Magnitude Relay (Nostr) Vector shipped Magnitude Relay, an open-source Nostr relay tuned for encrypted DMs and Communities. On the same hardware it answered real traffic about 38 times faster than strfry and used less than half the disk. You can run it yourself.

Vector

Magnitude Relay: The Fastest Nostr Relay

Vector now runs on its own Nostr relay: real traffic answered 38× faster than strfry, Community messages delivered 72× sooner, sync up to 6.7× f...

Wavelength (Lightning + agents) Lightning Labs put Wavelength on mainnet. Apps and AI agents can hold self-custodial bitcoin and send or receive Lightning payments with a few API calls—no node, no channels, no liquidity to manage. Agents can now pay for APIs or data in tiny amounts on their own.

Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet 🌊

Today we're announcing that Wavelength, our toolkit for integrating payments into any app, is now live on mainnet for everyone. That means humans a...

Curious about running these with local tools? cryptodecentral.co.za

You can download a model, hash it and run it fully offline, and still not have open source. Open weights means the parameters are downloadable. Open source means the freedom to study, change and share the whole system, including the data information and training code. New note: what the Llama, Gemma and OLMo licences actually let you do, and what you can (and can't) verify from your own machine. With AI-voice audio.

Open Weights Is Not Open Source: What a Model Licence Actually Lets You Do

Open weights means the learned parameters are downloadable. Open source means a specific set of freedoms over the form you would need to modify the...

Privacy coin on-ramp under the microscope ZachXBT looked at FreedomXMR, a swap service on Hyperliquid that turns deposits into Monero, and reported that more than 87% of its inflows were tied to ransomware, exploits, malware and similar activity, with over $20 million traced in larger transfers. It is a useful reminder of how transparent chains still leave a trail on the way in, even when the exit is a privacy-focused asset.

Crypto Briefing

ZachXBT links over 87% of FreedomXMR inflows to illicit activity

ZachXBT says over 87% of FreedomXMR inflows tie to illicit activity, tracing $20M+ from ransomware and exploits via Hyperliquid Core.

Lightning node security patch Eclair (the Lightning node software) shipped its second security release in five days. Version 0.14.5 addresses issues that malicious peers could exploit to interfere with payments or potentially take funds; operators can upgrade without closing existing channels, and no confirmed losses have been reported. Worth checking which version your nodes are on.

CryptoSlate

Bitcoin Lightning developers sound alarm over security flaws as second patch lands in five days

Bitcoin Lightning developer released its second security update in five days, warning that malicious nodes could exploit newly patched flaws.

Local coding model that stays on the machine Recursive released Flint, a mixture-of-experts coding model with roughly 40 billion total parameters that activates only about 2.5 billion per token. It is under Apache 2.0, runs locally (they report over 125 tokens/sec on an M4 Pro MacBook), and was built in under four months with heavy help from their automated research system. Interesting to see open weights aimed at agentic coding without sending the code off-device.

Introducing Flint - Recursive

Recursive self-improving superintelligence to automate knowledge discovery.

More plain-language notes on local AI and related tools: cryptodecentral.co.za

New in the Sovereign Starter path: the key-handling step (Module 3). The relay-list notes assume you have an identity worth routing. This one goes a step earlier, to the key itself. NIP-01 defines no way to rotate or revoke a key. So a leaked nsec is permanent, and so is a lost one. The usual mistake is pasting your nsec into every new client. NIP-46: "Private keys should be exposed to as few systems - apps, operating systems, devices - as possible as each system adds to the attack surface." The alternative is a signer that holds the key and answers requests. Three patterns in the NIPs: • NIP-07: browser extension (window.nostr) • NIP-55: Android signer app, with manual or remembered approvals • NIP-46: remote signer ("bunker") over relays, with scoped permissions like sign_event:4 When you must store the raw key, NIP-49's ncryptsec encrypts it with a password (scrypt + XChaCha20-Poly1305). Keep it offline and test that you can decrypt it. No client or signer rankings, no custody advice.

Your nsec Is Not a Password: Nostr Key Handling and Signers

Your nsec is not a password. A password unlocks an account that someone else holds. On Nostr, the private key is the account: there is no server to...

Path:

CryptoDecentral

CryptoDecentral — Tools for a sovereign internet

Education on self-custody, privacy money, Nostr, Autonomi, permissionless markets, and decentralized AI — without custody, swaps, or financial ad...

#nostr #privacy #selfcustody

ZachXBT flags FreedomXMR flows into Monero On-chain investigator ZachXBT reported that a swap service called FreedomXMR on Hyperliquid Core has taken in large volumes since August, with more than 87% of bigger inflows linked to ransomware, exploits, malware, and social-engineering cases. The service converts deposits into Monero, whose default privacy makes further tracing harder once the coins leave the transparent chain. It highlights how permissionless venues and privacy coins intersect in practice.

Bankless

ZachXBT Flags $20M XMR Laundering Ring on Hyperliquid on Bankless

More than 87% of inflows to FreedomXMR, a Monero swap service on Hyperliquid Core, came from illicit activity, with $20M+ traced to hacks and ranso...

Tether’s on-device speech model Tether’s QVAC team released TranscribePsy, a 254-million-parameter open-source speech-to-text model that runs locally on phones, laptops, glasses, or robots without uploading audio. It covers 25 European languages on larger machines and 8 on phones, and the iPhone Neural Engine version can turn 10 minutes of audio into text in about 1.65 seconds. Useful for private dictation or offline notes when you don’t want the cloud listening.

QVAC

On-Device Speech Recognition in 25 Languages: TranscribePsy

On-device speech recognition with TranscribePsy, a free 254M open model covering 25 European languages on a laptop and 8 on a phone. Get it on Hugg...

More plain notes on local tools and self-custody: cryptodecentral.co.za

Bull Wallet restores Lightning and Liquid Bull Bitcoin’s self-custodial wallet has switched Lightning and Liquid payments back on, so users can send and receive sats again and convert L-BTC to on-chain bitcoin. After earlier swap infrastructure pauses, the recovery shows how some wallets lean on sidechains and partners for instant payments while still keeping keys on-device.

Lightning and L-BTC to BTC Are Back on BULL Wallet

Send and receive Lightning again and convert L-BTC to on-chain bitcoin in BULL Wallet. Current limits, the new address rule and how to fund your wa...

Quick Monero check. Someone has your private view key and nothing else. What can they do? A) See every incoming transaction to that account B) Spend your funds C) Read the whole network's history D) Change your seed Reply with your letter. Answer tomorrow.

A Monero subaddress is a door, not a house. Every subaddress hangs off one view key and one seed. To someone just reading the chain, the doors look unrelated. But a counterparty holding two of your doors can test whether they're the same wallet, and the leak isn't broken crypto. It's you confirming "got it, thanks." New note: the 2019 Janus attack step by step, the three other ways doors get linked (sweeps, service accounts, reused habits), and what Carrot's Janus anchor fixes and doesn't. The short rule: separate identity, separate seed. Now with an audio version too.

A Subaddress Is Not a Separate Identity: Janus Outputs, Sweeps, and the Seed Boundary

Subaddresses give you receive unlinkability against observers and honest payers. They do not give you identity isolation against an active counterp...

New in the Sovereign Starter path: the network-privacy step (Module 2). Ledger privacy starts after a transaction reaches the network. Before that, it leaves your device with an IP address attached. Two separate leaks: • Broadcast origin: an observer who sees your transaction arrive first from one IP can guess you made it. • Wallet queries: a server you don't control learns which outputs you care about, and from where. Tor and I2P mainly fix the first and hide your IP for the second. They don't stop a server learning which addresses you asked about. Only node choice does that: your own node, a remote node you run, or an open remote node. Moneropedia: "Node operators can link transactions to IP addresses." Details the docs flag: DNS can leak to your ISP without a proxy. On I2P the receiver sees the initiator's address, unlike Tor. Monero calls its anonymity-network support "still considered experimental", and a wrong clock or starting a node just to send one transaction can link you. Not a setup tutorial or a ranking. Tor and I2P are restricted in some places, so check your own jurisdiction.

On-Chain Privacy Is Not Network Privacy: Node Choice, Tor, and I2P

On-chain privacy is not network privacy. Cryptography can hide who paid whom on the ledger, but whoever first sees your transaction, or your wallet...

Path:

CryptoDecentral

CryptoDecentral — Tools for a sovereign internet

Education on self-custody, privacy money, Nostr, Autonomi, permissionless markets, and decentralized AI — without custody, swaps, or financial ad...

#monero #bitcoin #privacy #tor

We read the source of the Nostrbook MCP server (@nostrbook/mcp 0.5.3) so you don't have to. • 7 tools, all read-only. read_nip pulls the spec from the NIPs repo itself, not from a model's memory. • fetch_event refuses nsec input outright, and by default queries four fixed relays, so those relays see what your agent looks up. • generate_kind picks a random unused number but reserves nothing. • The project's own MCP page lists 5 tools; the code has 7. The real line is signing. If an agent needs to post, keep the key in a NIP-46 remote signer that asks before each event, scoped to the kind you expect. The model drafts; only you sign.

A Docs MCP Can Read the Whole Protocol. The Line to Watch Is Signing

A documentation MCP server is read-only by design, and that is what makes it easy to say yes to. The line worth watching is not what an agent can r...

#nostr #mcp #agents

Monero researchers keep testing FCMP++, which would swap the current ring of 16 decoys for a membership proof over roughly the entire set of unspent outputs on the chain. That is a structural jump in the anonymity set if it reaches mainnet, and the mechanism is explained clearly here: cryptodecentral.co.za/notes/fcmp-full-chain-membership-proofs

getmonero.org, The Monero Project

Blog: Full-Chain Membership Proofs Development

A CCS to develop Full-Chain Membership Proofs has been successfully funded.

#monero

Lightning Labs published LayerTree, a design that lets many people share one Bitcoin UTXO while each keeps the right to leave alone in a single fixed-size transaction. Ownership lives in an off-chain Merkle-sum tree enforced by future covenant opcodes, leaves can host Lightning channels, and it cannot run on Bitcoin today.

LayerTree explained

An interactive explainer for LayerTree: one shared Bitcoin output, an off-chain Merkle-sum tree, and covenants that let any member leave in one tra...

DeepSeek open-sourced DeepInfer today, the inference engine that actually serves their V4.1-Flash model in production, under Apache 2.0. It currently works only for that model on high-end Nvidia Blackwell or Huawei Ascend hardware, and the full online serving pieces (cache, load balancing) are still missing, but it is a rare public look at a frontier lab’s real stack.

GitHub

GitHub - deepseek-ai/DeepInfer: DeepInfer: High-performance, large-scale inference framework for DeepSeek models

DeepInfer: High-performance, large-scale inference framework for DeepSeek models - deepseek-ai/DeepInfer

#opensourceAI

New in the Sovereign Starter path: the recovery step. The path promises you can lose a laptop and still reason about recovery. That depends on a backup, and a backup is only a copy of a secret. Recovery is the procedure that turns it back into keys, on a new device, under stress, maybe done by someone other than you. What the words don't carry: • A BIP 39 passphrase. Every passphrase makes a valid wallet, so a typo at restore just shows an empty one. • The wallet definition: script type, derivation path, whether it was one key in a multisig. • Labels. Bitcoin Core's own guide: "Metadata cannot be retrieved from a blockchain rescan." Monero's 25-word seed and the 16-word form aren't interchangeable, so write down which one you have. The drill: restore on a clean device, compare the first receive address, write down anything you had to look up, then wipe it. Never type real seed words into a website, chat or "validator" tool.

A Backup Is Not a Recovery: Seed Phrases, Passphrases, and the Restore You Haven't Tested

A seed backup is not a recovery plan. A backup is a copy of a secret. Recovery is a procedure that turns that copy back into usable keys, on a new ...

Path:

CryptoDecentral

CryptoDecentral — Tools for a sovereign internet

Education on self-custody, privacy money, Nostr, Autonomi, permissionless markets, and decentralized AI — without custody, swaps, or financial ad...

#bitcoin #monero #selfcustody

A threat model is not a fear list. It's one page: the secrets you protect (not the apps), the realistic adversaries, the one or two outcomes that would actually ruin you, and the costs you accept. Its real job is telling you what you can safely ignore. It now opens the Keys module of Sovereign Starter.

A Threat Model Is Not a Fear List: Writing Yours on One Page

A threat model is not a list of things to be afraid of. It is a short written record of what you are protecting, from whom, how bad failure would b...

Release radar, week of 19 Oct. Same eight projects every Monday, with every link going to the upstream release. Shipped: • Monero v0.18.5.4: bug-fix release with the new DNSSEC root trust anchor • Autonomi Node v0.23.0: old chunk store removed, a dependency update addresses three RustSec advisories, 24h staged auto-upgrade • Ollama v0.40.4 to v0.40.6: --ask decision models, Nemotron 3.5, a Windows orphan-process fix No release: Core Lightning, LND, LDK, NIPs. Bitcoin Core 32.0 is still rc4.

Release radar: week of 19 Oct 2026

Monday watchlist for eight sovereign-tech projects, week ending 19 Oct 2026: which upstreams tagged a release, and which of those are security rele...