UNGOVERNABLE

• bitcoiner.guide down due to hosting headaches
• Correction to last week's chat about Bitkey

• Hardware hacker Joe Grand examined a Trezor Model T bought on Facebook Marketplace in Canada in 2025 and a Trezor One from a TikTok shop in August 2026, both from unauthorized sellers on models Trezor discontinued in January 2026; in both, the main microcontroller had been replaced so the device produced one of about a dozen phrases the attacker already knew instead of a random recovery phrase, with a microSD card soldered inside the Model T holding genuine firmware to pass the integrity check and the Trezor One's swapped chip carrying both the malicious and official firmware, costing its owner about $50. Trezor told Zero Day on 15 October this is a known counterfeit method it has warned about since fake Model Ts turned up on Russian marketplaces in 2022, that it hasn't examined these specific units, that its Suite check is designed to catch devices producing predetermined phrases and it knows of no way to pull this off on its current Safe range, and that its 13 October comment about no evidence of compromise referred to new devices bought from its website or authorized resellers. Both hosts stressed this is not a Trezor supply chain issue, unlike the Ledger case, since both devices were counterfeits sold by unauthorized sellers, and urged listeners to buy hardware directly from the manufacturer and be wary of any reseller -- Zero Day (Kim Zetter), Cryptoast
• Trezor said on 13 October it has cut the number of resellers it works with and is reviewing vendor relationships as a preventive step following the CryptoBilis implants, with dropped resellers able to sell existing stock until 1 January 2027; this isn't a flaw unique to Trezor, the hosts noted, but something that could affect any hardware manufacturer -- Bitcoin Magazine, Cointelegraph
• Recapping the 9 October CryptoBilis drain of $86M to $93M, Ledger's 15 October statement says a "highly organized criminal group" bought devices, fitted the implants and fed them back through resellers with seed-collection, draining and laundering servers built in advance, that there was no flaw in its chip, operating system or servers, and it has asked resellers across Southeast Asia and Hong Kong to suspend sales without giving an official loss figure. Mark Karpelès says a Ledger Nano X bought at MediaMarkt in Germany is confirmed to carry the same implant, and reported another from a shop at Singapore's Changi airport, though Ledger hasn't examined either device and every confirmed theft still traces back to CryptoBilis; MediaMarkt has pulled Ledger devices worldwide. Chainalysis found a scam operator who stole roughly 60 BTC ($5M) from task-scam victims had it swept up in the same drain after moving it onto a compromised Ledger device, a bit of karma the hosts enjoyed -- Ledger statement, Bitcoin Magazine, Bitcoin Magazine (scammer victim), ForkLog (Karpelès), crypto.news (MediaMarkt), TokenPost (Gauthier v Karpelès)
• On the same day as its CryptoBilis statement, Ledger announced Atom, an Android phone due mid-2027 that runs everyday apps and switches into a protected mode for managing keys, with an OpenClaw AI assistant whose actions need physical approval on the device; Ledger says a tamper-sensing enclosure with its own battery will block screen-reading implants like the CryptoBilis ones, and Atom will sell only through Ledger's own website at $849 for a Founders Edition ($899 after launch). The hosts called the timing tasteless but the engineering impressive, questioning whether a phone that also runs WhatsApp and TikTok belongs anywhere near your keys -- CoinDesk
• A UK trader posting as "realist" on X says attackers held him at knife point and forced him to transfer close to $800,000, with $40,000 coming from a hot wallet and $720,000 from a Ledger hardware wallet; police have made no public statement though he says officers are investigating, and some commenters unofficially link it to the recent Revolut breach that leaked users' crypto holdings and home addresses -- CoinDesk
• AI-assisted searches from researcher Pizza Bitcoiner helped Jameson Lopp merge new cases into his wrench attack archive on 16 October, taking it past 700 documented incidents, with France the leading hotspot at 77 recorded incidents so far this year; the hosts' advice remains to keep your mouth shut about your holdings and stay pseudonymous online -- Jameson Lopp (GitHub), TFTC, Pizza Bitcoiner database, OCCRP
• Bank of Russia guidance dated 12 October confirms direct peer-to-peer crypto trades between individuals stay legal only until 1 July 2027, after which every trade must go through a registered broker or exchange under Federal Law 282-FZ -- TFTC, Bitcoin Magazine
• The US Treasury announced $1.2 billion in combined penalties on 13 October after Bank of America admitted willfully violating the Bank Secrecy Act, failing to report over $5 billion in suspicious transactions to FinCEN between 2018 and mid-2025, with the OCC's $750 million penalty counting toward the total, OFAC settling separately for $11.6 million, and no executive charged; the hosts set that against the five and four year federal prison sentences the Samourai Wallet developers are serving for pleading guilty to running an unlicensed money transmitting business over privacy software they wrote -- ABC News (AP), TFTC, Treasury
• Citizen Lab's AdFection report is the first public technical confirmation that mercenary spyware can reach a phone through targeted advertising alone, with no click needed from the victim: at least 45 devices at Al Jazeera were targeted with Candiru spyware in 2024 and 2025 through ads bought by Israeli firm Discover-Tech, with attacker scripts found in over 75,000 Android and iOS apps and over 120,000 websites; Google, IAB Europe and several ad exchanges cut Discover-Tech off in early October, just before the report came out -- Wired, BleepingComputer, Citizen Lab
• 404 Media and Court Watch reported that newly public court records include a letter from Telegram to US authorities, sent after a court order, disclosing a specific user's phone number, Telegram user ID and IP address, a reminder that Telegram is not a private messenger and shouldn't be used for anything you want kept private -- 404 Media
• OpenAI published a misalignment report describing how an internal GPT-5.6 Sol research model, given no funded wallet, checked 362 addresses derived from a commonly used developer recovery phrase on 26 June, found one with funds and paid Sepolia testnet fees from it to finish a coding task without disclosing where the money came from, reasoning the funds on a known public developer mnemonic were "effectively abandoned"; only valueless testnet ETH was involved, and OpenAI caught it on 25 September through extended monitoring and has restricted live internet access for similar tasks -- OpenAI misalignment report, CoinDesk

• Adds a parallel hash lookup that makes get_history and subscription queries 5x to 10x faster on cold or uncached lookups, tunable with a new history_lookup_threads setting. Also refreshes the built-in server seed list.

• Bundles Taproot Assets v0.8.6 with lnd v0.21.4-beta and Loop v0.35.0, ships reproducible archives with a signed tag, and the notes give a staged upgrade procedure for nodes with a price oracle.

• Fixes the find-connection tool added hours earlier in 0.43.0, which brought encrypted backups with an optional wallet key lock and graph investigation tools: find connections between addresses, BIP329 graph labels, a time layout and multi-select.

• Required update fixing vulnerabilities from Bisq's recent security audit. Offer takes must match the maker's current offer and price, buyers enforce seller reputation limits, and Bitcoin URI and Lightning invoice amounts are checked against the agreed trade. Also signs storage, isolates Tor connections between identities and moves to Tor 0.4.9.14.

• Stable release after 13.2.3-rc1: embedded LND 0.21.4 and an LDK Node build with the rust-lightning 0.2.7 security fixes. Also checks LSP-wrapped invoices match the invoice they wrap and binds LNURL-auth callbacks to the signing domain.

• Fourth release candidate for 32.0. Block validation can now fetch the coins being spent from disk in parallel (new -prevoutfetchthreads, default 8), the default connection limit rises from 125 to 200, onion services Bitcoin Core creates get Tor's proof-of-work defences against flooding, and a bug that could leak your IP when using private broadcast over Tor is fixed. The final release follows once testing on the candidates is done.

• Adds an option to export the XPUB of any key, including software keys, along with bug fixes.

• Fixes layout problems on phones and merges the SeedQR controls into one button with a SeedQR or Compact SeedQR switch, also for BIP-85 child seeds and Seed XOR shares. No change to how seeds, keys or addresses are generated.

• An open-source (MIT or Apache 2.0) Android Lightning wallet whose keys live on a cheap LilyGo T-Display-S3 (ESP32) board you flash yourself, with every payment confirmed on the device's own screen over Bluetooth. Built on Spark, so Spark operators co-sign with your key. App v0.3.0 adds paying Lightning addresses and LNURL plus a receive Lightning address; firmware v0.1.2 and app v0.2.1 shipped on 13 October.

• Tor now runs as an isolated package with separate sessions for vault-backup key servers and onion Electrum servers, and recovery words are typed on an in-app keyboard instead of the OS one. Adds a screen privacy toggle, AutoBuy and limit orders, Android memory tagging, and an experimental Silent Payments wallet behind developer mode.

• A Bitcoin wallet can now be split into multiple accounts, and a rebuilt sync engine brings wallets up to date almost instantly while history loads in the background. Also shows Lightning amounts in sats, adds more Tor…

• SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools 
• DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
• DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T 
• SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

(00:00:00) Welcome to Freedom Tech Friday

(00:02:32) SF Joins Us

(00:03:56) Who is SF?

(00:07:21) The Cult Within the Cult

(00:15:39) How Noderunners Radio Started

(00:31:14) Vibe Coding the Jukebox

(00:39:43) When Misty Breez Went Dark

(00:46:18) Live Sets and the Donation Pot

(00:58:27) Broadcasting Bitcoin Over the Airwaves

(01:05:58) See You Next Friday!

• KeyOS v1.4.1 released
• Passport Core v2.4 internal beta testing
• Prepping for Freedom Fest UK and Amsterdam
• Max renovating the house

• Hundreds of self-custody wallets belonging to Southeast Asian Ledger customers who bought their devices from CryptoBilis, Ledger's authorised reseller for Malaysia, Indonesia and the Philippines, were emptied in a coordinated sweep across six chains on 9 October, with on-chain tallies putting losses at $86M to $93M; Tether froze about $10M of the stolen USDT, and on 10 October Ledger confirmed an "unauthorized hardware implant" in one affected user's device. Mark Karpelès's Tibane Labs teardown found a hidden board inside a Nano X tapping the screen's data lines to read the 24 words during setup and send them out over its own cellular modem, never touching the secure element, so the device still passes Ledger's genuine check; CryptoBilis changed hands in March, with unverified registry screenshots showing a new owner based in China, though nobody has shown a link between the new owner and the theft. Anyone who bought from a non-direct seller should not set the device up, and anyone who already did should move funds to a new seed generated on a device bought direct -- Ledger Support (implant), Ledger Support (halt), Ledger (72-hour update), Bitquery investigation, Tibane Labs teardown, Mark Karpelès, Specter, CoinDesk, The Block, Crypto Briefing (Tether), Cointelegraph (EU report)
• On 11 October Coldcard said a post carrying a phishing link went out from its official X account and was deleted, telling users not to visit it and that coldcard.com is its only official site; it found no matching login or session record, says its credentials and offline 2FA remain secure, and has asked X Support to escalate, with no losses reported and no confirmation yet of how the post was published -- COLDCARD, COLDCARD follow-up, Cointelegraph, Stacker News
• Second says an attacker exploited a bug in its Ark server's boarding flow on 5 October, registering boards with only his own signature and then exiting them while also spending the same balances out of Second's node over Lightning, taking 0.75 BTC of the company's own liquidity; Second blocked the source within hours, briefly took the server offline and shipped a fix, with users' pre-signed exit paths unaffected, and links the attacker's coins to the 19 September Blink theft -- Second, bark MR #2612, Stacker News
• FinCEN filed notices on 5 October withdrawing the 2020 unhosted wallet proposal, which would have required reports on transfers to self-custody wallets over $10,000 and records over $3,000, and the 2023 finding that labelled international coin mixing a primary money laundering concern, saying it will take no further action on either; existing exchange AML rules and OFAC sanctions on specific mixers are untouched -- Federal Register (wallets), Federal Register (mixing), Coin Center, CoinDesk, TFTC
• On 25 September the DC Circuit upheld Roman Sterlingov's Bitcoin Fog conviction, finding that moving funds in and out of the mixer furthered its ability to launder funds for all users, enough to try him in Washington; on 5 October, the same day FinCEN withdrew its mixer rule, SDNY prosecutors cited that ruling against Tornado Cash developer Roman Storm, whose lawyers replied that Bitcoin Fog was custodial and Tornado Cash is not, with his retrial set for 26 April 2027 -- The Rage, TFTC, DC Circuit opinion
• ICANN's Reveal Day on 7 October published 1,615 applications for new top-level domains, including mempool.space operator Wiz's community application for .bitcoin, which proposes a restricted namespace for vetted Bitcoin builders with no auctions or premium names and 21% of gross revenue going to Bitcoin development; a rival standard .bitcoin application from Bird Pepper LLC, linked to Identity Digital, is also in the contention set, with string confirmation due 17 November -- Application PDF, ICANN, Contention sets

• Fixes launch failures on Apple Silicon Macs introduced in 2.9.0, which brought hardware-key inheritance to desktop.

• Block's Bitkey published app release 2026.13.0 with a matching source tag and an updated Emergency Exit Kit APK for users who lose access to the app stores or Bitkey's servers.

• Roughly ten versions between 5 and 8 October turned Am I Exposed from a single-transaction checker into a wallet privacy auditor: wallet-level privacy heuristics, a UTXO list with privacy-aware coin selection and manual coin control, a spending decision tree, and BIP329 label import and export.

• The nodeless Lightning plugin for BTCPay Server adds a Sweeps report (what left the wallet, the fee, what arrived) and a Stablecoin Payments report to BTCPay's Reporting page. Supports BTCPay 2.4.1 and later, with no database migration.

• Reproducible builds and BIP329 label import and export. Watch-only wallets can have their derivation path and fingerprint edited and show the raw PSBT when sending. Also fixes RBF on HD Bech32 wallets and animated QR scanning.

• Gateways can be marked secure, services become reachable from other routed private networks, packages can request hardware virtualisation, and apps that pin the server certificate, such as Sparrow and Electrum clients, now see the same certificate on every route. Networking and backup fixes too.

• Coinos founder Adam Soltys opened Coinos version 3 for public testing at v3.coinos.io on 8 October, with a video tour. The new version pairs an Ark spending wallet with a regular onchain bitcoin wallet, adds a built-in Nostr client and encrypted messaging, and can run offline.

• PayPerQ (PPQ.AI), a pay-per-use AI router that takes Lightning, now serves chat requests inside an AWS Nitro enclave, with prompts encrypted on the device and the company seeing only billing metadata.

• Alby Hub v1.24.1 -- 2026-10-06
  • Refreshed payment screens, transaction filtering, a Postgres to SQLite migration flow, and dependency and security updates.
• Amber 6.6.7 -- 2026-10-05
  • Nostr signer: relays reconnect after VPN and network changes instead of staying stuck until a force-close.
• Amethyst v1.18.0 -- 2026-10-11
  • Nostr client: web of trust, private DM fixes and a new desktop app.
  • Also in window: v1.17.0 (2026-10-05), reproducible builds and QR scanner audit fixes.
• Arkade TS SDK 0.4.79 -- 2026-10-08
  • Updates the scure crypto libraries and fixes a swap URI amount-conflict bug; the companion Swap SDK 0.0.25 carries the same fix. 0.5.0 release candidates continue alongside.
• balanceofsatoshis v25.0.0 -- 2026-10-08
  • LND command-line toolkit: adds a pending command and drops the price command.
• BDK chain 0.23.4 -- 2026-10-12
  • Patch releases across the Bitcoin Dev Kit crates, also core 0.6.4, esplora 0.22.3, electrum 0.24.1 and bitcoind_rpc 0.22.1.
• Bitcoin Core v32.0rc4 -- 2026-10-12
  • Fourth release candidate for 32.0, which brings parallel block validation and silent payments. Final not yet released.
• Bitcoin Keeper v2.6.3 -- 2026-10-07
  • Fixes pairing with Keeper Desktop.
  • Also in window: v2.6.2 (2026-10-06), smoother unlock and more reliable key rotation.
• BTCPay Server 2.4.5 -- 2026-10-06
  • SSRF blocking on by default and tighter refund permissions. Followed release candidates rc4 to rc7 (2026-10-05 to 10-06).
• Cake Wallet 6.4.6 -- 2026-10-05
  • Monero-side improvements and bug fixes; no Bitcoin-specific changes noted.
• Core Lightning v26.06.9 -- 2026-10-07
  • Security release.
• Ditto v2.44.2 -- 2026-10-10
  • Nostr social server: point releases, no readable notes.
  • Also in window: v2.44.1 (2026-10-07) and v2.44.0 (2026-10-06).
• Fedimint React Native SDK 0.1.0-beta.1 -- 2026-10-11
  • First React Native SDK for federated ecash apps, for testing only.
• Fedimint v0.12.2 -- 2026-10-06
  • Gateway security release.
  • Also in window: v0.11.4 (2026-10-06), related hardening.

• SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools 
• DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
• DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T 
• SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

(00:00:00) Welcome to Freedom Tech Friday

(00:02:45) Roy from Breez Joins Us

(00:05:04) Eight Years of Breez

(00:14:19) Liquid, Spark & Surviving the Hacks

(00:18:09) The New World of AI Attacks

(00:24:07) Why Spark...and Its Trade-offs

(00:43:14) Lightning Was Never Private

(00:49:36) The Breez SDK

(01:00:28) See You Next Friday!

• Weekend shenanigans
• Mission Control and Jarvis
• Max fighting insects

• Former National Crime Agency officer Paul Chowles has been ordered to repay GBP 1,810,678.93 after a Crown Prosecution Service confiscation order on 30 September; he stole 50 BTC in 2017 from a wallet holding coins seized from Silk Road 2.0 administrator Thomas White, worth about GBP 59,000 at the time, laundering it through Bitcoin Fog and spending it via CryptoPay and Wirex cards before Merseyside Police caught him in 2022; he was jailed for five and a half years in July 2025, and part of his confiscation order now pays off White's own unpaid confiscation order to the state -- CPS
• South Africa's Absa has become the first African bank to custody bitcoin, mainly for institutional clients, following Deutsche Bank's custody launch in September; head of digital assets Rob Downes said bitcoin will be the bank's largest custodied asset, with other digital assets to follow, in a market Chainalysis puts second in Sub-Saharan Africa by value received at about $36B -- Bitcoin Magazine
• Blink published its post-mortem of the 19 September attack: a permissions flaw in its admin tools, open since October 2023, let the attacker grant themselves admin rights through the OAuth consent page and take over 35 custodial accounts, withdrawing about 6.61 BTC from 24 of them; nine targeted accounts had 2FA on and all 18 login attempts to use them were refused, so nobody with 2FA lost anything; shareholders advanced the full amount as an interest-free loan so balances were restored by 24 September with fees refunded, and Blink is offering a 25% recovery bounty plus a matching 25% donation to circular economies including Bitcoin Beach, Bitcoin Ekasi and Afribit Kibera -- Blink
• Tether says USDT is coming to Bitcoin this month via the RGB protocol, issued by Utexo, whose co-founder Viktor Ihnatiuk says the company holds the commercial licence; Utexo can't freeze RGB addresses the way Tether freezes Ethereum ones, so instead it will blacklist UTXOs that become unredeemable at bridges and minting tools, with BTC-to-USDT swaps and BTC-backed lending to follow and Lightning support after launch; USDT first lived on Bitcoin via Omni back in 2014 -- CoinDesk
• A federal judge in Utah has granted a preliminary injunction blocking the VPN provisions of the state's SB 73, the first US law to penalise VPN use, which would have required adult sites to block VPN users or locate every visitor; the court found the law demands something technically impossible, though the separate ban on explaining how to use a VPN was not challenged and stays in force -- EFF
• Core Lightning is warning of active attacks on unpatched nodes: an operator on v26.06.7 reported an attacker opening a splice, routing a small keysend, then sending an error so the victim's node goes on-chain and sweeps its own output through the revocation path as if it had cheated; the path was already fixed in v26.06.8, and by 1 October Stacker News operators were reporting about 0.2 BTC lost between them, with one user reporting 4.88M sats across five incidents and a StartOS user reporting 3M sats; anyone on 26.06.7 or earlier should upgrade now, or restart with --offline if they can't upgrade immediately -- GitHub #9578, GitHub #9595, TFTC, Stacker News, Stacker News, CLN v26.06.8
• The Dutch cabinet has told parliament that shares, bonds and options will move to a realised-gains tax from 2028, with other assets following in 2030; crypto isn't named among the 2028 instruments, so if it counts as an "other asset" Dutch bitcoin holders keep paying yearly tax on unrealised paper gains for two years longer than shareholders, and the tax-free allowance falls to EUR 1,000 per person -- NL Times, Bitcoin Magazine, Crypto Benelux
• The Liquid Federation says an independent external audit of Elements v23.3.4 is underway, focused on safely restoring peg-outs, and it is replacing the peg-out authorisation key list and moving all peg-out keys to cold storage; peg-outs remain paused nearly a month after the exploit, with about 602 BTC of the stolen 3,996 BTC still unrecovered -- crypto.news, KuCoin News, liquid.net
• UK law firm Edmonds Marshall McMahon says it has recovered 20.00444711 BTC, about $1.725M, in full and with no deduction for one client seven weeks after the Coldcard theft, the first documented full recovery through the Crypto Recovery Trust; the claim rested on blockchain forensics, the client's exchange records, signed message challenges and wallet derivation checks -- EMM Legal, CoinDesk, Decrypt
• Apps built on the Breez SDK can now accept USDT or USDC from more than 30 networks including Ethereum, Base, Solana and Tron, with Flashnet converting the payment in the background so it lands in the receiver's self-custodial wallet as bitcoin, or as dollars with the stable balance feature; this is a developer-facing SDK feature, not something Breez's own wallet turns on automatically -- Bitcoin Magazine
• Block has launched its first big consumer ad campaign for bitcoin, "Some things don't make sense. Bitcoin does.", running on YouTube, X, Meta, Fox Sports and in cinemas until 31 December; meanwhile a Stacker News user described failing for the second time in two weeks to spend bitcoin at a Square terminal because the merchant hadn't switched the option on in their dashboard -- newer point-of-sale devices have the toggle on by default with a customer-facing screen, but older terminals still need the merchant to enable it -- Bitcoin Magazine, Stacker News
• Bitget reopened BTC withdrawals on 28 September, with fiat and P2P back by 2 October, and Bitcoin Magazine reported more than 4,000 BTC withdrawn in a single hour on 29 September; CEO Gracy Chen told CNBC only about $1.1M of the roughly $388M stolen has been frozen and she isn't "expecting to recover a lot" -- CNBC

• An MIT-licensed messenger that finds contacts over the Mainline DHT and talks over direct encrypted connections, with no servers or accounts, built-in payments across Lightning, Cashu, Ark, Spark and on-chain, and messages that vanish by default.

• A security release fixing two funds-theft bugs, including a malicious peer able to force a second commitment signature at the same state index, plus two denial-of-service bugs.

• Adds proper large-screen layouts for tablets, fixes the Passport Prime price graph stuck on "Loading Data", and removes leftover code from the retired Buy Bitcoin feature.

• Lets users set their own hardware signing device as the inheritance key in off-chain timelock inheritance plans, plus general bug fixes.

• Adds manual coin selection for Bitcoin and Liquid, a price chart and BIP39 passphrase guidance at login, and restores 2FA-protected and 2-of-3 multisig account creation.

• A redesigned interface with light mode, a compact transaction graph and a "Before you act" section, plus later patches fixing Umbrel startup and dropping Liquid from tips and guides.

• The nodeless Lightning plugin for BTCPay Server turns on unilateral exit for every server, letting a merchant take its balance on-chain without Spark's operators, now with automatic exit-state backups.

• A security fix for the router's management interface so requests from loopback no longer skip sign-in, meaning every settings change now needs authentication.

• 0xchat 1.5.6 -- 2026-09-30
  • Nostr chat: blocks connections while the Tor proxy is set but not ready, closes a system-proxy leak, validates TLS for non-onion hosts, and patches Cashu P2PK security issues.
• Amber 6.6.6 -- 2026-09-28
  • Nostr signer: fixes the nostrconnect parser corrupting secrets that contain "=", which broke NDK-based clients.
• AQUA 0.5.4 -- 2026-10-01
  • Fixes Lightning refunds, mismatched fee display and failed-payment status; minimum iOS is now 15.
• Arti 2.7.0 -- 2026-10-01
  • Tor in Rust: fixes low- to high-severity security issues (onion service operators should upgrade) and moves closer to running relays and directory mirrors.
• BasicSwap 0.19.0 -- 2026-10-03
  • Atomic-swap DEX: Smart Buy (beta) fills an order across offers, and offers and swap messages can now travel over Nostr with a key per swap and Tor when enabled.
  • Also in window: 0.18.10 (2026-09-29), switchable price oracles and stale-rate protection.
• BDK FFI v3.1.1 -- 2026-09-29
  • Error messages no longer echo back descriptor or key material; also fixes a fee-rate overflow.
• Bisq v1.10.9 -- 2026-10-01
  • Mandatory: fixes vulnerabilities found in a recent security audit and updates Tor. Required to keep trading.
• Bitcoin Core v32.0rc3 -- 2026-10-01
  • Third release candidate for 32.0, which brings parallel block validation and silent payments. Final not yet released.
• Bitcoin Keeper v2.5.17 -- 2026-10-02
  • Better Recovery Key backup checks and repair, and improved wallet recovery.
  • Also in window: v2.5.16 (2026-10-02), UI and crash fixes; v2.5.15 (2026-09-28), versioning only.
• Breez SDK Spark 0.26.1 -- 2026-10-02
  • Smaller mobile binaries.
• BTCPay Server v2.4.5-rc3 -- 2026-10-05
  • Release candidate, following rc1 (10-01) and rc2 (10-02). No release notes yet.
• COLDCARD 5.6.3 and 1.5.3Q -- 2026-09-30
  • Adds Codex32 and Shamir seed splitting, warns before installing contributor-signed or downgraded firmware, and…

• SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools 
• DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
• DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T 
• SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

(00:00) Welcome to Freedom Tech Friday

(03:12) Nathan Day Joins Us

(04:40) Freedom Fest & Bitfest

(11:10) The Overland Beast

(18:54) Who's Speaking & Ticket Code

(22:15) Putting Bitcoin on the Map

(32:44) Is It Omarchi or Omarki?

(46:48) Should You Pay in Bitcoin?

(54:16) Where to Get Tickets

(56:03) See You Next Friday!

In these episodes, we read Keonne’s recent letters written from prison. The aim in sharing this is simple: amplify Keonne’s story, support him and Bill, and ensure help reaches their families. If listening isn’t your thing, the full text is linked in the show notes—please read, listen, and share.

FREESAMOURAI.NOW

Privacy is NOT a crime! Keonne Rodriguez and William Hill, two Bitcoin developers, are currently serving prison sentences for crimes they couldn’t have committed. Join our Bitcoin prize draw to help raise money to support their families and drive awareness to increase their chances of a presidential pardon. 50% of the prize pot goes to one lucky winner. 50% goes to Samourai.Bitcoin only, powered by lightning, and 100% provably fair. Because we don’t trust, we verify.

LINK TO THE LETTER AT THE RAGE

HELP GET SAMOURAI A PARDON

• SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools 
• DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
• DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T 
• SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

• Max: flooded the downstairs after leaving a sink running over the weekend, spent Saturday ripping out old timber and clutter he'd been meaning to clear out anyway, then a full kids' day that left them sick afterwards
• Q: spent the weekend building his own local, voice-controlled AI assistant after watching the new Spider-Man film
• Q: read this week's letter #7 from Keone, "Notes from the Inside", posted on The Rage -- a tough one on conditions moving between facilities; audio version out later this week, timed with Rick's Free Samurai prize draw
• Q: enjoyed last week's Freedom Tech Friday listener questions episode, ranging from Bitcoin to Monero to privacy, multisig and local AI

• Research lab [alloc] init, founded by Misha Komarov with Clara Shikhelman as Head of Protocol Research, published Shielded Bitcoin, a proposal for Zcash-style private transfers needing no soft fork; shielded transactions are encrypted data blobs carried in OP_RETURN or witness data that Bitcoin only orders and timestamps, while separate indexer software checks zero-knowledge proofs and stops double-spends; value sits in encrypted "notes" spent by publishing a one-time nullifier that proves the spend without revealing which note it is; the peg moving real BTC in and out isn't designed yet and rests on an unproven witness-encryption scheme called PIPEs v2; CoinDesk reports fees around 4x normal, a trusted setup and no launch date -- Bitcoin Magazine, CoinDesk, allocinit
• Blockstream published its own post-mortem of the 6 September Liquid exploit: a rangeproof-cache flaw dating to April 2018 ("Bug A"), responsibly disclosed 2 August and patched by 11 August, introduced a second flaw ("Bug B") where unprefixed cache keys let two different proofs collide; the attacker used it to mint about 4,000 unbacked LBTC and peg out 3,996 BTC through SideSwap, draining the reserve from about 4,205 BTC to 197 BTC; 3,400 BTC was returned and the network resumed 9-10 September, but about 602 BTC remains with the attacker and peg-outs stay paused with no date; the 11-of-15 federation multisig worked exactly as designed, the failure was in the software deciding what counted as a valid transaction -- Blockstream
• Bitget detected unauthorised transfers from its hot and warm wallets at 18:31 UTC on 24 September and froze withdrawals platform-wide; CEO Gracy Chen says the attacker compromised a backend system, spoofed transaction data and triggered Bitget's own approval process, with private key compromise ruled out; the loss was revised from $351.6M to about $387.5M once Zcash and TRON assets were counted, mostly ETH, TRX and USDT with no bitcoin taken; Circle and Tether froze about $318K, while roughly $83M in native XRP moved beyond Ripple's power to freeze; North Korea attribution comes from Bitget, Elliptic and MetaMask's Taylor Monahan, not yet from any government; Bitget says its User Protection Fund covers the loss and is reopening withdrawals in phases from 28 September -- CoinDesk, TFTC, Bitcoin Magazine, CoinDesk (freezes), CoinDesk (XRP), Bitget
• AMLBot traced part of the Bitget haul from TRX to USDT, bridged to Ethereum, swapped to about 145 ETH, then through THORChain into about 4.59 BTC, with roughly 4 BTC of that linked to an unnamed Wasabi coinjoin round and the addresses "blacklisted"; most of the stolen funds have not moved -- AMLBot on X, crypto.news
• Matt Morehouse disclosed two denial-of-service bugs in Eclair v0.13.1 and earlier, fixed in v0.14.0: oversized feature-bit init messages could allocate about 300MB per message and crash a node, and zlib-compressed channel queries could inflate 64KB into 64MB; his smite fuzzer found the first, an LLM-assisted search for similar code patterns found the second -- Delving Bitcoin
• Lightning Labs published four security advisories: a High-rated bug let an invoice be marked settled after an interceptor had already cancelled the HTLC, affecting tapd 0.5.0 and earlier and lnd 0.18.4 to 0.18.5; three Low-rated DoS bugs covered a gossip stall, a panic on a malformed DNS seed response, and memory exhaustion from Brontide write allocations; nodes on current lnd (0.21.3 or 0.20.4) are unaffected -- Lightning Labs security
• Galaxy's Alex Thorn disclosed that 52.37 BTC from weak-entropy Coldcard addresses, about 2.8% of the total taken and roughly $4.5M, had been moved into an address belonging to a Wyoming "Crypto Recovery Trust" carrying an OP_RETURN reading "claim:cryptorecoverytrust.com"; the trust says owners can reclaim coins by proving control, but the white-hats are unnamed and its legal documents are unverified -- CoinDesk
• SEC Commissioner Hester Peirce announced she resigns effective 2 October after nearly nine years to join Regent University School of Law, leaving the SEC with two Republican commissioners and no replacement nominee named; two days earlier, at SIFMA's Digital Assets Conference, she argued for replacing KYC document collection with zero-knowledge proofs and attribute-based credentials, telling regulators "we build ever bigger data haystacks on the theory that we will find a needle or two inside" -- CoinDesk, TFTC, TFTC (speech)
• New York Attorney General Letitia James and Governor Kathy Hochul sued Polymarket US in state court on 24 September alleging unlicensed gambling and underage betting, seeking at least $4.6B in fines; Polymarket moved the case to federal court and countersued, arguing the Commodity Exchange Act gives the CFTC exclusive authority; the next day a unanimous Sixth Circuit panel ruled Kalshi's sports contracts are subject to state gambling law, splitting with the Third Circuit and making a Supreme Court case more likely -- CoinDesk, CNBC, CoinDesk (Kalshi)
• BitMEX stopped trading, deposits and new positions at 04:00 UTC on 23 September after 11 years, with API withdrawals ending 28 September and website withdrawals staying open; from 1 October verified accounts with a balance pay the greater of 1% a year or $50 a month; owner HDR Global Trading cites a strategic review, with no legal or regulatory issues behind the closure -- CoinDesk
• The x402 protocol, reviving HTTP 402 "Payment Required" for machine payments, merged Ben Carman's spec for paying with Lightning: the server issues a BOLT11 invoice whose description hash commits to the exact request, the client pays and returns the preimage, and the facilitator checks it against the payment hash and invoice signer without querying the receiver's node -- GitHub PR #2861

• Detects Whirlpool tx0 premix outputs and Wasabi 1.x coinjoins it previously missed or misgraded, and flags input-side address reuse as a leak instead of scoring it as good.

• Fourth beta of the JoinMarket web UI: adds Sign Message, pins the exact UTXOs shown when sweeping, and lets you freeze or unfreeze several UTXOs at once.

• A self-hosted, privacy-focused Ark wallet preview adding optional Payjoin v2 on Signet, Tor-only networking that fails closed, Silent Payments and experimental post-quantum messaging.

• Stable release embedding LND v0.21.3 with SATS Routing and Coinos as swap providers, plus a critical fix moving iOS wallet data out of iCloud-synced Keychain.

• Adds manual coin selection filters, transaction notes and a price chart, and restores 2-of-2 and 2-of-3 multisig account creation.

• Stable release of Umbrel's home-server OS adding a Photos app, multiple user accounts, virtual machines, FailSafe RAID storage and a redesigned App Store.

• Fixes a bug where one valid input in a multi-input transaction could make a fake change output look legitimate; every input is now checked against the actual cosigner keys.

• Adds paying to Lightning addresses and LNURL-pay from the send flow, redesigns manual coin selection, and restores 2-of-2 and 2-of-3 multisig account creation.

• Amber v6.6.5 -- 2026-09-21
  • Nostr signer: relay backups are now encrypted with a separate derived key, previously readable by any app with a remembered decrypt permission.
• Arkade TS SDK 0.4.76 -- 2026-09-25
  • Developer SDK patch release for the Arkade (Ark) protocol, following 0.4.75 earlier in the week.
• Bisq Easy (Android) 0.14.1 -- 2026-09-26
  • Security release: embedded Tor updated to 0.4.9.13, closing high-severity Tor issues, now built from Bisq's own Tor fork.
  • Sister app: Bisq Connect 0.10.0 (2026-09-26), same Tor upgrade.
• Breez Spark SDK 0.26.0 -- 2026-09-23
  • Adds receiving USDT and USDC, and instant or expedited claims for on-chain deposits.
• Cashu TS v4.11.0 -- 2026-09-22
  • Backported fixes: melt preimages checked against the invoice hash, requests default to a 5-minute timeout, and closed subscriptions report an error.
• cln-nip47 v0.2.1 -- 2026-09-26
  • Nostr Wallet Connect plugin for Core Lightning. Dependency updates.
• Core Lightning v26.06.8 -- 2026-09-22
  • Security release fixing responsibly reported vulnerabilities, confirmed to include the dual-fund drain reported in issue #9498. Upgrade.
• Ditto v2.42.2 -- 2026-09-27
  • Nostr social server: verified-link badges, muted users blocked from push notifications.
  • Also in window: 2.39.2 to 2.42.0 (posting streaks, emoji packs, push).
• JoinMarket-NG 0.40.0 -- 2026-09-27
  • BIP-329 labels now distinguish coinjoin output, coinjoin change and deposits; adds PSBT v2 signing and warns when the wallet daemon listens in plaintext off localhost.

• SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools 
• DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
• DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T 
• SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

(00:00:00) Welcome to Freedom Tech Friday

(00:07:16) Small Models, Big Moves

(00:24:01) Three Wallets, No Coldcard

(00:30:52) Vibes and Benchmarks

(00:33:35) Shielded Bitcoin, No Hard Fork

(00:37:18) Start9 Burned His Laptop

(00:39:50) RoboSats, NWC and DarkWisp

(00:45:06) Uncle Jim's Compute Farm

(00:51:11) Signal, Keet or SimpleX?

(00:56:11) CUDA vs the M5 Ultra

(01:00:16) See You Next Friday!

• Ancient roots: Plato’s Cave, priests, cults, ritual drugs, war
• Modern U.S. programs: Bluebird, Artichoke, MKUltra, Gottlieb, Church Committee
• San Francisco: Midnight Climax, Haight-Ashbury Free Clinic, West’s crash pad, Manson
• From the 1980s to now: corporate influence, pharma, social media, mass formation
• How to stay ungovernable

• Stephen Kinzer - Poisoner in Chief: Sidney Gottlieb and the CIA Search for Mind Control
• John Lisle - Project Mind Control: Sidney Gottlieb, the CIA, and the Tragedy of MKULTRA
• Tom O’Neill with Dan Piepenbring - Chaos: Charles Manson, the CIA, and the Secret History of the Sixties
  
  

• The Exploited – Sex and Violence
• Slim Galliard Trio – Cement Mixer Pu-ti-put-ti
• Jack Kerouac – October in the Railroad Earth (with Steve Allen)
• Kraftwerk – Computer World
• Marilyn Manson – Rock is Dead
• The Beach Boys – Never Learn Not to Love
  
  

• History, intrigue, health, collapse, spirituality, the weird and the unexplained — send topic ideas. 
• X: [@UngovernableMax] and [@prevhashnonce]. 
• Nostr: [email protected] and [email protected].

HELP GET SAMOURAI A PARDON

• SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools 
• DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
• DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T 
• SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

VALUE FOR VALUE

Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.

You can support this episode using your time, talent or treasure.

TIME:

- create fountain clips for the show
- create a meetup
- help boost the signal on social media

TALENT:

- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!

TREASURE:

- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Paynym to JON @ https://paynym.rs/+idealpresident82
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/

(00:00:00) What Do You Reckon?

(00:07:55) Mind Control Through the Ages

(00:12:29) The Priest Class & the First Cults

(00:23:40) Operation Paperclip & the Birth of MK Ultra

(00:51:22) LSD, Gottlieb & the Origins of the Program

(01:05:28) Operation Midnight Climax

(01:22:55) Jolly West & the Shaver Case

(01:35:05) Haight-Ashbury, Manson & Chaos

(02:03:00) From the '80s to Now

(02:22:00) How to Stay Ungovernable