BIP 110 stalled over the weekend without majority support from nodes, hash rate, businesses, or wallet software — and now Luke Dashjr is stepping away from Ocean Mining to focus on a proof-of-work hard fork that the hosts flatly call a new shitcoin. Meanwhile, over a million code repositories may be sitting on a vulnerable cryptography package, and the white-hat researchers trying to fix it are getting blocked by American AI tools.

In this episode:

• BIP 110 post-mortem: why the activation failed across every measured facet of the ecosystem — nodes, hash rate, exchanges, and wallet software — and what Simon Dixon's "Bitcoin worked as designed" take gets right

• Ocean Mining controversy: the 18-hour window where some miners may have unknowingly had hash directed to the BIP 110 chain, and how Ocean responded with a 0.3 BTC rebate to affected miners

• Luke Dashjr and Ocean's CTO both announce sabbaticals to pursue a proof-of-work hard fork — the hosts compare it directly to Bitcoin Cash and BSV

• Rob Hamilton and Red Team blocked by OpenAI's Cyber Trust program mid-investigation despite prior approval, forcing a pivot to open-source Chinese models to continue responsible disclosure work

• CryptoJS vulnerability: a dependency used across 19 million weekly downloads and over a million repositories flagged for insufficient entropy in cryptographic key generation

• Strategy sells 1,690 Bitcoin while selling MSTR stock to prop up STRC; Marathon (Mara) sold 23,000 Bitcoin worth 1.6 billion in the first half of 2026

• BlackRock lowers its in-kind Bitcoin minimum for iBit from 25 million to 1 million dollars, which the hosts flag as suspiciously timed against the self-custody crisis

• Luke Childs of Umbrel proposes a time-locked, two-device custody model called Anzin combining a phone, hardware wallet, and pre-signed monthly spending limits

Watch the video version: https://youtu.be/jDUgWb12oKg

BTC Pay Server is being actively exploited right now, and if you're running a lightning node through LND, a simple update won't cut it — you need to destroy and recreate your macaroons, or just shut the whole thing down until you can do it properly. This episode digs into a week where Cold Card was just the first domino, and the hacks keep coming for the most hardcore corner of Bitcoin infrastructure.

In this episode:

• BIP 110 mandatory signaling lands tomorrow with only about 2.6% miner support — far short of the 55% threshold, and even prominent supporter Bob Burnett says getting the BIP 110 chain to dominance is "roughly equivalent to flying a 747 through a basketball hoop"

• Jason Hughes analyzed 131,000 nodes and found 71% of detected BIP 110 signaling nodes were duplicates, putting genuine signaling nodes at under 6% of non-duplicated total

• Start9 closed 230 of their own Lightning channels ahead of the activation window and outlined four possible chain-split scenarios, including replay attack risks if no hard fork replay protection is added

• BTC Pay Server has a critical vulnerability actively being exploited — update to version 2.4.2 immediately, or shut your server down; Evan Kaloudis of Zeus warns upgrading alone isn't enough without regenerating root keys

• LND nodes also need updates, and Silent Link had to pull their payment processor entirely due to these cascading vulnerabilities

• A 24-person security research team has now scanned 425 Bitcoin projects and found over 1,000 high and critical findings — Cold Card appears to have been the breach that brought sharks into the water

• Michael Saylor claims he used ChatGPT to design preferred stock instruments STRK, STRF, and STRD, raising roughly $15 billion for Strategy's Bitcoin purchases

• U.S. economy unexpectedly shed 23,000 jobs in July against expectations of adding 85,000; the Crypto Clarity Act is now pushed to September

Watch the video version: https://youtu.be/vWRf6-odWa0

A white-hat group called Bitcoin Red Team filed nearly 5,000 security findings across 390 projects in just 30 hours — including 85 critical and 635 high-severity vulnerabilities — and that's before the conversation turns to whether Coinkite's CTO and the pseudonymous developer who introduced the entropy bug might be the same person. Meanwhile, BIP 110 is days away from its signaling window, and the hosts are warning listeners about replay protection before anyone touches coins on a potential fork chain.

In this episode:

• Bitcoin Red Team, now 16 researchers funded by OpenSats, spent roughly $40,000 on AI-powered security analysis to uncover the 4,962 findings, averaging 166 security issues per hour across Bitcoin-related projects.

• The hosts dissect evidence linking Coinkite CTO Peter Gray to the pseudonymous developer who committed the flawed RNG code, including a job posting from July 8th for a firmware engineer — which one host argues may have forced whoever knew about the bug to act immediately.

• NVK deleting old tweets about the Block Clock's network behavior, and the Block Clock's API calls being plain text rather than encrypted, are both examined; a source confirms it is not spyware but the deletions draw sharp criticism.

• Boltz swap service went offline under AI-driven attacks, taking down Lightning functionality for Aqua, Bull Bitcoin, Blockstream Green, and others; Zeus wallet also announced a cybersecurity incident within the same recording session.

• AI-powered voice phishing attacks hit major Wall Street hedge funds including Two Sigma, Citadel, and Point72, underscoring that the attack wave is not limited to Bitcoin infrastructure.

• BIP 110 sits at roughly 2.5% miner signaling with a 55% threshold and days left; the hosts break down why without exchange support, wallet readiness, or broad ecosystem consensus, activation looks unlikely — and explain replay protection in plain terms for anyone holding coins through a potential fork.

• South Korean Coinkite users who followed dice-roll seed generation practices appear to have been largely unaffected, offered as a concrete example of why that step matters.

Watch the video version: https://youtu.be/xDnlNAz8pEk

The ColdCard exploit has now drained a confirmed minimum of 1,360 Bitcoin — and attackers are no longer stopping at weak seed phrases. They're actively brute-forcing low-entropy passphrases on top of compromised seeds, and the carnage is still unfolding in real time. Meanwhile, a second major project, Bolts, has quietly shut down its swap services with no return date after AI-assisted attackers outpaced their small team's ability to patch vulnerabilities.

In this episode:

• ColdCard losses tracked at over 1,360 Bitcoin confirmed minimum, with reports of MK3, MK4, MK5, and Q devices affected — including one MK3 with a two-word passphrase that was brute-forced

• An analysis by Dusty Damon reveals a commit introducing the entropy bug had a five-character message ("runs.") describing 1,534 lines of changed code — a ratio of 0.003 versus a healthy benchmark of around 16

• Bolts, the backend powering lightning swaps in wallets like Aqua and Bull Bitcoin, has suspended swap services after AI-assisted attackers iterated faster than their team could patch, impacting lightning functionality in those wallets

• Rob Hamilton of Anchorwatch has personally spent over $10,000 scanning 100-plus Bitcoin ecosystem repositories using Kimi K3, finding multiple serious vulnerabilities and disclosing them responsibly

• Wizard Sardine's Perveen launched an out-of-band SlipStream tool at outofband.wizardsardine.com allowing multisig and Miniscript wallet users to submit transactions directly to Marathon miners without broadcasting publicly

• A Bitcoin Policy Institute video illustrated the exploit's scale: the bug reduced seed entropy from a search space equivalent to two billion Milky Way-sized galaxies down to the size of a large virus

• Jim Kramer announced he is selling his Bitcoin over quantum computing fears after IBM's CEO warned him to be paranoid within three to four years — immediately declared a bear market bottom signal by the hosts

Watch the video version: https://youtu.be/i4Ei0hM-WOg

A critical vulnerability in Coldcard hardware wallets has left Bitcoin holders scrambling to move funds, with roughly 1,000 BTC already seen moving on-chain. The bug traces back to a firmware change around 2021 that caused the device to fall back to a software pseudo-random number generator instead of true hardware randomness — meaning private keys generated since then have far fewer possible combinations than anyone realized. MK3 devices are the most exposed, but MK4, MK5, and the Q are also affected.

In this episode:

• BTC Sessions and Nathan from BTC Mentor run a live help desk, walking viewers through exactly which Coldcard models are vulnerable and why — MK3 seeds had roughly 40 bits of entropy, MK4/MK5/Q around 72 bits, all dangerously low

• Patch firmware version 5.6.0 for MK4/MK5 and 1.5.0 for the Q was released, but updating firmware alone does nothing — any seed generated before the fix must be migrated to a newly generated one

• Dice rolls (100 minimum) and a strong passphrase may have bought time but are not guaranteed safe — the hosts recommend treating all Coldcard-generated seeds as compromised and migrating regardless

• Recommended destinations for funds: Blockstream Jade, Trezor Safe 3/5/7 with Bitcoin-only firmware, Foundation Passport Core, Seedsigner, or even a passphrase-protected Sparrow hot wallet as a temporary measure

• Multi-sig setups are only at risk if the number of Coldcard keys meets or exceeds the signing threshold — a single compromised key in a two-of-three with non-Coldcard devices is manageable but should still be replaced

• Bitkey investigators identified an attacker using a paid blockchain analytics account, and authorities have been notified — hosts urge affected users to preserve their key records in case funds are ever recovered

• BTC Sessions announces he is terminating his Coldcard sponsorship, citing lost trust and frustration with Coinkite's broader conduct toward other wallet developers over the years

The full debrief and unfiltered takes drop on the video version of Bitcast — find it on the BTC Sessions YouTube channel.

Watch the video version: https://youtu.be/_ld5oX1LKas

A serious vulnerability in Cold Card hardware wallets has exposed Bitcoin funds across all current product lines — MK3, MK4, MK5, and the Q. Over 38 million dollars worth of Bitcoin had already been swept at the time of recording, with the number climbing, and the hosts make clear this is not a drill: if you generated a seed on a Cold Card, treat those keys as compromised and move your funds now.

In this episode:

• The bug stems from a flawed random number generator in Cold Card firmware — one line of code, undetected for five years, that reduced the entropy used when generating seeds, making wallets brute-forcible with roughly $10,000 worth of compute

• MK3 wallets are the highest priority, with only 40 bits of entropy; MK4, MK5 and Q wallets have around 72 bits — still brute-forcible and actively being targeted

• Recommended migration paths include: updating firmware and generating a fresh wallet, adding a strong six-word passphrase, moving to a hot wallet in Sparrow temporarily, or using another hardware wallet such as Trezor Safe 3/5/7, Blockstream Jade, Passport, Seed Signer, or Bitkey

• If you used 99 or more dice rolls during setup and added a passphrase, you are likely not at risk — but the hosts suggest migrating anyway out of caution

• NVK's public statement is read and discussed, including his warning that AI-assisted code review can now find latent bugs faster than seasoned human reviewers

• The attacker appears to have used bots to sweep high-value wallets first, skipping addresses below a threshold — and may have been identified through a paid service account they used during the attack

• The hosts reflect personally on years of recommending Cold Card to clients, friends and family, and discuss what this means for the future of self-custody, multi-vendor multisig, and user-generated entropy as a baseline requirement

Watch the video version: https://youtu.be/rrIQpRNhXiA

Fed Chair Kevin Warsh held rates steady this week and admitted out loud that the central bank cannot undo five years of above-target inflation in nine weeks — and the guys on Bitcast think that one throwaway line reveals everything wrong with the system. Bitcoin, meanwhile, is quietly sitting right on the 200-week moving average at roughly $63,500 — the same price it was in April 2021 — while everyone else piles into a single overcrowded AI trade.

In this episode:

• Kevin Warsh's first major Fed press conference draws mixed reviews: the hosts say he's "over his skis," lacks Powell's rapport with reporters, and his admission that inflation can't be undone only reinforces the case for hard money.

• Steve Eisman (the real-world inspiration behind a character in The Big Short) says he is sitting entirely in cash because the 60/40 portfolio is now effectively one trade — over 50% of stocks and most new bond issuance are AI-related.

• South Korea's stock market erased $2 trillion in market cap in just 40 days, prompting emergency stabilization measures from the country's finance minister.

• Fauci invokes the Fifth Amendment roughly 111 times in front of a Senate committee; Rand Paul argues a presidential pardon strips him of that right under Brown v. Walker (1896), making the entire hearing theater.

• The White House officially posts a "Truth in COVID" thread pointing to the lab-leak origin theory; Nathan's interview with Dr. Peter McCullough suggests the cover-up was driven by fear of violating 1970s bioweapons treaties.

• Iran launched a surprise missile attack on U.S. forces; Trump threatened a strong military response while invasion odds on prediction markets sit around 24%.

• BitChat — the Bluetooth mesh communication app requiring no internet or cell service — can now send itself phone-to-phone with no internet required, making it effectively unstoppable as a censorship-resistant tool.

Watch the video version: https://youtu.be/GVhIZrR1yE4

Michael Saylor's company Strategy just bought back $25 million of its own STRC preferred shares — but the money came from selling $544 million worth of MSTR common stock, not from Bitcoin purchases. Saylor hasn't bought any Bitcoin in five weeks, and Parker Lewis pointed out that same cash could have bought roughly 8,300 Bitcoin instead.

In this episode:

• Strategy sells 5.4 million MSTR shares for $544 million to fund STRC buybacks, with Saylor stating repurchases may also be funded by BTC sales — his stated goal is to keep STRC trading near $100.

• BIP 110 debate heats up ahead of an August 8th activation window, with the panel noting signaling hash rate remains in single digits and a minority chain split appears likely if nothing changes.

• Fauci's private diary leaked by Rand Paul reveals that in January 2020, only 2 of 12 scientists consulted believed natural origin was likely — directly contradicting Fauci's public statements for years.

• A former World Bank president tells CNBC the Federal Reserve has lost over a trillion dollars by borrowing from banks at 5.4% to buy government bonds, effectively hiding the true fiscal picture.

• NYC mayoral candidate Zohran Mamdani promises city-run grocery stores priced 30% below retail — the panel compares the plan to Chavez-era Venezuelan price controls and the inevitable empty shelves that followed.

• A traveler in Atlanta used GrapheneOS's duress PIN to wipe his device when asked to unlock it at the airport — the DOJ is now charging him with destroying evidence.

• Ben announces a new tutorial channel launching in eight days, with day-one videos covering GrapheneOS setup, local AI with LM Studio, and sovereign computing with Umbrel.

Watch the video version: https://youtu.be/I_qvrcaWyiA

BitMEX is shutting down after 11 years, and nobody can stop wondering who walks away with the $270 million sitting in its insurance fund. That same week, Poolin filed for Chapter 11 bankruptcy owing $163 million to its own wallet users — and nine institutions including BlackRock quietly pledged $15 million to a new Bitcoin Security Consortium. Two legacy pillars down, the suits moving in.

In this episode:

• BitMEX closing September 23rd after halting new signups, with speculation the shutdown is designed to unlock its $270 million insurance fund — and whether Arthur Hayes's 2022 guilty plea, $10 million fine, and Trump pardon factor into the timing

• Poolin filing for Chapter 11 with roughly $163 million owed to wallet users whose withdrawals have been frozen since 2022, with one user in the live chat reporting his IOU tokens are now worthless

• Strategy's Bitcoin Security Consortium — Anchorage, ARK Invest, BlackRock, Block, Blockstream, Coinbase, Fidelity, Galaxy, and Strategy pledging $15 million over three years — and whether this is genuine development support or a PR pivot away from MSTR's declining Bitcoin yield and falling STRK price

• India ordering GitHub to remove Jack Dorsey's Bitchat app within three hours, citing its anonymous mesh Bluetooth communication as a threat to law enforcement — and the internet mirroring the code on censorship-resistant platforms before the deadline

• Nvidia's Jensen Huang, Elon Musk, and roughly 20 other firms signing an open letter opposing US government restrictions on open AI models, while Polymarket odds of a government ban on open-source AI in 2026 spike to 46%

• Nick Carter's claim that the US government will use quantum computing to crack Satoshi's dormant coins and place them in a claimable trust — and the heated debate over whether quantum is a genuine threat or coordinated fear tactics

• A new Clarity Act provision stating that lawfully self-custodied assets cannot be deemed abandoned or forfeitable solely for being dormant, and what that might mean for Satoshi's coins

Watch the video version: https://youtu.be/a7XhBhpToH8

Jack Malers is out at 21 Capital — and the hosts aren't buying the official story. Meanwhile, Satsuma shareholders just voted to liquidate their 600-odd bitcoin and delist from the London Stock Exchange, and Lynn Alden is launching Orange Juice right into this wreckage. The timing could not be more awkward.

In this episode:

• Jack Malers steps down as CEO of 21 Capital — the panel debates whether the board actually removed him, why the stock is down roughly 50%, and what a return to Strike-focused work might mean for him

• Satsuma, with Mark Moss as chief Bitcoin strategist, votes to sell its bitcoin and exit the London Stock Exchange — raising questions about whether the pure-play treasury company model is broken

• Lynn Alden's Orange Juice venture gets a deep look — Walker recorded with her that day; the model buys cash-flowing, AI-resistant small businesses and uses free cash flow to accumulate bitcoin rather than playing capital-markets games

• The Clarity Act's latest draft bans elected officials and their spouses from issuing digital assets — a pointed reference given Trump and Melania's prior memecoin profits

• S&P launches its first crypto index holding 18 tokens led by ETH, BNB, SOL, and Hyperliquid — with Bitcoin excluded entirely

• Gross domestic income data shows wages are now just 43 percent of US GDI, near the lowest since 1929, and a Zero Hedge piece ties money printing directly to socialism's rise

• Libbitcoin, Eric Voskuil's alternative node implementation, achieves a full initial block download with complete validation in 55 minutes using GPU-based batch signature verification

Watch the video version: https://youtu.be/45dpOu_6dr8