
Breach Season Continues
Discussed in this episode
Boost this Episode
Send sats directly to the creators. Value for Value.
Plus 1% to Podcast Index, 1% to Boost Bot.
Show Notes
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Q: short weekend trip to Lisbon
Q: Envoy v2.3.4 out -- stability and maintenance release; faster Bluetooth firmware updates for Passport Prime, bug fixes and further Tor connectivity improvements
Q: Legacy Mode beta for Passport Prime -- optional app porting Ledger's open-source device applications to KeyOS so users can manage alt coin holdings on open-source hardware; not installed by default, device stays Bitcoin-only if ignored
Max: bought a Stanley flask and a robot vacuum and mop combo
NEWS
CLARITY Act dies in the US Senate 49-50, eleven votes short of the 60 needed for cloture; every Democrat who voted said no, joined by Republicans Collins, Hawley and Moran; the final text dropped the explicit criminal protection for non-custodial developers against 18 USC 1960 charges -- the same law used against the Samourai and Tornado Cash developers -- keeping only civil protections; Senator Lummis warned failure leaves no realistic chance this decade; the SEC and CFTC immediately signalled unilateral rulemaking -- CoinDesk, Newsweek, TFTC, The Rage, TFTC, Coin Center
Two days after the CLARITY Act failed, the CFTC sent a pre-rule rulemaking titled "Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets" to the White House for review; contents are not public but expected to create a path for crypto spot exchanges to operate under CFTC oversight; prepared in advance and filed immediately once Congress failed to act -- PYMNTS, CoinDesk, The Defiant
CFTC Staff Letter 26-25 extends to all qualifying developers the no-action relief Phantom received in March; software that passes user orders to CFTC-registered futures firms without holding assets, generating signals or controlling routing does not need to register as an introducing broker; not law, can be withdrawn at any time, and does not protect wallet developers from DOJ money-transmission charges -- TFTC, CFTC
The FCA, HMRC and Metropolitan Police raided three London premises on September 10 targeting unregistered peer-to-peer crypto trading operations and issued cease-and-desist letters at all three; the FCA says not a single P2P crypto business is registered in the UK; the second coordinated enforcement action this year, following raids across eight locations in April which are now feeding criminal investigations; the UK's full crypto regime begins October 2027 -- CoinDesk
Hodl Hodl shipped "enhanced bitcoin security scoring" on September 18 that checked incoming bitcoin for red flags and blocked trades with a bad score; after user backlash Anna from the team posted on September 19 that they got it wrong, it shipped without warning and was explained poorly, and it is now disabled; if it returns in any form it will be disclosed beforehand; scoring coins for red flags is taint analysis, and Hodl Hodl's position holding one key on every 2-of-3 multisig trade is what makes this kind of screening possible -- Hodl Hodl on X, Anna (Hodl Hodl) on X
The Rage argues the Strategic Bitcoin Reserve created by Executive Order 14233 may exist only on paper; no reserve office appears in Treasury's public org chart or the 2025 Fiscal Report; Bloomberg reported in July that Treasury and Commerce were still disputing who has authority to run it; the House Financial Services Committee advanced the ARMA bill 28-21 on September 16 ordering agencies to keep custody of their bitcoin until the reserve is "fully established and certified operational"; a FOIA request for records on the reserve office is still pending -- The Rage
Liquid peg-outs remain paused two weeks after the $320M exploit; 3,400 BTC was returned and blocks resumed September 10 but 598.5 BTC remains with the attacker; the federation says peg-outs will resume only after 1:1 backing is confirmed and software updates and independent security reviews are complete, with no date given; L-BTC holders can only sell or swap through services like AQUA's Indra where liquidity is limited -- Liquid_BTC on X, Liquid incident report
JAN3 launched Indra on September 15, its own Lightning-Liquid swap backend for AQUA, after Boltz suspended service in August following sustained AI-assisted attacks; for now it only handles Lightning sends paying invoices from L-BTC, with receiving to follow; JAN3 replicated the Boltz API signatures so it can act as a drop-in replacement; about three hours after launch Indra was hit by a DoS attack and forward swaps were temporarily disabled -- JAN3, Stacker News, Samson Mow on X
CLN operators are advised to disable experimental features after a suspected dual-fund channel drain; on September 12 a node operator reported a peer opened a dual-funded channel, drained most of his liquidity and went offline, with the funding txid his node recorded not existing on-chain; on September 15 Core Lightning issued a security advisory urging all operators running experimental features to disable them; at least two more operators have since reported losses; no patched release has shipped -- GitHub issue #9498, CLN collaborator comment, Core Lightning advisory
A pull request by Roasbeef would change the BOLT11 spec so readers must reject invoices containing more than one payment hash; a popular Telegram P2P bot was recently hacked through this ambiguity because some libraries took the first payment hash and others the last, allowing a system mixing both to be tricked into thinking a withdrawal was never paid out -- GitHub PR #1357
Lightning wallet Blink paused all services on September 19 after an attacker drained a limited number of custodial accounts; "a few dozen" custodial accounts were affected, every affected account will be made whole, and non-custodial wallets were untouched; a patch was deployed and services came back online the same afternoon; the attack path is unknown pending a post-mortem -- Blink on X, Bitcoin.com News, TFTC on X
London-based crypto infrastructure provider Haruko was hit by a targeted attack affecting 15 clients -- all those without an IP whitelist; attackers exploited a flaw in Haruko's own processes to extract a user-access token exposing exchange API details and trading data; three sources say a small amount of client funds was stolen, mainly from smaller hedge funds -- CoinDesk
Swiss Bitcoin Pay, a non-custodial Bitcoin and Lightning payment processor, took its servers offline on September 14 after a malicious user likely accessed its internal systems; customer email addresses, bitcoin addresses, IBANs, transaction histories and hashed passwords may have been exposed; user funds are safe and any amounts owed will be returned in full; servers remain offline as of today with no restore date -- Bitcoin Magazine, FinanceFeeds
Update on the Revolut breach: attackers used a hacked email account on a real Italian government domain to send fake law enforcement data requests; at least 680 customers are affected, targeted for their crypto holdings via blockchain analysis; on September 16 the group demanded 6,000 XMR (~$3M) within 24 hours or it would sell the data; the deadline passed, Revolut says it has had no direct contact, and Italian police and UK regulators are investigating; samples have already been posted on Telegram -- CoinDesk, SecurityWeek, CyberInsider
RELEASES
Highlights
Cake Wallet v6.4.5 -- 2026-09-20
- Smooths out the Trezor hardware wallet connection and transaction signing flow. Speeds up Monero background sync with more stable node connections. Includes UI polish and bug fixes.
umbrelOS 2.0 Beta 2 -- 2026-09-17
- Second beta of the umbrelOS 2.0 major rewrite. Adds redesigned search across apps, files, photos and settings with visual results. AI agents can now create and use virtual machines with screen and keyboard; Omakix Linux is available in the machines feature. Apps can be moved to external drives and cloud imports are supported. Opt in via Settings, Advanced Settings.
Bitcoin Core v32.0rc2 -- 2026-09-18
- Second release candidate for Bitcoin Core 32.0. PSBT-creating RPCs now default to version 2. A new exportwatchonlywallet RPC exports a watch-only copy of a descriptor wallet with no private keys for offline-signing setups. New derivehdkey and addhdkey RPCs aid multisig coordination. Testing release only -- not for nodes holding real funds.
Sparrow Wallet 2.5.5 -- 2026-09-17
- Adds a System theme that follows the OS light/dark setting, now the default. Enables BitBox02 xpub export and multisig signing at the m/45h keypath on firmware v9.19.0+. Includes Trezor Safe 7 session recovery and bug fixes.
BitBoxApp v4.52.0 -- 2026-09-15
- BitBox02 owners can now create a Lightning hot wallet inside the mobile BitBoxApp, funded from their on-chain balance and derived from their existing BitBox backup -- no extra seed words, no channel management. Public beta using Breez SDK and Spark statechains; unilateral exit is not yet available in the current beta.
Eclair v0.14.3 -- 2026-09-14
- Security hardening release with fixes from Project Loupe, Blockstream's AI-assisted open-source security research initiative. The team warns some issues can be exploited by malicious nodes and urges all operators to upgrade immediately. Fully backward compatible with no channel closures required.
Signal Beta Enables Phone-Numberless Registration -- 2026-09-16
- Signal's Android 8.28 beta lets new users register without a phone number by paying a one-time fee of about $3 via Google Play. Signal says the same zero-knowledge proofs used for donations keep the purchase unlinked from the new account. Requires Google Play Services; de-Googled phones cannot use it yet. Android beta only -- iOS and stable release timelines not announced.
Everything else
- Amber v6.6.4 -- 2026-09-14
- Fixes a Tor clearnet leak on Android where requests could bypass Tor and go over clearnet.
- BasicSwap DEX v0.18.9 -- 2026-09-15
- Latest in a rapid release series. Swap fund…
Bitcoin is close to becoming worthless.
Now what's the Bitcoin? Bitcoin's like rat poison. Yeah. Oh. The greatest scam in history. Let's get it. Bitcoin will go to fucking zero.
Welcome back to the Bitcoin Brief, the show where me and q and a talk about Bitcoin, privacy, open source, keeping your Bitcoin secure, and the news and software updates that matter. I just wanted to say a mass thank you to everyone who's been supporting Ungovernable Misfits, and a big thank you to Foundation
for supporting the show. If you haven't already checked them out, go to foundation.xyzed. They make cypherpunk tools for fuckwits,
and anyone can use this, even me. If you have any questions or you want to reach out, feel free, and I'll be happy to go through things with you. For anything super technical, I'll pass you on to q. If you wanna buy one of these incredible passports, use the code ungovernable.
It will get you a discount, and it will let them know that I'm shilling. I'd also like to say a huge thank you to the Cake Wallet team. Not only are they supporting this show, but they're also bringing out some incredible features.
For those of you who actually use Bitcoin and actually care about their privacy and security, Cake Wallet make it incredibly simple for you to live outside of the traditional financial system.
You can use CakePay within the app to buy gift cards for food, petrol, and whatever else you might need day to day. You can use silent payments, and, of course, you can use Monero. You can connect both Bitcoin and Monero nodes, use coin control, and this team are constantly innovating.
And I'm really excited to be working with them. If you have any questions, you can reach out to me, but check them out at cakewallet.com. Download the APK or start using this today on Mac, Windows, Linux, iPhone, or, of course, your Android device.
Enjoy the show.
Hello, everybody. Welcome back to The Bitcoin Brief, a live and interactive show taking place every Monday at 9AM eastern and 2PM UK time across the ungovernable network. Each week, we go through the news, the releases, and the developments that actually matter in Bitcoin.
This, of course, includes self custody, privacy, the tools you run yourself, and the people trying to make all of that harder. If it affects your ability to hold and spend your money without asking permission, then we wanna talk about it. This show and the topics we cover are powered by freedom.tech,
a daily news desk that uses AI to monitor hundreds of sources so that we can continue to bring you the signal every single week. We love to hear from you and help you have you help steer the conversation by commenting live, asking questions, boosting the show, or just sharing it with your friends.
My name's Q and A. I'm head of customer experience at Foundation. And as always, I'm joined by my good friend Max, the head honcho of the Ungovernable Network. Without further ado, let's dive into the show. Max, happy Monday. How are doing, mate? Very good, mate. Very good.
Excited to catch up on your holiday news. I wanna sort of like soak it in through what you tell me and feel the vibes there. Not so excited to go into some of the news that I've looked through on our show notes because it's fucking depressing, but still needs to be covered.
But yeah. Good, mate. How are you? I'm very good. Feeling very rested. I had a very short stint in Lisbon this weekend, just a Friday to Sunday. Hop in and hop back out to see one of my good pals who lives out there.
Very relaxing weekend. No children. No alcohol. We actually went for a run along the beach. It was it was almost like a little mini fitness retreat. Loads of good food, some excellent chicken, some sublime pizza, and lots of naughty dessert based treats treats.
So, yeah, thoroughly enjoyable little weekend, albeit a short one. But back at HQ today and, yeah, feeling ready to take on the world. Sounds so good. You you were describing the Neapolitan pizza to me earlier, and I was just I was just sat here just imagining just like, ah, coming out of a nice
stone oven and just like, just fucking perfect. It's one one of the best things in life is pizza, and it's, like, a really simple I wholeheartedly agree. Yep. It's so
my missus always, like, slags it off. She's like, oh, you've had one bite. You've had them all. It's all the same. You know, you get bit I get bored of it. I'm like, will you shut up? You wind your neck in. You don't wanna speak about pizza like that around me, pal, because it is the fact that you can eat it with your hands.
That's a win. There's, like, a a simplicity to it. It's just it's like it's like comfort food when it's good quality not Domino's and that sort of shit. But Yeah. Are you It's one of the best. Are you a a folder?
Yeah. I am these days. Not not folding from, like, the tip of the triangle to the base of the triangle. A a fold inwards on itself, so it's like a Like a hammock? Yep. Yeah. I mean, it it depends on the pizza. Like, if you if you go into if you have a pizza and it's like a shitty pizza and it just, like, doesn't move,
you know, like a very thick base, shitty one, then you don't need to. You just pick it up. You know, if you go to, like, a kid's birthday party or pizza wherever, it's gonna be shit. It's gonna be, like, oven pizza shit.
No need to fold. In fact, it's worse to fold because then as you fold, it's gonna crack all of the base. Yep. Which is not a very good base. It's gonna crack and crumble everywhere, which is annoying, so no need. But with a proper pizza like you will have had,
that fold is necessary. You keep the juices in. You're gonna get no cracking. It's yeah. That's the way. That is the way. The only way. Especially with the Neapolitan, like, kinda have to because they're kind of floppy, aren't they? Mhmm. Yeah. Yeah. Oh, weirdo robot in the chat. Good morning, sir. No such thing as shitty pizza.
Even a shit pizza is delicious. Do you know what? The the only pushback I'll give to that is Yeah. There is such a thing as shit pizza, and that is pizza with pineapple on top. I will die on that hill. No. No. No. I used I love pineapple on pizza.
And thanks for thanks for joining us, everybody. We'll we'll be back at the same time maybe next week. I think I'm gonna leave now.
Yeah. It divide it divides people. What about marm what's your stance on marmite? You a lover or a hater? I imagine you wouldn't like it. You like yeah. That's what I thought so. Like a like a little bitch. The same with the pineapple.
It's a shame. Listen, mate. I I still appreciate you. You're still a friend and all that. Just got a shit taste. It's fine. Misguided. Alan King is also in the YouTube chat. He said, New York pizza or go fuck yourself.
Do you know what? New York New Yorkers do do some excellent pizza. Is it them who do that horrible fucking pizza pie, like, thick dish shit? I think yours. That's Chicago.
That's Chicago. Yeah. Yeah. Yeah. Yeah. So what's New York pizza then? We will get on some Bitcoin stuff in a second. This isn't a pizza show, but I just need to know. New York is what? Like a It's relatively similar to traditional Italian pizza, the ones I've had.
You can't get you can't get really deep dish pizzas in New York, but the the the good ones that I've had have been fairly thin. Okay. Alright. Okay. I'll go along with that then. Well, outside of pizza, what else is going on in life?
I yeah. A couple of foundation based AOBs. Envoy version two three four has come out in the last couple of days or definitely since we last recorded. Fairly minor release in terms of feature improvements, more of a stability kind of maintenance release,
big improvements so you can kind of how fast firmware updates take place over Bluetooth for Passport Prime, a couple of bug fixes, and some further fixes to Tor connectivity, which is kind of been the the thorn in our side as I'm sure it is for many many wallet projects.
Yeah. But it does seem to be getting it's getting better with especially with two three four. So if you are a personal node enjoyer and you connect to that over definitely give two, three, four a a whirl and let us know if you come across any issues.
And the the other one that's slightly bigger news is we released legacy mode for Passport Prime last week. So for those of you that didn't see the pretty awesome AI video
tongue in cheek announcement video that Did you do that? Did you make that? No. That was Zach. Pretty good, wasn't it? It's very good. It is very impressive. Link will be in the show notes, by the way, people, if you're catching up afterwards and you wanna go and check it out.
But legacy mode is essentially a way for and and this might come as a shock to some listeners to the show, because I know that the show is named The Bitcoin Brief, but some people that hold Bitcoin also hold things that are not Bitcoin as well. I know Fuck off. That's enough to get you shot in some areas of Twitter.
So, yeah, be careful on what you admit here. But, yeah, we we we obviously recognize that and Passport Prime was never ever meant to be a Bitcoin only device. It does well, everybody that listens to this knows what it does and that feature set is all all always growing.
And legacy mode basically is a a suite of applications that basically allow you to easily migrate from your closed source hardware wallet that stores your alternative coins, such as your Ethereum and all of that other stuff that people seem to be into.
And you can just bring your seed words over into the legacy mode app on Passport Prime and basically have a similar to ledger experience so that you can manage all of your tokens directly on Passport Prime on our open source hardware and our open source software, more importantly.
The user interface will be very familiar to those that are familiar with using Ledger. The the cool part about this is that the one one of the few parts of the Ledger stack that is actually open source is the applications that run on the device themselves, and that's exactly what we've used and ported across to KeyOS
so that we can run it on Passport Prime, which I thought is pretty funny.
That we're kind of taking their open source stuff and whacking it on our open source hardware and software and saying, hey, Ledger users, you can now choose open source. Like, you don't need to settle for any less. So if you are an enjoyer of alternative coins like Ethereum and Solana and and whatnot,
feel free to migrate your funds across. You don't need to start again. You don't need to send any funds on chain or whatever the terminology is for Ethereum and and all that stuff. You just put your seed into the the legacy app and manage your assets. You know, you plug into Phantom or whatever
wall application that you wanna use. Metamask. Metamask. Whatever it is. Yeah. Yeah. All that stuff. Just plug it in via USB exactly the same way that you would with your ledger, but you're able to do decent hardware that's open source.
In terms of in terms Did they get rid of Go on. Go on, mate. Oh, was just gonna
we do it can we do it a fourth time? I'm gonna go first. I've
In terms of how this gets onto your device, because there's gonna be some people here that are gasping because they're die hard Bitcoin only people. If you never install this app, you never you never have to worry about any of the stuff I'm talking about. It's your device, you choose what what goes on it.
It's not part of the core KeyOS operating system. You have to make an intentional choice to load this application onto your device to be able to access the functionality. It's completely to you.
Someone in the comments I shared, like, clever cunts or something like that with a with a link to what you've done. And someone was like, why clever? And I was trying to explain I was just saying, like, you know, if someone is coming over and, like, even if they have all their shit coins and whatever else,
you're opening the door for them to use open source. Like, I I don't see how that can't be a good thing. And you're also opening the door. They're like, oh, okay. I can use this device, which is open source and uses the firmware on top, which is open source. And I can port port whatever I want across,
And then they might get into the fold and into the way of thinking of foundation and
the people around it, and it might just change their views on things a little bit. And they might be like, oh, okay. Maybe there's something to this Bitcoin thing and and everything else that I'm seeing here, and maybe security does matter. And, like, it just I think that step of saying, I will move to
an open source hardware company and use open source software. And it's like, yeah, but I can't with all my other coins. And so people don't move at all. So I think it I think it is, whatever way I look at it, anyway useful.
The thing I was interrupting you a million times there on was did they get did they get rid of Monero support, or did they keep that? I think they've kept it because we are that is one of the the coin apps from their open source stack that we are gonna be adding as well.
Okay. Okay. Yeah. Alright. Well, yeah, very cool. I I liked the video. I thought that was really good, and I like the sort of side step approach of, like I I hope at least it takes some of their market share and and makes people go, okay. I like what these guys are doing. They're doing it better, and I'm gonna move.
Yeah. Yeah. It's it is literally the best of both worlds. If you want it, install it. If you have zero interest in it, go for it. I mean, there's always gonna be people on particularly on Twitter that, like, will
see this as a red flag and just well, it's already happened, you know, the usual shit corners blah blah blah. But for me Yeah. Yeah. It's I would be better. I personally have zero interest in that sort of stuff. If it was my passport prime, I wouldn't be installing it.
But that's literally the point is that if I don't wanna have it on my device, I'm just not gonna pay zero attention. But for those people that wanna do it and they wanna secure those sort that sort of thing on some decent hardware and proper touch screen and that
is open source, then they then then they can choose your own journey. Yeah. And and if to be honest, like, you've already crossed the line for those type of
Oh, yeah. Yeah. Yeah. Yeah. Of course. You're way past you're way past, like, oh, now we've annoyed that little group. Yeah. Yeah. Passed him. I wouldn't worry about it. And if they wanna use something, you know, they can use a cold card.
Like, who I saw someone the other day, like, screeching about how they still wouldn't use their cold card and everything else is shit. I was like, good. Oh, good. Go and use it, mate. Like, just go and do your thing. We don't need to hear about it. It's like you say, choose your journey, lose your coins.
Yeah. Have at it. Yeah. That's it for my my AOB. If what's been going on in your world, mate? I believe you've got something interesting. I mean, relatively. For me, it's interesting. I bought two things that I'm really happy about.
Really, like, retail therapy to myself. So number one, and John's gonna call me gay for this, but I got another Stanley flask thing. And it's like, you can hear this little, like, a little click there. That's for my coffee. And it's just like a little no handle, no nothing, just simple, like, fits my
black coffee in there in the morning. And when normally at this part of the show where, I don't know, fifteen minutes in, I'd have made it ten minutes before, my coffee would be absolutely cold. Sort of, like, rushed through it.
But, actually, now that it's in here, I've still got half of it left for the rest of the show.
It was $20, and it keeps the coffee nice and hot for, I don't know, good few hours. So really fucking happy about that. And then the other bigger purchase I made was a robot vacuum
machine that also mops, and it, like, is the honestly, that's, I think, the best decision I've ever made in my life, like, especially with kids running in and out and dirt and grime and shit and being busy. And this thing is just like it's it's fucking amazing.
I love it so much. Is it is it the one because I saw one doing the rounds on on Twitter not so long ago that had just been released that's got the the arm on top that'll, like, pick up your socks and put them in a designated spot.
No. It's it's not that one. I don't know what that is. It was like a it was like what was the top model a year ago. So I got it, like, a bit less than half price, and I was like, that'll do. It'd be that's gonna be good enough for me. I don't need it to pick up my fucking socks. So, yeah, I think it was, like, $400
or something like that or maybe $500. It's not cheap, but it's fucking amazing. Like, you watch it on the little map thing, and, like, I know it's probably not good for privacy and it's back in my house. I know all that stuff, but I've got kids. They're they're fucking messy.
Always got stuff everywhere. I spend all my time, like, picking up stuff after them. You know, we've got a billion other things to do. And now it just sets itself. And in the evening, when everyone's out the way, we just pick up shit off the floor, and then it goes and it does full
vacuum of the house, takes itself back to its little station, empties itself into another separate bag. You don't have to it. Yeah. Yeah. It's like a has like a big separate bin that it, you know, gets all the stuff out. So, you know, it can just go on and on and on. And then it has a, like, a roller mop, like a paint roller underneath,
and then heats up the water, goes and does the mopping, comes back to its station, like, rings out the mop, that goes into a separate dirty container. And, like, you look at the thing. You're like, fucking hell. That is just like, that is grim. And now I'm, like, walking around my floors. There's no grittiness.
It's it's honestly, it's if you if you are busy and you have a million other things to do outside of just constantly hoovering and cleaning up after your kids the whole time, This thing is, like the the ROI is there, like, immediately.
That thing would I I'd love one, but it would last, like, twenty seven seconds before my dog destroys it.
Yeah.
Either that or it would be scared of it. It might just bark at it. You could put, like, a you could put, like, a figurine on the top of it. Do know what I mean? Something that shakes and, like, scares it a bit that it's not gonna Just like suction a dildo to the top of it or something.
Mate, what you wanna do in your own time is is completely down to you. I'm not gonna judge. Anyway, like, again, a non Bitcoin topic, but is it that's kind of like freedom tech because it is just freed up
so much time. And I know it's probably mapping out the house. I know all that stuff. Like, I get it. It's that's I know there's, like, other more freedom tech ones, and you could link it to your node, and it could go off on a certain block and stuff.
Whatever. It's fucking brilliant that, like, if I wanted to keep the house as clean as it is, I'd have to spend at least an hour to an hour and a half per day doing what it's doing, and it saves me that every day. It's fucking amazing. Sounds like a no brainer.
Yeah. Everyone go and buy one immediately. Use my code. Use my reference. Yeah. Use code on government check out. Yeah. Right. Shall we hit the do I mean, the news? Yes. Let's do it. Let's do yourselves, everybody.
Yeah. We tried to lube you up for this. First on the list, we finally have some sort of resolution. Oh, hang on. Hang on. I've got a fancy new screen share to bring up. I've now and this is I haven't I haven't shown you this, Max, but I've decided that I can turn the show or have Claude, should I say, not me. Yeah. Turn the
show plan that you and I reference into something that looks pretty decent, and we can just run through it visually on the show. I know I normally have, like, various different tabs open, but I thought, why not make this Oh, that's brilliant. And The other thing I wanted to say as well before we get into the doom, I keep putting it off,
is the intro is brilliant. I'm really enjoying that intro. That's a really, we you know, how quickly we've gone into a live show and have it also polished is pretty impressive. Yep. Well, you, Claude. So, yes, we finally have some form of closure
to the Clarity Act, which seems to have been, like, featuring in every Bitcoin brief in some way, shape, or form for what seems like an eternity. The the Clarity Act, for those that haven't heard the past 97 shows, is The US market structure bill that would have split crypto, Bitcoin, oversight between the SEC and the CFTC.
Last week, we covered the final text and the vote that was due on the September 15, which is obviously now passed. And on the September 15, the the senate voted forty nine and fifty, 11 short of the 60 needed to end the debate and move the bill forward to the final step.
Every democrat who voted said no, joined by three republicans who also voted no. Some guy called Tom Tillis also switched to no, was apparently a procedural move that lets him bring a motion to reconsider.
And some guy called Chris Koons did not vote. Democrats on surprisingly objected over ethics rules covering the president and his family's crypto interests. So basically, didn't want it to to go through because they wanna, you know, have a little pop at Trump for his questionable sort of interests. Yeah. Now to the stock market.
Yeah. Exactly. Yeah. Yeah. You're quite right there. The Republican holdouts were worried about community banks losing deposits to stable coins. Not sure how that's relevant, but it was in the notes anyway.
Another interesting fact, the the day before the vote, the final text dropped the explicit protection for non custodial developers against criminal charges on the section nineteen sixty, which is the unlicensed money transmitting law which carries up to five years in prison as we've kind of covered with the Samurai case at length. The
civil protection did stay in and there's a quote from Coincidence here that says that even if the bill would have passed, developers would still have been exposed under one part of the nineteen sixty.
The same charge which was, as we said, used against Tornado Cash and the Samurai developers. Senator Lummis, who was obviously behind this, warned before the vote that failure would leave no realistic chance this decade.
So, yeah, seems like it's pretty much dead. I believe there is one final stage that they that they can go to, like an appeal sort of thing. But the fact that it's got this far and then failed basically means that, as Lummis said, it's it's kinda dead in the water now.
You have to excuse my ignorance here a little bit, everyone, but I I'm personally not really taking this as a big loss, and that might be completely wrong. And, like, I really genuinely don't know how these things work and rather than, like, how government works, etcetera. Completely
don't understand it. But to me, at least, I just think whatever passes, whatever they say, if they wanna put someone in prison, they'll find a fucking way. They wanna stop something. They'll just make something up. There'll be a new act, a new emergency, this
this you know? And and even past that, if if they can't do any of that, they'll just plant evidence or fucking do some other bullshit or just kill someone. So I don't think, to me, this makes much difference. And if anything, they should just shake people up and remind you if you've been around for a long time and
open your eyes to if you're a bit newer. This stuff is never gonna be accepted ever, ever, ever, ever by the powers that be because it gives the individual more freedom or can if used properly.
And so all of this stuff to me is just complete theater, and it means very little.
Yeah. Dovetailing into the the Clarity Act flop, the CFTC
has contacted the White House, basically trying to jump at the chance with the the failure, basically saying that on September 17, two days after the the failed Clarity Act vote, the CFTC sent a rule making called, quote, regulation crypto asset transactions and regulation crypto asset markets. Wow. That's got a ring to it.
To the White House for review. It's the pre roll stage and the text is not public, but it is expected to give crypto spot exchanges a path to operate under CFTC oversight. This was basically ready and waiting, and it's basically the CFTC vying for control over the the regulation of this kind of market
in the wake of the Clarity Acts falling on its face, essentially. We obviously don't know how far that's gonna go or what the kind of the wording covers, But they're kind of staking their claim to say, you know, we wanna be the regulator for this sort of stuff.
That's what they want.
A no action letter is let me I've just lost my thought. Where are we? Yeah. The the CFTC, another one from them. They've they've got this thing called a dumb pipe letter, which apparently is letting passive trading software skip broker regulation regulation.
And no action letter is CFTC staff saying that basically they will not recommend enforcement against you as long as you meet their conditions. In March, the Wallet Phantom got one, which we, yeah, weirdly mentioned just a couple of minutes ago. On on September 17, CFTC staff letter opened the same relief to anybody who qualifies.
Software that passes user orders to CFTC registered futures firms and exchanges does not need to register as an introducing broker. Yeah. I mean, they're all just fighting to to be the ones that throw people in jail for failing to meet onerous regulations is what I can glean from all of this. Basically.
Yeah. Over the pond back in The UK, peer to peer trading
well, obviously, for those that don't know means buying Bitcoin directly from another person instead of through an exchange. And for a lot of people, that is the main way to buy without handing over your ID.
Well, in The UK on September 10, the FCA, the Financial Conduct Authority, HMRC, the tax authority, and the Met Police went into three London premises running quote unregistered peer to peer trading and issued a cease and desist letters at all three.
And it was announced on September 17 that it follows its first operation in April across eight locations, which is now feeding criminal investigations. The FCA says there is not a single peer to peer crypto business registered in The UK. No fucking wonder.
So anybody running a peer to peer desk as a business is quote, outside the rules. And the registration route has not worked for any of them. The UK's full crypto regime begins on the 10/25/2027, and two operations in five months suggest that their pressure is being cranked up.
I wanna be clear here that if you're in The UK, buying and selling Bitcoin directly with another person, you don't need to register to be a trader. Like, it's not illegal in any way, shape or form. Obviously Yeah. If you're not business.
Yes. If you're not doing it to make money, obviously, that is outside of the fact of the the kind of personal tax Mhmm. Obligations that you have. But in terms of, you know, needing to register as a business just to buy some Bitcoin, that is absolutely not the case.
But I just thought this is interesting that no there is not a single one registered in The UK. That says a lot of, like, how the what the posture look like towards this type of thing and how onerous the the regulations are to get over that line.
Yeah. Make it impossible for them to do it. And then when they don't do it, because they can't do it, fucking raid them. Yeah. Yeah. It's like, great. That's how you get business done, mate. That's how you get it done. Indeed. Yeah. There's no there's no name shared of, like, the the entities of whoever it was. So I don't know
who who it could be, but yeah. Now this is an interesting one. Huddl Huddl last week shipped coin security scoring, but then scrapped it a day later after quite a significant backlash.
HODL HODL for those that you don't know is Yeah. I I threw a few fucks into them actually. Well, I've got a hot take on this that you might disagree with, which I'll get to in a minute after I've given Yeah. The HODL HODL is appears to be a bitcoin marketplace with no KYC.
They trade settle through a kind of two or three multi sig escrow where Huddl Huddl holds one of the keys and you buy from another peer, essentially. So, you know, buyer has a key, seller has a key, Huddl Huddl has one for arbitration purposes.
On the September 18, HODL HODL announced, quote, enhanced Bitcoin security scoring, where incoming Bitcoin will be checked for, quote, serious red flags before a contract settles and trades with bad score would be blocked.
HODL HODL said it was, quote, not a KYC AML process. Users pushed back pretty hard on and on September 19, just one day later, Anna from the Huddl Huddl team posted a follow-up where she kind of basically said, you know, we we kind of got this wrong or we, you know, this could have been announced better.
She mentioned that it shipped without a warning and was explained fairly poorly and that they've they've disabled it for now. And that if it comes back in any form, it will be disclosed beforehand.
So the scoring system, I don't think they went into details on how they were scoring it. I'd imagine that was proprietary, but they were looking for, like, I guess, you know, what is sometimes called kind of taint analysis similar to how chain analysis look to kind of give certain kinds of score based on their history.
Huddl Huddl has not said how the blocking works, but, you know, obviously they hold a key on every trade. So it gives them a bit of a position to make well, it gives them all the position to kind of see what's happening in in every trade, basically.
Mhmm. So it's it's off for now after the push back. But my guess is that given that they have grown to a certain size, they probably didn't make this decision
off their own back. I'd imagine they probably had some pressure. Again, this is pure conjecture. I don't know this for sure, but I'm guessing they probably had some at at the very least, tap on the shoulder to be like, hey, we we see what you're doing. It's probably a good idea for you to do this.
And the fact that they've been able to rip it out a day later tells me that, obviously, they're trying to appease the the the user base, which is obviously predominantly privacy preserving users by the nature of or privacy appreciative users because of the nature of what the business is. It's paid to be a marketplace.
But, you know, as soon as you you're in this business and you grow to any sort of size, you're inevitably gonna get the catch the eye of the regulator and they are, you know, give you a tap on the shoulder or threatening letter and unsurprisingly,
and I do not blame them. If if that has happened, again, is conjecture, I don't know for sure, then they are not willing to go to prison over it. And hence, they're they're putting or they did put plans in place to kind of appease the the the regulator, basically. Now,
understandably, people got pissed off about it because it's something new. No. I would make privacy preserving users not want to use that service. So they did get some pushback, but I don't blame them for not wanting to go to prison.
Blame them for not wanting to go to prison, and I will give them this. At least they came out and said it upfront rather than the shotgun KYC sort of situation where it's like, you know,
which is that's the worst. That's that's the, like, hey. Come and use our service, and then you use it. And it's like, right. We've frozen your funds. Now what we're gonna need is enough information to really cause you and your family potential harm from attackers, and then we're gonna store that insecurely
for you so that you can get your money back. Like, that's the worst of the worst. So at least they came out and said it upfront. Yes. Almost certainly, they're gonna have pressure on them because it's, like, the worst marketing decision ever otherwise.
So I feel for them in that sense. And like you say, like, as you get larger, you're gonna have this pressure. But I think what pissed me off is just when you talk about risk scoring, what they're doing almost certainly, I can almost guarantee this if you've used any privacy preserving
tech, if you've used a coin join of any sort or or, like, done anything to try and protect yourself, that's what we'll flag. And so it's not so much that I'm angry that well, I'm annoyed that they're gonna have it eventually, but it's like, the way that these things are conducted is the problem. It's not like, oh, you've stolen funds from
this individual. We can see that. It's, like, 99.9%. Like, there's the hack. They've gone to your UTXO, and you sent straight out to this. We're gonna we're gonna freeze them. It's, oh, you've used Whirlpool or you've you know, whatever thing that they're not happy about. And that's what pisses me off. It's like, you're assumed criminal
for trying to protect yourself. It's that's fucked.
Yeah. So I don't know how this is gonna pan out. I'd imagine that they probably like I said, they they wouldn't have done it without good reason. So my guess is that this might come back at in some way, shape, or form. But for now, it's not there. And they seem to be,
you know, open to the idea of, like, if it if it does have to come back, we're gonna communicate it in a much more clear and concise way before Fair play on that part. Absolutely. Yeah. Yeah. As long as they do that, then then I respect it.
Yep. Absolutely. Next piece, another one from The Rage. Pretty good article actually that they're they're arguing that the strategic Bitcoin reserve may not actually exist, which I'm sure is probably an idea that's been shared by many people in the space who've been skeptical of it. But in March 2025,
executive order one four two three three created a US strategic bitcoin reserve meant to hold the bitcoin the government had seized. Well, on the September 16, Lola Leets at the rage published an investigation arguing it may exist only on paper.
That same day, the House Financial Services Committee advanced a bill called ARMA by 28 votes to 21, and it tells agencies to keep custody of their Bitcoin until the reserve is, quote, fully established and certified operational, which is how you would write a bill about something that is not running yet.
No reserve office appears in the treasury's public org chart or their office list, and the treasury's 2025 fiscal report does not mention it.
Bloomberg also reported that in July, the treasury and commerce were still arguing over who has the authority to run it, and the rageous freedom of information at request for the records on the reserve office is still pending shock horror.
Obviously, of this proves that it doesn't exist, but there's a there's a couple of red flags there.
Okay. Another update on well, a quick update on the Liquid saga.
Still well, Liquid is now back and operational, but they are still around about 600 Bitcoin short. And we're in what? Two, three weeks on now. And LBTC holders still, I believe, as of today cannot peg out to on chain Bitcoin, but they can sell or swap through services like Aqua's Indra, which we're gonna come on to in a second.
But liquidity is extremely limited.
When peg out reopen They can swap to
I was just gonna say they can swap to stable coin, whatever the stable coin is on there. Can't remember which one they use now. I think it's Tether, isn't it?
Yeah. It is Tether. Yeah. You I think you can swap from liquid to Tether, but you can't go from LBTC to BTC. Right. Oh, thank you for that. Wasn't it? Yeah, still they're still chasing that 600 or roundabout 600 Bitcoin, which is, like, $50,000,000 with the attacker. No further updates on that.
Blockstream gave a update on the September 17. Said peg outs are gonna stay paused until the one to one backing is confirmed and the software updates and independent security reviews are done.
It hasn't given any dates and the promised technical post mortem has not yet been published.
Next on the list and tangential to this, Aqua Wallet has launched Indra, which is its own liquid sorry, lightning to liquid swap service. I thought this was great timing. This is hilarious timing to me.
Yeah. Is it not like is it not like, hey. Whoopsie. We had a bit of a just a small mistake that's just happened, but come and use this service. Yeah. Well Seems like bad timing. Yeah. I mean,
they are two separate companies, albeit they are kind of known to be friends. The same. Like, yeah. Aqua is is run by Jam three, which is Samsung mouse company. It's not a Blockstream or or at least a direct subsidiary of Blockstream to my knowledge. But Yeah.
But it's the same cabal. It's the same, like, I don't know. It just seemed fun. I read through the list. I didn't know it was in there, and I read it this morning, and I was like, fucking hell. Yeah.
So on the September 15, January 3 of Aqua Wallet launched Indra, its own liquid Lightning Liquid Swap Service for Aqua Wallet, which is in open beta. For now, it only handles Lightning sends, paying an invoice from liquid Bitcoin with receiving to follow later.
January 3 have said that they've copied the Bolt's API signature so it can act as a drop in replacement and other wallets could plug into it. Although for now, it is Aqua only. And then about three hours after launch, Indra was hit by a denial of service attack and forward swaps were temporarily switched off.
So, yeah. Seems like nothing is nothing is safe at the moment. That was actually one of the potential show titles I had for this show was Nothing is Safe.
Speaking of speaking of Nothing is Safe, Core Lightning I've lost my notes for this one. Must have done oh, no. Core Lightning, which is Blockstream's Lightning node software.
They have been told to disable experimental features such as dual funded channels. For those of you who don't know, dual funded channels let both sides put money into a channel when it opens.
This feature is sat behind an experimental flag, literally called experimental dual fund. On September 12, CLN operator opened the GitHub issue and a peer had opened the dual from the channel with his node, drained most of the liquidity and gone offline.
And the funding tracks transaction his node had recorded did not exist on chain. On the September 14, a CLN collaborator said early indications were that only dual funded channels channel opens are affected and that removing the dual fund flag should be enough for now.
On the September 15, Core Lightning issued a security advisory telling anybody running the experimental features to turn them off. At least two more operators have since reported losses and one says that the channel was about 10 times larger than the funds that were actually locked, which I found pretty bizarre.
Two, this day there's no published root cause and no patch released yet. So if you do run a CLN node and you are being reckless, maybe go in and check all of your configs and turn off the experimental stuff.
I guess the clue is in the name if you are running experimental stuff, particularly with lightning where funds are hot, then do so at your own risk, especially in September 2026 where nothing is safe.
Right.
Next on the list, we have a lightning spec proposal for rejecting invoices with duplicate payment hashes. This is for bolt 11, is the standard format for a lightning invoice that's been around for well, since 2017 essentially.
In that, every invoice carries a payment hash, which is like the the fingerprint used to confirm that an an invoice was paid. On September 10, roast beef of Lightning Labs, the one that talks at 19,000 miles an hour,
opened up a request to change the specs so that software reading an invoice must reject it if it contains more than one payment hash. The poll request says a popular Telegram p to p trading bot was recently hacked through this gap. I'm guessing that's LNP to p bot because one of the most popular ones.
So apparently, some libraries read the first payment hash and others read the last. So a system using both could be tricked into believing that a withdrawal was never paid out. The change has early approval but has not been merged yet.
Obviously, another warning if you run a service that kind of reads lightning invoices in code, maybe have a check at how it rejects the invoices and, you know, minimize your risk accordingly.
Again, nothing seems to be safe, so be very, very careful.
That's just everything just being taken out. Nice. Shot after shot. You know, we said before going live that it was, like, fucking depressing. Can I bring our robot discussion from off air in just to, like, break up the pain just for two seconds? Absolutely.
Do you think we're gonna get you know, obviously, I'm so excited about my little robot Hoover. We've got these Optimus Prime, like, whatever they're called, things from Tesla supposedly coming in 2027.
Obviously, you've got great experience in this field actually being one for all these years. Like, do you think that we're gonna get to a stage where not every household has one in the same way that not every household has local AI, But it could be a reality that, like, you get one of these things and it's taking the bins out and, like,
you know, dad mode of, like, walking behind your children just picking fucking stuff up that they just they take that off the shelf. They just fucking throw that on. That smashes. Like, it can do that stuff.
It can just clear away, do the like, just all the all the stuff that, like, could free you up to do other things in life. Do you think we get there within the next couple of years with everything accelerating as it is if maybe regulators stay out the way or we get some open source stuff happening?
For the majority of households in the next couple of years, no. Okay. I think would it be a possibility? Yes. Is it gonna be ridiculously expensive and very buggy? Yes. I think that type of horizon where it's, like, as commonplace as having a a Hoover Right. Is at least ten years out. Really? Ten years? That's a long time. Yeah.
Okay. You're much more bearish on this. And what you're saying is if you could afford one of these things, get a Filipino made. Yeah. It'd be a lot cheaper. Pretty much and better, probably. Yeah. And it's just there's a part of me that's like, I got I got caught out with Bitcoin
thinking it was gonna be much faster for the average person to start using it than it is, like, by a long way. Like, I was really wrong. I was really wrong. Like, I thought, I don't know, ten years from now, it's gonna be so commonplace that people don't even question using it. And I was so fucking wrong.
And then I was also wrong on all the AI stuff. I was like, oh, this is gonna be a long time till this is useful. You know? It's gonna be a long time till we're gonna be able to do useful stuff with this, and I can trust it to do some of the stuff it's doing now. I thought, like, it's gotta be at least five, ten years.
And then and then suddenly, I'm like, oh, no. This is, amazing. I'd I'd I'd much rather have my AI than I would, like, a team of two or three people. So, you know, we're we're there. So I'm just wondering if we get caught off guard with this. I just think, like, you're right. And in hindsight, the the AI acceleration
makes sense because, like, it's it's software at the end of the day. That's and that it's it's the language of computers. Right? It lives in the computer. It stays in the computer. Does shit in the computer.
When you go into Meetspace, like, that just raises the the difficulty level exponentially. Like, how how long have we had Tesla's ability to do full self driving? And only in the last month or so have we got autonomous fully autonomous Yeah. Yeah. But that's not fair because because that is regulatory bullshit.
That's Well, these will be regulated into oblivion as well. No. But my point is, right, it is very different. I think it's more different than people realize because a car or a truck on a public road is gonna be much more attacked by regulators as are taxis and things that take jobs away that are out in public.
Something that's inside your own home on your own land is a very different risk profile. And, yeah, those things have had the ability to drive around for, I don't know, like, five years. They've been doing it in parts of America. They're fine.
Much better than most drivers that you encounter on the road who are human. So, like, it's not that it's not capable. It's that it's regulated and not allowed to do what it can do. So my my thinking is, well, we've got AI.
We've got three d printers. We've got the ability to share software. We've got the ability to pay anyone anywhere in the world without, like, the friction if we so wish.
We're getting into the realm of, like, metal three d printing and all this other stuff. I'm just wondering if there's, like, a a merging of, okay. Well, you can build these five parts, and this thing's gonna, like, do your dishes and do your stuff, and you can download this software, which is open source and, like, completely bypass
the regulators who would otherwise definitely get in the way. I'm just thinking, like, is it is it that we can build it and make it possible if we sidestep all that sludge? Yeah. Potentially.
I just I just think when you do shit in meatspace, irrespective of where it where it goes, I just think It's harder. It's it's gonna be a lot harder to actually make it useful. Fair. Fair. Okay. Right. Non Bitcoin. We'll go back to the Bitcoin thing. Just just something I'm thinking about.
Okay. Next on the list, Blink. On the September 19, Blink, a Bitcoin wallet that offers custodial and noncustodial Bitcoin accounts. They paused all services after an attacker got into a limited number of custodial accounts and withdrew funds.
It later said, quote, a few dozen custodial accounts were affected and and that everybody has been or everybody affected has been notified and will be made whole. And that non custodial wallets were not affected at all.
And patch went out and services were back on the exact same day. The affected accounts are gonna stay locked for now apparently and that those users do not need to do anything to be I need like a Blink has not yet said how the attacker got in or how much was taken and a full post mortem is promised, but has not yet landed.
Another one.
Another one bites the dust. We need a DJ Khaled one. Which one? DJ Khaled. Another one. Yeah. Yeah. Yeah. Yeah. That was slow for me. Yeah. Okay. That's a good idea. Another one. If anyone has ideas for the soundboard and you wanna clip something up and send it to me, I will strongly consider its use. You can
create an m p three and ping it across to us. That would be much appreciated. Bit of value for value. Nice. Haruko is a London based tech provider for crypto trading firms. Probably not. And they connect clients to exchanges through an API service.
On September 18, Koinesk reported that Haruko had been hit by a targeted attack earlier that week, which affected 15 of their clients,
which were all of the ones without an IP whitelist, a setting that only allows API access from approved addresses. Why would they even allow you to use the service without it? Anyway, according to the CTO's message to clients, the attackers used the floor in Haruko's processes
to pull out user access token exposing exchange API details and trading data. Three sources told CoinDesk that a small amount of client funds were stolen, mostly from smaller hedge funds with weaker controls, but Haruko did not respond to CoinDesk, so details
are limited in terms of the volume of the attacks. But if it's a hedge fund, my guess is it's not a couple of thousand dollars worth. No. Next on the doom list, we're nearly there guys. Thanks for sticking with us. Swiss Bitcoin Pay takes its servers offline after a suspected breach.
Swiss Bitcoin Pay, which I'd never heard of until now, is a non custodial Bitcoin or Lightning payment processor for merchants based in a place called well, it's on screen there. I'll let you try and Where?
Based in Neuchatel?
That can't be a real word. Why has it got what's the c oh, it's just because it's a different Yeah. That's been translated hardly by the agent when he made the slides for me. It's it's not actually there. There is a out over the a, but anyway, it's Swiss.
Okay. They took their service offline on September 14 after a malicious user likely got into its internal systems. The company believes customer email addresses, bitcoin addresses, I bands, transaction histories, and hash passwords may have been accessed.
It says that user funds are safe and any amount owed to users will be fully returned. As of today, servers are still offline with no date for restoration. Obviously, non custodial design limited direct access to, you know, and and limited losses
because the the merge merchant funds sell directly to to user wallets in a self custodial manner, which is good. Obviously, the main damage here is a significant privacy one. Tailors all the time, you know, if if you can't look after your customer's data, don't have it in the first place. KYC is the dragon that man must slay.
Yes. Thank you, Jamie. Order must be restored by the robot with monstrous calves. Down to you, mate. Do my best. I'll have to get my magic wand though. Alright. Last on the list, a quick update on the Revolut story that we spoke about last week where somebody from Revolut handed over customer data to a fake government request.
The attackers are starting to leak it. They used a hacked email account on a real Italian government domain to send fake law enforcement data to request Revolut's Lithuanian bank. The bank handed over identity documents, KYC selfies, bank statements, transaction histories, and at least 680 customers are affected.
And the the attacker say they picked accounts with significant crypto holdings using blockchain analysis. On the September 16, the group which calls itself I'm not a villain, demanded 6,000 XMR, which is about $3,000,000 within twenty four hours or it was gonna sell the data.
The deadline passed on September 17. Revolut says it's had no direct contact from the group, and the Italian police and The UK regulators are still looking into it. Samples have already been unfortunately posted on Telegram, so this data is gonna continue to circulate whether or not anybody pays.
Wow. What a week. KYC is the dragon that man must slay. Say it, Jordan. Can't say this too many times. Slay that fucking dragon. I wholeheartedly agree. Right. Let's do let's hit something positive, mate. Let's do some boost. I'll let you lead us off.
Okay. Lonely pumpkins with 10,000 sats. Thank you, Lonely pumpkins. That is that's like a Monero style boost, that is. Keep up the good work, gents. It's been a crazy summer with all the hacks and drama.
Never a bad time to check-in with your Huddl setup and do some reps. Cheers. That is a that is a great boost. It is it is never a bad time to do some reps. Yeah. Cosign that one. Next one comes from Cruz.
He said this is going back to our meet my discussion around my very boring weekend. And he said, the worst part about kids birthday parties is dealing with the NPC parents. Did you catch the Oh, god. What do you do for work? Jeez. This weather,
wouldn't be any closer to the truth. Yeah. It is fucking painful. How do you get around that? Is there any, like is it I'd like to hear if anyone's come up with a hack because you can I I guess that you could be, like, the volatile weird one and say something really fucking inappropriate, and then people either will love it
or they'll just never speak to you again? So it's kind of a win win, but I wonder if there's anything else. But you don't you sort of don't wanna do that because that's like, oh, I don't want my kids to play with that one. Do you hear what they said?
They said the KYC is the dragon must be slayed. What a what a fucking weirdo. Yeah. My my hack is to send the wife as often as possible. Oh, yeah. I mean, that's that's the best way possible.
Late stage huddle. Apparently, I can't keep my boost cadence with the new weekly releases. Thank you for providing the news and entertainment for me on a weekly basis. Thank you, late stage Huddl.
Quick shout out for the best of the rest, RevHuddl, t y m Thank you. Silla Stormbrook, Gnostigang. We see you. We appreciate you. Thank you all for your boost as well. Well, we do appreciate you. Oh, on another note, bit of value for value stuff.
I went on Bowls With Buds with Lorien and Spence the other night. Did a live show, and it was good fun. So thank you for for them to getting me on and spreading the good word about Ungovernable.
I appreciate you both. Very good. Alright. Let's whisk through these releases and wrap this baby up. K Qualate version six point four point five is out on the September 20. It contains minimal release, smoothing out connection to Trezza hardware wallets.
Also speeds up Monero background sync with more stable node connections plus a couple of UI polishes and bug fixes. Umbrella OS 2.0 is now on beta version two. I don't have any release notes as to what's actually in this beta two yet, but they've been doing lots of teasing.
They're they're good at marketing them them guys. I'll I'll I do Very good. I do like you know, we've got a link to the release notes here. Let's have a look. You remember when they released that, like, storage thing with the with the wooden stuff?
You remember? Yes. I do That was that was top tier. See, look at this. Yeah. Look at this. That looks great, doesn't it? Just a simple graphic. You see, Bitcoin is you can do this, especially now with AI. You can get to this level where
things don't look like they were built on the back of a fag packet and in command line. Like, it can look it can look beautiful. So, Umbrella two point o, we've got redesigned search across apps, files, photos, settings with visual results.
Your AI agents can now create and use machines with screen, keyboard. Oh, yeah. They have virtual machines in there as well. Omaki, which is that new Linux distro that everybody seems to be very excited about, is now available in the machines feature.
Android machine is now open in portrait mode. You can track uploads. Yeah. Very nice. You can move apps to external drives, cloud imports. Yeah. They do a cracking job. That that machines is very interesting, actually. I'm gonna have to give that a whirl on mine to spin up virtual machines and mess around with some AI stuff.
Very cool. I have a question for you. If we if we have time, I have a question which will take about one minute. Okay. You got time for that? Is yeah. Right. Yeah. So when I was discussing on Freedom Tech Friday with Seth updates,
AI updates and stuff, which is a great show. If anyone hasn't listened, go back. We go into all sorts of things on there for self hosting. But one of the things I was asking him is, like, is there gonna be, like, a an I actually said, like, an Umbral type operating system where someone can manage their sparks or or Mac hardware and
make it easy to use and simple and laid out in a way that, like, a crayon eater could use. And he said, no. I don't think it's necessary. Just have your AI build you
the system for you to use and tailor it to yourself, and there's absolutely no need for a number. I don't think there's a place for it. And I was kind of, like, not expecting that answer really, and I wondered if you feel the same.
What what are you like, what what is the experience that you're you're kind of leaning into here? Like, what what do what are you after? So I'll give you so I'll give you an example. For some reason, I find behind the sofa a $100, and I go, wow. Right. I'm gonna be like Seth.
I'm gonna go and buy eight or 10 Sparks, and then I'm gonna start setting up infrastructure so that I can talk to my
computer from my phone and my laptop anywhere in the world. I want it all set up privately as possible. I want the storage to be connected to this whatever NAS RAID shit. Whatever the thing is, I want all that done. I want it all done like a a Seth or a Q would do.
And I I would look at the boxes, and I'd go,
right, people are talking about this Quinn something. Oh, where would I download that? How would I have to verify it? How would I and then that would go on what? That would go on the storage thing that's over there, but could that and I'd have, like, a thousand, like,
autistic style questions without the processing power to actually work it out. The I would just get confused and be like, what I would want is, like, download this, you know, Umbrella OS. That's the first thing you do. You download that onto your laptop, and then it just fucking does all the other shit. Everything else is, like,
simple somehow. That's what I'm imagining. Yeah. I I do you know what? I don't think Umbrella OS is that far away from that. Okay. Like, you you you know, you can buy the box from them. It comes preinstalled with the software. You can install your apps.
Those apps can be Olama, it can be Hermes, OpenClaw, whatever you want. And then from within those applications, like, it's just click and point of
if you've got a beefy enough Umbrella machine, you can download the model straight to it, have it locally, or plug in API keys. Like, it feels like it's not a million miles away from that. So, yeah, I take the other side of that coin for for Seth. Okay. Yeah. Because he was just like, well, you would just get your AIs to build it.
And I'm like, hey. You would. You would do that. You'd build your own operating system, whatever, but I'm just talking about for simplicity. So okay. Alright. Good to know. I just lost my screen. There we go.
Bitcoin Core version 32 release candidate two is now out. Is there anything worth talking about here? Yes. According to the draft release notes, PSBTs now default to version two. A new export option creates a watch only copy of a wallet with no private keys and offline signing setups.
There's new commands to help set up multisig. Basically, stuff that people are never gonna use because no one uses Bitcoin Core as a wallet. One. Not no one. Who do you know that uses it?
That Wookiee thing, and it's and it's mate, and, like like, maybe seven other people. Yeah.
Yeah. I just I don't obviously, I'm thankful that Bitcoin Core exists to work on the the core code base, but, like Yeah. We could really use those engineering hours, like, elsewhere because Yep. It just just seems like a waste of time. Like, nobody's using it. It's just a terrible, terrible user experience.
There's so many better options available. Speaking of which, Spiral Wallet version. Look at that. There we go. It's in '2 point five point five is now out as of the September 17. It's got some BitBox o two related fixes, some treasure related fixes,
and oh, it now adds a system theme that follows your operating system light or dark setting. Very nice.
Speaking of BitBox, this is pretty cool. The BitBox companion app, which is literally called the BitBox app, as of version 4.52, which came out on the September 15, let BitBox o two owners of the hardware wallet create a lightning wallet inside the mobile app, funded from their on chain balance,
and crucially, derived from their existing Bitbuck backup. There's no extra no extra seed words and no channels to manage because it's built using Spark and the Breeze SDK. Pretty cool. Very cool. I like that.
Oh, a little bit of what do call it? Like a teaser. We have Roy from Breeze coming on to talk about all this type of stuff in a couple of weeks on Freedom Tech Friday. So I'm really looking forward to that one. Yeah. That'd be a good one. I like I like Roy. A lot he's got some of the my favorite articles in Bitcoin.
Very good writer. We always we always talk about how it's just heads down, build, no drama. Yep. Absolutely. Yeah. I like it. Eclair Vision zero point fourteen point three has come out. Not a very exciting one, but I've included it in the highlights because it is a security
hardening release with fixes that came out of project loop, which is blocks open source AI, white hacker initiative, basically, that kind of points agents at open source projects to kind of harden them. So this release is as an output of that. So
more examples of block kind of doing good work in the open source space, which I thought was pretty cool. For the one person that listens to this, it might run a a on an incline node. Because again, just like Bitcoin Core, I don't know anybody that does run one.
Make sure that you're updated because there are some vulnerabilities that have been patched. And finally, not strictly Bitcoin, but I thought it was pertinent to a lot of people that do listen to this.
As of the latest beta release for Signal Android, you can now register without a phone number by paying a one time fee of about $3 to to presumably to the Signal Foundation.
And, yes, this is one of the the kind of main things that gets leveled at Signal is that you need a phone number to set up. Well, now you don't have to if you pay a one time $3 fee. Signal say that the payment uses the the same zero proof
as its donation system, so the purchase is not linked to your new account. Because obviously, if you're paying with your bank card, then, you know, if there is no zero knowledge proof there, then
it would be trivial to to link those two. Users get an account ID and an account key instead of a phone number and a PIN. There is no recovery if either of those things are lost. And without an additional sorry, optional username, the account can only take part in the chat that it starts.
Okay. That's quite cool. If it I mean Absolutely. It's cool. Very cool. I'm just trying to think. So they use this zero knowledge proof stuff to not tie your payment to the account. So there's obviously
proof that you have an account and you've paid for the account because you've gotta pay with your credit card. Presumably, they're not accepting Monero or Lightning. So so there's that. So it's like, we know you you have an account. We don't know what the account is kind of thing.
Yeah. So we would know that the person that has Max's Google account has paid for a Signal account. Mhmm. But Signal doesn't know which account that is. Well, that's actually I like that. Yeah. That's really good. Like that as well. There are a couple caveats.
The payment obviously goes through Google Play Store, so it needs Google Play services. So if you run something like Graphene and you haven't got the compatibility layer installed, you ain't gonna be able to access this. Yeah. Yeah.
And signal does say that more payment plans, although they haven't specified what those are.
That's right. I like that. Yeah. And to be clear, this is Android and it's beta only. No current date for iOS or a stable release. So be careful. What was you just made me think wait. As you said, Graphene. You know, I shared that
link and I said, is this just clickbait nonsense or any truth to this? I shared it enough for even till Friday about I'm I'm bringing it up now. I'll be honest, I I didn't read it. I'm just I put it up on screen here. It says from b c address, bitcoin on your hardware, the passphrase.
Bear in mind, this is translated by Twitter, so it might not be fully accurate. But by now, you already know that without clicking, they drain your crypto from your hot wall on Android. Even with Graphene OS, the vulnerability has been shown
known to Samsung and Google for months. Google says zero click cellular modem vulnerability in pixel has been detected in limited and targeted attacks. Logic error allows an attacker to bypass permission checks and gain elevated access.
GrapheneOS affected since it's a baseband processor exploit. It's a completely separate RF computer responsible for all incoming outgoing communications and which by default has roots access to the main system.
Oh, yeah. There we go. Look, GrapheneOS. I knew they'd be on this. They said it's patched in the latest cellular firmware. That that will be included in today's GrapheneOS release, which is four days old.
So it update graphene basically is is the TLDR there. Yeah. Okay. Just I just saw it and thought, oh, okay. I wonder. Yeah. No. It definitely worthwhile bringing that one up. Yeah. That brings us to the end of the show. Hopefully,
next week, we might have something more positive to talk about, but the way that things are going these days, we you never know. Yeah. Well, I'll leave I'll leave it with one positive note is we still have Bitcoin, and it still fucking works.
I've made a few payments today to different people all around the world, and it just fucking works. So, yes, they might want to make things difficult. Yes. There's a load of hacks and all the sorts of stuff, but you do have the power to transact freely, and that is fucking awesome.
It certainly is. Yeah. I can't think of a better way to close out the show than that. So, yeah, until next time. Stay uncovernable. Yeah. Stay ungovernable.
Machine transcript; expect the odd mishearing. Click a passage to play from there.




