BTCPay Server operators saw hot-wallet drains on old versions. The open-source Bitcoin payment processor reported thefts from servers still running 2.4.1 (July 2026) or earlier; the fix had shipped in 2.4.2 months before. If you self-host one, check the version at the bottom of the UI and treat anything older as potentially exposed—hot keys on an internet-facing box are a different risk than a hardware wallet. Official advisory:

Security Incident Affecting BTCPay Server 2.4.1 and Earlier | BTCPay Server Blog

Official BTCPay Server Blog

#selfcustody Most flagged Lightning nodes were still on vulnerable LND lines two months later. A study of public gossip data found that 71% of a group of LND nodes marked exposed in an August disclosure were still announcing the affected release lines as of mid-October, even though the patches had been available for over a year. Upgrades clustered more around platform releases (like Umbrel) than around security warnings themselves. Paper:

arXiv.org

Who Patches the Lightning Network? Evidence from Release Lines in Gossip, 2023-2026

Every implementation of Bitcoin's Lightning payment network disclosed security vulnerabilities in 2026, and every advisory told operators to upgrad...

Lightning Labs opened Wavelength so AI agents can hold and spend Bitcoin over Lightning without running a node. Agents can now use the toolkit (via MCP tools and L402) to pay for API calls or services in tiny amounts, with the wallet self-custodial and no human approving each transaction. It is early and still alpha, but it is open tooling for machine-to-machine Bitcoin payments. Announcement:

Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet 🌊

Today we're announcing that Wavelength, our toolkit for integrating payments into any app, is now live on mainnet for everyone. That means humans a...

Practical notes on local AI and self-custody at cryptodecentral.co.za

Permission to message an agent is not permission to reconfigure it. Agent Zero 2.15 (1 Nov) fixed a hole in its Telegram and WhatsApp channels: any sender on the allow-list could change their own tool permissions from chat. The fix adds separate admin lists (admin_users, admin_numbers) that default to nobody and are checked on every message. It also closed a remote-execution bypass and isolated the browser helper. The new per-action permissions help, but the project itself says they are not a filesystem sandbox. If you run an agent on a chat app: list who can chat, then list who can change its rules. They should be different lists. Write-up with sources, plus a 10-minute listen:

An Allow-List Is Not an Admin List: What Agent Zero 2.15 Fixed in Its Chat Channels

Agent Zero 2.15 stops chat users from lifting their own tool limits. Why being allowed to message an agent must not mean being allowed to change it...

#nostr #ai #selfhosted

Mistral Large 4 (“Le Chonk”) open weights are out. Curious how far local models have come? Mistral published the weights for this ~1-trillion-parameter multimodal Mixture-of-Experts (about 49–52B active) under a modified-MIT licence that is mostly permissive for self-hosting and fine-tuning, but asks for a separate commercial deal if you offer it as a hosted service to others. A heavy quant can run on a single high-memory Apple Silicon box.

Local AI

Mistral Large 4

Mistral has published the open weights for Mistral Large 4, the trillion-parameter multimodal model nicknamed Le Chonk, three weeks after its API p...

#localAI Monero’s FCMP++ privacy upgrade is still on the testnet. Developers are replacing today’s ring of 16 decoys with full-chain membership proofs so a spend can prove membership in the entire set of eligible outputs (tens or hundreds of millions), plus a new addressing scheme called Carrot. It is running on a public stressnet with no official mainnet fork date yet; the project continues to prioritise audits and wallet readiness over a rushed activation.

Is Monero Traceable? What the FCMP++ Upgrade Changes, and When – Hot Paths

#monero Lightning Labs opened Wavelength on mainnet for agents and apps. The toolkit lets AI agents (and ordinary apps) hold and spend self-custodial bitcoin over Lightning without running a node, opening channels, or managing liquidity—agents can pay for an API call or data feed on the spot via L402.

Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet 🌊

Today we're announcing that Wavelength, our toolkit for integrating payments into any app, is now live on mainnet for everyone. That means humans a...

For plain education on non-custodial tools across privacy money, Nostr, and local AI, see cryptodecentral.co.za. #lightning

On 29 Oct 2026 (about 22:05 SAST), Binance says, its hot wallets were compromised, with roughly $6.3B in tokens taken. Its update says it will cover the losses from SAFU and company funds, withdrawals are paused during security checks, about $3B has been frozen on-chain, and the root cause is still under investigation, with technical findings to follow. Source (Binance, Update #2, 30 Oct): https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751 We won't guess at the cause. The question that stays useful whatever it turns out to be: for any balance you hold, who can unilaterally move the funds? If it isn't you, or a multisig policy you documented, it's a claim on someone else's systems. That can be a deliberate choice; it should be a known one.

Self-Custody Without Verify-Before-Trust Is a Slogan

Not your keys, not your coins is still the right first sentence. It is also incomplete — keys only stay yours if software, addresses, and assumpt...

#bitcoin #selfcustody

1. AI agents can now hold and spend bitcoin over Lightning without running a node. Lightning Labs opened Wavelength on mainnet so agents use typed MCP tools and L402 to pay for API calls or services in small amounts, with keys staying under user control (still alpha, with per-account caps). Curious what practical agent workflows this unlocks next.

Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet 🌊

Today we're announcing that Wavelength, our toolkit for integrating payments into any app, is now live on mainnet for everyone. That means humans a...

#Lightning 2. Monero’s on-chain privacy held; a swap service’s logs did not. Wagyu confirmed three months of order data leaked, with thousands of completed swaps linking a public-chain deposit, a Monero destination, and a client IP in the same record. Off-chain retention is still the weak point even when the protocol itself is not.

ForkLog

Wagyu Confirms Data Leak Affecting Monero Swaps | ForkLog

Cryptocurrency exchange platform Wagyu has confirmed a three-month data leak that could compromise the privacy of Monero (XMR) users.

#Monero 3. Mistral released the open weights for its 1-trillion-parameter Large 4 model. With heavy quantization it is already being tested for local inference on high-end machines (for example a 512 GB unified-memory Mac), so fully offline runs are no longer theoretical for the right hardware.

Welcome Le Chonk: Mistral Large 4 on Hugging Face

We’re on a journey to advance and democratize artificial intelligence through open source and open science.

More practical local setups at cryptodecentral.co.za.

An xpub is not "just a public key." It's a public key plus a chain code, and BIP 32 spells out what that pair gives away: 1. Every past and future address in its subtree. Rotating addresses doesn't help against someone who holds the parent. 2. With one leaked non-hardened child private key, the parent private key itself. Hardened derivation is why the damage stops at the account level. Share the narrowest node that does the job (BIP 32's receive-only m/i'/0 case), keep one account per purpose, and never let an xpub sit next to a child private key. Write-up with the spec quotes, plus a 9-minute listen:

An xpub Is Not a Public Key: What Sharing an Extended Public Key Actually Exposes

An extended public key is a public key plus a chain code. Shared, it reveals every past and future address in its subtree, and with one leaked chil...

#bitcoin #selfcustody

Offline Protocol browser node Offline Protocol SDK 0.31 runs a full mesh node (identity, MLS, groups) inside a browser worker. Two devices that share only a Nostr relay can now form an encrypted session, and split sessions heal themselves. https://www.offlineprotocol.com/blog/sdk-0-31-the-browser-as-a-full-nodeMore plain-language notes on these stacks at cryptodecentral.co.za #Nostr

Monero CCS for Tor and I2P work A Monero developer is seeking 45 XMR through the Community Crowdfunding System for three months of full-time work on Tor Control protocol support in monerod, better I2P integration, and wallet/core maintenance. Most of the target is already funded.

Altcoin Buzz

Monero Seeks 45 XMR for Privacy and Core Development

Monero developer jpk68 seeks 45 XMR for three months of work on Tor and I2P support, wallet improvements and core network maintenance.

Wavelength receive-only credentials Wavelength’s public mainnet release adds receive-only credentials that cannot sign, recover funds, or administer the wallet. An agent can accept sats for an API or service without being able to move the balance itself.

Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet 🌊

Today we're announcing that Wavelength, our toolkit for integrating payments into any app, is now live on mainnet for everyone. That means humans a...

Quick self-custody check. What is "address poisoning"? A) A fee market attack on miners B) A broken bech32 checksum that still pays C) A lookalike address, sharing prefix and suffix characters, planted in your history so you copy it later D) A Lightning invoice that never expires Reply with your letter. Answer tomorrow.

Nostr VPN Nostr VPN 4.1.19 is out. It tightens reconnects, desktop networking, and connection security for the mesh that uses Nostr keys for identity and discovery instead of a company account. Still early and experimental in places, but it’s one of the clearer attempts to apply the “keys, not accounts” idea to networking.

Freedom.Tech

Nostr VPN 4.1.19

Fixes reconnect and desktop networking issues plus hardens connection security; Upgrade if seeing drops on reconnect

More plain notes on these stacks at cryptodecentral.co.za #Nostr

Release radar: week of 27 Oct 2026 Same eight projects every Monday. Did the software you run ship, and is it a security release? Mechanism only; no rankings. Window: tags and releases published roughly 20–27 Oct 2026 (week ending Monday 26 Oct, posted a day late). Verified on upstream GitHub release and tag pages and git.rust-bitcoin.org (UTC dates). Bitcoin Core: v32.1 (tagged 26 Oct 2026). A v32.0 tag followed rc4 on 21 Oct, but the 32.1 release notes say that, due to last-minute issues, 32.0 "was never fully announced or released." 32.1 is the first full 32.x release; on top of 32.0 it backports fixes for peer send timeouts, socket monitoring and 64-bit block-file positioning, and caps -maxconnections at 2000. Its notes list zero low-severity fixes to disclose, so it is not a security release. Core Lightning: no release this week (releases; newest is v26.06.9 from 7 Oct). LND: no final release this week. Release candidates v0.21.5-beta.rc1 and v0.20.6-beta.rc1 were published 22 Oct for testing; newest finals remain v0.21.4-beta and v0.20.5-beta from 1 Oct. LDK (rust-lightning): no release this week (primary repository, mirrored to GitHub; newest tags, v0.3-rc3, v0.2.7 and v0.1.13, are from 2 Oct). Ollama: v0.40.11 (24 Oct 2026), after v0.40.8 (21 Oct), v0.40.9 (22 Oct) and v0.40.10 (23 Oct). Across the week: the Flint coding model (macOS first, then Linux and Windows), the Nemotron 3.5 Bolt E4B vision model, speech output on macOS with an OpenAI-compatible /v1/audio/speech endpoint, and streaming requests that now report generation failures instead of ending silently. A v0.40.12-rc0 pre-release followed on 27 Oct. nostr-protocol/nips: no tagged release this week; NIPs are merged continuously (repository). Autonomi: Autonomi Node v0.23.1 (22 Oct 2026): spreads reads of frequently requested records and sizes browser (WebRTC) sessions more strictly; dependency updates to zip and rustls address seven RustSec advisories. Upstream does not label it a security release. Monero: no release this week (releases; newest is v0.18.5.4, release page 17 Oct). Lines with no release stay in the list on purpose, so you can compare one week's list with the next. Feature essays remain Wed/Fri; the Monday OSS AI special is separate. Sources (upstream publish dates, UTC)

GitHub

Tags · bitcoin/bitcoin

Bitcoin Core integration/staging tree. Contribute to bitcoin/bitcoin development by creating an account on GitHub.

GitHub

bitcoin/doc/release-notes.md at v32.1 · bitcoin/bitcoin

Bitcoin Core integration/staging tree. Contribute to bitcoin/bitcoin development by creating an account on GitHub.

GitHub

Comparing v32.0...v32.1 · bitcoin/bitcoin

Bitcoin Core integration/staging tree. Contribute to bitcoin/bitcoin development by creating an account on GitHub.

GitHub

Releases · ElementsProject/lightning

Core Lightning — Lightning Network implementation focusing on spec compliance and performance - ElementsProject/lightning

GitHub

Releases · lightningnetwork/lnd

Lightning Network Daemon ⚡️. Contribute to lightningnetwork/lnd development by creating an account on GitHub.

https://git.rust-bitcoin.org/lightningdevkit/rust-lightning

GitHub

Tags · lightningdevkit/rust-lightning

Active development happens on git.rust-bitcoin.org, this repo is a mirror of https://git.rust-bitcoin.org/lightningdevkit/rust-lightning - Tags · ...

GitHub

Releases · ollama/ollama

Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models. - ollama/ollama

GitHub

GitHub - nostr-protocol/nips: Nostr Implementation Possibilities

Nostr Implementation Possibilities. Contribute to nostr-protocol/nips development by creating an account on GitHub.

GitHub

Release Autonomi Node v0.23.1 · WithAutonomi/ant-node

Autonomi Node v0.23.1 CLI Downloads (Manual Installation) Download, extract, and run directly from command line: Platform Download Linux x64...

GitHub

Comparing v0.23.0...v0.23.1 · WithAutonomi/ant-node

The post-quantum network node for the Autonomi decentralised network. (Rust) - Comparing v0.23.0...v0.23.1 · WithAutonomi/ant-node

GitHub

Releases · monero-project/monero

Monero: the secure, private, untraceable cryptocurrency - monero-project/monero

Hugging Face shipped Llama Windows, a tray app that lets you pick a model from the hub, download it in one click, and run llama.cpp locally on Windows 11 with no terminal or admin rights. Other apps and agents can share the same local OpenAI-compatible endpoint.

Introducing Llama Windows: llama.cpp in your Windows tray

A Blog post by Hugging Face on Hugging Face

Monero’s community is funding developer jpk68 for three months of full-time work on Tor Control support in monerod, I2P exploration in the wallet, GUI improvements, and core fixes so privacy-network routing takes fewer manual steps. About 69% of the 45 XMR request is already in.

CCS - jpk68 full-time work (3 months)

Lightning Labs opened Wavelength on Bitcoin mainnet so agents can hold a small balance and pay for API calls, data, or other agents in sats without a human approving each one. Keys stay local, no node or channels to run, and you can exit to the chain. Still alpha with balance caps.

Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet 🌊

Today we're announcing that Wavelength, our toolkit for integrating payments into any app, is now live on mainnet for everyone. That means humans a...

#Bitcoin

Nostr Valley III Nostr Valley III recap is out: builders talked infrastructure, agents holding their own keys, and web-of-trust search while being plain that user growth is slow and funding is tight. The shipping continues either way. https://www.youtube.com/playlist?list=PLOLZM5RbfV68 More plain-language notes on these stacks at cryptodecentral.co.za #Nostr

Monero FCMP++ Monero’s next privacy step (FCMP++) is still on a public stressnet, not mainnet. It would replace today’s 16-member ring signatures with proofs that a spend is one of every eligible output on the chain, expanding the anonymity set dramatically. No official activation date yet.

Is Monero Traceable? What the FCMP++ Upgrade Changes, and When – Hot Paths

#Monero

Wavelength mainnet Lightning Labs opened Wavelength on mainnet this week. It’s a toolkit that lets apps and AI agents send and receive Bitcoin over Lightning without running a node, opening channels, or managing liquidity—users stay self-custodial and can exit to the chain themselves. Curious what agents start paying for once the friction drops this low.

Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet 🌊

Today we're announcing that Wavelength, our toolkit for integrating payments into any app, is now live on mainnet for everyone. That means humans a...

#Lightning

FCMP++ (Monero privacy) Monero’s FCMP++ is moving through public stressnet testing. It would replace today’s rings of 16 with a proof that a spend belongs to the full set of spendable outputs—over 150 million—so the anonymity set gets much larger. No official mainnet date; a non-binding draft points toward early 2027.

Is Monero Traceable? What the FCMP++ Upgrade Changes, and When – Hot Paths

Magnitude Relay (Nostr) Vector shipped Magnitude Relay, an open-source Nostr relay tuned for encrypted DMs and Communities. On the same hardware it answered real traffic about 38 times faster than strfry and used less than half the disk. You can run it yourself.

Vector

Magnitude Relay: The Fastest Nostr Relay

Vector now runs on its own Nostr relay: real traffic answered 38× faster than strfry, Community messages delivered 72× sooner, sync up to 6.7× f...