So Nostube by @florian is pretty cool...

Nostube

Video on Nostr: the web app, the self-hosted server and the embed player

Speaking of stealing billions... > Delay box 3 threatens after 'pitch black advice' Council of State and tax authorities The maybe-partially-unrealized gains tax might be delayed by another year again, to 2029. #box3

Ok, now this is actually an interesting move...

FixupX

Esmaill (@czesmaill)

The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto. First, Tether froze $1.5 billion in USDT. Then Cir...

#binance

> the security incident may involve a compromised DevOps engineer’s laptop Unless you still use notepad and email patches, you probably want to have a production deployment process that assumes compromised developer laptops.

X (formerly Twitter)

Binance (@binance) on X

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker...

> Paolo Ardoino, chief executive of Tether, said his company had in response frozen about $1.547bn of USDT, its $180bn dollar-linked stablecoin. > Total losses across Binance “might be a bit higher” than $1bn, CZ later warned. About the amount of BTC stolen? > Bitcoin fell 3.2 per cent to $78,623. So the coin that couldn't be frozen and that people now need to buy again, drops in value. https://www.ft.com/content/c7f5e395-c3a9-430e-b757-5014527b4d49

Bug existed for a decade, then found three times in a row independently over the past few months.

Bitcoin Core

CVE-2026-117346 - Undo file overflow under extreme conditions

CVE-2026-117346 - Undo file overflow under extreme conditions

I had my agent write an anti-exfil BIP for hardware wallets, implement it in libsecp, Bitcoin Core and several firmwares, with HWI device simulator integration tests on top. That said, I haven't read it :-) It might even be the wrong design. I won't have time to work on this anytime soon, so feel free to run with it. They're all pull requests against my forks.

GitHub

Draft BIPXXX: interactive anti-exfiltration for single-signer Taproot by Sjors · Pull Request #2 · Sjors/bips

This draft specifies an interactive anti-exfiltration protocol for single-signer BIP340 signatures and provisional PSBT input fields. A malicious d...

For people listening to Bitcoin, Explained via Apple, Spotify, etc (but not @Fountain and others apps that use the Podcast Index): I redirected the hosting to my self-hosted Castopod instance. This may cause the last 9 episodes to reappear in your feed. Just listen to them again. Also, episode 101 now has a transcript! And episode 102 is coming in two weeks(tm). https://bitcoinexplainedpodcast.com/@nado/

Can we rate limit critical bugs to one per day, so that when someone says "todays bug" it's unambiguous?

Or just block port 80 and 443 on all your firewalls. View quoted note →

Stop Collecting Data (or at least keep archives offline) View quoted note →

> An internal research model asked to update a cryptocurrency trading application used funds from a wallet that the task had not supplied to pay for a deployment on Sepolia, an Ethereum test network. It derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment. The model questioned whether it had permission, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use.

Using a funded test cryptocurrency wallet without authorization · OpenAI Alignment

Research on aligning AI with human values and intent, and reports documenting model failures.

Philosophical question in light of #assumeUTXO: if you were a brand new bitcoiner, would you care if the history before a snapshot was dishonest? You know that validating from genesis would reject the snapshot. Someone clearly stole coins in the past and this somehow got grandfathered into the dominant software, but only for assume utxo users. You already missed your chance to buy early. Even if a malicious fork in the past stole coins, it wouldn't impact your new stash. And you know the total supply. Couple of assumptions for this scenario: 1. you find no alternative chain of headers forking before the snapshot (indicating an ongoing conflict that you don't want to be on the wrong side of when it reorgs) 2. you receive your coins in a transaction after the snapshot So this is not a case of someone giving you targeted malware with a snapshot to trick you into providing services for coins that are never received on the real chain. This is an all out, perhaps even publicly known, conspiracy where everyone just gave up on the real chain. It's true regarding (1) that you can't rule out the existence of an alternative (valid history) chain that will eventually wipe you out. This is also true for a regular deep reorg, but the risk may be different. Some new users would never want to use such a corrupted system (but then what, revert to fiat, start an altcoin?). The incentive for pre-existing users is different. They might not like snapshots exactly because many new users might not care.

Ok, so Mohammed Hijab is an obvious charlatan and intellectual lightweight. He spends: - 80% of the time bullying (well beyond normal bantering): appeals to authority, shouting over his opponent (can't respect a dhimmi of course, he even called Avery a slave: "boy"), loaded questions, screaming strawman gotcha's on repeat, etc - 10% calmly trying a line of argument in the hopes his opponent doesn't know it, only to revert to shouting when he realizes Avery does know it. - 10% being intellectually honest (answering a question, reading a quote, acknowledging an argument)

Someone has been creatively vibe coding phishing emails... this one tries to exfiltrate your address by pretending a package is on its way, but needs an address "correction" (which is not a thing).