Old BTCPay Server versions exposed hot wallets

Privacy (7)

• Q and A says attackers exploited two linked flaws in Foundation’s self-hosted Cal.com and credential-management software, then sent more than 23,000 branded phishing emails to 21,500 addresses on October 25.
• The breach exposed names, email addresses, order details, and archived support conversations; some records also contained postal addresses, phone numbers, and partial card details. Foundation says Passport and Envoy devices, software, and customer funds were unaffected.
• Q and A says old WooCommerce records remained in database copies despite appearing redacted in the admin panel, while Shopify data had not yet been redacted. Foundation accepted responsibility for retaining data it believed was gone.
• Max argues that customers should share as little personal information as possible, even while expecting companies to protect data they collect. He recommends using a P.O. box or buying in person when practical, rather than giving vendors a home address.
• Q and A recommends Have I Been Pwned to check whether an email appears in known breaches, while noting it only checks email addresses. For changing contact details, he suggests listing accounts, using carrier forwarding where available, and updating services directly.
• Max says Chainalysis disclosed that an outside attacker accessed user IDs, names, email addresses, and organization roles, then later found that usernames, password hashes, and live tokens were exposed. Its screening products went offline temporarily; the company said investigation content was not accessed.
• Max says Bull Bitcoin made Payjoin the default for on-chain buys and sells through its wallet exchange. Payjoin breaks the assumption that every transaction input belongs to one sender, though the exchange still knows the transaction and a first purchase into an empty wallet cannot use it.

Safety (4)

• Q and A says companies must test their systems as attackers would and check how connected software can be exploited together. Foundation is reviewing old software and considering less self-hosting, since running more code itself also increased maintenance and attack exposure.
• Max says the Binance attackers used compromised employee machines and internal signing systems rather than stealing private keys directly. Earlier intrusions involved a tampered Homebrew package and malware in a fake recruiter’s coding task, then spread through an internal AI tool.
• Max says a 23-year-old crypto holder in France, targeted for a second time since 2022, was sentenced after firing at attempted kidnappers who were fleeing his father’s home. Max condemns the sentence and warns that public displays of wealth can expose holders to physical attacks.
• Max reports that Russian police arrested five men accused of holding a programmer in a garage for five hours and forcing him to send 10.4 BTC. The attackers allegedly chose him after seeing luxury cars in his social-media photos.

Custody (5)

• Max and Q and A favor separating Bitcoin activity from experimental AI use. Max suggests keeping Sparrow and a Bitcoin node off an AI-running computer; Q and A prefers a dedicated Bitcoin device and isolating AI access to other personal data.
• Q and A says meeting Bitcoin builders at BTC Amsterdam eased his pessimism; he gave a talk on human-authority hardware. Max argues continued work matters because Bitcoin tools can help people resist growing financial control and leave more freedom to their children.
• Max reports that Binance’s hot wallets lost assets across several chains, including 18,270 BTC, in the largest exchange hack discussed. Binance said the losses were covered by its SAFU fund and company funds; the FBI attributed the attack to North Korea.
• Max says Cake Wallet 6.5.3 adds Bluetooth support for the BitBox02 Nova on iPhone and iPad, including a pairing-code check, and adds BTC Map support.
• Max says Liana 16 makes Taproot the installer’s recommended default, changes encrypted descriptor backups to BIP-138 format, and adds a privacy mode. The upgrade migrates the wallet database irreversibly, so users must back up the descriptor before updating.

Lightning (3)

• Max reports that the LNbits team told operators to shut down after attacks on its paywall extension, then took hosted my.lnbits.com offline. BitTipBot reported 2.2 million sats withdrawn; LNbits said patches would follow, but no official release was available.
• Max says Electrum 4.8.4 drops incoming onion messages to prevent malformed messages from disconnecting Lightning peers, rejects channel announcements with identical node IDs, and fixes restoration of older seeds. He urges users to install the security release.
• Max says Core Lightning 26.06.10 fixes reported vulnerabilities involving dual funding, splicing, and peer signature checks. He urges node operators to update and avoid keeping more funds hot than necessary.

Regulation (1)

• Max says FinCEN and the Federal Reserve withdrew a proposal to lower the cross-border travel-rule recordkeeping threshold and explicitly include crypto. The existing $3,000 threshold remains; Coin Center also noted earlier hosted-wallet and mixing proposals had been dropped.

Banking (1)

• Max says ZachXBT flagged about $133 million stolen from French bank Crédit Mutuel Arkéa; the bank later said attackers compromised a service provider, wired money through bank accounts, then converted it to crypto. Max speculates some crypto hacks could be state-sponsored efforts to promote regulation and centrally controlled stablecoins.

Energy (2)

• A listener pointed to Edison Motors’ diesel-electric trucks, which use available parts and are described as having electric operation with diesel range for remote areas. Max said he was unfamiliar with the design and did not endorse the claim.
• Max preferred a new analog, manual Porsche over a Tesla, describing it as a higher-end model above the 911 and saying he expected a flat-eight engine. The discussion contrasted its simple, low-screen interior with newer tech-heavy cars.

BTC Markets (1)

• Marty Bent reviews Bitcoin network metrics as the asset trades around $75,420 with a $1.52 trillion market cap. The network approaches its next difficulty adjustment with an estimated 3.3% downward revision.

Elections (1)

• Thomas Pacquia argues the midterm elections signaled a broad voter rejection of current economic policies, predicting intensified data center and mining moratoriums under incoming Democratic leaders like Elizabeth Warren on Senate Banking.

Stablecoins (2)

• Marty Bent details the $6.3 billion Binance heist, where North Korean hackers exploited a DevOps engineer and leveraged Ethereum EIP-7702 to siphon hot wallet keys. Tether and Circle froze stolen funds, leaving Binance to cover remaining losses.
• Samsung plans to deploy USDC stablecoin wallets across 82 million Galaxy mobile devices for cross-border payment rails. Thomas Pacquia notes this expands user familiarity with digital assets, though without self-custody guarantees.

Banking (1)

• Marty Bent highlights systemic fragility across international banking, noting Paraguay's Ueno Bank shutdown triggered civil unrest and executive resignations. These incidents underscore the structural necessity of multi-signature Bitcoin self-custody over centralized financial entities.

Open Source (1)

• Developer Calle warned of rising burnout among open-source Bitcoin maintainers facing immense pressure from managing monetary software. Marty Bent stresses the urgency of supporting developer grants and independent security initiatives to sustain the protocol ecosystem long term.

Regulation (1)

• Marty Bent and Thomas Pacquia expect World Liberty Financial to draw heavy Congressional subpoenas once Democrats assume key committee chairmanships. They argue the project created an avoidable political target for crypto opposition.

Privacy (1)

• Marty Bent announces Bull Bitcoin implemented PayJoin for exchange deposits and withdrawals to break common-input ownership heuristics. The company is simultaneously taking legal action against French authorities to contest invasive KYC and AML regulations.

Europe (1)

• Thomas Pacquia identifies France as a potential catalyst for European economic instability due to unsustainable debt burdens, strict regulatory friction around technology, and an inability to independently print fiat currency to relieve fiscal deficits.

Labor (1)

• Marty Bent criticizes Pennsylvania Governor Josh Shapiro's proposed minimum wage increase, citing Thomas Sowell to argue that price floors create unemployment and compound cost-of-living pressures driven primarily by central bank inflation.

Physics (1)

• Physical Superintelligence published a machine-verified proof of the Aaronson-Banas conjecture using the Lean language. Marty Bent notes the finding establishes mathematical limits showing quantum computers offer only polynomial speedups over classical computing under general conditions.

Payments (1)

• Sat Attack found that Three Forks no longer accepted Bitcoin after a point-of-sale upgrade, though a sourdough pizza-roll shop accepted Bitcoin through Square; Austin merchants often do not advertise acceptance.

BTC Markets (1)

• Satoshi Nakamoto revised the Bitcoin white paper through four versions, and the drafts later surfaced in Craig Wright’s failed lawsuit over claims that he was Satoshi. Keon argues Bitcoin’s unusual value comes partly from rules that make the system resistant to change.

AI & Tech (1)

• Keon says Wei Dai left cryptography circles around Bitcoin’s launch and now focuses on existential risk from AI, including work associated with LessWrong. The hosts also debated whether altcoin creators understand Bitcoin but pursue modifications, or become detached from money through wealth and speculation.

Society (1)

• Totally Human Writer returned to a Himalayan trek eight years after postponing it to be with his terminally ill father. The guided journey passed villages and monasteries; a Sherpa guide was working through a holiday to help fund his children’s university studies in Japan.

Religion (1)

• The hosts described Nepal’s Kumari tradition, in which a young girl is selected as a living goddess and kept in a palace; the current Kumari was three years old and reportedly waves to visitors three times daily. The tradition ends for a Kumari if she sheds blood.

Privacy (1)

• Motorola’s Signature is the first Motorola phone designed to support GrapheneOS, with Gemini available through Google services and a camera advertised with 100x zoom. Keon questioned whether a $1,599 flagship is useful for privacy-focused users who may prefer simpler, cheaper hardware.

Elections (2)

• Carr viewed the Democratic election gains as a possible benefit for Bitcoin, arguing that Bitcoin has performed poorly during Trump presidencies; Carr expects more pressure on stablecoins and non-custodial tools but sees political opposition as potentially strengthening Bitcoin. The hosts also discussed reported Democratic gains in Texas and Greg Abbott’s defeat.
• CJE95, a Republican congressional staffer with five years on Capitol Hill, expected to lose a mid-level job after Democrats took control of the House, which would shift two-thirds of office funding to Democrats and one-third to Republicans. CJE95 said an impeachment conviction would require a two-thirds Senate vote, which was not attainable at the time.

Open Source (1)

• Bitcoin Core’s proposed AI contribution rules would let contributors use AI but require them to understand the code, review its implications, and communicate with maintainers themselves. Keon said his own project rejects feature pull requests that appear to lack human review, while accepting AI-assisted bug reports.

Labor (1)

• Keon expects AI to reshape tasks inside jobs more than eliminate whole categories of work, while Carr sees roles combining into broader positions and small startups doing more with fewer people. They disagreed with claims that AI will quickly erase pointless jobs, especially in slow-moving organizations.

Enterprise (1)

• Proton’s CTO declared that software engineering had irreversibly changed and quoted a senior engineer saying nobody in one business unit wrote code anymore. Keon warned that sensitive products involving email, VPNs, documents, and wallets need close human review because AI-written code can be harder to verify.

AI Infrastructure (1)

• Keon warned that automated agents make it cheap to scan internet-wide software for weaknesses, so outdated hot wallets are especially risky for operators who cannot monitor them. He expects the current security turmoil to ease by early next year, while Carr doubted it would settle that quickly.

Startups (1)

• Discussion of Spyro’s follow-up on Bitcoin use in gray markets surfaced a broader concern: nonprofit funding and grants may crowd out entrepreneurial experimentation. Carr argued that independent Bitcoin businesses and events such as the Austin Rodeo produce useful products and bring new people into Bitcoin.

Social Media (1)

• Reddit plans to require users to log in to browse, a change Keon linked to scraping and AI companies’ demand for platform data. Carr expects content creators to move toward higher-quality formats such as video as platforms restrict access to text and other material.

Psychology (1)

• The hosts briefly discussed sleep paralysis: Keon recalled possible episodes in childhood, while Carr described one vivid dream that felt like being awake. They noted that people often report sensing a frightening presence, but did not establish whether Carr’s experience was sleep paralysis.