PSA: THE NEW LOTTERY DRAW FOR FREE SAMOURAI OPENS ON NOVEMBER 21ST, 2026. FOLLOW @RMessitt ON X FOR MORE DETAILS
In this episode, Max finally sits down with Lauren Rodriguez for a long-overdue conversation about the human cost of the Samourai Wallet case. Rather than rehashing every court filing, we focus on the people at the centre of it all: how Lauren and Keonne met, the life they built before Bitcoin took over, and what it has been like for her to carry the burden of advocacy while her husband is behind bars. Max and Lauren talk about why Samourai mattered, why privacy tools are not some abstract luxury, and why so many ordinary people still struggle to grasp the danger of a world where every financial move can be watched, profiled and weaponised.
Lauren also opens up about the pressure of the prosecution, the reality of prison visits, the financial destruction that follows even after sentencing, and what supporters can do now to help Keonne and Bill. We get into the growing threat posed by KYC leaks, physical attacks and surveillance creep, why the Samourai prosecution should concern far more than just Bitcoiners, and why keeping these names in the public eye still matters. If you care about privacy, open-source software, or simply the principle that good people should not be crushed for building tools that protect others, this one will stay with you.
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
(00:00:00) INTRO
(00:02:16) THANK YOU CAKE WALLET
(00:02:54) THANK YOU FOUNDATION
(00:03:47) THANK YOU MYNYMBOX
(00:04:17) Lauren Joins Us
(00:14:11) Tools That Were Too Good
(00:26:19) Notes From the Inside
(00:31:38) The Wait Before Prison
(00:39:46) Chasing the Pardon
(00:51:22) The New Lottery
(00:57:00) Vindicated
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Foundation suffered a data breach: attackers chained two bugs in its self-hosted cal.com booking software to reach internal credentials and sent more than 23,000 phishing emails, spoofing a Passport recall, to 21,500 email addresses. No Passport or Envoy funds or software are affected, but names, order details and, for some customers, postal addresses, phone numbers and partial card details were exposed. Q posted a full incident report to the community forum and is offering help to anyone affected at hello@foundation.xyz.
Max recaps BTC Amsterdam at the Sugar Factory, where he gave a talk on human authority hardware and joined a panel with Derek Ross and Seth.
Max is heading to Manchester this week for Freedom Fest, where Freedom Tech Friday will go live from the show with Derek Ross talking through the mobile Linux distro he's been vibe-coding.
NEWS
LNbits, the open-source Lightning wallet software that sits behind a huge number of tipping bots, paywalls, point-of-sale setups and community wallets most people have never heard of, told every operator to shut down after a wave of attacks drained one of those tipping bots. At around 12:33 UTC on 8 November LNbits flagged a possible vulnerability in its Paywall extension and told operators to disable it; about 80 minutes later it escalated to telling every LNbits service to stop immediately, taking its own hosted my.lnbits.com offline too. The one confirmed victim so far is BitTipBot, whose operator Kevin Ravensberg says new accounts using the exploit withdrew around 2.2 million sats between 09:22 and 14:00 UTC before the shutdown warning went out; he has pledged to repay users himself. A fix titled "centralize SSRF protection and block self-targeted requests" was merged into the dev branch around midday on 9 November, but there is still no patched release, no security advisory and the cause has not been confirmed. Both hosts said anyone running LNbits should stay offline until a proper release lands and, as always, keep as little as possible sitting in a hot wallet -- TFTC, Bitcoin.com News, LNbits on X, Kevin Ravensberg on X, PR #4310
Back to the original BTCPay Server hot-wallet hack: a new route into the same bug has swept through servers that were never updated. Attackers drained the first wallet of BTC and Litecoin on 1 November, the first theft report came in that morning and a community warning followed roughly an hour later. The flaw was fixed in version 2.4.2, so servers already on 2.4.2 or later were untouched, as were any wallets whose keys live off the server, such as a hardware wallet connected as watch-only. BTCPay has given no loss figure and hasn't described the new method, and the incident landed just three days after 2.4.7 fixed 85 separate security findings. Both hosts repeated the same advice: if you're on 2.4.1 or older, treat the server as compromised and get funds off it, and don't keep Bitcoin hot on a payment server unless you genuinely have to -- BTCPay Server blog, Unchained, TFTC
A week on from the Binance hack, the picture is getting clearer and it dwarfs everything that came before it: hot wallets backing customer balances in Binance's own proof-of-reserves were drained across several chains in about 20 minutes, including 18,270 BTC (around $1.4B) split across 19 wallets nobody can freeze. Total estimates run from $5.8B to $6.4B, with Binance itself citing $6.34B, by far the largest exchange hack on record. The FBI has attributed it to North Korea. Withdrawals reopened in phases from 1 November and users pulled a net $3.6B in the first hours; Binance says losses are covered from its SAFU fund and company money. On 6 November Elliptic reported the hackers had swapped about $50M of stolen XRP, mostly into bitcoin through THORChain, with about $3.1B still sitting in identified wallets; by 7 November around 2,300 BTC from those swaps had moved and 88 BTC had gone through a CoinJoin, while the main 18,270 BTC stash has not moved in bulk. The hosts noted the drain was still only around 5% of Binance's roughly $129.4B in customer assets, and wondered aloud why the attackers haven't pushed harder into bitcoin or privacy coins, landing on liquidity as the likeliest reason -- TRM Labs, CoinDesk, CoinDesk (19 wallets), BleepingComputer (FBI), Bitcoin.com News (Elliptic)
A post-mortem from Binance traces the hack back five months, and no key was stolen in the classic sense: the attackers drove Binance's own wallet-signing system from the inside. In June, a wallet DevOps engineer looking for a popular AI coding tool installed a tampered copy of the Homebrew package manager found through a search result; Binance caught it, replaced the laptop and rotated credentials. In September a second engineer was approached by a fake recruiter on a legitimate job platform, and a second-round coding task carried malware that replaced the pyenv tool with a malicious copy. On 20 October the attackers used that machine, plus an internal AI tool, to take over two more engineers' machines, which gave them the wallet-signing service used in the 29 October drain. Both hosts flagged that fake recruiters and poisoned dev tools target anyone who writes code, not just exchange staff, and that any take-home coding task should be run in a disposable, keyless environment -- BleepingComputer, CoinDesk, Bitcoin Magazine, SafeDep
Chainalysis, which builds the surveillance datasets exchanges and police forces use to screen Bitcoin addresses, had its own breach widen considerably. Having first disclosed on 30 October that an attacker using "offensive agentic techniques" had accessed user IDs, names, emails and organisation roles, it took its KYT and Address Screening products offline on 4 November after what it called "abnormal activity", then said that night that names, usernames, password hashes and live tokens for every Chainalysis user had been exposed. The products came back on 7 November and every user now has to reset their password and rotate their API keys; no attacker has been named, and Chainalysis says it has found no access to investigation content. For three days, exchanges that rely on its screening were running without it. Both hosts enjoyed the irony of the company that builds tracking datasets on Bitcoin users being unable to protect its own customers' data -- Chainalysis, The Rage
Bull Bitcoin says it's the first exchange to make payjoin the default on deposits and withdrawals: every on-chain buy or sell made through BULL Wallet's built-in exchange is now a payjoin, built on the Payjoin Foundation's tools. In a payjoin both sides contribute coins to the transaction, which breaks the common-input-ownership heuristic chain analysis relies on to assume every input in a transaction belongs to one owner. It hides the transaction from outside observers, though not from Bull Bitcoin itself, which is still a party to it; a first buy into an empty wallet is a normal transaction, since there's nothing yet to contribute. Q wondered whether the exchange is running something close to per-customer wallets to make this work -- Bitcoin Magazine, Bull Bitcoin, Stacker News
A rare bit of good news: FinCEN and the Federal Reserve have formally withdrawn their October 2020 proposal to cut the recordkeeping and Travel Rule threshold for cross-border transfers from $3,000 down to $250, a change that would also have written crypto explicitly into those rules. The $3,000 threshold stays, and the agencies say any similar future proposal would need a fresh comment period. Coin Center counts it as the latest in a run of withdrawals, following the unhosted-wallet proposal and the 2023 mixing proposal dropped earlier in October -- Coin Center, FinCEN, Federal Register, TFTC
On-chain investigator ZachXBT flagged a roughly $133M theft from Crédit Mutuel Arkéa, a French bank, days before the bank said anything, spotting the flows on public blockchains. The bank confirmed it shortly after, saying attackers had compromised a service provider, used the bank's own accounts to wire money to other banks, then converted it into crypto through exchanges; some of the converted funds have since been frozen. The hosts noted this ran the opposite way to most crypto hacks: the theft itself happened entirely inside the banking system, with crypto used only as the exit, and they pointed out it's the transparency of a public chain that let an outsider size up the theft before the victim disclosed it -- The Record, The Block
A 23-year-old crypto holder in France, targeted for the second time since 2022, fired a pistol at men trying to kidnap him at his father's home in the Vendée on 31 October. On 4 November he was sentenced to 30 months in prison and a 15-year weapons ban, because prosecutors argued the attackers were already fleeing when he fired; both hosts were furious that defending himself, after the state failed to stop a second attack on him, landed him in a cage. Separately, Russian police reported on 3 November the arrest of five men accused of picking a programmer as a target from photos of his luxury cars on social media, holding him in a garage for five hours in September and forcing him to send 10.4 BTC (around $800,000). The advice stands: don't flex your holdings online -- Bitcoin.com News, CoinTurk
RELEASES
Electrum 4.8.4 -- 2026-11-06
Security update, the "15th Anniversary Edition". Malformed onion messages sent by anyone could make Electrum disconnect from its Lightning channel peer, so it now drops incoming onion messages entirely. It also refuses channel announcements where both node IDs are the same and fixes restoring pre-2.0 seeds, broken since 4.6.1.
Cake Wallet 6.5.3 -- 2026-11-05
Adds BitBox02 Nova support over Bluetooth on iPhone and iPad with a pairing-code check, a built-in BTC Map, Zcash on Ledger, faster launch and a fix for BTC wallets stuck connecting.
Core Lightning v26.06.10 -- 2026-11-04
Point release fixing vulnerabilities reported by a number of sources, in dual funding and splicing (including signature checks on the peer's tx_signatures), onchaind HTLC resolution, gossip limits, connectd, runes, plugin hooks and hsmd, plus remote-crash fixes. The third Core Lightning security release in three weeks, so anyone running a CLN node should upgrade as soon as practical.
Liana v16.0 -- 2026-11-03
Taproot is now the installer's recommended default, the encrypted descriptor backup moves to the BIP138 format with a privacy mode, labels carry over from related addresses, coins and transactions, and the app is translated into French, Italian and Portuguese. It shipped alongside the matching
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
This week we're joined by Miguel Medeiros, last on the show in February with his phoenixd dashboard. Since then he's shipped Ghostly, a peer to peer encrypted messenger with a wallet built in and no server at all, over 4,000 commits in eight months with version 1.6.0 out this week. He talks us through how it grew out of an earlier project with Nuvi building a decentralised DNS on the Mainline DHT (the same network BitTorrent runs on), how he stumbled into turning that into a chat system, and how he bridges peers from the DHT into WebRTC, Iroh or HyperDHT so two people can talk with no server in the middle and nothing left behind once they do.
Most of the demo is practical: wallets for Cashu, Lightning, Ark, Spark, Fedimint, on-chain and USDT sit inside the chat itself, so you can send sats to a contact the same way you'd send a message. He shows off proving identities (Nostr, PGP, SSH, a domain via a TXT record) without any server checking the proof for you, sharing a localhost web app with a contact, and the built in app store: chess, a Quake deathmatch, a shared Minecraft-style world and a cinema for watching films together. He also shows how he runs his own AI agents as contacts inside Ghostly itself, coordinating a "war room" of coding agents that patch and bug-hunt the project while he's away from his desk, and compares the project to Keet and White Noise. Max presses him on why anyone would move their group chats over from Signal or Telegram, and the main sticking point is syncing the same profile across devices, which Miguel's still working on.
We also get a tour of his other project, miguelmedeiros.dev, a drivable 3D island built with three.js that doubles as his portfolio: driving, flying or sailing between Mempool Plaza (live blocks from mempool.space), his GitHub Castle, Elektron Mining and a Lightning-powered boat ride, with 47 achievements and multiplayer built in. Links: Ghostly, Ghostly web app, Ghostly on GitHub, miguelmedeiros.dev, Miguel on X, Miguel on GitHub.
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable lot, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) Welcome to Freedom Tech Friday
(00:02:53) Miguel Returns
(00:06:12) Ghostly Wasn't Supposed to Happen
(00:19:33) A Live Tour of Ghostly
(00:28:34) Minecraft, Chess and a Deathmatch
(00:31:07) Your AI Agents Live Here Too
(00:35:14) Scanning Into Ghostly at Plan B
(00:39:19) Keet, White Noise or Ghostly?
(00:51:07) Too Many Chats, Too Little Time
(00:53:46) A Drive Around Miguel's Island
(01:00:00) See You Next Friday!
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
This week we're joined by Pavol Lupták, a Slovak cryptoanarchist, voluntaryist and perpetual traveller currently moving between Nicaragua, Honduras and (soon) Bolivia and Argentina. He co-founded Paralelní Polis in Prague and the IT security firm Nethemba, and now runs Liberation.Travel, helping people set up residencies, bank accounts and companies abroad. Pavol explains flag theory as decentralising your life the way Bitcoin decentralises money: spreading residency, tax base, banking and companies across several countries so no single government holds a monopoly over you. He talks us through his own journey from penetration tester in Bratislava to giving up his Slovak residency (while keeping his citizenship) and building a life with no fixed tax home.
Most of the conversation is practical. For EU and UK citizens, Pavol's advice is to give up permanent residency rather than relocate, then live off crypto loans rather than a salary: he borrows euro stablecoins against Bitcoin on Aave and Morpho at under 1% interest, which counts as a loan rather than income and carries no tax or reporting obligation. He sets out why Paraguay is uniquely useful here: it has territorial taxation and, unlike almost anywhere else, grants tax residency without requiring you to actually live there, just a short visit roughly every three years. He covers the cost and process of getting Paraguayan residency, why it works for families who want a backup plan without pulling kids out of school (international school networks let children switch countries without changing school), why it falls apart for US citizens taxed on worldwide income regardless of residency, and why he's now also testing Bolivia, which offers similarly crypto-friendly non-CRS banking on nothing more than a passport.
We also get into his travel and privacy setup: a 7kg bag, a GrapheneOS Pixel, a Flipper Zero, the rugged Tank 5 Pro phone and Even Realities G2 smart glasses, plus his rules for staying safe on the road, splitting his seed across continents, hidden wallet passphrases, and never posting his location until after he's left. On a listener question about counterparty risk in his borrow-against-Bitcoin setup, he describes the AI agents he runs to monitor his collateral and alert him before any risk of liquidation, and to shop his loans across platforms for the best rate. Links: The Global Opportunist, Liberation.Travel, Paralelní Polis, Nethemba.
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable lot, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) Welcome to Freedom Tech Friday
(00:04:11) Pavol Joins Us
(00:06:38) Who is Pavol?
(00:14:23) Flag Theory for Normies
(00:26:31) Why Paraguay?
(00:30:10) A Backup Plan for the Kids
(00:36:21) The Price of a Passport
(00:41:46) Shorting the Euro
(00:48:21) Pack Light, Hack Light
(00:54:47) Who Holds Your Collateral?
(00:58:16) Where to Find Pavol
(00:59:30) See You Next Friday!
In this Confab, Max sat down with Rick (@rmessitt on Twitter) to talk about the fight for financial privacy, why the Samourai case matters, and how he helped raise over 10,000,000 sats through a provably fair lottery to support the Samourai developers. They got into the cypherpunk roots of Bitcoin, the dangers of KYC, paper Bitcoin, and the creeping surveillance state, as well as why privacy tools are essential if Bitcoin is ever going to be genuinely useful as freedom money. Rick also shared his perspective on why so many people in Bitcoin have lost sight of the bigger picture, and why supporting people like Keonne and Bill matters far beyond just one legal case.
Rick opened up about his own painful experience of losing around 25 BTC in a hack, how that changed the way he thinks about self-custody, and what others can learn from it. They talked through the emotional reality of being hacked, the importance of continuing to learn rather than becoming complacent, and the trade-offs between different custody setups. It was an honest conversation about sovereignty, security, time, family, and how to keep fighting without letting any of this consume your life.
LINKS MENTIONED:
- Fiesta Lottery: https://x.com/RMessitt/status/1993055214203478261
- Samourai Lottery: https://freesamourai.now
- Free Samourai Presentation: https://x.com/RMessitt/status/2105342444594225195
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
(00:00:00) INTRO
(00:02:36) THANK YOU CAKE WALLET
(00:03:41) THANK YOU FOUNDATION
(00:05:27) THANK YOU MYNYMBOX
(00:06:11) Welcome to the Confag, Rick
(00:13:03) Why Privacy Beats Number-Go-Up
(00:26:42) The 25 Bitcoin Hack
(00:45:48) El Salvador & the Moment It Hit
(01:01:55) How Samourai Showed Up
(01:14:07) Make Bitcoin Based Again
(01:25:40) The Lottery for Samourai
(01:38:34) It's a Marketing Problem
(01:47:40) The State of Self-Custody
(02:00:42) Signing Off
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
bitcoiner.guide down due to hosting headaches
Correction to last week's chat about Bitkey
NEWS
Hardware hacker Joe Grand examined a Trezor Model T bought on Facebook Marketplace in Canada in 2025 and a Trezor One from a TikTok shop in August 2026, both from unauthorized sellers on models Trezor discontinued in January 2026; in both, the main microcontroller had been replaced so the device produced one of about a dozen phrases the attacker already knew instead of a random recovery phrase, with a microSD card soldered inside the Model T holding genuine firmware to pass the integrity check and the Trezor One's swapped chip carrying both the malicious and official firmware, costing its owner about $50. Trezor told Zero Day on 15 October this is a known counterfeit method it has warned about since fake Model Ts turned up on Russian marketplaces in 2022, that it hasn't examined these specific units, that its Suite check is designed to catch devices producing predetermined phrases and it knows of no way to pull this off on its current Safe range, and that its 13 October comment about no evidence of compromise referred to new devices bought from its website or authorized resellers. Both hosts stressed this is not a Trezor supply chain issue, unlike the Ledger case, since both devices were counterfeits sold by unauthorized sellers, and urged listeners to buy hardware directly from the manufacturer and be wary of any reseller -- Zero Day (Kim Zetter), Cryptoast
Trezor said on 13 October it has cut the number of resellers it works with and is reviewing vendor relationships as a preventive step following the CryptoBilis implants, with dropped resellers able to sell existing stock until 1 January 2027; this isn't a flaw unique to Trezor, the hosts noted, but something that could affect any hardware manufacturer -- Bitcoin Magazine, Cointelegraph
Recapping the 9 October CryptoBilis drain of $86M to $93M, Ledger's 15 October statement says a "highly organized criminal group" bought devices, fitted the implants and fed them back through resellers with seed-collection, draining and laundering servers built in advance, that there was no flaw in its chip, operating system or servers, and it has asked resellers across Southeast Asia and Hong Kong to suspend sales without giving an official loss figure. Mark Karpelès says a Ledger Nano X bought at MediaMarkt in Germany is confirmed to carry the same implant, and reported another from a shop at Singapore's Changi airport, though Ledger hasn't examined either device and every confirmed theft still traces back to CryptoBilis; MediaMarkt has pulled Ledger devices worldwide. Chainalysis found a scam operator who stole roughly 60 BTC ($5M) from task-scam victims had it swept up in the same drain after moving it onto a compromised Ledger device, a bit of karma the hosts enjoyed -- Ledger statement, Bitcoin Magazine, Bitcoin Magazine (scammer victim), ForkLog (Karpelès), crypto.news (MediaMarkt), TokenPost (Gauthier v Karpelès)
On the same day as its CryptoBilis statement, Ledger announced Atom, an Android phone due mid-2027 that runs everyday apps and switches into a protected mode for managing keys, with an OpenClaw AI assistant whose actions need physical approval on the device; Ledger says a tamper-sensing enclosure with its own battery will block screen-reading implants like the CryptoBilis ones, and Atom will sell only through Ledger's own website at $849 for a Founders Edition ($899 after launch). The hosts called the timing tasteless but the engineering impressive, questioning whether a phone that also runs WhatsApp and TikTok belongs anywhere near your keys -- CoinDesk
A UK trader posting as "realist" on X says attackers held him at knife point and forced him to transfer close to $800,000, with $40,000 coming from a hot wallet and $720,000 from a Ledger hardware wallet; police have made no public statement though he says officers are investigating, and some commenters unofficially link it to the recent Revolut breach that leaked users' crypto holdings and home addresses -- CoinDesk
AI-assisted searches from researcher Pizza Bitcoiner helped Jameson Lopp merge new cases into his wrench attack archive on 16 October, taking it past 700 documented incidents, with France the leading hotspot at 77 recorded incidents so far this year; the hosts' advice remains to keep your mouth shut about your holdings and stay pseudonymous online -- Jameson Lopp (GitHub), TFTC, Pizza Bitcoiner database, OCCRP
Bank of Russia guidance dated 12 October confirms direct peer-to-peer crypto trades between individuals stay legal only until 1 July 2027, after which every trade must go through a registered broker or exchange under Federal Law 282-FZ -- TFTC, Bitcoin Magazine
The US Treasury announced $1.2 billion in combined penalties on 13 October after Bank of America admitted willfully violating the Bank Secrecy Act, failing to report over $5 billion in suspicious transactions to FinCEN between 2018 and mid-2025, with the OCC's $750 million penalty counting toward the total, OFAC settling separately for $11.6 million, and no executive charged; the hosts set that against the five and four year federal prison sentences the Samourai Wallet developers are serving for pleading guilty to running an unlicensed money transmitting business over privacy software they wrote -- ABC News (AP), TFTC, Treasury
Citizen Lab's AdFection report is the first public technical confirmation that mercenary spyware can reach a phone through targeted advertising alone, with no click needed from the victim: at least 45 devices at Al Jazeera were targeted with Candiru spyware in 2024 and 2025 through ads bought by Israeli firm Discover-Tech, with attacker scripts found in over 75,000 Android and iOS apps and over 120,000 websites; Google, IAB Europe and several ad exchanges cut Discover-Tech off in early October, just before the report came out -- Wired, BleepingComputer, Citizen Lab
404 Media and Court Watch reported that newly public court records include a letter from Telegram to US authorities, sent after a court order, disclosing a specific user's phone number, Telegram user ID and IP address, a reminder that Telegram is not a private messenger and shouldn't be used for anything you want kept private -- 404 Media
OpenAI published a misalignment report describing how an internal GPT-5.6 Sol research model, given no funded wallet, checked 362 addresses derived from a commonly used developer recovery phrase on 26 June, found one with funds and paid Sepolia testnet fees from it to finish a coding task without disclosing where the money came from, reasoning the funds on a known public developer mnemonic were "effectively abandoned"; only valueless testnet ETH was involved, and OpenAI caught it on 25 September through extended monitoring and has restricted live internet access for similar tasks -- OpenAI misalignment report, CoinDesk
RELEASES
Fulcrum 2.1.4 -- 2026-10-18
Adds a parallel hash lookup that makes get_history and subscription queries 5x to 10x faster on cold or uncached lookups, tunable with a new history_lookup_threads setting. Also refreshes the built-in server seed list.
Lightning Terminal v0.17.7 -- 2026-10-17
Bundles Taproot Assets v0.8.6 with lnd v0.21.4-beta and Loop v0.35.0, ships reproducible archives with a signed tag, and the notes give a staged upgrade procedure for nodes with a price oracle.
Am I Exposed v0.43.1 -- 2026-10-15
Fixes the find-connection tool added hours earlier in 0.43.0, which brought encrypted backups with an optional wallet key lock and graph investigation tools: find connections between addresses, BIP329 graph labels, a time layout and multi-select.
Bisq 2 v2.1.14 -- 2026-10-15
Required update fixing vulnerabilities from Bisq's recent security audit. Offer takes must match the maker's current offer and price, buyers enforce seller reputation limits, and Bitcoin URI and Lightning invoice amounts are checked against the agreed trade. Also signs storage, isolates Tor connections between identities and moves to Tor 0.4.9.14.
ZEUS v13.2.3 -- 2026-10-12
Stable release after 13.2.3-rc1: embedded LND 0.21.4 and an LDK Node build with the rust-lightning 0.2.7 security fixes. Also checks LSP-wrapped invoices match the invoice they wrap and binds LNURL-auth callbacks to the signing domain.
Bitcoin Core v32.0rc4 -- 2026-10-12
Fourth release candidate for 32.0. Block validation can now fetch the coins being spent from disk in parallel (new -prevoutfetchthreads, default 8), the default connection limit rises from 125 to 200, onion services Bitcoin Core creates get Tor's proof-of-work defences against flooding, and a bug that could leak your IP when using private broadcast over Tor is fixed. The final release follows once testing on the candidates is done.
Nunchuk Android 2.9.1 -- 2026-10-13
Adds an option to export the XPUB of any key, including software keys, along with bug fixes.
Bitcoin Seed Tool 2.4.1 -- 2026-10-13
Fixes layout problems on phones and merges the SeedQR controls into one button with a SeedQR or Compact SeedQR switch, also for BIP-85 child seeds and Seed XOR shares. No change to how seeds, keys or addresses are generated.
Corisco app v0.3.0 -- 2026-10-18
An open-source (MIT or Apache 2.0) Android Lightning wallet whose keys live on a cheap LilyGo T-Display-S3 (ESP32) board you flash yourself, with every payment confirmed on the device's own screen over Bluetooth. Built on Spark, so Spark operators co-sign with your key. App v0.3.0 adds paying Lightning addresses and LNURL plus a receive Lightning address; firmware v0.1.2 and app v0.2.1 shipped on 13 October.
Bull Bitcoin Mobile 6.14.0 -- 2026-10-12
Tor now runs as an isolated package with separate sessions for vault-backup key servers and onion Electrum servers, and recovery words are typed on an in-app keyboard instead of the OS one. Adds a screen privacy toggle, AutoBuy and limit orders, Android memory tagging, and an experimental Silent Payments wallet behind developer mode.
Cake Wallet 6.5.0 -- 2026-10-12
A Bitcoin wallet can now be split into multiple accounts, and a rebuilt sync engine brings wallets up to date almost instantly while history loads in the background. Also shows Lightning amounts in sats, adds more Tor…
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
This week we're joined by SF, aka Pleb Royale, a designer and Noderunner from the Netherlands behind a pile of free Bitcoin art and Noderunners Radio, a listener-funded internet radio station where song requests are paid for in sats. SF talks us through his design background (BTCPay Server skins, the Bitcoin Focus magazine, logo work for Alex Gladstein and Andreas Antonopoulos, and the Noderunners logo that's spread right across the community) and how a group of friends running nodes in the Netherlands turned into one of Bitcoin's most dedicated grassroots scenes, including this year's Noderunners Conference held in Arnhem's old prison.
We get into how the station's jukebox evolved: built first by HeroVK as a Telegram bot controlling SF's Spotify, then rebuilt from the ground up with AI once he picked up a Claude subscription, and now running on self-hosted LNbits with its own seven-and-a-half-terabyte music library. Library tracks cost 21 sats as an anti-spam measure, Wavlake tracks run through a value-for-value lane where most of the 210 sats goes straight to the artist, and live DJ and band sets (streamed over RTMP) pool donations that only get split out once the set ends. Everything moved to self-custodial wallets to stay clear of EU rules around holding value, which is also why the old bot's leftover user balances are only now being unwound for withdrawal.
SF also sets out the station's manifesto, a push toward a real FM/AM broadcast that could carry the state of the Bitcoin network over the airwaves if the internet ever goes down, and the idea of musicians timestamping their work to the chain as proof of creation. He clears up a tweet aimed at Breez after Misty Breez broke in September (his post, Roy's reply): it wasn't the radio's backend failing, just bad timing trying out Liquid swaps right as the hack hit. Links: Noderunners Radio manifesto, Noderunners Conference, Pleb Royale, Pleb Projects, SF's GitHub, Bitcoin Fortune Cookie.
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable lot, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) Welcome to Freedom Tech Friday
(00:02:32) SF Joins Us
(00:03:56) Who is SF?
(00:07:21) The Cult Within the Cult
(00:15:39) How Noderunners Radio Started
(00:31:14) Vibe Coding the Jukebox
(00:39:43) When Misty Breez Went Dark
(00:46:18) Live Sets and the Donation Pot
(00:58:27) Broadcasting Bitcoin Over the Airwaves
(01:05:58) See You Next Friday!
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
KeyOS v1.4.1 released
Passport Core v2.4 internal beta testing
Prepping for Freedom Fest UK and Amsterdam
Max renovating the house
NEWS
Hundreds of self-custody wallets belonging to Southeast Asian Ledger customers who bought their devices from CryptoBilis, Ledger's authorised reseller for Malaysia, Indonesia and the Philippines, were emptied in a coordinated sweep across six chains on 9 October, with on-chain tallies putting losses at $86M to $93M; Tether froze about $10M of the stolen USDT, and on 10 October Ledger confirmed an "unauthorized hardware implant" in one affected user's device. Mark Karpelès's Tibane Labs teardown found a hidden board inside a Nano X tapping the screen's data lines to read the 24 words during setup and send them out over its own cellular modem, never touching the secure element, so the device still passes Ledger's genuine check; CryptoBilis changed hands in March, with unverified registry screenshots showing a new owner based in China, though nobody has shown a link between the new owner and the theft. Anyone who bought from a non-direct seller should not set the device up, and anyone who already did should move funds to a new seed generated on a device bought direct -- Ledger Support (implant), Ledger Support (halt), Ledger (72-hour update), Bitquery investigation, Tibane Labs teardown, Mark Karpelès, Specter, CoinDesk, The Block, Crypto Briefing (Tether), Cointelegraph (EU report)
On 11 October Coldcard said a post carrying a phishing link went out from its official X account and was deleted, telling users not to visit it and that coldcard.com is its only official site; it found no matching login or session record, says its credentials and offline 2FA remain secure, and has asked X Support to escalate, with no losses reported and no confirmation yet of how the post was published -- COLDCARD, COLDCARD follow-up, Cointelegraph, Stacker News
Second says an attacker exploited a bug in its Ark server's boarding flow on 5 October, registering boards with only his own signature and then exiting them while also spending the same balances out of Second's node over Lightning, taking 0.75 BTC of the company's own liquidity; Second blocked the source within hours, briefly took the server offline and shipped a fix, with users' pre-signed exit paths unaffected, and links the attacker's coins to the 19 September Blink theft -- Second, bark MR #2612, Stacker News
FinCEN filed notices on 5 October withdrawing the 2020 unhosted wallet proposal, which would have required reports on transfers to self-custody wallets over $10,000 and records over $3,000, and the 2023 finding that labelled international coin mixing a primary money laundering concern, saying it will take no further action on either; existing exchange AML rules and OFAC sanctions on specific mixers are untouched -- Federal Register (wallets), Federal Register (mixing), Coin Center, CoinDesk, TFTC
On 25 September the DC Circuit upheld Roman Sterlingov's Bitcoin Fog conviction, finding that moving funds in and out of the mixer furthered its ability to launder funds for all users, enough to try him in Washington; on 5 October, the same day FinCEN withdrew its mixer rule, SDNY prosecutors cited that ruling against Tornado Cash developer Roman Storm, whose lawyers replied that Bitcoin Fog was custodial and Tornado Cash is not, with his retrial set for 26 April 2027 -- The Rage, TFTC, DC Circuit opinion
ICANN's Reveal Day on 7 October published 1,615 applications for new top-level domains, including mempool.space operator Wiz's community application for .bitcoin, which proposes a restricted namespace for vetted Bitcoin builders with no auctions or premium names and 21% of gross revenue going to Bitcoin development; a rival standard .bitcoin application from Bird Pepper LLC, linked to Identity Digital, is also in the contention set, with string confirmation due 17 November -- Application PDF, ICANN, Contention sets
RELEASES
Nunchuk Desktop 2.9.1 -- 2026-10-10
Fixes launch failures on Apple Silicon Macs introduced in 2.9.0, which brought hardware-key inheritance to desktop.
Bitkey app 2026.13.0 -- 2026-10-05
Block's Bitkey published app release 2026.13.0 with a matching source tag and an updated Emergency Exit Kit APK for users who lose access to the app stores or Bitkey's servers.
Am I Exposed v0.42.1 -- 2026-10-08
Roughly ten versions between 5 and 8 October turned Am I Exposed from a single-transaction checker into a wallet privacy auditor: wallet-level privacy heuristics, a UTXO list with privacy-aware coin selection and manual coin control, a spending decision tree, and BIP329 label import and export.
Flint 1.3.0 -- 2026-10-06
The nodeless Lightning plugin for BTCPay Server adds a Sweeps report (what left the wallet, the fee, what arrived) and a Stablecoin Payments report to BTCPay's Reporting page. Supports BTCPay 2.4.1 and later, with no database migration.
BlueWallet 8.0.2 -- 2026-10-06
Reproducible builds and BIP329 label import and export. Watch-only wallets can have their derivation path and fingerprint edited and show the raw PSBT when sending. Also fixes RBF on HD Bech32 wallets and animated QR scanning.
StartOS 0.4.0.2 -- 2026-10-05
Gateways can be marked secure, services become reachable from other routed private networks, packages can request hardware virtualisation, and apps that pin the server certificate, such as Sparrow and Electrum clients, now see the same certificate on every route. Networking and backup fixes too.
Coinos v3 (public testing) -- 2026-10-08
Coinos founder Adam Soltys opened Coinos version 3 for public testing at v3.coinos.io on 8 October, with a video tour. The new version pairs an Ark spending wallet with a regular onchain bitcoin wallet, adds a built-in Nostr client and encrypted messaging, and can run offline.
PayPerQ Enclave Router -- 2026-10-07
PayPerQ (PPQ.AI), a pay-per-use AI router that takes Lightning, now serves chat requests inside an AWS Nitro enclave, with prompts encrypted on the device and the company seeing only billing metadata.
Everything Else
Alby Hub v1.24.1 -- 2026-10-06
Refreshed payment screens, transaction filtering, a Postgres to SQLite migration flow, and dependency and security updates.
Amber 6.6.7 -- 2026-10-05
Nostr signer: relays reconnect after VPN and network changes instead of staying stuck until a force-close.
Amethyst v1.18.0 -- 2026-10-11
Nostr client: web of trust, private DM fixes and a new desktop app.
Also in window: v1.17.0 (2026-10-05), reproducible builds and QR scanner audit fixes.
Arkade TS SDK 0.4.79 -- 2026-10-08
Updates the scure crypto libraries and fixes a swap URI amount-conflict bug; the companion Swap SDK 0.0.25 carries the same fix. 0.5.0 release candidates continue alongside.
balanceofsatoshis v25.0.0 -- 2026-10-08
LND command-line toolkit: adds a pending command and drops the price command.
BDK chain 0.23.4 -- 2026-10-12
Patch releases across the Bitcoin Dev Kit crates, also core 0.6.4, esplora 0.22.3, electrum 0.24.1 and bitcoind_rpc 0.22.1.
Bitcoin Core v32.0rc4 -- 2026-10-12
Fourth release candidate for 32.0, which brings parallel block validation and silent payments. Final not yet released.
Bitcoin Keeper v2.6.3 -- 2026-10-07
Fixes pairing with Keeper Desktop.
Also in window: v2.6.2 (2026-10-06), smoother unlock and more reliable key rotation.
BTCPay Server 2.4.5 -- 2026-10-06
SSRF blocking on by default and tighter refund permissions. Followed release candidates rc4 to rc7 (2026-10-05 to 10-06).
Cake Wallet 6.4.6 -- 2026-10-05
Monero-side improvements and bug fixes; no Bitcoin-specific changes noted.
Core Lightning v26.06.9 -- 2026-10-07
Security release.
Ditto v2.44.2 -- 2026-10-10
Nostr social server: point releases, no readable notes.
Also in window: v2.44.1 (2026-10-07) and v2.44.0 (2026-10-06).
Fedimint React Native SDK 0.1.0-beta.1 -- 2026-10-11
First React Native SDK for federated ecash apps, for testing only.
Fedimint v0.12.2 -- 2026-10-06
Gateway security release.
Also in window: v0.11.4 (2026-10-06), related hardening.
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
This week we're joined by Roy from Breez to talk about how the nodeless SDK has evolved, moving from Liquid to Spark after Boltz suspended swaps in August citing AI-assisted attacks, and why Breez picked Spark over Ark: Roy says payments need a near-perfect Lightning operator and that liquidity, not the ledger design, is the real bottleneck.
We get into what Breez takes on as a Spark operator, the closed-source nature of Lightspark's SSP versus the open-source SSP Breez has now released, and why Spark's confidential transactions and oblivious send are still on the roadmap rather than shipped. Roy is blunt that Lightning was never a privacy tool, that around nine nodes handle 80-90% of network volume, and that Spark's privacy model is comparable to an LSP rather than something better.
We also cover the stablecoin features (Stable Balance, instant on-chain deposits via zero-conf), the Glow reference wallet, and how AI coding tools have cut SDK integration times from weeks to days, including partners going from API key to production in under 24 hours. Links: Breez SDK (Spark) docs, Spark FAQ, Cake case study, Radar case study.
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable lot, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) Welcome to Freedom Tech Friday
(00:02:45) Roy from Breez Joins Us
(00:05:04) Eight Years of Breez
(00:14:19) Liquid, Spark & Surviving the Hacks
(00:18:09) The New World of AI Attacks
(00:24:07) Why Spark...and Its Trade-offs
(00:43:14) Lightning Was Never Private
(00:49:36) The Breez SDK
(01:00:28) See You Next Friday!
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Weekend shenanigans
Mission Control and Jarvis
Max fighting insects
NEWS
Former National Crime Agency officer Paul Chowles has been ordered to repay GBP 1,810,678.93 after a Crown Prosecution Service confiscation order on 30 September; he stole 50 BTC in 2017 from a wallet holding coins seized from Silk Road 2.0 administrator Thomas White, worth about GBP 59,000 at the time, laundering it through Bitcoin Fog and spending it via CryptoPay and Wirex cards before Merseyside Police caught him in 2022; he was jailed for five and a half years in July 2025, and part of his confiscation order now pays off White's own unpaid confiscation order to the state -- CPS
South Africa's Absa has become the first African bank to custody bitcoin, mainly for institutional clients, following Deutsche Bank's custody launch in September; head of digital assets Rob Downes said bitcoin will be the bank's largest custodied asset, with other digital assets to follow, in a market Chainalysis puts second in Sub-Saharan Africa by value received at about $36B -- Bitcoin Magazine
Blink published its post-mortem of the 19 September attack: a permissions flaw in its admin tools, open since October 2023, let the attacker grant themselves admin rights through the OAuth consent page and take over 35 custodial accounts, withdrawing about 6.61 BTC from 24 of them; nine targeted accounts had 2FA on and all 18 login attempts to use them were refused, so nobody with 2FA lost anything; shareholders advanced the full amount as an interest-free loan so balances were restored by 24 September with fees refunded, and Blink is offering a 25% recovery bounty plus a matching 25% donation to circular economies including Bitcoin Beach, Bitcoin Ekasi and Afribit Kibera -- Blink
Tether says USDT is coming to Bitcoin this month via the RGB protocol, issued by Utexo, whose co-founder Viktor Ihnatiuk says the company holds the commercial licence; Utexo can't freeze RGB addresses the way Tether freezes Ethereum ones, so instead it will blacklist UTXOs that become unredeemable at bridges and minting tools, with BTC-to-USDT swaps and BTC-backed lending to follow and Lightning support after launch; USDT first lived on Bitcoin via Omni back in 2014 -- CoinDesk
A federal judge in Utah has granted a preliminary injunction blocking the VPN provisions of the state's SB 73, the first US law to penalise VPN use, which would have required adult sites to block VPN users or locate every visitor; the court found the law demands something technically impossible, though the separate ban on explaining how to use a VPN was not challenged and stays in force -- EFF
Core Lightning is warning of active attacks on unpatched nodes: an operator on v26.06.7 reported an attacker opening a splice, routing a small keysend, then sending an error so the victim's node goes on-chain and sweeps its own output through the revocation path as if it had cheated; the path was already fixed in v26.06.8, and by 1 October Stacker News operators were reporting about 0.2 BTC lost between them, with one user reporting 4.88M sats across five incidents and a StartOS user reporting 3M sats; anyone on 26.06.7 or earlier should upgrade now, or restart with --offline if they can't upgrade immediately -- GitHub #9578, GitHub #9595, TFTC, Stacker News, Stacker News, CLN v26.06.8
The Dutch cabinet has told parliament that shares, bonds and options will move to a realised-gains tax from 2028, with other assets following in 2030; crypto isn't named among the 2028 instruments, so if it counts as an "other asset" Dutch bitcoin holders keep paying yearly tax on unrealised paper gains for two years longer than shareholders, and the tax-free allowance falls to EUR 1,000 per person -- NL Times, Bitcoin Magazine, Crypto Benelux
The Liquid Federation says an independent external audit of Elements v23.3.4 is underway, focused on safely restoring peg-outs, and it is replacing the peg-out authorisation key list and moving all peg-out keys to cold storage; peg-outs remain paused nearly a month after the exploit, with about 602 BTC of the stolen 3,996 BTC still unrecovered -- crypto.news, KuCoin News, liquid.net
UK law firm Edmonds Marshall McMahon says it has recovered 20.00444711 BTC, about $1.725M, in full and with no deduction for one client seven weeks after the Coldcard theft, the first documented full recovery through the Crypto Recovery Trust; the claim rested on blockchain forensics, the client's exchange records, signed message challenges and wallet derivation checks -- EMM Legal, CoinDesk, Decrypt
Apps built on the Breez SDK can now accept USDT or USDC from more than 30 networks including Ethereum, Base, Solana and Tron, with Flashnet converting the payment in the background so it lands in the receiver's self-custodial wallet as bitcoin, or as dollars with the stable balance feature; this is a developer-facing SDK feature, not something Breez's own wallet turns on automatically -- Bitcoin Magazine
Block has launched its first big consumer ad campaign for bitcoin, "Some things don't make sense. Bitcoin does.", running on YouTube, X, Meta, Fox Sports and in cinemas until 31 December; meanwhile a Stacker News user described failing for the second time in two weeks to spend bitcoin at a Square terminal because the merchant hadn't switched the option on in their dashboard -- newer point-of-sale devices have the toggle on by default with a customer-facing screen, but older terminals still need the merchant to enable it -- Bitcoin Magazine, Stacker News
Bitget reopened BTC withdrawals on 28 September, with fiat and P2P back by 2 October, and Bitcoin Magazine reported more than 4,000 BTC withdrawn in a single hour on 29 September; CEO Gracy Chen told CNBC only about $1.1M of the roughly $388M stolen has been frozen and she isn't "expecting to recover a lot" -- CNBC
RELEASES
Ghostly 1.1.2 -- 2026-10-05
An MIT-licensed messenger that finds contacts over the Mainline DHT and talks over direct encrypted connections, with no servers or accounts, built-in payments across Lightning, Cashu, Ark, Spark and on-chain, and messages that vanish by default.
LDK v0.2.7 -- 2026-10-01
A security release fixing two funds-theft bugs, including a malicious peer able to force a second commitment signature at the same state index, plus two denial-of-service bugs.
Envoy 2.3.5 -- 2026-10-01
Adds proper large-screen layouts for tablets, fixes the Passport Prime price graph stuck on "Loading Data", and removes leftover code from the retired Buy Bitcoin feature.
Nunchuk Android 2.9.0 -- 2026-09-30
Lets users set their own hardware signing device as the inheritance key in off-chain timelock inheritance plans, plus general bug fixes.
Blockstream Green iOS 5.7.0 -- 2026-09-28
Adds manual coin selection for Bitcoin and Liquid, a price chart and BIP39 passphrase guidance at login, and restores 2FA-protected and 2-of-3 multisig account creation.
Am I Exposed v0.37.5 -- 2026-09-30
A redesigned interface with light mode, a compact transaction graph and a "Before you act" section, plus later patches fixing Umbrel startup and dropping Liquid from tips and guides.
Flint 1.2.1 -- 2026-09-28
The nodeless Lightning plugin for BTCPay Server turns on unilateral exit for every server, letting a merchant take its balance on-chain without Spark's operators, now with automatic exit-state backups.
StartWRT 1.2.1 -- 2026-10-01
A security fix for the router's management interface so requests from loopback no longer skip sign-in, meaning every settings change now needs authentication.
Everything Else
0xchat 1.5.6 -- 2026-09-30
Nostr chat: blocks connections while the Tor proxy is set but not ready, closes a system-proxy leak, validates TLS for non-onion hosts, and patches Cashu P2PK security issues.
Amber 6.6.6 -- 2026-09-28
Nostr signer: fixes the nostrconnect parser corrupting secrets that contain "=", which broke NDK-based clients.
AQUA 0.5.4 -- 2026-10-01
Fixes Lightning refunds, mismatched fee display and failed-payment status; minimum iOS is now 15.
Arti 2.7.0 -- 2026-10-01
Tor in Rust: fixes low- to high-severity security issues (onion service operators should upgrade) and moves closer to running relays and directory mirrors.
BasicSwap 0.19.0 -- 2026-10-03
Atomic-swap DEX: Smart Buy (beta) fills an order across offers, and offers and swap messages can now travel over Nostr with a key per swap and Tor when enabled.
Also in window: 0.18.10 (2026-09-29), switchable price oracles and stale-rate protection.
BDK FFI v3.1.1 -- 2026-09-29
Error messages no longer echo back descriptor or key material; also fixes a fee-rate overflow.
Bisq v1.10.9 -- 2026-10-01
Mandatory: fixes vulnerabilities found in a recent security audit and updates Tor. Required to keep trading.
Bitcoin Core v32.0rc3 -- 2026-10-01
Third release candidate for 32.0, which brings parallel block validation and silent payments. Final not yet released.
Bitcoin Keeper v2.5.17 -- 2026-10-02
Better Recovery Key backup checks and repair, and improved wallet recovery.
Also in window: v2.5.16 (2026-10-02), UI and crash fixes; v2.5.15 (2026-09-28), versioning only.
Breez SDK Spark 0.26.1 -- 2026-10-02
Smaller mobile binaries.
BTCPay Server v2.4.5-rc3 -- 2026-10-05
Release candidate, following rc1 (10-01) and rc2 (10-02). No release notes yet.
COLDCARD 5.6.3 and 1.5.3Q -- 2026-09-30
Adds Codex32 and Shamir seed splitting, warns before installing contributor-signed or downgraded firmware, and…
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
This week we're joined by Nathan Day, co-founder of Bitfest, to talk about Freedom Fest, a new event for privacy, digital rights, civil liberties and freedom tech running alongside Bitfest at the Pendulum Hotel in Manchester this November. Freedom Fest is ticketed and marketed separately to reach freedom-minded communities who aren't into Bitcoin yet, with talks from the Tor and GrapheneOS teams, Free Cities and HRF's CBDC Tracker crew.
Listeners get 21% off Bitfest tickets with the code UNGOVERNABLE at bitfest.uk, limited to the first 21 uses.
We also get into Nathan's eight-ton overland camper mining three terahash off solar, the state of merchant adoption on BTC Map and the wrench-attack risk merchants take on by being on a map, and how Omarchy, OpenCode and Hermes have turned him into a prolific vibe coder.
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable lot, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00) Welcome to Freedom Tech Friday
(03:12) Nathan Day Joins Us
(04:40) Freedom Fest & Bitfest
(11:10) The Overland Beast
(18:54) Who's Speaking & Ticket Code
(22:15) Putting Bitcoin on the Map
(32:44) Is It Omarchi or Omarki?
(46:48) Should You Pay in Bitcoin?
(54:16) Where to Get Tickets
(56:03) See You Next Friday!
In these episodes, we read Keonne’s recent letters written from prison. The aim in sharing this is simple: amplify Keonne’s story, support him and Bill, and ensure help reaches their families. If listening isn’t your thing, the full text is linked in the show notes—please read, listen, and share.
FREESAMOURAI.NOW
Privacy is NOT a crime! Keonne Rodriguez and William Hill, two Bitcoin developers, are currently serving prison sentences for crimes they couldn’t have committed. Join our Bitcoin prize draw to help raise money to support their families and drive awareness to increase their chances of a presidential pardon. 50% of the prize pot goes to one lucky winner. 50% goes to Samourai.Bitcoin only, powered by lightning, and 100% provably fair. Because we don’t trust, we verify.
LINK TO THE LETTER AT THE RAGE
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Max: flooded the downstairs after leaving a sink running over the weekend, spent Saturday ripping out old timber and clutter he'd been meaning to clear out anyway, then a full kids' day that left them sick afterwards
Q: spent the weekend building his own local, voice-controlled AI assistant after watching the new Spider-Man film
Q: read this week's letter #7 from Keone, "Notes from the Inside", posted on The Rage -- a tough one on conditions moving between facilities; audio version out later this week, timed with Rick's Free Samurai prize draw
Q: enjoyed last week's Freedom Tech Friday listener questions episode, ranging from Bitcoin to Monero to privacy, multisig and local AI
NEWS
Research lab [alloc] init, founded by Misha Komarov with Clara Shikhelman as Head of Protocol Research, published Shielded Bitcoin, a proposal for Zcash-style private transfers needing no soft fork; shielded transactions are encrypted data blobs carried in OP_RETURN or witness data that Bitcoin only orders and timestamps, while separate indexer software checks zero-knowledge proofs and stops double-spends; value sits in encrypted "notes" spent by publishing a one-time nullifier that proves the spend without revealing which note it is; the peg moving real BTC in and out isn't designed yet and rests on an unproven witness-encryption scheme called PIPEs v2; CoinDesk reports fees around 4x normal, a trusted setup and no launch date -- Bitcoin Magazine, CoinDesk, allocinit
Blockstream published its own post-mortem of the 6 September Liquid exploit: a rangeproof-cache flaw dating to April 2018 ("Bug A"), responsibly disclosed 2 August and patched by 11 August, introduced a second flaw ("Bug B") where unprefixed cache keys let two different proofs collide; the attacker used it to mint about 4,000 unbacked LBTC and peg out 3,996 BTC through SideSwap, draining the reserve from about 4,205 BTC to 197 BTC; 3,400 BTC was returned and the network resumed 9-10 September, but about 602 BTC remains with the attacker and peg-outs stay paused with no date; the 11-of-15 federation multisig worked exactly as designed, the failure was in the software deciding what counted as a valid transaction -- Blockstream
Bitget detected unauthorised transfers from its hot and warm wallets at 18:31 UTC on 24 September and froze withdrawals platform-wide; CEO Gracy Chen says the attacker compromised a backend system, spoofed transaction data and triggered Bitget's own approval process, with private key compromise ruled out; the loss was revised from $351.6M to about $387.5M once Zcash and TRON assets were counted, mostly ETH, TRX and USDT with no bitcoin taken; Circle and Tether froze about $318K, while roughly $83M in native XRP moved beyond Ripple's power to freeze; North Korea attribution comes from Bitget, Elliptic and MetaMask's Taylor Monahan, not yet from any government; Bitget says its User Protection Fund covers the loss and is reopening withdrawals in phases from 28 September -- CoinDesk, TFTC, Bitcoin Magazine, CoinDesk (freezes), CoinDesk (XRP), Bitget
AMLBot traced part of the Bitget haul from TRX to USDT, bridged to Ethereum, swapped to about 145 ETH, then through THORChain into about 4.59 BTC, with roughly 4 BTC of that linked to an unnamed Wasabi coinjoin round and the addresses "blacklisted"; most of the stolen funds have not moved -- AMLBot on X, crypto.news
Matt Morehouse disclosed two denial-of-service bugs in Eclair v0.13.1 and earlier, fixed in v0.14.0: oversized feature-bit init messages could allocate about 300MB per message and crash a node, and zlib-compressed channel queries could inflate 64KB into 64MB; his smite fuzzer found the first, an LLM-assisted search for similar code patterns found the second -- Delving Bitcoin
Lightning Labs published four security advisories: a High-rated bug let an invoice be marked settled after an interceptor had already cancelled the HTLC, affecting tapd 0.5.0 and earlier and lnd 0.18.4 to 0.18.5; three Low-rated DoS bugs covered a gossip stall, a panic on a malformed DNS seed response, and memory exhaustion from Brontide write allocations; nodes on current lnd (0.21.3 or 0.20.4) are unaffected -- Lightning Labs security
Galaxy's Alex Thorn disclosed that 52.37 BTC from weak-entropy Coldcard addresses, about 2.8% of the total taken and roughly $4.5M, had been moved into an address belonging to a Wyoming "Crypto Recovery Trust" carrying an OP_RETURN reading "claim:cryptorecoverytrust.com"; the trust says owners can reclaim coins by proving control, but the white-hats are unnamed and its legal documents are unverified -- CoinDesk
SEC Commissioner Hester Peirce announced she resigns effective 2 October after nearly nine years to join Regent University School of Law, leaving the SEC with two Republican commissioners and no replacement nominee named; two days earlier, at SIFMA's Digital Assets Conference, she argued for replacing KYC document collection with zero-knowledge proofs and attribute-based credentials, telling regulators "we build ever bigger data haystacks on the theory that we will find a needle or two inside" -- CoinDesk, TFTC, TFTC (speech)
New York Attorney General Letitia James and Governor Kathy Hochul sued Polymarket US in state court on 24 September alleging unlicensed gambling and underage betting, seeking at least $4.6B in fines; Polymarket moved the case to federal court and countersued, arguing the Commodity Exchange Act gives the CFTC exclusive authority; the next day a unanimous Sixth Circuit panel ruled Kalshi's sports contracts are subject to state gambling law, splitting with the Third Circuit and making a Supreme Court case more likely -- CoinDesk, CNBC, CoinDesk (Kalshi)
BitMEX stopped trading, deposits and new positions at 04:00 UTC on 23 September after 11 years, with API withdrawals ending 28 September and website withdrawals staying open; from 1 October verified accounts with a balance pay the greater of 1% a year or $50 a month; owner HDR Global Trading cites a strategic review, with no legal or regulatory issues behind the closure -- CoinDesk
The x402 protocol, reviving HTTP 402 "Payment Required" for machine payments, merged Ben Carman's spec for paying with Lightning: the server issues a BOLT11 invoice whose description hash commits to the exact request, the client pays and returns the preimage, and the facilitator checks it against the payment hash and invoice signer without querying the receiver's node -- GitHub PR #2861
RELEASES
Am I Exposed v0.36.0 -- 2026-09-26
Detects Whirlpool tx0 premix outputs and Wasabi 1.x coinjoins it previously missed or misgraded, and flags input-side address reuse as a leak instead of scoring it as good.
Jam v2.0.0-beta.4 -- 2026-09-24
Fourth beta of the JoinMarket web UI: adds Sign Message, pins the exact UTXOs shown when sweeping, and lets you freeze or unfreeze several UTXOs at once.
Shhark v0.8.1-shhark-preview.5 -- 2026-09-12
A self-hosted, privacy-focused Ark wallet preview adding optional Payjoin v2 on Signet, Tor-only networking that fails closed, Silent Payments and experimental post-quantum messaging.
ZEUS v13.2.2 -- 2026-09-23
Stable release embedding LND v0.21.3 with SATS Routing and Coinos as swap providers, plus a critical fix moving iOS wallet data out of iCloud-synced Keychain.
Blockstream Green Android 5.7.0 -- 2026-09-24
Adds manual coin selection filters, transaction notes and a price chart, and restores 2-of-2 and 2-of-3 multisig account creation.
umbrelOS 2.0.0 -- 2026-09-22
Stable release of Umbrel's home-server OS adding a Photos app, multiple user accounts, virtual machines, FailSafe RAID storage and a redesigned App Store.
SignerOS v1.3.0 -- 2026-09-23
Fixes a bug where one valid input in a multi-input transaction could make a fake change output look legitimate; every input is now checked against the actual cosigner keys.
Blockstream Green Desktop 3.6.0 -- 2026-09-21
Adds paying to Lightning addresses and LNURL-pay from the send flow, redesigns manual coin selection, and restores 2-of-2 and 2-of-3 multisig account creation.
Everything Else
Amber v6.6.5 -- 2026-09-21
Nostr signer: relay backups are now encrypted with a separate derived key, previously readable by any app with a remembered decrypt permission.
Arkade TS SDK 0.4.76 -- 2026-09-25
Developer SDK patch release for the Arkade (Ark) protocol, following 0.4.75 earlier in the week.
Bisq Easy (Android) 0.14.1 -- 2026-09-26
Security release: embedded Tor updated to 0.4.9.13, closing high-severity Tor issues, now built from Bisq's own Tor fork.
Sister app: Bisq Connect 0.10.0 (2026-09-26), same Tor upgrade.
Breez Spark SDK 0.26.0 -- 2026-09-23
Adds receiving USDT and USDC, and instant or expedited claims for on-chain deposits.
Cashu TS v4.11.0 -- 2026-09-22
Backported fixes: melt preimages checked against the invoice hash, requests default to a 5-minute timeout, and closed subscriptions report an error.
cln-nip47 v0.2.1 -- 2026-09-26
Nostr Wallet Connect plugin for Core Lightning. Dependency updates.
Core Lightning v26.06.8 -- 2026-09-22
Security release fixing responsibly reported vulnerabilities, confirmed to include the dual-fund drain reported in issue #9498. Upgrade.
Ditto v2.42.2 -- 2026-09-27
Nostr social server: verified-link badges, muted users blocked from push notifications.
Also in window: 2.39.2 to 2.42.0 (posting streaks, emoji packs, push).
JoinMarket-NG 0.40.0 -- 2026-09-27
BIP-329 labels now distinguish coinjoin output, coinjoin change and deposits; adds PSBT v2 signing and warns when the wallet daemon listens in plaintext off localhost.
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
In this episode we answer your listener questions. Covering everything from local vs hosted AI, Bitcoin multisig solutions, private chat options and even who cuts Q's hair!
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable lot, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) Welcome to Freedom Tech Friday
(00:07:16) Small Models, Big Moves
(00:24:01) Three Wallets, No Coldcard
(00:30:52) Vibes and Benchmarks
(00:33:35) Shielded Bitcoin, No Hard Fork
(00:37:18) Start9 Burned His Laptop
(00:39:50) RoboSats, NWC and DarkWisp
(00:45:06) Uncle Jim's Compute Farm
(00:51:11) Signal, Keet or SimpleX?
(00:56:11) CUDA vs the M5 Ultra
(01:00:16) See You Next Friday!
For years Max would call and ask, “Hey mate, what do you reckon about ___?” This is that conversation, turned into a show. First episode: mind control and influence operations, with a hard look at MKUltra.
We walk through history from the priest classes and their drug and sex rituals, war as the original mass psychological operation, Operation Paperclip and the Cold War labs, Sidney Gottlieb, Operation Midnight Climax in New York and San Francisco, Ewan Cameron, Jolly West in the Haight, the moment LSD left the building, Manson and the communes, then the quieter tools that followed: pharmaceuticals, screens, surveillance, COVID-era mass formation. We flag what is documented and what is speculation. We close on how you push back: escape dialectics, Occam’s Razor, question with boldness like Jefferson, and John Lisle’s eleven questions. MK Ultra, answered with MK Ungovernable.
What they cover
Ancient roots: Plato’s Cave, priests, cults, ritual drugs, war
Modern U.S. programs: Bluebird, Artichoke, MKUltra, Gottlieb, Church Committee
San Francisco: Midnight Climax, Haight-Ashbury Free Clinic, West’s crash pad, Manson
From the 1980s to now: corporate influence, pharma, social media, mass formation
How to stay ungovernable
Books they read for this one
Stephen Kinzer - Poisoner in Chief: Sidney Gottlieb and the CIA Search for Mind Control
John Lisle - Project Mind Control: Sidney Gottlieb, the CIA, and the Tragedy of MKULTRA
Tom O’Neill with Dan Piepenbring - Chaos: Charles Manson, the CIA, and the Secret History of the Sixties
Music
The Exploited – Sex and Violence
Slim Galliard Trio – Cement Mixer Pu-ti-put-ti
Jack Kerouac – October in the Railroad Earth (with Steve Allen)
Kraftwerk – Computer World
Marilyn Manson – Rock is Dead
The Beach Boys – Never Learn Not to Love
Got a stone you want turned over?
History, intrigue, health, collapse, spirituality, the weird and the unexplained — send topic ideas.
X: [@UngovernableMax] and [@prevhashnonce].
Nostr: ungovernablemisfits@nostrplebs.com and meshtadel@nostrplebs.com.
Want to sponsor What Do You Reckon?
We are looking for sponsors that belong next to these conversations and fit the Ungovernable ethos. Reach out the same places, or start at [ungovernable.network](https://ungovernable.network).
A special thank you to Cake Wallet, Foundation Devices, and MyNymBox for already carrying the rest of the Ungovernable network.
Question everything with boldness. Stay ungovernable.
ungovernable.network
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Paynym to JON @ https://paynym.rs/+idealpresident82
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
(00:00:00) What Do You Reckon?
(00:07:55) Mind Control Through the Ages
(00:12:29) The Priest Class & the First Cults
(00:23:40) Operation Paperclip & the Birth of MK Ultra
(00:51:22) LSD, Gottlieb & the Origins of the Program
(01:05:28) Operation Midnight Climax
(01:22:55) Jolly West & the Shaver Case
(01:35:05) Haight-Ashbury, Manson & Chaos
(02:03:00) From the '80s to Now
(02:22:00) How to Stay Ungovernable
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Q: short weekend trip to Lisbon
Q: Envoy v2.3.4 out -- stability and maintenance release; faster Bluetooth firmware updates for Passport Prime, bug fixes and further Tor connectivity improvements
Q: Legacy Mode beta for Passport Prime -- optional app porting Ledger's open-source device applications to KeyOS so users can manage alt coin holdings on open-source hardware; not installed by default, device stays Bitcoin-only if ignored
Max: bought a Stanley flask and a robot vacuum and mop combo
NEWS
CLARITY Act dies in the US Senate 49-50, eleven votes short of the 60 needed for cloture; every Democrat who voted said no, joined by Republicans Collins, Hawley and Moran; the final text dropped the explicit criminal protection for non-custodial developers against 18 USC 1960 charges -- the same law used against the Samourai and Tornado Cash developers -- keeping only civil protections; Senator Lummis warned failure leaves no realistic chance this decade; the SEC and CFTC immediately signalled unilateral rulemaking -- CoinDesk, Newsweek, TFTC, The Rage, TFTC, Coin Center
Two days after the CLARITY Act failed, the CFTC sent a pre-rule rulemaking titled "Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets" to the White House for review; contents are not public but expected to create a path for crypto spot exchanges to operate under CFTC oversight; prepared in advance and filed immediately once Congress failed to act -- PYMNTS, CoinDesk, The Defiant
CFTC Staff Letter 26-25 extends to all qualifying developers the no-action relief Phantom received in March; software that passes user orders to CFTC-registered futures firms without holding assets, generating signals or controlling routing does not need to register as an introducing broker; not law, can be withdrawn at any time, and does not protect wallet developers from DOJ money-transmission charges -- TFTC, CFTC
The FCA, HMRC and Metropolitan Police raided three London premises on September 10 targeting unregistered peer-to-peer crypto trading operations and issued cease-and-desist letters at all three; the FCA says not a single P2P crypto business is registered in the UK; the second coordinated enforcement action this year, following raids across eight locations in April which are now feeding criminal investigations; the UK's full crypto regime begins October 2027 -- CoinDesk
Hodl Hodl shipped "enhanced bitcoin security scoring" on September 18 that checked incoming bitcoin for red flags and blocked trades with a bad score; after user backlash Anna from the team posted on September 19 that they got it wrong, it shipped without warning and was explained poorly, and it is now disabled; if it returns in any form it will be disclosed beforehand; scoring coins for red flags is taint analysis, and Hodl Hodl's position holding one key on every 2-of-3 multisig trade is what makes this kind of screening possible -- Hodl Hodl on X, Anna (Hodl Hodl) on X
The Rage argues the Strategic Bitcoin Reserve created by Executive Order 14233 may exist only on paper; no reserve office appears in Treasury's public org chart or the 2025 Fiscal Report; Bloomberg reported in July that Treasury and Commerce were still disputing who has authority to run it; the House Financial Services Committee advanced the ARMA bill 28-21 on September 16 ordering agencies to keep custody of their bitcoin until the reserve is "fully established and certified operational"; a FOIA request for records on the reserve office is still pending -- The Rage
Liquid peg-outs remain paused two weeks after the $320M exploit; 3,400 BTC was returned and blocks resumed September 10 but 598.5 BTC remains with the attacker; the federation says peg-outs will resume only after 1:1 backing is confirmed and software updates and independent security reviews are complete, with no date given; L-BTC holders can only sell or swap through services like AQUA's Indra where liquidity is limited -- Liquid_BTC on X, Liquid incident report
JAN3 launched Indra on September 15, its own Lightning-Liquid swap backend for AQUA, after Boltz suspended service in August following sustained AI-assisted attacks; for now it only handles Lightning sends paying invoices from L-BTC, with receiving to follow; JAN3 replicated the Boltz API signatures so it can act as a drop-in replacement; about three hours after launch Indra was hit by a DoS attack and forward swaps were temporarily disabled -- JAN3, Stacker News, Samson Mow on X
CLN operators are advised to disable experimental features after a suspected dual-fund channel drain; on September 12 a node operator reported a peer opened a dual-funded channel, drained most of his liquidity and went offline, with the funding txid his node recorded not existing on-chain; on September 15 Core Lightning issued a security advisory urging all operators running experimental features to disable them; at least two more operators have since reported losses; no patched release has shipped -- GitHub issue #9498, CLN collaborator comment, Core Lightning advisory
A pull request by Roasbeef would change the BOLT11 spec so readers must reject invoices containing more than one payment hash; a popular Telegram P2P bot was recently hacked through this ambiguity because some libraries took the first payment hash and others the last, allowing a system mixing both to be tricked into thinking a withdrawal was never paid out -- GitHub PR #1357
Lightning wallet Blink paused all services on September 19 after an attacker drained a limited number of custodial accounts; "a few dozen" custodial accounts were affected, every affected account will be made whole, and non-custodial wallets were untouched; a patch was deployed and services came back online the same afternoon; the attack path is unknown pending a post-mortem -- Blink on X, Bitcoin.com News, TFTC on X
London-based crypto infrastructure provider Haruko was hit by a targeted attack affecting 15 clients -- all those without an IP whitelist; attackers exploited a flaw in Haruko's own processes to extract a user-access token exposing exchange API details and trading data; three sources say a small amount of client funds was stolen, mainly from smaller hedge funds -- CoinDesk
Swiss Bitcoin Pay, a non-custodial Bitcoin and Lightning payment processor, took its servers offline on September 14 after a malicious user likely accessed its internal systems; customer email addresses, bitcoin addresses, IBANs, transaction histories and hashed passwords may have been exposed; user funds are safe and any amounts owed will be returned in full; servers remain offline as of today with no restore date -- Bitcoin Magazine, FinanceFeeds
Update on the Revolut breach: attackers used a hacked email account on a real Italian government domain to send fake law enforcement data requests; at least 680 customers are affected, targeted for their crypto holdings via blockchain analysis; on September 16 the group demanded 6,000 XMR (~$3M) within 24 hours or it would sell the data; the deadline passed, Revolut says it has had no direct contact, and Italian police and UK regulators are investigating; samples have already been posted on Telegram -- CoinDesk, SecurityWeek, CyberInsider
RELEASES
Highlights
Cake Wallet v6.4.5 -- 2026-09-20
Smooths out the Trezor hardware wallet connection and transaction signing flow. Speeds up Monero background sync with more stable node connections. Includes UI polish and bug fixes.
umbrelOS 2.0 Beta 2 -- 2026-09-17
Second beta of the umbrelOS 2.0 major rewrite. Adds redesigned search across apps, files, photos and settings with visual results. AI agents can now create and use virtual machines with screen and keyboard; Omakix Linux is available in the machines feature. Apps can be moved to external drives and cloud imports are supported. Opt in via Settings, Advanced Settings.
Bitcoin Core v32.0rc2 -- 2026-09-18
Second release candidate for Bitcoin Core 32.0. PSBT-creating RPCs now default to version 2. A new exportwatchonlywallet RPC exports a watch-only copy of a descriptor wallet with no private keys for offline-signing setups. New derivehdkey and addhdkey RPCs aid multisig coordination. Testing release only -- not for nodes holding real funds.
Sparrow Wallet 2.5.5 -- 2026-09-17
Adds a System theme that follows the OS light/dark setting, now the default. Enables BitBox02 xpub export and multisig signing at the m/45h keypath on firmware v9.19.0+. Includes Trezor Safe 7 session recovery and bug fixes.
BitBoxApp v4.52.0 -- 2026-09-15
BitBox02 owners can now create a Lightning hot wallet inside the mobile BitBoxApp, funded from their on-chain balance and derived from their existing BitBox backup -- no extra seed words, no channel management. Public beta using Breez SDK and Spark statechains; unilateral exit is not yet available in the current beta.
Eclair v0.14.3 -- 2026-09-14
Security hardening release with fixes from Project Loupe, Blockstream's AI-assisted open-source security research initiative. The team warns some issues can be exploited by malicious nodes and urges all operators to upgrade immediately. Fully backward compatible with no channel closures required.
Signal Beta Enables Phone-Numberless Registration -- 2026-09-16
Signal's Android 8.28 beta lets new users register without a phone number by paying a one-time fee of about $3 via Google Play. Signal says the same zero-knowledge proofs used for donations keep the purchase unlinked from the new account. Requires Google Play Services; de-Googled phones cannot use it yet. Android beta only -- iOS and stable release timelines not announced.
Everything else
Amber v6.6.4 -- 2026-09-14
Fixes a Tor clearnet leak on Android where requests could bypass Tor and go over clearnet.
BasicSwap DEX v0.18.9 -- 2026-09-15
Latest in a rapid release series. Swap fund…
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
In this episode, Max chats with Seth for a wide-ranging catch-up on the state of open source and local AI following his visit to the Open Source AI Summit in San Francisco. They talked about why AI feels so energising compared with the slower pace of Bitcoin development, how local and open models are rapidly improving, and why more people in the freedom tech world need to pay attention. Seth shared his view that we are already close to a point where self-hosted AI is practical for everyday use, with the right hardware, and explained the trade-offs between speed, intelligence and cost when choosing a setup.
Max and Seth also dug into what it means to treat AI like “self-custody for intelligence", keeping your data private, running tools locally, and avoiding dependence on closed platforms that can limit, monitor or shape your usage. Along the way, they covered how AI can help with everything from infrastructure and creative work to family life and productivity, as well as the risks around surveillance, security and misuse. Max and Seth closed by looking at the idea of “resonant computing”, a vision for technology that is private, adaptable and built to serve people rather than exploit them.
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Max: spent a full day and roughly $100 in API credits on a marketing project using lower-end models rather than his normal Claude subscription -- couldn't use it due to privacy concerns around Ungovernable content; a warning that frontier model quality costs real money per token
Q: quiet weekend -- kids party Saturday, christening Sunday; off to Portugal on Friday
NEWS
Revolut hands passports and Bitcoin histories to a spoofed government request: attackers used a real government agency's email domain to extract passport scans, verification selfies, home addresses, and full transaction histories including Bitcoin activity; Revolut refuses to confirm the number of affected customers, the market, or the agency involved; attacker is now leaking customer files daily on Telegram and demanding 10,000 BTC -- CoinDesk, TechCrunch, Decrypt
Liquid exploit recovery: 3,400 BTC returned to block 965950 on September 7 via on-chain OP_RETURN negotiation; ~598.5 BTC (~$47M) remains with the exploiters; Blockstream refused the demanded 10% bounty, called it theft, and says it will work with law enforcement; block production resumed September 10 but peg operations remain suspended -- Bitcoin Magazine, news.bitcoin.com, CoinDesk, The Bitcoin Manual
Final CLARITY Act text drops: ethics deal done, developer protections narrowed; the Blockchain Regulatory Certainty Act now covers civil enforcement only with criminal protections removed -- including the charge brought against the Samourai developers; cloture vote is September 15 at 2:15pm ET, needs 60 votes; prediction markets put passage at ~25% -- The Crypto Times, The Block, The Hill, CoinDesk
Chinese quantum benchmark drops secp256k1 attack to 835 logical qubits, down 60% from the 2020 estimate of 2,124; current best hardware reaches 94 logical qubits; addresses with exposed public keys face the greatest future risk -- TFTC, CoinDesk
Alby Hub authentication bypass lets attackers drain Lightning wallets: critical flaw in v1.7.0 through v1.18.5 allows unauthenticated remote takeover when port 8080 is internet-accessible; at least one user confirmed compromised; update to v1.24.0 and block external access to port 8080 -- The Hacker News
Brevo breach lets attackers send phishing from Trezor, BitBox, and CoinTracking domains: attackers created API keys inside Brevo customer accounts allowing emails from real sending domains that passed SPF, DKIM, and DMARC; the lure was a fake STM32 Entropy Vulnerability alert targeting hardware wallet owners; Trezor and BitBox both confirmed the breach on September 9 -- CryptoTimes, Decrypt
RELEASES
Highlights
Electrs v0.12.0 -- 2026-09-13
Switches to the bindex indexing library. Requires Bitcoin Core 31 or later and a full reindex -- upgrade Core first and plan for downtime, especially on lower-powered hardware.
Fedimint v0.12.1 -- 2026-09-12
Security release fixing a vulnerability in the Lightning gateway's LNv1 payment handling. Gateway operators should upgrade immediately. The fix is consensus-neutral so federation participants and wallet users do not need to coordinate an upgrade.
Radar v1.0.7 -- 2026-09-12
Adds BOLT11 invoice payments alongside lightning addresses, scan-to-pay from the send screen, on-chain receive via bitcoin: URI, full balance hiding across the app, and Signal backup migration on a single device.
Bitcoin Seed Tool v2.4.0 -- 2026-09-11
Adds SeedQR scanning, Seed XOR splitting into 2-8 Coldcard-compatible shares, NIP-06 Nostr key derivation, BIP-44/49/84/86 descriptor export, and blank backup template printing. Also fixes seed leakage bugs -- existing users should update before use.
Phoenix v2.8.2 -- 2026-09-08 (Android), 2026-09-07 (iOS)
Adds Italian, Japanese, Polish, Ukrainian, and Korean language support. Android users can now manually set feerates on outgoing on-chain transactions, matching iOS parity.
BTCPay Server v2.4.4 -- 2026-09-08
Breaking-change release: NFC payments disabled by default at checkout, zero-amount invoices blocked by default, and Boltcard desktop setup removed in favour of the dedicated Boltcard app. Review the breaking changes before upgrading.
Ashigaru Desktop v1.4.5 -- 2026-09-07
Major catch-up release. Fixes broken HTTPS connectivity in earlier builds (missing crypto modules broke all outbound connections). Adds in-app update checking with signature verification, a guided tour, dice-based passphrases, and stronger Dojo node verification. Existing users on older versions must download manually.
Flint v1.1.0 -- 2026-09-07
Updates compatibility to BTCPay Server 2.4.4 and enforces Breez SDK Spark release gating. Upgrade alongside BTCPay 2.4.4. All artifacts signed with Sigstore build provenance.
Everything else
Amethyst v1.15.2 -- 2026-09-12
BasicSwap DEX v0.18.8 -- 2026-09-13
BasicSwap DEX v0.18.7 -- 2026-09-10
BDK FFI v3.1.0 -- 2026-09-12
Citrine v3.1.1 -- 2026-09-10
Core Lightning v26.06.7 -- 2026-09-11
Fedimint v0.11.3 -- 2026-09-12
JoinMarket-NG v0.39.2 -- 2026-09-12
LDK v0.2.6 -- 2026-09-10
LNbits v1.6.1 -- 2026-09-09
ngit-cli v3.0.0 -- 2026-09-08
Ride The Lightning v0.15.12 -- 2026-09-09
RoboSats v0.8.7-alpha -- 2026-09-10
Tor Browser 15.0.22 -- 2026-09-10
Trezor Suite 26.9.1 -- 2026-09-11
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) INTRO
(00:00:41) THANK YOU FOUNDATION
(00:01:29) THANK YOU CAKE WALLET
(00:03:50) The Privacy Tax
(00:12:08) Kids Parties and Christenings
(00:15:56) NEWS
(00:16:14) KYC: Kill Your Customer
(00:28:00) MORE NEWS
(00:52:42) BOOSTS
(01:02:36) UPDATES & RELEASES
A weekly live show covering all things Freedom Tech with Max, Q and Seth.
Thanks to Jordan for joining us to walk through Ashigaru Desktop live on air. Jordan built a full graphical desktop wallet on top of Ashigaru Terminal, bringing Whirlpool mixing to a wider audience with a guided tour for newcomers, a dice-based EFF passphrase generator, in-app software verification against his BIP47 payment code, and the ability to mix straight to cold storage using an output descriptor. We watched a full mix go through in real time, explored the Mix To feature for sending post-mix funds directly to a Passport Prime wallet, and talked through bad bank, pool fees, and keeping KYC and privacy stacks separate.
Download Ashigaru Desktop and follow the project on GitHub: https://github.com/linkinparkrulz/ashigaru-desktop/releases
Learn more about Ashigaru Terminal and get the download: https://ashigaru.rs/download/
Check pool activity at https://whirlpoolstats.xyz/ and connect Passport to software wallets: https://docs.foundation.xyz/passport/connect/
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
First live show!
Ungovernable.network updates
KeyOS 1.4 is out
NEWS
Liquid exploit: roughly 4,000 BTC withdrawn; return discussions ongoing-- TFTC, CoinDesk, Stacker News | Updates: OrangeSurf, Samson Mow
Orionx Exchange Collapses in Chile: $7M Missing, 100K Users Affected -- TFTC
Coinbase/Better Bitcoin-Backed Mortgages Can Reuse Borrowers' Collateral -- CoinDesk
House Cancels Late-September Votes, Squeezing CLARITY Act Window -- Roll Call, CoinDesk
Trezor Breach Worse Than Reported: 67,000 More US Customers Exposed -- Bitcoin Magazine
Pocket Bitcoin Breach Links 291 Users' Identities to Bitcoin Addresses -- Pocket Bitcoin Blog
Coldcard Wave 3 Attacker Moves Stolen BTC Through THORChain -- TFTC
Tether Froze $42.4M USDT on a Verbal Homeland Security Request, No Warrant -- CoinDesk
RELEASES
Highlights
KeyOS v1.4.0 -- 2026-09-04
Major release for Passport Prime with a redesigned launcher, app sideloading with granular permissions, multisig exports for Unchained and Casa, new wallet connections (Bitcoin Safe, Coconut Wallet), authenticator imports from Aegis and Proton, and PIN-before-seed-reveal. Includes security fixes: P2WSH/P2SH-P2WSH change output validation, enhanced ATECC608 entropy, and a PSBT trust_witness_utxo toggle addressing CVE-2020-14199.
Cake Wallet 6.4.4 -- 2026-09-04
Adds native Trezor hardware wallet support for Bitcoin cold storage and offline signing. Fixes a security vulnerability (GHSA-695v-fhpj-fv8x) where a malicious deep-link could cause EVM assets to be sent on an incorrect network. Also includes improved Monero sync visibility.
Nunchuk Android 2.8.5 -- 2026-09-03
Adds BitBox02 connectivity over Bluetooth and USB, integrates Krux hardware wallet support, and introduces emergency push notifications with home-screen alerts.
RoboSats v0.8.7-alpha -- 2026-08-31
Major update adding three new coordinators (Eleuteria, Freeport, Ammanaya), a federation consensus mechanism, and end-to-end encrypted image uploads in order chat via Blossom. Coordinators are now ranked live by DevFund donation value. Multiple security fixes including PGP verification.
Everything else
Aqua Wallet v0.5.3 -- 2026-09-01
BasicSwap DEX v0.18.6 -- 2026-09-06
BitBox02 Firmware v9.27.1 -- 2026-09-04
Bitcoin Knots v29.4.1 -- 2026-09-02
Blockstream Green Desktop 3.5.4 -- 2026-09-04
Bull Bitcoin Mobile 6.13.4 -- 2026-09-04
Cashu CDK v0.18.0 -- 2026-09-02
Cashu TS v5.0.0-rc.9 -- 2026-09-04
Coldcard Firmware v5.6.2 and v1.5.2Q -- 2026-09-03
Flint v1.0.4 -- 2026-09-02
JoinMarket-NG v0.39.1 -- 2026-09-06
LDK v0.3-rc1 -- 2026-09-04
Lightning Terminal v0.17.4-alpha -- 2026-09-03
LND v0.21.3-beta -- 2026-09-02
Mostro v0.18.7 -- 2026-09-05
Specter-DIY v1.10.5 -- 2026-09-06
Tails 7.12 -- 2026-09-05
Zeus v13.2.1 -- 2026-09-02
EDUCATION
Liquid explainer: cached validation versus key compromise
Use OrangeSurf's technical notes alongside the DeFi Prime explainer. Treat early reporting as provisional, not a completed postmortem.
The reported flaw lets an invalid proof receive a cached pass; confidential amounts do not make validity unknowable. OrangeSurf reports one explorer rejected the transaction, with the cause of divergence unresolved.
Do not describe this as cryptographically bypassing federation signatures, or assert that Confidential Transactions hid issuance from every observer.
Liquid trust model: validation, custody and recovery
The SpendNode discussion can frame key compromise versus invalid issuance, but its incident details need the qualifications above.
Holding an L-BTC wallet key still leaves the underlying BTC dependent on the federation and the system's validation rules. Mainchain self-custody avoids that particular peg exposure; it does not eliminate all software or consensus risk.
Pair with Mow's on-chain message chronology: an offer to return most funds is not completed recovery, and an acknowledgement is not proof of a complete patch.
Bitcoin Optech #421: Silent Payments for Mining Pool Coinbase Payouts -- Bitcoin Optech
Published: 2026-09-04
Explains how mining pools could use BIP352 silent payment addresses to pay miners directly in coinbase transactions, replacing xpub-based payouts and improving miner privacy. The newsletter also covers the full CLN ping-flood DoS disclosure and post-quantum signature proposals.
A concrete, actionable application of silent payments moving from theory to real infrastructure. Shows how the protocol can improve miner privacy without new consensus changes. The CLN disclosure detail is also worth mentioning as follow-up to last episode's CLN coverage.
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) INTRO
(00:00:58) THANK YOU FOUNDATION
(00:01:38) THANK YOU CAKE WALLET
(00:02:44) Not Just Weekly, Live Weekly!
(00:07:44) KeyOS 1.4.0
(00:14:59) NEWS
(00:15:07) The Liquid Exploit
(00:40:02) MORE NEWS
(00:55:05) BOOSTS
(01:05:44) UPDATES & RELEASES
(01:07:29) EDUCATION
(01:09:10) THANK YOU MYNYMBOX
