Episode notes
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
Ghostly 1.1.2 -- 2026-10-05
Everything Else
AOB
- Weekend shenanigans
- Mission Control and Jarvis
- Max fighting insects
NEWS
- Former National Crime Agency officer Paul Chowles has been ordered to repay GBP 1,810,678.93 after a Crown Prosecution Service confiscation order on 30 September; he stole 50 BTC in 2017 from a wallet holding coins seized from Silk Road 2.0 administrator Thomas White, worth about GBP 59,000 at the time, laundering it through Bitcoin Fog and spending it via CryptoPay and Wirex cards before Merseyside Police caught him in 2022; he was jailed for five and a half years in July 2025, and part of his confiscation order now pays off White's own unpaid confiscation order to the state -- CPS
- South Africa's Absa has become the first African bank to custody bitcoin, mainly for institutional clients, following Deutsche Bank's custody launch in September; head of digital assets Rob Downes said bitcoin will be the bank's largest custodied asset, with other digital assets to follow, in a market Chainalysis puts second in Sub-Saharan Africa by value received at about $36B -- Bitcoin Magazine
- Blink published its post-mortem of the 19 September attack: a permissions flaw in its admin tools, open since October 2023, let the attacker grant themselves admin rights through the OAuth consent page and take over 35 custodial accounts, withdrawing about 6.61 BTC from 24 of them; nine targeted accounts had 2FA on and all 18 login attempts to use them were refused, so nobody with 2FA lost anything; shareholders advanced the full amount as an interest-free loan so balances were restored by 24 September with fees refunded, and Blink is offering a 25% recovery bounty plus a matching 25% donation to circular economies including Bitcoin Beach, Bitcoin Ekasi and Afribit Kibera -- Blink
- Tether says USDT is coming to Bitcoin this month via the RGB protocol, issued by Utexo, whose co-founder Viktor Ihnatiuk says the company holds the commercial licence; Utexo can't freeze RGB addresses the way Tether freezes Ethereum ones, so instead it will blacklist UTXOs that become unredeemable at bridges and minting tools, with BTC-to-USDT swaps and BTC-backed lending to follow and Lightning support after launch; USDT first lived on Bitcoin via Omni back in 2014 -- CoinDesk
- A federal judge in Utah has granted a preliminary injunction blocking the VPN provisions of the state's SB 73, the first US law to penalise VPN use, which would have required adult sites to block VPN users or locate every visitor; the court found the law demands something technically impossible, though the separate ban on explaining how to use a VPN was not challenged and stays in force -- EFF
- Core Lightning is warning of active attacks on unpatched nodes: an operator on v26.06.7 reported an attacker opening a splice, routing a small keysend, then sending an error so the victim's node goes on-chain and sweeps its own output through the revocation path as if it had cheated; the path was already fixed in v26.06.8, and by 1 October Stacker News operators were reporting about 0.2 BTC lost between them, with one user reporting 4.88M sats across five incidents and a StartOS user reporting 3M sats; anyone on 26.06.7 or earlier should upgrade now, or restart with --offline if they can't upgrade immediately -- GitHub #9578, GitHub #9595, TFTC, Stacker News, Stacker News, CLN v26.06.8
- The Dutch cabinet has told parliament that shares, bonds and options will move to a realised-gains tax from 2028, with other assets following in 2030; crypto isn't named among the 2028 instruments, so if it counts as an "other asset" Dutch bitcoin holders keep paying yearly tax on unrealised paper gains for two years longer than shareholders, and the tax-free allowance falls to EUR 1,000 per person -- NL Times, Bitcoin Magazine, Crypto Benelux
- The Liquid Federation says an independent external audit of Elements v23.3.4 is underway, focused on safely restoring peg-outs, and it is replacing the peg-out authorisation key list and moving all peg-out keys to cold storage; peg-outs remain paused nearly a month after the exploit, with about 602 BTC of the stolen 3,996 BTC still unrecovered -- crypto.news, KuCoin News, liquid.net
- UK law firm Edmonds Marshall McMahon says it has recovered 20.00444711 BTC, about $1.725M, in full and with no deduction for one client seven weeks after the Coldcard theft, the first documented full recovery through the Crypto Recovery Trust; the claim rested on blockchain forensics, the client's exchange records, signed message challenges and wallet derivation checks -- EMM Legal, CoinDesk, Decrypt
- Apps built on the Breez SDK can now accept USDT or USDC from more than 30 networks including Ethereum, Base, Solana and Tron, with Flashnet converting the payment in the background so it lands in the receiver's self-custodial wallet as bitcoin, or as dollars with the stable balance feature; this is a developer-facing SDK feature, not something Breez's own wallet turns on automatically -- Bitcoin Magazine
- Block has launched its first big consumer ad campaign for bitcoin, "Some things don't make sense. Bitcoin does.", running on YouTube, X, Meta, Fox Sports and in cinemas until 31 December; meanwhile a Stacker News user described failing for the second time in two weeks to spend bitcoin at a Square terminal because the merchant hadn't switched the option on in their dashboard -- newer point-of-sale devices have the toggle on by default with a customer-facing screen, but older terminals still need the merchant to enable it -- Bitcoin Magazine, Stacker News
- Bitget reopened BTC withdrawals on 28 September, with fiat and P2P back by 2 October, and Bitcoin Magazine reported more than 4,000 BTC withdrawn in a single hour on 29 September; CEO Gracy Chen told CNBC only about $1.1M of the roughly $388M stolen has been frozen and she isn't "expecting to recover a lot" -- CNBC
RELEASES
Ghostly 1.1.2 -- 2026-10-05
- An MIT-licensed messenger that finds contacts over the Mainline DHT and talks over direct encrypted connections, with no servers or accounts, built-in payments across Lightning, Cashu, Ark, Spark and on-chain, and messages that vanish by default.
- A security release fixing two funds-theft bugs, including a malicious peer able to force a second commitment signature at the same state index, plus two denial-of-service bugs.
- Adds proper large-screen layouts for tablets, fixes the Passport Prime price graph stuck on "Loading Data", and removes leftover code from the retired Buy Bitcoin feature.
- Lets users set their own hardware signing device as the inheritance key in off-chain timelock inheritance plans, plus general bug fixes.
- Adds manual coin selection for Bitcoin and Liquid, a price chart and BIP39 passphrase guidance at login, and restores 2FA-protected and 2-of-3 multisig account creation.
- A redesigned interface with light mode, a compact transaction graph and a "Before you act" section, plus later patches fixing Umbrel startup and dropping Liquid from tips and guides.
- The nodeless Lightning plugin for BTCPay Server turns on unilateral exit for every server, letting a merchant take its balance on-chain without Spark's operators, now with automatic exit-state backups.
- A security fix for the router's management interface so requests from loopback no longer skip sign-in, meaning every settings change now needs authentication.
Everything Else
- 0xchat 1.5.6 -- 2026-09-30
- Nostr chat: blocks connections while the Tor proxy is set but not ready, closes a system-proxy leak, validates TLS for non-onion hosts, and patches Cashu P2PK security issues.
- Amber 6.6.6 -- 2026-09-28
- Nostr signer: fixes the nostrconnect parser corrupting secrets that contain "=", which broke NDK-based clients.
- AQUA 0.5.4 -- 2026-10-01
- Fixes Lightning refunds, mismatched fee display and failed-payment status; minimum iOS is now 15.
- Arti 2.7.0 -- 2026-10-01
- Tor in Rust: fixes low- to high-severity security issues (onion service operators should upgrade) and moves closer to running relays and directory mirrors.
- BasicSwap 0.19.0 -- 2026-10-03
- Atomic-swap DEX: Smart Buy (beta) fills an order across offers, and offers and swap messages can now travel over Nostr with a key per swap and Tor when enabled.
- Also in window: 0.18.10 (2026-09-29), switchable price oracles and stale-rate protection.
- BDK FFI v3.1.1 -- 2026-09-29
- Error messages no longer echo back descriptor or key material; also fixes a fee-rate overflow.
- Bisq v1.10.9 -- 2026-10-01
- Mandatory: fixes vulnerabilities found in a recent security audit and updates Tor. Required to keep trading.
- Bitcoin Core v32.0rc3 -- 2026-10-01
- Third release candidate for 32.0, which brings parallel block validation and silent payments. Final not yet released.
- Bitcoin Keeper v2.5.17 -- 2026-10-02
- Breez SDK Spark 0.26.1 -- 2026-10-02
- Smaller mobile binaries.
- BTCPay Server v2.4.5-rc3 -- 2026-10-05
- Release candidate, following rc1 (10-01) and rc2 (10-02). No release notes yet.
- COLDCARD 5.6.3 and 1.5.3Q -- 2026-09-30
- Adds Codex32 and Shamir seed splitting, warns before installing contributor-signed or downgraded firmware, and…
