Episode notes
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Q: short weekend trip to Lisbon
Q: Envoy v2.3.4 out -- stability and maintenance release; faster Bluetooth firmware updates for Passport Prime, bug fixes and further Tor connectivity improvements
Q: Legacy Mode beta for Passport Prime -- optional app porting Ledger's open-source device applications to KeyOS so users can manage alt coin holdings on open-source hardware; not installed by default, device stays Bitcoin-only if ignored
Max: bought a Stanley flask and a robot vacuum and mop combo
NEWS
CLARITY Act dies in the US Senate 49-50, eleven votes short of the 60 needed for cloture; every Democrat who voted said no, joined by Republicans Collins, Hawley and Moran; the final text dropped the explicit criminal protection for non-custodial developers against 18 USC 1960 charges -- the same law used against the Samourai and Tornado Cash developers -- keeping only civil protections; Senator Lummis warned failure leaves no realistic chance this decade; the SEC and CFTC immediately signalled unilateral rulemaking -- CoinDesk, Newsweek, TFTC, The Rage, TFTC, Coin Center
Two days after the CLARITY Act failed, the CFTC sent a pre-rule rulemaking titled "Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets" to the White House for review; contents are not public but expected to create a path for crypto spot exchanges to operate under CFTC oversight; prepared in advance and filed immediately once Congress failed to act -- PYMNTS, CoinDesk, The Defiant
CFTC Staff Letter 26-25 extends to all qualifying developers the no-action relief Phantom received in March; software that passes user orders to CFTC-registered futures firms without holding assets, generating signals or controlling routing does not need to register as an introducing broker; not law, can be withdrawn at any time, and does not protect wallet developers from DOJ money-transmission charges -- TFTC, CFTC
The FCA, HMRC and Metropolitan Police raided three London premises on September 10 targeting unregistered peer-to-peer crypto trading operations and issued cease-and-desist letters at all three; the FCA says not a single P2P crypto business is registered in the UK; the second coordinated enforcement action this year, following raids across eight locations in April which are now feeding criminal investigations; the UK's full crypto regime begins October 2027 -- CoinDesk
Hodl Hodl shipped "enhanced bitcoin security scoring" on September 18 that checked incoming bitcoin for red flags and blocked trades with a bad score; after user backlash Anna from the team posted on September 19 that they got it wrong, it shipped without warning and was explained poorly, and it is now disabled; if it returns in any form it will be disclosed beforehand; scoring coins for red flags is taint analysis, and Hodl Hodl's position holding one key on every 2-of-3 multisig trade is what makes this kind of screening possible -- Hodl Hodl on X, Anna (Hodl Hodl) on X
The Rage argues the Strategic Bitcoin Reserve created by Executive Order 14233 may exist only on paper; no reserve office appears in Treasury's public org chart or the 2025 Fiscal Report; Bloomberg reported in July that Treasury and Commerce were still disputing who has authority to run it; the House Financial Services Committee advanced the ARMA bill 28-21 on September 16 ordering agencies to keep custody of their bitcoin until the reserve is "fully established and certified operational"; a FOIA request for records on the reserve office is still pending -- The Rage
Liquid peg-outs remain paused two weeks after the $320M exploit; 3,400 BTC was returned and blocks resumed September 10 but 598.5 BTC remains with the attacker; the federation says peg-outs will resume only after 1:1 backing is confirmed and software updates and independent security reviews are complete, with no date given; L-BTC holders can only sell or swap through services like AQUA's Indra where liquidity is limited -- Liquid_BTC on X, Liquid incident report
JAN3 launched Indra on September 15, its own Lightning-Liquid swap backend for AQUA, after Boltz suspended service in August following sustained AI-assisted attacks; for now it only handles Lightning sends paying invoices from L-BTC, with receiving to follow; JAN3 replicated the Boltz API signatures so it can act as a drop-in replacement; about three hours after launch Indra was hit by a DoS attack and forward swaps were temporarily disabled -- JAN3, Stacker News, Samson Mow on X
CLN operators are advised to disable experimental features after a suspected dual-fund channel drain; on September 12 a node operator reported a peer opened a dual-funded channel, drained most of his liquidity and went offline, with the funding txid his node recorded not existing on-chain; on September 15 Core Lightning issued a security advisory urging all operators running experimental features to disable them; at least two more operators have since reported losses; no patched release has shipped -- GitHub issue #9498, CLN collaborator comment, Core Lightning advisory
A pull request by Roasbeef would change the BOLT11 spec so readers must reject invoices containing more than one payment hash; a popular Telegram P2P bot was recently hacked through this ambiguity because some libraries took the first payment hash and others the last, allowing a system mixing both to be tricked into thinking a withdrawal was never paid out -- GitHub PR #1357
Lightning wallet Blink paused all services on September 19 after an attacker drained a limited number of custodial accounts; "a few dozen" custodial accounts were affected, every affected account will be made whole, and non-custodial wallets were untouched; a patch was deployed and services came back online the same afternoon; the attack path is unknown pending a post-mortem -- Blink on X, Bitcoin.com News, TFTC on X
London-based crypto infrastructure provider Haruko was hit by a targeted attack affecting 15 clients -- all those without an IP whitelist; attackers exploited a flaw in Haruko's own processes to extract a user-access token exposing exchange API details and trading data; three sources say a small amount of client funds was stolen, mainly from smaller hedge funds -- CoinDesk
Swiss Bitcoin Pay, a non-custodial Bitcoin and Lightning payment processor, took its servers offline on September 14 after a malicious user likely accessed its internal systems; customer email addresses, bitcoin addresses, IBANs, transaction histories and hashed passwords may have been exposed; user funds are safe and any amounts owed will be returned in full; servers remain offline as of today with no restore date -- Bitcoin Magazine, FinanceFeeds
Update on the Revolut breach: attackers used a hacked email account on a real Italian government domain to send fake law enforcement data requests; at least 680 customers are affected, targeted for their crypto holdings via blockchain analysis; on September 16 the group demanded 6,000 XMR (~$3M) within 24 hours or it would sell the data; the deadline passed, Revolut says it has had no direct contact, and Italian police and UK regulators are investigating; samples have already been posted on Telegram -- CoinDesk, SecurityWeek, CyberInsider
RELEASES
Highlights
Cake Wallet v6.4.5 -- 2026-09-20
AOB
Q: short weekend trip to Lisbon
Q: Envoy v2.3.4 out -- stability and maintenance release; faster Bluetooth firmware updates for Passport Prime, bug fixes and further Tor connectivity improvements
Q: Legacy Mode beta for Passport Prime -- optional app porting Ledger's open-source device applications to KeyOS so users can manage alt coin holdings on open-source hardware; not installed by default, device stays Bitcoin-only if ignored
Max: bought a Stanley flask and a robot vacuum and mop combo
NEWS
CLARITY Act dies in the US Senate 49-50, eleven votes short of the 60 needed for cloture; every Democrat who voted said no, joined by Republicans Collins, Hawley and Moran; the final text dropped the explicit criminal protection for non-custodial developers against 18 USC 1960 charges -- the same law used against the Samourai and Tornado Cash developers -- keeping only civil protections; Senator Lummis warned failure leaves no realistic chance this decade; the SEC and CFTC immediately signalled unilateral rulemaking -- CoinDesk, Newsweek, TFTC, The Rage, TFTC, Coin Center
Two days after the CLARITY Act failed, the CFTC sent a pre-rule rulemaking titled "Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets" to the White House for review; contents are not public but expected to create a path for crypto spot exchanges to operate under CFTC oversight; prepared in advance and filed immediately once Congress failed to act -- PYMNTS, CoinDesk, The Defiant
CFTC Staff Letter 26-25 extends to all qualifying developers the no-action relief Phantom received in March; software that passes user orders to CFTC-registered futures firms without holding assets, generating signals or controlling routing does not need to register as an introducing broker; not law, can be withdrawn at any time, and does not protect wallet developers from DOJ money-transmission charges -- TFTC, CFTC
The FCA, HMRC and Metropolitan Police raided three London premises on September 10 targeting unregistered peer-to-peer crypto trading operations and issued cease-and-desist letters at all three; the FCA says not a single P2P crypto business is registered in the UK; the second coordinated enforcement action this year, following raids across eight locations in April which are now feeding criminal investigations; the UK's full crypto regime begins October 2027 -- CoinDesk
Hodl Hodl shipped "enhanced bitcoin security scoring" on September 18 that checked incoming bitcoin for red flags and blocked trades with a bad score; after user backlash Anna from the team posted on September 19 that they got it wrong, it shipped without warning and was explained poorly, and it is now disabled; if it returns in any form it will be disclosed beforehand; scoring coins for red flags is taint analysis, and Hodl Hodl's position holding one key on every 2-of-3 multisig trade is what makes this kind of screening possible -- Hodl Hodl on X, Anna (Hodl Hodl) on X
The Rage argues the Strategic Bitcoin Reserve created by Executive Order 14233 may exist only on paper; no reserve office appears in Treasury's public org chart or the 2025 Fiscal Report; Bloomberg reported in July that Treasury and Commerce were still disputing who has authority to run it; the House Financial Services Committee advanced the ARMA bill 28-21 on September 16 ordering agencies to keep custody of their bitcoin until the reserve is "fully established and certified operational"; a FOIA request for records on the reserve office is still pending -- The Rage
Liquid peg-outs remain paused two weeks after the $320M exploit; 3,400 BTC was returned and blocks resumed September 10 but 598.5 BTC remains with the attacker; the federation says peg-outs will resume only after 1:1 backing is confirmed and software updates and independent security reviews are complete, with no date given; L-BTC holders can only sell or swap through services like AQUA's Indra where liquidity is limited -- Liquid_BTC on X, Liquid incident report
JAN3 launched Indra on September 15, its own Lightning-Liquid swap backend for AQUA, after Boltz suspended service in August following sustained AI-assisted attacks; for now it only handles Lightning sends paying invoices from L-BTC, with receiving to follow; JAN3 replicated the Boltz API signatures so it can act as a drop-in replacement; about three hours after launch Indra was hit by a DoS attack and forward swaps were temporarily disabled -- JAN3, Stacker News, Samson Mow on X
CLN operators are advised to disable experimental features after a suspected dual-fund channel drain; on September 12 a node operator reported a peer opened a dual-funded channel, drained most of his liquidity and went offline, with the funding txid his node recorded not existing on-chain; on September 15 Core Lightning issued a security advisory urging all operators running experimental features to disable them; at least two more operators have since reported losses; no patched release has shipped -- GitHub issue #9498, CLN collaborator comment, Core Lightning advisory
A pull request by Roasbeef would change the BOLT11 spec so readers must reject invoices containing more than one payment hash; a popular Telegram P2P bot was recently hacked through this ambiguity because some libraries took the first payment hash and others the last, allowing a system mixing both to be tricked into thinking a withdrawal was never paid out -- GitHub PR #1357
Lightning wallet Blink paused all services on September 19 after an attacker drained a limited number of custodial accounts; "a few dozen" custodial accounts were affected, every affected account will be made whole, and non-custodial wallets were untouched; a patch was deployed and services came back online the same afternoon; the attack path is unknown pending a post-mortem -- Blink on X, Bitcoin.com News, TFTC on X
London-based crypto infrastructure provider Haruko was hit by a targeted attack affecting 15 clients -- all those without an IP whitelist; attackers exploited a flaw in Haruko's own processes to extract a user-access token exposing exchange API details and trading data; three sources say a small amount of client funds was stolen, mainly from smaller hedge funds -- CoinDesk
Swiss Bitcoin Pay, a non-custodial Bitcoin and Lightning payment processor, took its servers offline on September 14 after a malicious user likely accessed its internal systems; customer email addresses, bitcoin addresses, IBANs, transaction histories and hashed passwords may have been exposed; user funds are safe and any amounts owed will be returned in full; servers remain offline as of today with no restore date -- Bitcoin Magazine, FinanceFeeds
Update on the Revolut breach: attackers used a hacked email account on a real Italian government domain to send fake law enforcement data requests; at least 680 customers are affected, targeted for their crypto holdings via blockchain analysis; on September 16 the group demanded 6,000 XMR (~$3M) within 24 hours or it would sell the data; the deadline passed, Revolut says it has had no direct contact, and Italian police and UK regulators are investigating; samples have already been posted on Telegram -- CoinDesk, SecurityWeek, CyberInsider
RELEASES
Highlights
Cake Wallet v6.4.5 -- 2026-09-20
- Smooths out the Trezor hardware wallet connection and transaction signing flow. Speeds up Monero background sync with more stable node connections. Includes UI polish and bug fixes.
- Second beta of the umbrelOS 2.0 major rewrite. Adds redesigned search across apps, files, photos and settings with visual results. AI agents can now create and use virtual machines with screen and keyboard; Omakix Linux is available in the machines feature. Apps can be moved to external drives and cloud imports are supported. Opt in via Settings, Advanced Settings.
- Second release candidate for Bitcoin Core 32.0. PSBT-creating RPCs now default to version 2. A new exportwatchonlywallet RPC exports a watch-only copy of a descriptor wallet with no private keys for offline-signing setups. New derivehdkey and addhdkey RPCs aid multisig coordination. Testing release only -- not for nodes holding real funds.
- Adds a System theme that follows the OS light/dark setting, now the default. Enables BitBox02 xpub export and multisig signing at the m/45h keypath on firmware v9.19.0+. Includes Trezor Safe 7 session recovery and bug fixes.
- BitBox02 owners can now create a Lightning hot wallet inside the mobile BitBoxApp, funded from their on-chain balance and derived from their existing BitBox backup -- no extra seed words, no channel management. Public beta using Breez SDK and Spark statechains; unilateral exit is not yet available in the current beta.
- Security hardening release with fixes from Project Loupe, Blockstream's AI-assisted open-source security research initiative. The team warns some issues can be exploited by malicious nodes and urges all operators to upgrade immediately. Fully backward compatible with no channel closures required.
- Signal's Android 8.28 beta lets new users register without a phone number by paying a one-time fee of about $3 via Google Play. Signal says the same zero-knowledge proofs used for donations keep the purchase unlinked from the new account. Requires Google Play Services; de-Googled phones cannot use it yet. Android beta only -- iOS and stable release timelines not announced.
- Amber v6.6.4 -- 2026-09-14
- Fixes a Tor clearnet leak on Android where requests could bypass Tor and go over clearnet.
- BasicSwap DEX v0.18.9 -- 2026-09-15
- Latest in a rapid release series. Swap fund…
