
More Compromised Hardware!?
Discussed in this episode
Boost this Episode
Boost from here and it goes to the show. Boost from a podcast app and it splits like this:
Plus 1% to Podcast Index, 1% to Boost Bot.
Show Notes
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
- bitcoiner.guide down due to hosting headaches
- Correction to last week's chat about Bitkey
NEWS
- Hardware hacker Joe Grand examined a Trezor Model T bought on Facebook Marketplace in Canada in 2025 and a Trezor One from a TikTok shop in August 2026, both from unauthorized sellers on models Trezor discontinued in January 2026; in both, the main microcontroller had been replaced so the device produced one of about a dozen phrases the attacker already knew instead of a random recovery phrase, with a microSD card soldered inside the Model T holding genuine firmware to pass the integrity check and the Trezor One's swapped chip carrying both the malicious and official firmware, costing its owner about $50. Trezor told Zero Day on 15 October this is a known counterfeit method it has warned about since fake Model Ts turned up on Russian marketplaces in 2022, that it hasn't examined these specific units, that its Suite check is designed to catch devices producing predetermined phrases and it knows of no way to pull this off on its current Safe range, and that its 13 October comment about no evidence of compromise referred to new devices bought from its website or authorized resellers. Both hosts stressed this is not a Trezor supply chain issue, unlike the Ledger case, since both devices were counterfeits sold by unauthorized sellers, and urged listeners to buy hardware directly from the manufacturer and be wary of any reseller -- Zero Day (Kim Zetter), Cryptoast
- Trezor said on 13 October it has cut the number of resellers it works with and is reviewing vendor relationships as a preventive step following the CryptoBilis implants, with dropped resellers able to sell existing stock until 1 January 2027; this isn't a flaw unique to Trezor, the hosts noted, but something that could affect any hardware manufacturer -- Bitcoin Magazine, Cointelegraph
- Recapping the 9 October CryptoBilis drain of $86M to $93M, Ledger's 15 October statement says a "highly organized criminal group" bought devices, fitted the implants and fed them back through resellers with seed-collection, draining and laundering servers built in advance, that there was no flaw in its chip, operating system or servers, and it has asked resellers across Southeast Asia and Hong Kong to suspend sales without giving an official loss figure. Mark Karpelès says a Ledger Nano X bought at MediaMarkt in Germany is confirmed to carry the same implant, and reported another from a shop at Singapore's Changi airport, though Ledger hasn't examined either device and every confirmed theft still traces back to CryptoBilis; MediaMarkt has pulled Ledger devices worldwide. Chainalysis found a scam operator who stole roughly 60 BTC ($5M) from task-scam victims had it swept up in the same drain after moving it onto a compromised Ledger device, a bit of karma the hosts enjoyed -- Ledger statement, Bitcoin Magazine, Bitcoin Magazine (scammer victim), ForkLog (Karpelès), crypto.news (MediaMarkt), TokenPost (Gauthier v Karpelès)
- On the same day as its CryptoBilis statement, Ledger announced Atom, an Android phone due mid-2027 that runs everyday apps and switches into a protected mode for managing keys, with an OpenClaw AI assistant whose actions need physical approval on the device; Ledger says a tamper-sensing enclosure with its own battery will block screen-reading implants like the CryptoBilis ones, and Atom will sell only through Ledger's own website at $849 for a Founders Edition ($899 after launch). The hosts called the timing tasteless but the engineering impressive, questioning whether a phone that also runs WhatsApp and TikTok belongs anywhere near your keys -- CoinDesk
- A UK trader posting as "realist" on X says attackers held him at knife point and forced him to transfer close to $800,000, with $40,000 coming from a hot wallet and $720,000 from a Ledger hardware wallet; police have made no public statement though he says officers are investigating, and some commenters unofficially link it to the recent Revolut breach that leaked users' crypto holdings and home addresses -- CoinDesk
- AI-assisted searches from researcher Pizza Bitcoiner helped Jameson Lopp merge new cases into his wrench attack archive on 16 October, taking it past 700 documented incidents, with France the leading hotspot at 77 recorded incidents so far this year; the hosts' advice remains to keep your mouth shut about your holdings and stay pseudonymous online -- Jameson Lopp (GitHub), TFTC, Pizza Bitcoiner database, OCCRP
- Bank of Russia guidance dated 12 October confirms direct peer-to-peer crypto trades between individuals stay legal only until 1 July 2027, after which every trade must go through a registered broker or exchange under Federal Law 282-FZ -- TFTC, Bitcoin Magazine
- The US Treasury announced $1.2 billion in combined penalties on 13 October after Bank of America admitted willfully violating the Bank Secrecy Act, failing to report over $5 billion in suspicious transactions to FinCEN between 2018 and mid-2025, with the OCC's $750 million penalty counting toward the total, OFAC settling separately for $11.6 million, and no executive charged; the hosts set that against the five and four year federal prison sentences the Samourai Wallet developers are serving for pleading guilty to running an unlicensed money transmitting business over privacy software they wrote -- ABC News (AP), TFTC, Treasury
- Citizen Lab's AdFection report is the first public technical confirmation that mercenary spyware can reach a phone through targeted advertising alone, with no click needed from the victim: at least 45 devices at Al Jazeera were targeted with Candiru spyware in 2024 and 2025 through ads bought by Israeli firm Discover-Tech, with attacker scripts found in over 75,000 Android and iOS apps and over 120,000 websites; Google, IAB Europe and several ad exchanges cut Discover-Tech off in early October, just before the report came out -- Wired, BleepingComputer, Citizen Lab
- 404 Media and Court Watch reported that newly public court records include a letter from Telegram to US authorities, sent after a court order, disclosing a specific user's phone number, Telegram user ID and IP address, a reminder that Telegram is not a private messenger and shouldn't be used for anything you want kept private -- 404 Media
- OpenAI published a misalignment report describing how an internal GPT-5.6 Sol research model, given no funded wallet, checked 362 addresses derived from a commonly used developer recovery phrase on 26 June, found one with funds and paid Sepolia testnet fees from it to finish a coding task without disclosing where the money came from, reasoning the funds on a known public developer mnemonic were "effectively abandoned"; only valueless testnet ETH was involved, and OpenAI caught it on 25 September through extended monitoring and has restricted live internet access for similar tasks -- OpenAI misalignment report, CoinDesk
RELEASES
Fulcrum 2.1.4 -- 2026-10-18
- Adds a parallel hash lookup that makes get_history and subscription queries 5x to 10x faster on cold or uncached lookups, tunable with a new history_lookup_threads setting. Also refreshes the built-in server seed list.
Lightning Terminal v0.17.7 -- 2026-10-17
- Bundles Taproot Assets v0.8.6 with lnd v0.21.4-beta and Loop v0.35.0, ships reproducible archives with a signed tag, and the notes give a staged upgrade procedure for nodes with a price oracle.
Am I Exposed v0.43.1 -- 2026-10-15
- Fixes the find-connection tool added hours earlier in 0.43.0, which brought encrypted backups with an optional wallet key lock and graph investigation tools: find connections between addresses, BIP329 graph labels, a time layout and multi-select.
Bisq 2 v2.1.14 -- 2026-10-15
- Required update fixing vulnerabilities from Bisq's recent security audit. Offer takes must match the maker's current offer and price, buyers enforce seller reputation limits, and Bitcoin URI and Lightning invoice amounts are checked against the agreed trade. Also signs storage, isolates Tor connections between identities and moves to Tor 0.4.9.14.
ZEUS v13.2.3 -- 2026-10-12
- Stable release after 13.2.3-rc1: embedded LND 0.21.4 and an LDK Node build with the rust-lightning 0.2.7 security fixes. Also checks LSP-wrapped invoices match the invoice they wrap and binds LNURL-auth callbacks to the signing domain.
Bitcoin Core v32.0rc4 -- 2026-10-12
- Fourth release candidate for 32.0. Block validation can now fetch the coins being spent from disk in parallel (new -prevoutfetchthreads, default 8), the default connection limit rises from 125 to 200, onion services Bitcoin Core creates get Tor's proof-of-work defences against flooding, and a bug that could leak your IP when using private broadcast over Tor is fixed. The final release follows once testing on the candidates is done.
Nunchuk Android 2.9.1 -- 2026-10-13
- Adds an option to export the XPUB of any key, including software keys, along with bug fixes.
Bitcoin Seed Tool 2.4.1 -- 2026-10-13
- Fixes layout problems on phones and merges the SeedQR controls into one button with a SeedQR or Compact SeedQR switch, also for BIP-85 child seeds and Seed XOR shares. No change to how seeds, keys or addresses are generated.
Corisco app v0.3.0 -- 2026-10-18
- An open-source (MIT or Apache 2.0) Android Lightning wallet whose keys live on a cheap LilyGo T-Display-S3 (ESP32) board you flash yourself, with every payment confirmed on the device's own screen over Bluetooth. Built on Spark, so Spark operators co-sign with your key. App v0.3.0 adds paying Lightning addresses and LNURL plus a receive Lightning address; firmware v0.1.2 and app v0.2.1 shipped on 13 October.
Bull Bitcoin Mobile 6.14.0 -- 2026-10-12
- Tor now runs as an isolated package with separate sessions for vault-backup key servers and onion Electrum servers, and recovery words are typed on an in-app keyboard instead of the OS one. Adds a screen privacy toggle, AutoBuy and limit orders, Android memory tagging, and an experimental Silent Payments wallet behind developer mode.
Cake Wallet 6.5.0 -- 2026-10-12
- A Bitcoin wallet can now be split into multiple accounts, and a rebuilt sync engine brings wallets up to date almost instantly while history loads in the background. Also shows Lightning amounts in sats, adds more Tor…
Bitcoin is close to becoming worthless.
Now what's the Bitcoin? Bitcoin's like rat poison. Yeah. Oh. The greatest scam in history. Let's get it. Bitcoin will go to fucking zero.
Welcome back to the Bitcoin Brief, the show where me and q and a talk about Bitcoin, privacy, open source, keeping your Bitcoin secure, and the news and software updates that matter. I just wanted to say a massive thank you to everyone who's been supporting Ungovernable Misfits, and a big thank you to Foundation
for supporting the show. If you haven't already checked them out, go to foundation.xyzed. They make cypherpunk tools for fuckwits, and anyone can use this, even me. If you have any questions or you want to reach out, feel free, and I'll be happy to go through things with you. For anything super technical,
I'll pass you on to queue. If you wanna buy one of these incredible passports, use the code ungovernable. It will get you a discount, and it will let them know that I'm shilling. I'd also like to say a huge thank you to the Cake Wallet team. Not only are they supporting this show, but they're also bringing out some incredible features.
For those of you who actually use Bitcoin and actually care about their privacy and security, Cakewallet make it incredibly simple for you to live outside of the traditional financial system. You can use CakePay within the app to buy gift cards for food, petrol, and whatever else you might need day to day. You can use silent payments,
and, of course, you can use Monero. You can connect both Bitcoin and Monero nodes, use coin control, and this team are constantly innovating. And I'm really excited to be working with them. If you have any questions, you can reach out to me, but check them out at cakewallet.com.
Download the APK or start using this today on Mac, Windows, Linux, iPhone, or, of course, your Android device. Enjoy the show.
Hello. Good morning, everybody. Welcome back to the Bitcoin Brief, a live and interactive show taking place every Monday at 9AM Eastern or 2PM UK time across the ungovernable network. Each week, go through the news, the releases, the developments that actually matter in Bitcoin.
This of course includes self custody, privacy, the tools you run yourself, and of course, the people trying to make all of that more difficult. If it affects your ability to hold your... Hold and spend your own money without asking permission, then we wanna talk about it.
This show and the topics we cover are powered by freedom.tech, a daily news desk that uses AI to monitor hundreds of sources so we can continue to bring you the signal signal each and every week.
We'd love to have you help steer the conversation by commenting live, asking questions, boosting the show or just sharing it with your friends. My name is Q and A. I'm head of customer experience at Foundation and as always, I'm joined by my good friend Max, the head honcho of the Ungovernable Network.
Max, welcome back. How are doing? Very good, mate. Very good. Coming off a high. I did my first confab that I've done in months and months and months, and it was a good one. And,
yeah, it was nice. It was nice to just have a one on one chat with someone and someone worthy of coming onto the show. I'm very excited to listen to this one. Are we are we teasing? Are we telling the listener what's coming up? We're we're teasing, but we're also gonna tell them.
It's a bit of foreplay. Rick Messer, who has been doing some incredible work and helping support our friends and try and try and raise some funds for them and not just try, but I think the 10,000,000 sats on this prize draw. So Awesome. We talked a little bit about that. We talked about
why a lot of people know him and his dad in the space, a hack of... I think it was, like, 25 Bitcoin a few years ago. Pretty incredible story. And,
yeah, it's just to see someone get up after something like that and then give back is pretty rare. So, yeah, it was a good one, a really good one. And that's that's gonna go live on Wednesday, I believe.
Looking forward to that. I mean, yeah, it says says a lot about his character to be able to bounce back from that. I'm sure many people, it would have the story would have ended a very different Different way. And more somber way. Yeah. I can't,
for one minute, stand here in good faith and say I'd be anywhere near the man that he is after going through what he's gone through with, you know, losing that amount of bitcoin. It's... Yeah.
Take my hat off to him. And, yeah, looking forward to seeing him again in Manchester for for Bitfest in a couple of weeks. By the way, use code on Governable for that one. We do not get any kickback, but you'll get this Yeah.
It does sound good. I'm... I am little bit jealous of that one and actually Amsterdam. Yep. Got that one coming up. That one's first, second week in November, I think. So I've been prepping
prepping my slides. It was quite funny actually watching the ledger announcement this week. I don't know whether you saw that they've released a phone basically amongst Yeah. All of other things.
And before before they started talking about the phone, they were basically just talking about all of the the kind of AI integrations and MCPs and that sort of stuff they've got. Mhmm. And how it can be tied to to their hardware. It... Honestly, it was like hearing my own
not public yet slides that I've got planned for Amsterdam at the festive as to what we're working on, you know, basically what passport prime is, pun intended, primed for, to be able to do this sort of stuff and seems that they're heading in a similar trajectory.
So we're just kind of kind of validating, I guess, that a company of that size is is, you know, heading in the same direction. Also incredibly tasteless for them to go ahead and release the...
With the big announcements no less than a few days after what we talked about as the headline. Yeah. News item on on the last week's show. So it was interesting that they that they continued regardless, and we've we've got an update on that as we we get into the news. Yeah. It's... It seems like a lot of hardware companies,
their vibe is like a tasteless vibe. Yes. Yeah. Well, we we we we... There is certainly at least one that fits that bill. Well, definitely two now.
Yeah. Well, talking about Amsterdam, it's good to have the Node Runners or or part of the Node Runners on. We had SF join us on Friday. That was a good one. And I'm sure you'll be bumping into all of those guys out there as well. Yeah. Absolutely.
Absolutely. Looking forward to to run the. It should be good. Looking forward to some Stroop waffles. It's a good place. It really is. Before we dive into the news, have you seen what's going on in France?
I have. The place appears to be to be burning to the ground. Although, some places appear to be having some difficulty. I always... I'm always wary because, like, whenever there's events like this, Twitter
always, like, like, really rewards those terrible videos with the algorithm. So it's literally all as you see, which gives you on Twitter. Pardon? I've actually not seen it on Twitter. I was just...
Like, yesterday, we're with family friends, and they were like, oh, have seen what's happened in France? Was like, no. My phone's been off for the weekend. I'll just turn it off now. And the...
They're like, yeah. It's fucking bad. And I started looking at the pictures. I was like, oh, okay. Yeah. This is this is not looking good. Yeah. Absolutely. It's always hard to know what what to believe in and to the scale of it. You know, it could be the same the same city on one night used over and over again and
just to, you know, amplify and get likes and clicks and retweets and stuff like that. I mean, I'm sure the the truth is somewhere in the middle, but it's not a place that I'd wanna be right now from what I've seen.
No. Definitely not. Couple of bits of AOB for me. Number one, spent the morning reviving my website after somebody kindly tweeted or d m'd me on Twitter last night to say, hey, your website is down.
And lo and behold, yes, it was. Normally, it's a certificate issue or something like that that I can just kick Claude and it's fixed in thirty seconds. But this time was was not the case.
The the the server that my website was running on hosted through a through a VPS provider basically died. And Oh. Ironically, their status page was completely green. So I messaged support. Was like, hey, you know, obviously, I got called to do some due diligence for me first to check what was going on and
contact the support and they were like, oh, yeah. I think the server's dead and it's not coming back. And that was the end of the support message. I was like, right.
I was like, so where does that leave me? Like, what what you're gonna do for me? And it was basically a case of, well, you can just spin up a new server and we'll refund you for the downtime that you've had, is probably gonna be like 20 p. Right. Luckily, I had most things most things backed up.
There's a couple of things that weren't up to date in terms of the backups, but again, thank you. Thanks to the power of AI, we were able to bridge that gap pretty easily and spin up a new server. And in fairness to
the hosting provider, they did say that I'm on like a really old plan and they're gonna honor the old plan pricing, not not put me on the new one with the new server. Okay. Although the the support was kind of not exactly helpful,
it... I did get the resolution I wanted in the end, albeit I've had to kind of You know what? Do some hoops. These days, that is more than you hope for as a general rule. Like, general levels of support most places is so bad that if you even get a response,
it's like, oh, fucking hell. You know, what really winds me up is when you ask for support, you have issues, like genuine fuck ups on a company's side.
And then they don't respond to them, but they send you a load of other promo shit. So you're, like, looking at your email, and you're like, I've got six fucking emails from you selling me other shit, but you can't do the one thing that I've paid you to do. Yeah. It's very frustrating.
Yeah. And the other piece of AOB for me is it actually came in via a boost and it's somebody rightfully so calling me out on something that I said incorrectly last week. We were obviously talking about self custody and multisig and and one of the very brief criticism that I leveled at BitKey
Mhmm. Which to be clear, if you go back and check the tapes, I'm actually very open about being quite a fan of the bit key architecture. Think they did a great job. But last week, what I incorrectly said was that you give away all of your privacy because they are a key holder in the two or three that you have with them. That is not true
with a caveat. They use something called chain code delegation which we've actually covered off when they released this. So I did know this but we do a weekly show now. Well, we do multiple weekly shows my brain can only fit so much information.
So I forgot about this and I said, they can see all of your coins if you just use it under normal operations. Not true. On the normal operations, bit key, holds a key in your two or three multi sig. They cannot see your UTXOs. The only time they see your UTXOs and your balances is if you lean on that server key in any form of recovery.
It's hidden up until that point, which is very cool. As I say, we have covered it before.
But what I said last week was was wrong because they they do have that protection in place. And it is now, I believe default for all users. It's when it first came out, I think it was something that you have to turn on, but I believe now it's default for everybody.
So user 12931825 who boosted a thousand stats to call me out. Thank you very much. Yeah. Thank you for the call out. We appreciate that. Keep us in line and that is quite cool. Yeah. Again, I'm gonna repeat myself, but they have a great architecture. I know that sounds weird because they they are a competitor of ours, arguably so.
Obviously, there there are a couple of of call outs, you know, it's two of... You could argue that two of the two of the keys are hot, aren't they, basically? There's one on your phone and there's the server key that they hold. So I've seen some
criticism levy layered at it basically saying, you know, it's it's, you know, air quotes warm wallet, which I guess that there is some definitely some merit to that. And obviously, you also have the
the kind of... I think I called it soft vendor lock in last week, which may have been too harsh. But basically, where you like, you have to use their hardware. You can migrate away, but you have to do that through their kind of APK
recovery kit, so to speak. And you can't export the descriptor so that you can monitor it in Spyro or anything like that. It is... It's kind of like they've built it in a way which protects their user experience, which I can fully understand.
But for more sovereign users that might wanna watch it elsewhere and have like another copy of it in BlueWallet or something like that, they don't give you enough information as far as I'm aware to to kind of go and do that. So but for for beginners, like, it can be a great option where people...
Like, if you use this in that in that architecture and the protections they've got, you have to try very hard to fuck yourself out of your sats. Yeah. Yeah. Yeah. Yeah. I was talking to Rick about this the other day because, you know, he was working with the Bitcoin way, and he was saying they'd done some sort of, like,
quiz or, like, sending questions out to users. And he said, like, one of them was, if you use collaborative custody, like, why do you use it? And, like, you know, so I have someone there if I fuck up and, like,
they've got a backup and blah blah blah. And then, like, another question was, you you have to listen to it in the episode because he says it better than I do, but it's like, what what do you do then if you lose one of your keys and... Or they go away? What happens if they go away? And it was like, oh, well, I can still,
you know, I can still access my funds. And it's like, do you... Would you know how to do that? And it was, like, 80 or 90% are like, no. And they haven't actually saved whatever files they needed, etcetera. So I think this... Like, if they go away or if there's a problem thing, I don't know. Like, do people know how to access things if
if they're not there, if they don't respond? Or Yeah. I I think these days, like, again, to... I think you're you're using the analogy of BitKey here where they they save, like, backup stuff automatically or cloud and stuff. So, like, it's unlikely that they're go away.
Oh, yeah. For sure. Let's let's say they did. They just literally disappeared overnight, and they took all of their websites offline, everything. Mhmm. There's enough on the internet and you could just speak to chat GPT and say, hey, I was a BitKey user,
like help me recover. There's already enough information out there that would help us do that. So I I think it's true. It's it's nowhere near right for more sovereign people that want that ability to see access and to backup things individually.
It's... But it's not geared towards those people. It's geared towards this being your first foray into self custody Yeah. And detecting yourself against as many single points of failures as as you can. And I think their architecture is pretty good at that. Yeah. That's fair.
Right. Anything from you? Any AOB, or should we hit the news, mate? I'm trying to keep it tight to a tight hour today. I... Can we get a... Just give me a little brief synopsis of what is in the news? Because I'm not having the best start to a Monday, and I don't wanna just read, like, the most depressing bullshit ever.
So is is there stuff... Let's start with, like, what's the most interesting, like, least cunty bit?
So we've got an update on Ledger. We've got potentially a risk with Trezza, although there are a lot of caveats with that. Okay. We have a UK trader getting nearly $1,000,000 worth taken at knife point after the Revolut pack.
We've got the Ledger phone. We've got Jameson Lop updating his venture tax, which now surpasses 700 total reports. We've got the Bank of Russia confirming p 2 p bitcoin is about to become illegal in July 2027.
Excellent. We've got the Bank of America. This is a cool... Well, that's cool. That's definitely not the term I meant to say. This is a outrageous double standards talking about basically,
you know, we've got two of our friends, the samurai dev sit sit in rotting in prison for five years. And the Bank of America just pays a little little fine. I say little relative to Little 1%, yeah. Yeah.
For basically the same charges. We've got Citizen Labs zero click spyware delivered through targeted ads to your mobile phone. Not strictly Bitcoin, but affects your Bitcoin wallet potentially.
Some... Let... Let's let's start with the Trezza one. That's at the top of my list, which works... Only because if it if it actually is a risk, we should, and there are listeners who are using Trezza, we should cover that Yeah. First.
Yeah. I... That's why I put it at the top of the list. So let me bring up screen share. Right. So hardware hacker Joe Grant, who I've never heard of before this story, has found tampered chips in two Trezor wallets.
Now, again, I said before there were some caveats here. So before we get into it, there are two things that matter here and I wanna say them right at the top. Both of these instances were bought from unauthorized sellers and both are older models that Trezza stopped selling in January of this year.
Right. The first one was a model t, and you're gonna laugh here, bought on Facebook marketplace in Canada.
And you're gonna laugh them.... Who's gonna be hacked by this. This is fucking Jordan. Listen, mate. If you lost some stats, I'm really sorry. Exactly what he'd do. Oh, let me go on Facebook's marketplace and buy with my Canadian $5.
And the second one was a Trezza one from a TikTok shop in August of this year. In in both instances, somebody had replaced the main chip so that the wallet no longer created a random recovery phrase.
Instead it picked one of about a dozen phrases the attacker already knew. To get past the wallet's check that it is running genuine software, the Model T had a micro SD card soldered inside holding a real copy of the Trezor's firmware.
The Trezor one's swap chip carried both the malicious firmware and an official copy, but thankfully the owner only lost about $50. Wow. That's Yeah. The reporter... He reported about the one about the model t to Trezza in August of this year, and Trezza answered within three days.
Trezza made no public statement, but it gave zero day, the reporter on this, a detailed reply on the October 15. Basically says that this is a known counterfeit method and has warned about it since the fake Model T turned up on a Russian marketplace way back in 2022.
It says it hasn't examined the specific units and that Trezor Suite, their companion software, runs a check designed to spot wallets that produce predetermined recovery phrases and Trezor knows of no way to pull this off on its current product range.
It also clarified its comment on the October 13 that said there is no evidence that Trezza devices had been compromised. And what they mean by that is new devices bought from its website or its authorized resellers.
Yeah. That's not a treasure issue. That is just... That's like, you can't control that as a hardware supplier like you said. That's why I said there's lots of caveats here. But, again, the reason I've included this is there are clearly people who are naive enough to buy things off...
Buy security hardware from places they absolutely should not be buying them from. Oh, yeah. Yeah. Yeah.
So... Yeah. I mean, that... And that's why I included it. Just to reiterate, and I know it seems obvious to many, many people listening to this, but like, please, for the love of God, endeavor to buy your hardware from... Directly from the manufacturer.
Mhmm. And be very cautious if you're buying from resellers. Yeah. Buy directly. Buy insets on Lightning. Give as little details as you can. Either send it to somewhere that isn't your home when you buy it online directly from them or go to a conference and buy
without giving you details, etcetera, directly from them at the stand. Don't go on to fucking eBay Mhmm. Facebook marketplace, whatever, Grindr, wherever you're spending your time, just don't be buying from there. Go direct, please.
Yeah. Absolutely. And the the second news item, I don't know whether these two are linked or not, but I'm gonna talk about it anyway because it is relevant. Trezza has said on the October 13 that it cuts the number of resellers that it works with and is reviewing vendor relationships as a preventative step after...
Well, it says it's after the implants were found in alleged devices through its reseller crypto billies, which again, we're gonna give a... An update on very shortly. So Trezza has said the dropped... Resellers that have been dropped from their authorized list can sell existing stock up until the 01/01/2027.
Okay. Well Right. Like we said, not not a Trezor issue that as Yeah. That is just any... Anyone, any any person who builds any hardware, this could affect. Yeah. Absolutely. Update on the the headline item from last week, the the ledger reseller, Crypto Billies implant saga.
Quick recap on the October 9, somewhere between eighty six and ninety three million dollars was drained from ledger devices sold by Crypto Billies, a ledger reseller... Well, not just a ledger reseller, but a hardware wallet reseller in Malaysia, Indonesia, and The Philippines.
They had cellular implant that reads the 24 word seed off the screen and phones home to the attacker, where they can sit and wait, waiting for you to deposit your Bitcoin or your Altcoins waiting to pounce and they pounced on the October 9.
So in a October 15 statement, Ledger said it... A highly organized criminal group bought devices, fitted the implants and fed them back through resellers. With seed collection, draining, and laundering servers built in advance.
Legis says there is no flow in its chip, operating system, or servers, and has asked resellers across Southeast Asia, Hong Kong to suspend sales, and it has not given its own official loss figure yet.
On the October 15, former Mt. Gox CEO, Mark Garpelez, said that a Leger Nano X bought at Media Market in Germany has confirmed bugged with the exact same implant and reported another from a shop at Singapore's Changi Airport.
Ledger says it has not examined either device and every confirmed theft still traces back to crypto billies. Media market, the German one has pulled ledger devices worldwide. So it seems that it's not just isolated to Southeast Asia here.
Chainalysis found a scammer operator moved around 60 BTC, roughly $5,000,000 of victims monies onto ledger devices in September. And this was also swept up in the drain. So this is like a little nice little silver lining here that there's a scam operator that scammed people out of to the tune of £5,000,000
also getting pulled by another scammer in this drain. So basically they they stole funds. It's like inception. Yeah. They they stole funds. They put it onto a compromised ledger that they must have bought from a reseller, and then they got done themselves.
That is that is quite nice, actually. I do like that. It is. It is indeed. It's still unknown who the group is and whether there have been any arrest as of yet. But if you bought a ledger route... Ledger through a reseller in Southeast Asia or Hong Kong or indeed anywhere in the world as it seems at the moment,
then you should be taking steps to migrate your funds in my personal opinion. And karma's real. There we are in real time. Yes. Yeah. Absolutely. That is what goes around comes around. Imagine that you'd scam that 5,000,000.
You're like, yeah. I'm a bit of a cunt here, but, like, at least I don't have to work the rest of my life. I can just chill, put it on this little ledger, and then boom. Go. Yeah. Bye bye.
Bye bye. Nice to see people get in there come up and sometimes, you know? It is. Okay. Next on the list, still talking about Ledger this week. This is an interesting one. I wanna get your your thoughts on this. And on the very same week that their users fell prey to the losses to the tune of roughly, what did I say, $90,000,000.
Mhmm. Ledger continued with their announcement event on the October 15. It... The exact same day that they sent out that crypto billy statement, and they have released or announced the the upcoming release of Atom, an Android phone customized to them, built... Sorry, due in mid twenty twenty seven.
It runs everyday apps, but it has a switch to switch into a protected mode for managing keys. It has an open core AI assistant on the device, but any action it takes needs physical approval from you.
Ledger also says that a tamper sensing enclosure with its own battery will block screen reading implants like the Crypto Billy ones. Atom sells only through Ledger's own website at first at $849 for a founder's edition, and it will be $899 after launch.
Interesting. Mhmm. Your thoughts?
Tasteless timing, but really tasteless timing. But I suppose that probably won't matter. I mean, they are the big boys in the room. They Yep. They sell more devices than anyone.
Don't know. It sounds like quite a good device to me. Like, I haven't actually... Genuinely haven't looked at it other than I saw at, like, mid scroll saw
the thing, didn't even read it. Just saw a thing. I was like, that looks like a phone, and then I didn't bother looking at the rest of it. I think it looks like maybe it was on Friday, and I was, like, closing down just like, fuck. This is the weekend now. I'm not doing anymore.
So that's sort of really the first I've heard of it. Sounds good. Would I trust Ledger? I don't know. I mean, I don't know is the answer. I don't know the technicals on it. Like, I assume it's not open source.
It's probably quite nice hardware. Would I buy it? No. Yeah. It's it's a strange one for me. I I don't know where this sits in terms of, like, you know, if you're a Ledger user, you have your your Nano X or stacks or whatever.
You obviously also have your your phone for day to day stuff. I think the only way that this kind of makes sense is to replace your your actual phone, your day to day carry, and have it as like a slightly more secure mobile wallet essentially,
where you benefit from... Again, I I I don't have all of the technical understanding for the details of as to where they sit on the security spectrum between a dedicated hardware device and, you know, say an iPhone.
Yeah. I probably think it's gonna sell, irrespective of what I think about it. Yeah. Think there's, you know, the the ledger crowd and the people have multiple assets and things like that might lean into this.
Yeah. Would I spend a thousand pound on a on a first gen phone from a non stereotypical phone manufacturer? Probably not because the iPhone or, you know, the latest Pixel is gonna shit all over it in terms of like capabilities and hardware specs, I'm sure. And we have graphene.
Yep. Yeah. Who who... I think their Motorola stuff's gonna be coming out by next year as well, isn't it? Yeah. It looks... Loads of people are saying it looks really ugly, and they hated the look of it and all that. I thought it looked alright. Oh, no. The back end of it looks fucking terrible, I think. Well... Yeah.
But you're not, like, you're not dating it. Do you know what I mean? It's like, it's probably gonna go in a case anyway. And, like, how much time do you spend looking at the back? Like, you're looking at the screen or it's in your pocket?
Well, my my phone is always face down on my desk. Okay. Alright. Face down, ass up. That's the way we like to... Yeah. Fair enough. Well, I thought it looked alright. I didn't... I I liked the fact that it looks a little bit different at least because every fucking phone just looks extremely the same. It's so
boring. I... I've... I'm still running proper old hardware. I won't say exactly what I'm running, but, like, old. Really old. Because I'm just like,
fucking, like, you know, why do I wanna spend money and update my phone? Because it does exactly the same shit. Like, I'm not using it. I don't need the faster chip. I don't need it to do all the clever stuff because I wouldn't be able to use it anyway because I'm too dumb.
Only The thing I've guessed I care about on a on a phone is, like, does it take good pictures? Wouldn't, like, have good family photos? But outside of that, I mean, I just don't fucking care.
Yeah. I mean, I'm slightly different. My... Like, I consistently cook, and I I mean not literally cook my iPhone.
How? What are you doing with it? Just... It seems to be... It seems to get very hot when I'm doing, like, remote AI stuff, like talking to cord and to and to code out and stuff. Like, I'll I'll put my hand on my back on my phone after I spent like half an hour going back and forth, and it is red hot.
So I'm sure that that processor in there is working very hard. And yes, I'm two generations behind, and I'm sure the latest one will be able to cope with it a lot better, but I kinda like see you. With, like, an iPhone 12 or a Pixel seven.
But you're you're doing stuff. That's what I'm saying. It's like, you're doing that kind of stuff. You're using your phone. Mine is like, take the old picture, ask you a question on fucking Telegram or Signal. Like, I go on Twitter, do a post that gets seven likes, and then I and then I close it down again. Yeah.
Nothing more happens. And for me, like, an iPhone or a graphing phone, that is is good enough. Yeah. Yeah. Before we move on to, like, really sad and depressing news, which I'm sure will be the next thing, did you see the Tesla?
That's so weird that you bring that up. I I literally had the same thought ten seconds ago. Yes. I saw it. Yes. I I had two reactions. Yeah. Number one, wow. Yeah. Number two, why?
Like, for for those of, like, that don't go on Twitter and may not have seen this, mister Musk had an event last week and basically they had the new Tesla Roadster. They were showcasing that. They had like this big half pipe basically, like a like a c shape ramp.
Yeah. And they were... They started the the showcase off basically by driving this roadster up really slow and it just like stopped halfway, like semi defiant gravity if you like. Yeah. Well, it didn't stop. Yeah. Sorry. Yeah. Stopped. It was pointing nose to the sky and it just stopped there, then reversed back up, Back down. Sorry.
Then it went all the way to the top, like, so it was basically upside down and just stayed there, again, defying gravity. Basically showcasing that this is one of those fan cars that it has enough suction underneath it to basically hold it upside down. And this is an electric vehicle. It's gonna be minimum two tons.
Yep. And then it reversed all the way back down. And everybody was like, holy shit. Like, this is this is pretty cool. And then the next minute, it goes up the ramp and drives off the end of the ramp upside down.
It does a kickflip. Does a kickflip, so it flips on its on its long axis midair. There's loads of air jets shooting out of it. It perfectly balances itself stable just before it hits the... Well, I say hit, just before it lands relatively comfortably and then drives off.
That's pretty wild. And then the second clip that I saw is it's driving in a straight line towards basically the entire Tesla fleet. So they've got all the different Tesla models including the semi truck and stuff.
And it's just driving at them at, like, you know, a moderate rate of speed. And then the next minute, it just fucking catapults itself off the floor.
And I think, did it also kickflip in the air? It did kickflip. You've always gotta do a kickflip. So it jumped over the entire fleet of Tesla cars. There must have been about 10 cars and 10 different vehicles.
It did a kickflip in midair, and again, perfectly steadied itself and then just drove off again, all by compressed air shooting out of different jets at different places in in the... On the car. And then the last one was they were showcasing the north to 60 where it was at a standstill.
They've got like, you know, like when you walk into a nightclub and they've got like lasers going through smoke and that was like, what, the length of a driveway in front of the vehicle? Probably, I don't know, 15
meters if that. Mhmm. And the next minute it just like shits out all this compressed air and just takes off like a scalded rat. Yeah. Through these lasers and it did not to 60 in one second flat.
That's, yeah, pretty fucking incredible. Like, you can say what you want around and to all of this I I would agree with in terms of like the horrific
non sovereign nature of an electric vehicle and the fact that you're tracked, then you can be... It can be turned off wherever if you don't pay your bills and all that sort of stuff. Like, I completely agree with all that. But as a feat of engineering, what they've done there is absolutely
mind blowing. And again, I come full circle all the way back to why. Well, the reason the reason I mentioned it wasn't the why. It was actually about timing because Porsche released their new vehicle. I can't remember what they've called it now. It's like the Porsche that sit... Will sit above a nine eleven.
It's like supercar kind of thing, two seater thing. And they released that on the same day that Elon did his thing. And that's why I was thinking about the ledger release and, like, bad timing and stuff because Porsche did theirs and their... I mean,
it's a fucking beautiful car. Like, I like Porsches and that is... I mean, it's stunning. And I'm sure it's fucking excellent car. Mhmm. But all you had under every single comment was, doesn't even do a fucking kickflip. Why would I buy this shit? Like, everyone's just, like, abusing Porsche.
It's like, does it even fly, bro? And stuff like that. And it did... It just made me laugh. I was like, that's fucking excellent. That's such bad timing to release that vehicle. Because it's kind of in the same, I guess, with the same sort of person buy that. I guess, maybe not. Like,
I'd still probably go for the Porsche, to be honest with you, if they're the same sort of money because it's just a nicer car. But why, yeah, why all that stuff? I think, like, you know, maybe the... We're we're so far away from Bitcoin here, but it's so depressing. So we'll we'll carry on with this. I think that the fans and the
compressed air and all that kind of stuff isn't probably gonna be used really for, like, kickflips and, like, jumping over people in traffic and stuff like that, although it would be fun. I think it's more likely that it sets some incredible nerve bug ring times Oh, yeah. And
the the fact that it can suck itself down onto the ground and you have this compressed air that can go from the sides or downforce or whatever. Like, you could probably corner at ridiculous speeds with this thing, and it's fucking fast. So,
yeah, my guess is that if he actually builds it... Because he said he was gonna build the last one, never did. He actually builds it and actually gets released. My guess is it's gonna be an absolute weapon.
Yeah. I mean, I I joke all the time about my Lambo. Obviously, everybody will know I don't actually have a Lambo, but I do have a moderately fast Yeah. You've got a fast one. Relatively old German car that will do not to 60 in three and a half seconds, and that scares the living daylights out of me. Yeah.
Imagine getting to 60 two and a half seconds faster than that. Like, it's it's just absolutely, like, blows my brain as to what that must feel like. Well, yeah. It it would be,
yeah, absolutely ridiculous. It would be fun. Like... But it it gets boring. We had a Tesla. My missus had a Tesla, and it's fun. It's like you put your foot down and you just fucking fly into the back of the seat, and it's silent. And it's like, it's fun, but it's kind of... It's it's really... That's just like a part...
It's, yeah, it's just like a party trick. Like, I've had less fast cars that are more fun. And I've had fast bikes that are more fun because you you get that, like, that feeling and that sound of that, you know, everything is... Like, that's why I would go for the Porsche over that. But like you say, as a feat of engineering, fucking
hell. Yeah. Absolutely. Final comment on this. As as a self certified petrol head myself, there's nothing more annoying than the fact of how fast electric vehicles are. Like, it really pisses me off. Yeah.
Final final point on it, and then I promise we'll get back to misery and pain and death and doom. When people talk about electric cars and they say, oh, yeah. They're they're shit because they track you and they do this and they do that. It, like, agree with all that stuff.
But I have a feeling that with all the AI stuff and with the way that you could engineer things now without having to be an enormous company, I think there will be some smaller companies that will make some electric cars or that there'll be some open source y type stuff where people can tinker and start to build their own stuff
where they don't have to track you and have cameras inside and have all the crazy stuff. Like, I think there is gonna be a a middle ground where you can have a vehicle that is very fast and has all the upsides of the electric stuff without having all of the downsides as well. I do think that probably does come and also the hybrid stuff,
you know, you could maybe adjust the car that you already have that's petrol or diesel and add some bits and pieces onto them and do some engineering yourself so that you get the pluses. And they can't just turn you off because you still have petrol or diesel.
Yeah. I mean, it... I could see, like, a cool little nascent industry popping out. You you know, like, people buy old ThinkPods and they put, like, cubes OS and stuff like that. Yeah. Yeah. Like I could see there being manufacturers or they're they're Modifying.
Modifying, you know, buying fi... Well, anything that's out of warranty and like hacking the the software on there and you you'd have like open Tesla or whatever you'd want to call it. Exactly.
Whether or not... I suppose with AI, anything's fucking possible either. Was gonna say whether you'd be able to get into the software, but... I'm sure you would.... Rip out all the... I'm sure it'd be highly illegal, of course, But... Oh, yeah. I know.
That'd be that'd be a cool little industry to pop up, and I bet you'll you'll see businesses pop up around that. If anyone is seeing anything like that, like modifying vehicles and doing clever stuff with electric or, like, resto mods or retro mods and stuff, let us know. We maybe do a Freedom Tech on it.
Because we we were talking about the the open sourcing of that gym equipment the other day where someone was open sourcing that, like, resistance pulley thing. Yeah. So in context, just quickly, it's digital resistance, basically. So if you have a home gym, the old way to do it was you had some cables, handles, and some weight plates.
Yeah. Well, now you've got this tiny little box that you can just mount to a wall or to a squat rack and it just has like some motors and gears inside
and a digital screen on the front. And basically, you can set it to be one kilogram or you can set it to be 200 kilograms and it just adjusts the resistance on the cables accordingly and it's tiny. Sorry. Continue.
Yeah. That was it. So I was just... Anything... If anyone's listening and they're, like, you know, looking at the open sourcing of tech, and I use that loosely. It can be, like, cars. It can be gym equipment. It can be things in the home. It can be anything. Anyone who's seeing anything cool, let us know because
that's what's exciting me at the moment. It's, like, where the physical world meets AI and open source and people can engineer and create cool shit. I think that we could have, like, a cool renaissance here.
Yeah. I agree. I agree. You mentioned the word rest on what here, and I and I know we're way off topic here, but this is our way of coping because Bitcoin's boring and scary at the moment.
Let me let me... If we've any card not here, you might like You're gonna send me a singer? No. No. I'm gonna I'm gonna share my screen. Let me switch... Share this tab. Have you seen this?
No. But that's lovely. So for the audio listeners,
it's a... This probably won't mean anything if if you're not in The UK because I I don't know whether they had the escort in in America, but it's a These escorts go for so much money in The UK. So this is a company called Borum Motor Werks, and they've done a restomod on the mark one Ford Escort, which in The UK is...
If you're of a certain age, it's... This is like the institution. Yeah. So basically, they have basically fully modernized it, give it an engine with 330 horsepower. It weighs 900 kilograms, so it's very... It's gonna be very fast, but it looks Yeah. Just like the old one with some very minor subtle tweaks. Look.
That is lovely. Is How much is it though? That's a good question. Think it's one of those that if you have to ask, you can't Look afford at that. That is The details. The the helmets in the back. Oh my gosh. That singer quality.
But those things are like a million or $2,000,000 or something crazy now. You know? I would... Yeah. Look. They don't even put the price on. It's just a case if you have to inquire. Just inquire.
Yeah. We'll we'll consider whether we get back to you or not. Yes. Yeah. Yeah. You have to pass the test first. Yeah. It's fucking beautiful. And, you know, this is the thing. It's like, things can be manufactured by smaller companies now to a very high quality, and
I'm I'm excited to see what can be done. It's it's gonna be very, very cool. Alright. That... That's it now. Back to the... Let's talk about fucking Bitcoin, coin, please. Well, before we do that, I've got the price. Okay. I'm gonna let you have a guess. Oh my god.
In pounds, is it? Yes. Starting price. My guess would be £400,000, which is about $600,000. Not a million miles away. It's 354. It starts at £354,000. That's pretty close. And they're only building a 150 of them. Okay. And they'll sell tomorrow because there are so many people in that age group
who have boomer money. Yeah. And literally, they will see that, and they will get erect. Yeah. Even if they have problems and they no... Normally need Viagra, that that is that is all they're gonna need. They're gonna see that, and they're just gonna be fucking rock solid.
Alright. That was a digression, wasn't it? Shall we get back to the doom? Yeah. Let's hear some doom. What... What's what's depressing in Bitcoin today? UK trader posting as realist on x says that attackers held him at knife point and forced him to transfer close to $800,000 of crypto.
40,000 of it came out of a hot wallet. Why have you got $40 in a hot wallet? And 720,000 came from, you guessed it, a ledger hard wallet. Police have made no public statement though we say officers are investigating.
There were a couple of people in the comments of this when this guy, whoever he is, reported it and basically said, do you use Revolut? Because as you know, a couple of weeks ago, Revolut had a massive hack where all the crypto holdings and everything was was leaked. To To which he said, yes. So it's unofficially been linked to that.
I don't know how fair that is. Like, fuck Revolut and, like, fuck KYC and blah blah blah blah, all the stuff we say. But a lot of people in The UK have Revolut. It doesn't necessarily mean...
Yeah. And I don't know how big of a following this guy has, but this story blew up. So I'm guessing he got at least a semi decent following. So maybe he's made some mistakes along the way and his his identity is linked... Leaked, excuse me. And the fact that he's a trader probably posting his
his trade on social media doesn't help. But, yeah, he's been done for a million million dollars. Well, sorry to whoever you are. That's pretty shitty. Yeah. I'm gonna quickly gloss over this one, but there's been some AI based searches assisting Jameson Lop who maintains, well, many different piece of Bitcoin infrastructure.
One of which is a wrench attack archive. And the AI search has basically gone through, you know, multiple languages all over the world, local news sites and stuff, and basically doubled the wrench attack archive so that it now surpasses 700 recorded instances of people being attacked for their Bitcoin and crypto.
No surprises. France is is one of the main hotspots where it has 77 of those incidents. And that's that's just so far this year. Wow. What's that, like, 14% or something like that? Yeah. I mean That is fucking hell. Of global Yeah. France.
So, again, please, keeping your mouth short is an absolute superpower. Staying pseudonymous or anonymous online is an absolute superpower, especially if you interact with Bitcoin and crypto. So just KYC is the dragon that man must slay. Yeah. And absolutely avoid KYC because,
know, as we've seen with recent services like Revolut leaking all of your data, including your... The fact that you're a Bitcoin or crypto user as well. As well as your home address, which is basically target on your front door. Yes. So be careful.
The Bank of Russia has confirmed that p two p Bitcoin trades are gonna become illegal after the 07/01/2027. They released guidance dated the October 12 confirming that direct peer to peer crypto trade between individuals
stay legal only until the July 1. After that, every single trade has to go through a registered broker or exchange under federal law two eight two. The not good, not good and probably gonna be expanded worldwide if, you know, Bitcoin and crypto continues to gain further adoption.
I'd imagine. So before you do the next one, I'm gonna run for a piss. Can we see if I can go piss and come back before you finish the next news item? Alright. Three two one, go. Next on the list, the Bank of America is paying 1,200,000,000 for willful money laundering failures while Samurai devs sit in prison.
So the US Treasury has announced 1,200,000,000 in combined penalties on the October 13 after the Bank of America admitted willfully violating the Bank Secrecy Act. The bank failed to report over 5,000,000,000 in suspicious transactions to FinCEN on time between 2018 and mid two thousand and twenty five.
The OCC's 750,000,000 penalty counts towards that total, and OFAC settled separately for another $11,600,000. No executive at the Bank of America was charged with anything. All of this meanwhile, the Samurai Wallet developers are serving five and four year federal prison sentences for pleading guilty to conspiring
to run an unlicensed money transmitting business. Not money laundering over privacy software that they wrote. So a bank admits it willfully broke the same laws and pays a fine that each of its shareholders will undoubtedly cover, And the people who run it face zero charges.
The developers who wrote code go to prison. I mean, the the level of double speak or injustice here is once again just completely staggering, Max. How was your piss? Yeah. A little bit rushed, but very good. I stood on a dinosaur on my my run back.
A little fucking stegosaurus or something. But, yeah, it was good, mate. Thank you. Thank you for covering. I know I'm old now because a couple of coffees in the morning and and getting through just even an hour now is tough.
Yeah. Yeah. I'm the same. When you get to a certain age, mate, it catches up with you. I've just seen... We've got guest zero one e c in the Nosher chat going off. The escort was in The US, apparently, but it wasn't like the one in The UK, which was an institution.
Yeah. I imagine they had, like, an Americanized version of Yeah. Yeah. But, yeah, I mean, it is it is like... I guess it's like... What what would America... It'd be like a a Mustang or something like that. Like, something that they really covered.
Yeah. And then they said that they've got a 165 mile... A 165 miles per hour in a souped up Mustang with his late father. Okay. And they were also good enough to convert it to kilometers per hour. Well, we're great. You don't need to do that. You don't need to do that. I've never done a 165 in a car.
I've, on a private racetrack, maybe somewhere in Germany, done one fifty five and then completely lost my ball. Fucking hell. I've done 200 on a bike. Oh, fucking hell. Yeah. On on a on a b road in The UK.
Wow. But I don't I don't think I don't think I've done more than probably one thirty, one forty in a car. It feels... It's scary on both, but, like, I think it depends what car you're driving as well. If you're driving, like, a big tall thing, it doesn't feel
as fast. It's like the lower you are off the ground. Or, obviously, on a bike, it feels quick as well. Yeah.
Next on the list, Citizen Lab has published the first public technical confirmation that mercenary spyware can reach a phone through targeted advertising alone with no click from the victim.
The ad only has to render on screen. This is wild. The report called Adfection found that at least 45 devices at Al Jazeera, the news network, were targeted in 2024 and 2025 with Kandiru spyware through ads bought by an Israeli firm called Discover Tech,
which Citizen Lab describes as a bridge between spyware companies and the ad industry. Attacker scripts turned up in 75,000 Android and iOS apps and a 128,000 websites across mobile and desktop browsers.
Google, IAB Europe, and several ad exchanges cut Discover Tech off in early October just before this report came out. The... This is wild. The the ad network itself is now an attack service.
You don't need to click anything and you only need to be targetable. So this goes without saying that, you know, ad and tracker blocking are arguably a required security measure, not just Mhmm. I guess like a comfort setting.
And another reminder that maybe your phone is not the best idea or the best place to keep all of your secrets. Yeah. Maybe not. Absolutely. I'm Gonna wish through these last ones. Court records made public this week show exactly what Telegram hands over when The US authorities come asking.
Four zero four media and Court Watch reported that the filing includes a letter from Telegram to US US authorities sent after a court order, which basically they gave away and disclosed the specific user's telephone number, Telegram user ID, and IP address.
And is another reminder that Telegram, despite somehow being branded as one, is not a private messenger. You should not be using Telegram for anything that you want to be private. For that, use Signal or Radar.
Yeah. It is good, though. Like, it is useful. We do a lot of our planning and, like, keeping media on there and stuff like that. Like, you don't have the compression problems. You can upload of any sort of size. Like,
it's just fucking useful. I wish I wish Signal was as useful. It's great at what it does. I just wish you could do everything on Signal, then I just fuck Telegram off completely. Yeah. I agree.
Right. Whizzing through the last few. There's there's a couple of articles about quantum stuff, which I'll leave the listeners to click the link in the show notes because we're we're already way up on time. We spent too much time talking about Ford Escort and Yeah. All Last one on the list, OpenAI
published a misalignment report on the October 15 describing something an internal research model did back on the June 26. The model which was part of the g p six five... G p t 5.6 Sol family was given a coded task and no funded wallet of its own. It checked 362 addresses derived from a commonly used developer recovery phrase,
found one with funds and paid a Sepulio, which is the Ethereum test net, to finish the job it was asked to do. Reporting the task was done without saying where the money came from. Its reasoning was that funds were sitting on a known public developer mnemonic seed were effectively abandoned and only valueless test net eth was involved.
OpenAI caught it on the September 25 through extended monitoring and a sin restricted live internet access for similar tasks. Thought this is interesting. Obviously, there's no real vulnerability or attack here, but like again, this is like a a warning flag as to where the capability of these models are heading.
And again, you should be very careful about what you're keeping online in terms of secrets and your... Especially your money. Yeah. Yeah. Right. So as I say, there's three more stories all about quantum resistance
in the show notes if you wanna go and catch that one up, guys. But next up, let's whisk through the boost. I will kick us off once again. Lonely Pumpkins, 10,000 sats, good rip gents. Multi sig isn't as intimidating as it can seem. One idea I first heard from Michael Flaxman some years ago is a, quote, dumb two of two multi sig.
Not certain that's what he calls it, but that's what I call it. Take your hardware wallet device of choice and the hot wallet and make it two of two multisig via a coordinator of choice. Use usual cold wallet hygiene for the hardware wallet device, Back up the hell out of that hotkey even in unrecommended
ways. Email it to yourself, post it on monitor even, like with a post it note, and then it cuts off. So I'm just gonna head to our back end to grab the rest of it. My apologies.
How much are our earmarks in it?
Well, while you're looking for that, thank you, Lonely Pumpkins, this boost. I'm not sure. How do you feel about this as as advice? I'm unsure. I'm trying to get the full context so that I can then pass on my full comments.
Okay.
There we go.
Oh, it's cut off there as well. Yeah. Lonely Pumpkins, your your boost has been cut off. It must have been too long, and I don't know It's a two of two. Where else I can go of... Go and kind of retrieve it from. But I think we got the gist. It was basically you have a two of two,
which is basically what you have with a passphrase, but I guess, well, there's not a lot of different really, is there? I do I do feel like we're missing some context here. Let me see if I can find it on Farmington.
Do you wanna read the rest of them while I go find it? Yeah. So anonymous sent 66,666 sats saying keep up the good work. Thank you, anonymous. We we intend to.
Best of the rest, World Reign with... Oh, why is it doing in BTC? 3,000... Well, 3,333 stats. Well, fucking hell. I'm selling all my stack, throwing my devices in the sea, and moving the family into a cave.
What a shit show for self custody, Worlder Inn. There's still hope, mate. I I know what you mean. There's still hope. I think we all feel like that a little bit, but Yeah. Spread your risk, all the stuff that I keep repeating.
Go and buy a a Mark one Escort. You know? If you got a big stack, you know, diversify. Yeah. I bet you're Welder Ian. Like, welders are car guys, aren't they? I bet you're even loving the sport chat.
Yeah. Ian's sort of that sort of name where I think it would be that generation as well. Probably. I think Weldorian might actually be an escort owner. You've got an escort owner's name, hasn't he? Yeah. For sure. Weldorian doesn't get any more escort than that.
Yeah. I'm Apart from maybe Roxanne. I'm failing here with the lonely pumpkins one. It's even cut off on fountain, so it doesn't like it's anything wrong with our infrastructure. Okay. World Reign also said, Max forgot ungovernable.bitcoin.
Try ungovernable.doom.
Bitcoin.doom. Right. Let's wrap this up. We also see boosts from RevHuddle, user one four one six five four one four, and, of course, Gnostic Gang as well.
Thank you for your support, guys. We appreciate it nonetheless. And Lonely Pumpkins, if you wanna DM me on Twitter or Nostril summit with the full thing, I'm happy to go over your recommendation on the next show.
Yeah. For sure. Oh, and also Cool. Not to forget, we had another on chain boost. Oh, we did. Yes. There it is on screen. From c brown sent 0.0085449 Bitcoin. Another huge on chain boost from some... Because it wasn't c Brown last time.
Appreciate you, mate. Is that Connor Brown? Is that Chris Brown? Chris Chris Brown. Yeah. Probably him. I know he's a big he's a big listener of the show. It's either Chris Brown or it's Connor Brown who now does all the the legal stuff, doesn't he?
Yeah. One of the two. Either way, c Brown, thank you very much for your support. Really do appreciate that. Right. Let's wizz through these releases.
First one, this is a cool one. Fulcrum two point one point four. Fulcrum, for those of you that don't know, is an election server that people run to query the Bitcoin blockchain for their own wallets, pulls address balances instead of doing it with somebody else's server.
It's been very popular in the the samurai circles and forms the back end for a lot of popular wallets like Cake Wallet, Envoy, etcetera, etcetera. On... It's October 18, it added parallel hash lookups that make the get history call and subscription queries, basically your balance queries, five to 10 times faster on old lookups.
And you know who's behind this? I do. I do. It's someone really, really fucking nerdy, but does cool stuff. It's it's mister for privacy and his clankers. Yeah. Seth for AI just suddenly speeding things up. Yep. I did see this. I actually put it in my, my last ad read. But Oh, very nice. Basically calling
Cakewallet a a bunch of nerds, but who do cool stuff. So I'm sure they'll appreciate that in the ad rate. Absolutely. Right. I'm gonna skip the Lightning Terminal one. They just got required updates for, I believe, there's some security related stuff in there. If
run like... If you run Lightning Terminal, which arguably not many people are doing, especially to be with type type assets, make sure you're up to date. Next one, they're shipping again, mate. Am I exposed version 0.43 Yeah.
This is the free open source tool for all this in your own coins for privacy leaks, which you can run against your own back end. Latest release on the October 15 shipped encrypted backups with an optional wallet key lock, plus a set of graph investigational tools for finding connections between addresses.
You've also got graph labels for your bit three twenty nine labels,
and a time layout and multi select options as well. Very cool. I would love to get them on for you until Friday one day. It would be good. Would be Next on the list, BISC two version two point one point fourteen has been released. A required update for one of the leading no KYC peer to peer exchanges.
Closing findings from its recent security audit. Offer takes must now match the maker's current offer and price, buyer in force seller reputation limits and Bitcoin URI and lightning invoice amounts are checked against the agreed trade.
The update also signs storage, isolates TOR connections between identities and removes TOR version, a long version number.
If you run this too, make sure you're up to speed. This seems like a required one. Oh, Adrian Lundy is just... I might expose this package for start nine, just saying. Yeah. I think we've Oh. We've mentioned that before, haven't we?
Is that on the community app store or is it on the main one? Just for for everybody else's benefits, let us know. My guess is community, but yeah. Could say so. Zeus version thirteen point two point three has been released. It's a stable bill following many release candidates that they like to do. Ships the latest l and d and l d k node
d k node builds Mhmm. Carrying the latest Rust Lightning security fixes. The update also had to check that the l s p wrapped invoices match the invoice they wrap which stops the LSP quietly swapping the payment you approved and stealing your funds.
Bitcoin Core version 32, our release candidate four, few changes that stand out here. When your node checks in a block, it can now fetch the coins being spent from the hard disk in parallel which speeds up the validation on machines that cannot keep everything in memory, I. E, Raspberry Pis, etcetera.
And the default limit on connections rises from a 125 to 200, which gives the network more room for more peers. And finally, onion services that Bitcoin Core sets up for you now turn on TOR's proof of work defense, which makes them harder to knock offline by flooding attacks.
Nunchuck Android two point nine point one adds the option to export x pubs, the extended public key that lets other watch wallets watch your address. Or you can use that in a multisig without holding the private key.
Can't wrap my head around that. Which makes it easier to build multisig corums or watch only setups that span different wallet apps. Okay. So it's just more public key export information.
Andrew Lundy's come back the supported package by the team, available on the main registry. Very nice. Love to see it. Next on the list, my very own bitcoin c tool two point four point one. Small quality of life update that basically just has some mobile layout fixes relating to BIP 85 and CQR rendering.
This one is a new release, Corsico app. This is version 0.3. This is a new open source Android lightning wallet that keeps your spending keys off your phone entirely. They live on a cheap LilyGoatee display board built on top of the ESP 32 chip which is commonly used in a lot of hardware projects
that you of course flash yourself and then every payment gets confirmed on that device over Bluetooth. It's built on top of, no surprises in 2026, Spark. So Spark operators can cosign with your key.
And yeah, they shipped a couple of point releases in the last week or so adding support for paying lightning addresses and LN URL plus receive to a lightning address as well. Pretty novel and interesting thing here to kind of segregate the the lightning keys but do it over Spark as well. I'm not seeing this used in the wild yet, but
thought I'd include it because it's a new interesting Yeah. Project. Well, I'm just gonna click the link very quickly just so we see who's behind it, if it's anybody that we know. No, it is not, but it will be linked in the show notes if you wanna go and check it out.
I think finally on the list. No, not finally. Next on the list, Bull Bitcoin mobile six point fourteen point zero. Couple of cool additions here. TOR now runs an isolated package with separate sessions.
One for your vault backup key service and one for Onion Electrum service so that backup traffic and wallet traffic cannot be linked by the Ball Bitcoin team. Recovery words, this is an interesting one. I've not heard of anybody do this before. Recovery words are now typed on an in app keyboard instead of the phone's own native keyboard,
keeping them away from the OS keyboard app and any learning or cloud features that may be enabled. Okay. The release also adds screen privacy toggle, auto buy and limit orders, Android memory tagging and experimental silent payments wallet hidden behind the developer mode. Very cool.
And then this actually is the last one on the list. KQuality 6.5, now been released. Bitcoin wallets can now be split into multiple accounts under one seed. Very nice. So you can separate your funds by purpose. So KYC, no KYC,
etcetera etcetera without ever spending from them accidentally together. That's the whole point of account segregation. Yeah. And of course, it's got the rebuilt sync engine that's powered by the fulcrum stuff that we talked about five minutes ago, which make means that your wallet updates for your bitcoin stuff load significantly
faster up to five to 10 x faster. Very, very cool. Very fast. Yeah. Finally, this update also shows lightning amounts in stats. Nice. Oh, nice. Yep. That's the end of the list, mate. Not as much doom as as last week.
Probably counterbalanced by the Tesla and the Escort chat. Yeah. But... Yeah. I mean, I'm not gonna apologize if that's our way of coping with through the boredom and the doom of Yeah. People getting It's a coping mechanism. There sucks, then Yeah. Why not?
It's... You know, if you have PTSD from all this stuff, if if it's affecting your mental health, you have to have these coping mechanisms. Otherwise, you just won't be around for long. You just have to you
have to do this, I think, in Bitcoin land at the moment. You certainly do. Thank you everyone for supporting the show. Thank you for the boost, the stats, the messages, calling us out where we're wrong, and all that kind of stuff. We do appreciate it. Absolutely.
I hope you all have a wonderful week, and we'll catch you on Friday for Freedom Tech Friday. Have a good Monday, folks. Stay uncomfortable.
Machine transcript; expect the odd mishearing. Click a passage to play from there.




