Episode notes
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
Nunchuk Desktop 2.9.1 -- 2026-10-10
AOB
- KeyOS v1.4.1 released
- Passport Core v2.4 internal beta testing
- Prepping for Freedom Fest UK and Amsterdam
- Max renovating the house
NEWS
- Hundreds of self-custody wallets belonging to Southeast Asian Ledger customers who bought their devices from CryptoBilis, Ledger's authorised reseller for Malaysia, Indonesia and the Philippines, were emptied in a coordinated sweep across six chains on 9 October, with on-chain tallies putting losses at $86M to $93M; Tether froze about $10M of the stolen USDT, and on 10 October Ledger confirmed an "unauthorized hardware implant" in one affected user's device. Mark Karpelès's Tibane Labs teardown found a hidden board inside a Nano X tapping the screen's data lines to read the 24 words during setup and send them out over its own cellular modem, never touching the secure element, so the device still passes Ledger's genuine check; CryptoBilis changed hands in March, with unverified registry screenshots showing a new owner based in China, though nobody has shown a link between the new owner and the theft. Anyone who bought from a non-direct seller should not set the device up, and anyone who already did should move funds to a new seed generated on a device bought direct -- Ledger Support (implant), Ledger Support (halt), Ledger (72-hour update), Bitquery investigation, Tibane Labs teardown, Mark Karpelès, Specter, CoinDesk, The Block, Crypto Briefing (Tether), Cointelegraph (EU report)
- On 11 October Coldcard said a post carrying a phishing link went out from its official X account and was deleted, telling users not to visit it and that coldcard.com is its only official site; it found no matching login or session record, says its credentials and offline 2FA remain secure, and has asked X Support to escalate, with no losses reported and no confirmation yet of how the post was published -- COLDCARD, COLDCARD follow-up, Cointelegraph, Stacker News
- Second says an attacker exploited a bug in its Ark server's boarding flow on 5 October, registering boards with only his own signature and then exiting them while also spending the same balances out of Second's node over Lightning, taking 0.75 BTC of the company's own liquidity; Second blocked the source within hours, briefly took the server offline and shipped a fix, with users' pre-signed exit paths unaffected, and links the attacker's coins to the 19 September Blink theft -- Second, bark MR #2612, Stacker News
- FinCEN filed notices on 5 October withdrawing the 2020 unhosted wallet proposal, which would have required reports on transfers to self-custody wallets over $10,000 and records over $3,000, and the 2023 finding that labelled international coin mixing a primary money laundering concern, saying it will take no further action on either; existing exchange AML rules and OFAC sanctions on specific mixers are untouched -- Federal Register (wallets), Federal Register (mixing), Coin Center, CoinDesk, TFTC
- On 25 September the DC Circuit upheld Roman Sterlingov's Bitcoin Fog conviction, finding that moving funds in and out of the mixer furthered its ability to launder funds for all users, enough to try him in Washington; on 5 October, the same day FinCEN withdrew its mixer rule, SDNY prosecutors cited that ruling against Tornado Cash developer Roman Storm, whose lawyers replied that Bitcoin Fog was custodial and Tornado Cash is not, with his retrial set for 26 April 2027 -- The Rage, TFTC, DC Circuit opinion
- ICANN's Reveal Day on 7 October published 1,615 applications for new top-level domains, including mempool.space operator Wiz's community application for .bitcoin, which proposes a restricted namespace for vetted Bitcoin builders with no auctions or premium names and 21% of gross revenue going to Bitcoin development; a rival standard .bitcoin application from Bird Pepper LLC, linked to Identity Digital, is also in the contention set, with string confirmation due 17 November -- Application PDF, ICANN, Contention sets
RELEASES
Nunchuk Desktop 2.9.1 -- 2026-10-10
- Fixes launch failures on Apple Silicon Macs introduced in 2.9.0, which brought hardware-key inheritance to desktop.
- Block's Bitkey published app release 2026.13.0 with a matching source tag and an updated Emergency Exit Kit APK for users who lose access to the app stores or Bitkey's servers.
- Roughly ten versions between 5 and 8 October turned Am I Exposed from a single-transaction checker into a wallet privacy auditor: wallet-level privacy heuristics, a UTXO list with privacy-aware coin selection and manual coin control, a spending decision tree, and BIP329 label import and export.
- The nodeless Lightning plugin for BTCPay Server adds a Sweeps report (what left the wallet, the fee, what arrived) and a Stablecoin Payments report to BTCPay's Reporting page. Supports BTCPay 2.4.1 and later, with no database migration.
- Reproducible builds and BIP329 label import and export. Watch-only wallets can have their derivation path and fingerprint edited and show the raw PSBT when sending. Also fixes RBF on HD Bech32 wallets and animated QR scanning.
- Gateways can be marked secure, services become reachable from other routed private networks, packages can request hardware virtualisation, and apps that pin the server certificate, such as Sparrow and Electrum clients, now see the same certificate on every route. Networking and backup fixes too.
- Coinos founder Adam Soltys opened Coinos version 3 for public testing at v3.coinos.io on 8 October, with a video tour. The new version pairs an Ark spending wallet with a regular onchain bitcoin wallet, adds a built-in Nostr client and encrypted messaging, and can run offline.
- PayPerQ (PPQ.AI), a pay-per-use AI router that takes Lightning, now serves chat requests inside an AWS Nitro enclave, with prompts encrypted on the device and the company seeing only billing metadata.
- Alby Hub v1.24.1 -- 2026-10-06
- Refreshed payment screens, transaction filtering, a Postgres to SQLite migration flow, and dependency and security updates.
- Amber 6.6.7 -- 2026-10-05
- Nostr signer: relays reconnect after VPN and network changes instead of staying stuck until a force-close.
- Amethyst v1.18.0 -- 2026-10-11
- Nostr client: web of trust, private DM fixes and a new desktop app.
- Also in window: v1.17.0 (2026-10-05), reproducible builds and QR scanner audit fixes.
- Arkade TS SDK 0.4.79 -- 2026-10-08
- Updates the scure crypto libraries and fixes a swap URI amount-conflict bug; the companion Swap SDK 0.0.25 carries the same fix. 0.5.0 release candidates continue alongside.
- balanceofsatoshis v25.0.0 -- 2026-10-08
- LND command-line toolkit: adds a pending command and drops the price command.
- BDK chain 0.23.4 -- 2026-10-12
- Patch releases across the Bitcoin Dev Kit crates, also core 0.6.4, esplora 0.22.3, electrum 0.24.1 and bitcoind_rpc 0.22.1.
- Bitcoin Core v32.0rc4 -- 2026-10-12
- Fourth release candidate for 32.0, which brings parallel block validation and silent payments. Final not yet released.
- Bitcoin Keeper v2.6.3 -- 2026-10-07
- Fixes pairing with Keeper Desktop.
- Also in window: v2.6.2 (2026-10-06), smoother unlock and more reliable key rotation.
- BTCPay Server 2.4.5 -- 2026-10-06
- SSRF blocking on by default and tighter refund permissions. Followed release candidates rc4 to rc7 (2026-10-05 to 10-06).
- Cake Wallet 6.4.6 -- 2026-10-05
- Monero-side improvements and bug fixes; no Bitcoin-specific changes noted.
- Core Lightning v26.06.9 -- 2026-10-07
- Security release.
- Ditto v2.44.2 -- 2026-10-10
- Fedimint React Native SDK 0.1.0-beta.1 -- 2026-10-11
- First React Native SDK for federated ecash apps, for testing only.
- Fedimint v0.12.2 -- 2026-10-06
- Gateway security release.
- Also in window: v0.11.4 (2026-10-06), related hardening.
