I think everyone on NOSTR should have NostrComments installed.

The pattern in this story is worth memorising: a scary pop-up, a "fraud investigator" who won't let you hang up, a cover story for the bank ("it's for a renovation"), and then cash into a Bitcoin ATM. Every step is designed to stop you from talking to anyone else. Simple rule to pass on to parents and grandparents: no real sheriff, court, bank, Microsoft or IRS will ever ask you to pay at a crypto ATM or with gift cards. If a caller won't let you hang up, hang up anyway and call the official number yourself. The FBI figure in the article is $388 million lost to crypto ATM scams in 2025, up 58% in a year, and once the coins are sent they usually can't be reversed. Beth got some of her money back because she reported it fast, so if it happens to you or someone you know, report it right away.

https://www.investigatetv.com/

How you can protect yourself from crypto ATM scams

Here's what you need to look out for if you think you're being scammed for cryptocurrency

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

The "campaign investment pool" one is worth spelling out, because it doesn't sound like a scam to people who follow politics closely: you put money in, and it supposedly pays out if your candidate wins. That isn't a thing. Political donations are never investments, they don't grow and they are never paid back. Anyone promising returns, or asking you to bring in friends, is running a pyramid with a campaign logo on it. Two quick checks before giving to anything political: look the committee up on the FEC website (fec.gov) yourself rather than following a link, and check your voter registration at your state's official site or vote.org instead of tapping a link in a text.

WDIV

FBI warning voters about election-related scams

FBI warns the public that scammers could exploit the 2026 U.S. midterm election.

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

NostrComments is a browser extension that adds a comment section to any website. The comments live on Nostr, not on the site itself, so the website owner can't delete them or close them. It's useful for leaving notes or warnings on pages that have no comments, or for discussions that shouldn't be easy to censor. No account, no tracking, open source. Caveats: it's still early, so most pages are empty. And like everything on Nostr, you manage your own key. It works best if you already use Nostr or are curious about it. You don't need the extension to read along: the web reader shows any page's thread in your browser, and other Nostr clients that support web comments see them too. Firefox:

Client Challenge

Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido Read without installing:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

The detail that matters most for owners: the leak includes names and shipping addresses, and the stolen key can make a fake device pass the authenticity check. That combination has been used before. After the 2021 Ledger data leak, customers received "replacement" devices in the post that were rigged to steal their seed. So treat any recall, swap or "migrate your funds" message as a scam, by email, phone or a parcel at your door. Keystone says it will never ask for devices back and you do not need to move anything. A device delivered before October 20 that passes the check is fine; one received after that date with the old key should be confirmed with Keystone support before use.

crypto.news

Keystone to destroy 18,835 hardware wallets after authentication key breach

Keystone will destroy 18,835 hardware wallets after hackers stole a device authentication key and exposed personal information belonging to 25,964 ...

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

NostrComments has three small issues open for anyone who wants a first contribution to a Nostr project: one in the UI, one in the docs, one in the browser tests. No build step, no dependencies, and a test suite that tells you if something broke.

GitHub

Issues · briskness-byte/NostrComments

The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no se...

Questions on the issues are welcome too. #nostr #opensource #dev

Hi from a comment thread under primal.net. NostrComments (I build it) gives every URL a Nostr thread, so you can talk about any page with your own key, on your own relays. Which site would you most like to see a Nostr discussion under?

NostrComments — the comment section no website can close

A thread on every web page, kept on Nostr relays, not on the site. No account, no server, no tracking.

Primal

Live Free

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

LO AND BEHOLD: The ONLY woman on NOSTR: @Nox from NL 🇳🇱 🥳🥳 View quoted note →

The practical consequence for individuals: you can get a breach letter from a company you have never heard of. That isn't necessarily a scam, it is often a vendor that processed your data for your insurer, clinic or employer. The real risk comes after: criminals use the news of the breach as a hook for phishing, so an email "about the breach" asking you to verify your account is more dangerous than the breach letter itself. What actually limits the damage when it is a vendor you can't control: a different password for every account, a separate email address (or alias) for anything health or finance related, and, in the US, a free credit freeze with the three bureaus, which stops new accounts being opened in your name.

The HIPAA Journal

Vendor Data Incidents Account for 69% of All Breach Victims

Cybersecurity incidents at vendors can have a massive impact, as they frequently result in unauthorized access to the data of many, and sometimes a...

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

The part that makes this one work is the flyer: it carries the department's real phone number and a real officer's photo, so it passes the checks people are told to do. Those details are public and easy to copy. What can't be faked is how courts actually work: a missed summons comes by mail, and no court or police department takes payment in crypto, gift cards or by phone to cancel a warrant. If you get one of these, look up the department's number yourself instead of using the one on the flyer, and ask whether there is really a warrant. If you already paid, report it to local police right away, with the wallet address you sent it to.

https://www.wistv.com

Sumter Police warn of ‘jury duty’ cryptocurrency scam

The Sumter Police Department reported a spike in scam calls demanding cryptocurrency payments for missed jury duty.

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

NostrComments 23.10.10 is out, and most of it came from one user's GitHub issues. Hashtags in a comment are now real t tags, so a scam warning tagged #scam reaches people who follow #scam. Quote a note with nostr:nevent and other clients show it as a quote; in the panel it appears inline, fetched only from your own relays. Replies now also go to the read relays of the person you answer (NIP-65), so strict anti-spam relays on their side don't swallow them. The reading side I deliberately left out: fetching a page's comments from every commenter's own relays would let any commenter see who reads the thread. And the first run is calmer: while your signer is asked, the panel says so, and why the prompt names the website you are on. Decline, and it stops asking. Thanks to @codonaft for pushing on all of this. Firefox:

Client Challenge

Chrome: https://chromewebstore.google.com/detail/nostrcomments/ebmgdpicceaencegknannfaljhbfgido

One detail from the policy change itself (bitcoin-core/bitcoincore.org PR #1281) that matters if you run a node: the two-week pre-announcement now only applies to embargoed bugs. For a bug classed as "easily discoverable", the point release and the advisory come out together, with no heads-up first. The moment the fix is public, so is enough detail to go looking for unpatched nodes. So it's worth hearing about releases the day they land, not the next time you happen to check. Two easy ways: the RSS feed at bitcoincore.org/en/rss.xml, or on GitHub, bitcoin/bitcoin → Watch → Custom → Releases. If your node runs on Umbrel, Start9 or a similar box, the fix reaches you when they repackage it, so check their app update too rather than assuming you're covered. And a rushed release is exactly when a fake download is most tempting, so keep verifying SHA256SUMS and its signatures as usual.

Bitcoin Magazine

Bitcoin Core Ends Long Embargoes For Bugs AI Can Rediscover

Bitcoin Core now fast-tracks fixes and disclosures for vulnerabilities that AI can easily rediscover, ending the long embargoes those bugs once rec...

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

The practical takeaway for anyone who isn't a mail admin: a real Dell or Staples email can still be a scam, because the scammer typed their own "Helpline" number into a genuine order form and let the company's system send it for them. Passing every authentication check only proves who sent it, not who wrote the text inside. So if you get a receipt for something you never bought, don't call the number in the email. Look up the company's support number on their own website, or log into your account directly and check whether the order exists. The whole scam depends on you calling them.

Help Net Security

Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks - Help Net Security

Attackers abuse legitimate platforms to send out phishing emails delivered as order confirmations, sign-up notices and bounces.

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

This is the project's own thread. Questions, ideas, or things that annoy you about NostrComments: leave them here, and I'll answer. Bugs are easier to track in Issues. Recent fixes: the Share button could be hidden by content blockers (fixed in 23.9.5), and it could post twice with a slow signer (fixed in 23.9.4).

GitHub

GitHub - briskness-byte/NostrComments: The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no server, no tracking.

The comment section no website can close. A thread on every page, kept on Nostr relays. Browser extension for Firefox and Chrome. No account, no se...

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

What would persuade you to install this, or what is holding you back?

NostrComments — the comment section no website can close

A thread on every web page, kept on Nostr relays, not on the site. No account, no server, no tracking.

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

An update since this was written: the GTA 6 scams have moved on from "pay $250 in crypto". Some pages now ask you to connect a wallet to "unlock" a leaked copy, and approving that transaction lets them take far more than the advertised price. Others offer a free "installer" that steals the passwords saved in your browser. There is no early copy. GTA 6 comes out on 19 November on PS5 and Xbox, and even preorders from the official stores only let you preload from 12 November. Anything that offers more than that, for crypto or for free, is the scam. Worth passing on to anyone in your family who is counting down to it.

Malwarebytes

GTA 6 early access is nothing but a scam

No matter what a website claims, nobody is selling legitimate GTA 6 early access. And scammers are counting on fans believing otherwise.

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.

Every comment section belongs to the site it sits under. The site decides whether it exists, who may speak, and when the conversation is over. NostrComments moves the conversation off the site. A thread is filed under the page's address and stored on public Nostr relays. The site can't close it. Neither can I: there is no server of mine in between. That matters most where comments are least welcome: the news site that turned them off, the government page, the press release, the article in a country where disagreeing in public is expensive. The limits: the relays you ask can see which pages you look up, and most pages have no comments yet. An empty thread on every page isn't a revolution. It's a place where one can start, so leave the first comment on a page you care about.

NostrComments — the comment section no website can close

A thread on every web page, kept on Nostr relays, not on the site. No account, no server, no tracking.

#freespeech

One thing the article leaves out: what to do if you already put money in. Call the number printed on the machine straight away. Some operators hold a new customer's first purchase for a while before it goes out (CoinFlip says 48 hours), and inside that window the money can still be stopped. After that, a bitcoin payment cannot be reversed. And for anyone reading this for a parent: Microsoft, banks, police and tax offices never ask you to pay in bitcoin or gift cards. Anyone who does, and won't let you hang up, is the scam.

https://www.ksla.com

How you can protect yourself from crypto ATM scams

Here's what you need to look out for if you think you're being scammed for cryptocurrency

Read the thread:

Read a NostrComments thread

Read the comment thread attached to any web page, without installing anything.