pay server.

This is added basically just some reporting structures so that you can get some more merchant based tooling added in there in terms of like the fee that's been paid, what arrived, and it's also got some stable coin related stuff as well.

Then we got blue wallet version eight point zero point two. This build is now reproducible, meaning that anybody can check the published app matches the public source code. And this release also adds import and export labels for BIP three twenty nine, which is very nice, keeps it in line with Sparrow

and many of the other BIP three twenty nine compatible label bullets.

Start OS version zero point four point two has been released. This one landed on the October 5 with a batch of networking and certificate based fixes. Gateways can now be marked as secure.

Services become reachable from other routed private networks and packages can request hardware virtualization. The bigger changes for apps that pin server... Pin the server certificate such as Sparrow and Electrum clients.

They now see the same certificate on every single route, which clears up the long standing source of connection errors for anybody linking their own wallet to their own node.

That's fine. CoinOS version three is now in public... Available in public testing as of the October 8. CoinOS, for those that you don't know, has been a popular custodial Lightning Web Wallet for quite some time.

Version three pairs ARC spending with regular... With a regular on chain Bitcoin wallet. And it also adds a built in NOS decline and encrypted messaging and it can run offline. The ARC implementation here gives the users a pre signed way to exit to the chain without the operator being present or even online,

which is the same mechanism being tested by this week's second exploit, essentially. And finally, not strictly Bitcoin, but it is a Bitcoin adjacent service, pay per queue, which you can find at ppq.ai, is a paper use AI router that takes Lightning payments with no account needed.

It now serves its chat request inside an AWS Nitro Enclave, basically encrypting your prompts on your device so that the company sees only your billing metadata. Similar to to kind of how Maple operates as well.

Thought that was very cool. I know it's not strictly Bitcoin, but you can pay for your AI services in Bitcoin. And now you have end to end encryption so that even the pay per queue team can't see your prompts or or the responses that you're getting back from the agent as well.

You you say it's not strictly Bitcoin. I I think we are at a stage now where Bitcoin and AI are so interwoven that you you can't protect yourself without one and no attack to... No attackers aren't using the other. Like, it...

Yeah. It is merging into one topic at this point. Mhmm. Yeah. Absolutely. Right. That brings us to to the end of the show, mate. I just wanna recap with some some takeaways for for the headline. Obviously, we we talked ad nauseam about the the ledger issue.

But please take this as as your tap on the shoulder from the universe to go and revisit your self custody setup.

If you don't have a 100% confidence in it, then you need to, you know, do some serious thinking and think about what is the next step. If you don't know what that next step is, then pay for the services of a professional to give you some advice.

Max, anything else to add?

Usual ban. Don't keep all your eggs in one basket. Don't trust anyone. Don't trust any asset. Spread your risk. Live your life. Enjoy time with your kids and your family, and don't put too much risk on on your head if you're struggling to sleep at night, if you're worrying about all this kind of stuff, you're probably in too deep.

Yes. Absolutely. Stay ungovernable. Obviously, always stay ungovernable. And, Wiz, if you're still in the chat, when you win in 2030, just please make sure that we get ungovernable.bitcoin.

That'd be such a big flex. I'd love that so much. It would be. Although I am going pretty attached to ungovernable.network. We have both. I'm not saying have a redirect, can't we? Yeah. We have a redirect. We definitely have both.

That's it. And and also the final words for everyone listening and everyone boosting, thank you. The the support has been amazing. Watching this thing grow over the last few months has been incredible,

and I really appreciate all the support from everyone. So thank you. Absolutely. Yeah. We love you all. Happy Monday. Hope you have a good week. We'll catch you on Friday for Freedom Tech Friday.

Peace out. See you then.