UNGOVERNABLE

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.

AOB

Q: short weekend trip to Lisbon
Q: Envoy v2.3.4 out -- stability and maintenance release; faster Bluetooth firmware updates for Passport Prime, bug fixes and further Tor connectivity improvements
Q: Legacy Mode beta for Passport Prime -- optional app porting Ledger's open-source device applications to KeyOS so users can manage alt coin holdings on open-source hardware; not installed by default, device stays Bitcoin-only if ignored
Max: bought a Stanley flask and a robot vacuum and mop combo

NEWS

CLARITY Act dies in the US Senate 49-50, eleven votes short of the 60 needed for cloture; every Democrat who voted said no, joined by Republicans Collins, Hawley and Moran; the final text dropped the explicit criminal protection for non-custodial developers against 18 USC 1960 charges -- the same law used against the Samourai and Tornado Cash developers -- keeping only civil protections; Senator Lummis warned failure leaves no realistic chance this decade; the SEC and CFTC immediately signalled unilateral rulemaking -- CoinDesk, Newsweek, TFTC, The Rage, TFTC, Coin Center

Two days after the CLARITY Act failed, the CFTC sent a pre-rule rulemaking titled "Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets" to the White House for review; contents are not public but expected to create a path for crypto spot exchanges to operate under CFTC oversight; prepared in advance and filed immediately once Congress failed to act -- PYMNTS, CoinDesk, The Defiant

CFTC Staff Letter 26-25 extends to all qualifying developers the no-action relief Phantom received in March; software that passes user orders to CFTC-registered futures firms without holding assets, generating signals or controlling routing does not need to register as an introducing broker; not law, can be withdrawn at any time, and does not protect wallet developers from DOJ money-transmission charges -- TFTC, CFTC

The FCA, HMRC and Metropolitan Police raided three London premises on September 10 targeting unregistered peer-to-peer crypto trading operations and issued cease-and-desist letters at all three; the FCA says not a single P2P crypto business is registered in the UK; the second coordinated enforcement action this year, following raids across eight locations in April which are now feeding criminal investigations; the UK's full crypto regime begins October 2027 -- CoinDesk

Hodl Hodl shipped "enhanced bitcoin security scoring" on September 18 that checked incoming bitcoin for red flags and blocked trades with a bad score; after user backlash Anna from the team posted on September 19 that they got it wrong, it shipped without warning and was explained poorly, and it is now disabled; if it returns in any form it will be disclosed beforehand; scoring coins for red flags is taint analysis, and Hodl Hodl's position holding one key on every 2-of-3 multisig trade is what makes this kind of screening possible -- Hodl Hodl on X, Anna (Hodl Hodl) on X

The Rage argues the Strategic Bitcoin Reserve created by Executive Order 14233 may exist only on paper; no reserve office appears in Treasury's public org chart or the 2025 Fiscal Report; Bloomberg reported in July that Treasury and Commerce were still disputing who has authority to run it; the House Financial Services Committee advanced the ARMA bill 28-21 on September 16 ordering agencies to keep custody of their bitcoin until the reserve is "fully established and certified operational"; a FOIA request for records on the reserve office is still pending -- The Rage

Liquid peg-outs remain paused two weeks after the $320M exploit; 3,400 BTC was returned and blocks resumed September 10 but 598.5 BTC remains with the attacker; the federation says peg-outs will resume only after 1:1 backing is confirmed and software updates and independent security reviews are complete, with no date given; L-BTC holders can only sell or swap through services like AQUA's Indra where liquidity is limited -- Liquid_BTC on X, Liquid incident report

JAN3 launched Indra on September 15, its own Lightning-Liquid swap backend for AQUA, after Boltz suspended service in August following sustained AI-assisted attacks; for now it only handles Lightning sends paying invoices from L-BTC, with receiving to follow; JAN3 replicated the Boltz API signatures so it can act as a drop-in replacement; about three hours after launch Indra was hit by a DoS attack and forward swaps were temporarily disabled -- JAN3, Stacker News, Samson Mow on X

CLN operators are advised to disable experimental features after a suspected dual-fund channel drain; on September 12 a node operator reported a peer opened a dual-funded channel, drained most of his liquidity and went offline, with the funding txid his node recorded not existing on-chain; on September 15 Core Lightning issued a security advisory urging all operators running experimental features to disable them; at least two more operators have since reported losses; no patched release has shipped -- GitHub issue #9498, CLN collaborator comment, Core Lightning advisory

A pull request by Roasbeef would change the BOLT11 spec so readers must reject invoices containing more than one payment hash; a popular Telegram P2P bot was recently hacked through this ambiguity because some libraries took the first payment hash and others the last, allowing a system mixing both to be tricked into thinking a withdrawal was never paid out -- GitHub PR #1357

Lightning wallet Blink paused all services on September 19 after an attacker drained a limited number of custodial accounts; "a few dozen" custodial accounts were affected, every affected account will be made whole, and non-custodial wallets were untouched; a patch was deployed and services came back online the same afternoon; the attack path is unknown pending a post-mortem -- Blink on X, Bitcoin.com News, TFTC on X

London-based crypto infrastructure provider Haruko was hit by a targeted attack affecting 15 clients -- all those without an IP whitelist; attackers exploited a flaw in Haruko's own processes to extract a user-access token exposing exchange API details and trading data; three sources say a small amount of client funds was stolen, mainly from smaller hedge funds -- CoinDesk

Swiss Bitcoin Pay, a non-custodial Bitcoin and Lightning payment processor, took its servers offline on September 14 after a malicious user likely accessed its internal systems; customer email addresses, bitcoin addresses, IBANs, transaction histories and hashed passwords may have been exposed; user funds are safe and any amounts owed will be returned in full; servers remain offline as of today with no restore date -- Bitcoin Magazine, FinanceFeeds

Update on the Revolut breach: attackers used a hacked email account on a real Italian government domain to send fake law enforcement data requests; at least 680 customers are affected, targeted for their crypto holdings via blockchain analysis; on September 16 the group demanded 6,000 XMR (~$3M) within 24 hours or it would sell the data; the deadline passed, Revolut says it has had no direct contact, and Italian police and UK regulators are investigating; samples have already been posted on Telegram -- CoinDesk, SecurityWeek, CyberInsider

RELEASES

Highlights

Cake Wallet v6.4.5 -- 2026-09-20
Smooths out the Trezor hardware wallet connection and transaction signing flow. Speeds up Monero background sync with more stable node connections. Includes UI polish and bug fixes.
umbrelOS 2.0 Beta 2 -- 2026-09-17
Second beta of the umbrelOS 2.0 major rewrite. Adds redesigned search across apps, files, photos and settings with visual results. AI agents can now create and use virtual machines with screen and keyboard; Omakix Linux is available in the machines feature. Apps can be moved to external drives and cloud imports are supported. Opt in via Settings, Advanced Settings.
Bitcoin Core v32.0rc2 -- 2026-09-18
Second release candidate for Bitcoin Core 32.0. PSBT-creating RPCs now default to version 2. A new exportwatchonlywallet RPC exports a watch-only copy of a descriptor wallet with no private keys for offline-signing setups. New derivehdkey and addhdkey RPCs aid multisig coordination. Testing release only -- not for nodes holding real funds.
Sparrow Wallet 2.5.5 -- 2026-09-17
Adds a System theme that follows the OS light/dark setting, now the default. Enables BitBox02 xpub export and multisig signing at the m/45h keypath on firmware v9.19.0+. Includes Trezor Safe 7 session recovery and bug fixes.
BitBoxApp v4.52.0 -- 2026-09-15
BitBox02 owners can now create a Lightning hot wallet inside the mobile BitBoxApp, funded from their on-chain balance and derived from their existing BitBox backup -- no extra seed words, no channel management. Public beta using Breez SDK and Spark statechains; unilateral exit is not yet available in the current beta.
Eclair v0.14.3 -- 2026-09-14
Security hardening release with fixes from Project Loupe, Blockstream's AI-assisted open-source security research initiative. The team warns some issues can be exploited by malicious nodes and urges all operators to upgrade immediately. Fully backward compatible with no channel closures required.
Signal Beta Enables Phone-Numberless Registration -- 2026-09-16
Signal's Android 8.28 beta lets new users register without a phone number by paying a one-time fee of about $3 via Google Play. Signal says the same zero-knowledge proofs used for donations keep the purchase unlinked from the new account. Requires Google Play Services; de-Googled phones cannot use it yet. Android beta only -- iOS and stable release timelines not announced.
Everything else
Amber v6.6.4 -- 2026-09-14Fixes a Tor clearnet leak on Android where requests could bypass Tor and go over clearnet.

BasicSwap DEX v0.18.9 -- 2026-09-15Latest in a rapid release series. Swap fund…

A weekly live show covering all things Freedom Tech with Max, Q and Seth.

In this episode, Max chats with Seth for a wide-ranging catch-up on the state of open source and local AI following his visit to the Open Source AI Summit in San Francisco. They talked about why AI feels so energising compared with the slower pace of Bitcoin development, how local and open models are rapidly improving, and why more people in the freedom tech world need to pay attention. Seth shared his view that we are already close to a point where self-hosted AI is practical for everyday use, with the right hardware, and explained the trade-offs between speed, intelligence and cost when choosing a setup.

Max and Seth also dug into what it means to treat AI like “self-custody for intelligence", keeping your data private, running tools locally, and avoiding dependence on closed platforms that can limit, monitor or shape your usage. Along the way, they covered how AI can help with everything from infrastructure and creative work to family life and productivity, as well as the risks around surveillance, security and misuse. Max and Seth closed by looking at the idea of “resonant computing”, a vision for technology that is private, adaptable and built to serve people rather than exploit them.

HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate

VALUE FOR VALUE

Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.

You can support this episode using your time, talent or treasure.

TIME:

- create fountain clips for the show
- create a meetup
- help boost the signal on social media

TALENT:

- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!

TREASURE:

- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/

FOUNDATION

https://foundation.xyz/ungovernable

Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.

As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.

Thank you Foundation Devices for sponsoring the show!

Use code: Ungovernable for $10 off of your purchase

CAKE WALLET

https://cakewallet.com

Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.

Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.

Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.

Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.

Thank you Cake Wallet for sponsoring the show!

MYNYMBOX

https://mynymbox.io

Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.

Explore benefits such as No KYC, complete privacy & security, and human support.

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.

AOB

Max: spent a full day and roughly $100 in API credits on a marketing project using lower-end models rather than his normal Claude subscription -- couldn't use it due to privacy concerns around Ungovernable content; a warning that frontier model quality costs real money per token
Q: quiet weekend -- kids party Saturday, christening Sunday; off to Portugal on Friday

NEWS

Revolut hands passports and Bitcoin histories to a spoofed government request: attackers used a real government agency's email domain to extract passport scans, verification selfies, home addresses, and full transaction histories including Bitcoin activity; Revolut refuses to confirm the number of affected customers, the market, or the agency involved; attacker is now leaking customer files daily on Telegram and demanding 10,000 BTC -- CoinDesk, TechCrunch, Decrypt

Liquid exploit recovery: 3,400 BTC returned to block 965950 on September 7 via on-chain OP_RETURN negotiation; ~598.5 BTC (~$47M) remains with the exploiters; Blockstream refused the demanded 10% bounty, called it theft, and says it will work with law enforcement; block production resumed September 10 but peg operations remain suspended -- Bitcoin Magazine, news.bitcoin.com, CoinDesk, The Bitcoin Manual

Final CLARITY Act text drops: ethics deal done, developer protections narrowed; the Blockchain Regulatory Certainty Act now covers civil enforcement only with criminal protections removed -- including the charge brought against the Samourai developers; cloture vote is September 15 at 2:15pm ET, needs 60 votes; prediction markets put passage at ~25% -- The Crypto Times, The Block, The Hill, CoinDesk

Chinese quantum benchmark drops secp256k1 attack to 835 logical qubits, down 60% from the 2020 estimate of 2,124; current best hardware reaches 94 logical qubits; addresses with exposed public keys face the greatest future risk -- TFTC, CoinDesk

Alby Hub authentication bypass lets attackers drain Lightning wallets: critical flaw in v1.7.0 through v1.18.5 allows unauthenticated remote takeover when port 8080 is internet-accessible; at least one user confirmed compromised; update to v1.24.0 and block external access to port 8080 -- The Hacker News

Brevo breach lets attackers send phishing from Trezor, BitBox, and CoinTracking domains: attackers created API keys inside Brevo customer accounts allowing emails from real sending domains that passed SPF, DKIM, and DMARC; the lure was a fake STM32 Entropy Vulnerability alert targeting hardware wallet owners; Trezor and BitBox both confirmed the breach on September 9 -- CryptoTimes, Decrypt

RELEASES

Highlights

Electrs v0.12.0 -- 2026-09-13
Switches to the bindex indexing library. Requires Bitcoin Core 31 or later and a full reindex -- upgrade Core first and plan for downtime, especially on lower-powered hardware.
Fedimint v0.12.1 -- 2026-09-12
Security release fixing a vulnerability in the Lightning gateway's LNv1 payment handling. Gateway operators should upgrade immediately. The fix is consensus-neutral so federation participants and wallet users do not need to coordinate an upgrade.
Radar v1.0.7 -- 2026-09-12
Adds BOLT11 invoice payments alongside lightning addresses, scan-to-pay from the send screen, on-chain receive via bitcoin: URI, full balance hiding across the app, and Signal backup migration on a single device.
Bitcoin Seed Tool v2.4.0 -- 2026-09-11
Adds SeedQR scanning, Seed XOR splitting into 2-8 Coldcard-compatible shares, NIP-06 Nostr key derivation, BIP-44/49/84/86 descriptor export, and blank backup template printing. Also fixes seed leakage bugs -- existing users should update before use.
Phoenix v2.8.2 -- 2026-09-08 (Android), 2026-09-07 (iOS)
Adds Italian, Japanese, Polish, Ukrainian, and Korean language support. Android users can now manually set feerates on outgoing on-chain transactions, matching iOS parity.
BTCPay Server v2.4.4 -- 2026-09-08
Breaking-change release: NFC payments disabled by default at checkout, zero-amount invoices blocked by default, and Boltcard desktop setup removed in favour of the dedicated Boltcard app. Review the breaking changes before upgrading.
Ashigaru Desktop v1.4.5 -- 2026-09-07
Major catch-up release. Fixes broken HTTPS connectivity in earlier builds (missing crypto modules broke all outbound connections). Adds in-app update checking with signature verification, a guided tour, dice-based passphrases, and stronger Dojo node verification. Existing users on older versions must download manually.
Flint v1.1.0 -- 2026-09-07
Updates compatibility to BTCPay Server 2.4.4 and enforces Breez SDK Spark release gating. Upgrade alongside BTCPay 2.4.4. All artifacts signed with Sigstore build provenance.
Everything else

Amethyst v1.15.2 -- 2026-09-12

BasicSwap DEX v0.18.8 -- 2026-09-13

BasicSwap DEX v0.18.7 -- 2026-09-10

BDK FFI v3.1.0 -- 2026-09-12

Citrine v3.1.1 -- 2026-09-10

Core Lightning v26.06.7 -- 2026-09-11

Fedimint v0.11.3 -- 2026-09-12

JoinMarket-NG v0.39.2 -- 2026-09-12

LDK v0.2.6 -- 2026-09-10

LNbits v1.6.1 -- 2026-09-09

ngit-cli v3.0.0 -- 2026-09-08

Ride The Lightning v0.15.12 -- 2026-09-09

RoboSats v0.8.7-alpha -- 2026-09-10

Tor Browser 15.0.22 -- 2026-09-10

Trezor Suite 26.9.1 -- 2026-09-11

TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate

HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

VALUE FOR VALUE

Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.

You can support this episode using your time, talent or treasure.

TIME:

- create fountain clips for the show
- create a meetup
- help boost the signal on social media

TALENT:

- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!

TREASURE:

- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/

FOUNDATION

https://foundation.xyz/ungovernable

Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.

As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.

Thank you Foundation Devices for sponsoring the show!

Use code: Ungovernable for $10 off of your purchase

CAKE WALLET

https://cakewallet.com

Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.

Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.

Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.

Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.

Thank you Cake Wallet for sponsoring the show!

MYNYMBOX

https://mynymbox.io

Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.

Explore benefits such as No KYC, complete privacy & security, and human support.

(00:00:00) INTRO
(00:00:41) THANK YOU FOUNDATION
(00:01:29) THANK YOU CAKE WALLET
(00:03:50) The Privacy Tax
(00:12:08) Kids Parties and Christenings
(00:15:56) NEWS
(00:16:14) KYC: Kill Your Customer
(00:28:00) MORE NEWS
(00:52:42) BOOSTS
(01:02:36) UPDATES & RELEASES

A weekly live show covering all things Freedom Tech with Max, Q and Seth.

Thanks to Jordan for joining us to walk through Ashigaru Desktop live on air. Jordan built a full graphical desktop wallet on top of Ashigaru Terminal, bringing Whirlpool mixing to a wider audience with a guided tour for newcomers, a dice-based EFF passphrase generator, in-app software verification against his BIP47 payment code, and the ability to mix straight to cold storage using an output descriptor. We watched a full mix go through in real time, explored the Mix To feature for sending post-mix funds directly to a Passport Prime wallet, and talked through bad bank, pool fees, and keeping KYC and privacy stacks separate.

Download Ashigaru Desktop and follow the project on GitHub: https://github.com/linkinparkrulz/ashigaru-desktop/releases

Learn more about Ashigaru Terminal and get the download: https://ashigaru.rs/download/

Check pool activity at https://whirlpoolstats.xyz/ and connect Passport to software wallets: https://docs.foundation.xyz/passport/connect/

HELP GET SAMOURAI A PARDON
SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate

VALUE FOR VALUE

Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.

You can support this episode using your time, talent or treasure.

TIME:

- create fountain clips for the show
- create a meetup
- help boost the signal on social media

TALENT:

- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!

TREASURE:

- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/

FOUNDATION

https://foundation.xyz/ungovernable

Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.

As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.

Thank you Foundation Devices for sponsoring the show!

Use code: Ungovernable for $10 off of your purchase

CAKE WALLET

https://cakewallet.com

Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.

Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.

Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.

Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.

Thank you Cake Wallet for sponsoring the show!

MYNYMBOX

https://mynymbox.io

Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.

Explore benefits such as No KYC, complete privacy & security, and human support.

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.

AOB

First live show!
Ungovernable.network updates
KeyOS 1.4 is out

NEWS

Liquid exploit: roughly 4,000 BTC withdrawn; return discussions ongoing-- TFTC, CoinDesk, Stacker News | Updates: OrangeSurf, Samson Mow

Orionx Exchange Collapses in Chile: $7M Missing, 100K Users Affected -- TFTC

Coinbase/Better Bitcoin-Backed Mortgages Can Reuse Borrowers' Collateral -- CoinDesk

House Cancels Late-September Votes, Squeezing CLARITY Act Window -- Roll Call, CoinDesk

Trezor Breach Worse Than Reported: 67,000 More US Customers Exposed -- Bitcoin Magazine

Pocket Bitcoin Breach Links 291 Users' Identities to Bitcoin Addresses -- Pocket Bitcoin Blog

Coldcard Wave 3 Attacker Moves Stolen BTC Through THORChain -- TFTC

Tether Froze $42.4M USDT on a Verbal Homeland Security Request, No Warrant -- CoinDesk

RELEASES

Highlights

KeyOS v1.4.0 -- 2026-09-04
Major release for Passport Prime with a redesigned launcher, app sideloading with granular permissions, multisig exports for Unchained and Casa, new wallet connections (Bitcoin Safe, Coconut Wallet), authenticator imports from Aegis and Proton, and PIN-before-seed-reveal. Includes security fixes: P2WSH/P2SH-P2WSH change output validation, enhanced ATECC608 entropy, and a PSBT trust_witness_utxo toggle addressing CVE-2020-14199.
Cake Wallet 6.4.4 -- 2026-09-04
Adds native Trezor hardware wallet support for Bitcoin cold storage and offline signing. Fixes a security vulnerability (GHSA-695v-fhpj-fv8x) where a malicious deep-link could cause EVM assets to be sent on an incorrect network. Also includes improved Monero sync visibility.
Nunchuk Android 2.8.5 -- 2026-09-03
Adds BitBox02 connectivity over Bluetooth and USB, integrates Krux hardware wallet support, and introduces emergency push notifications with home-screen alerts.
RoboSats v0.8.7-alpha -- 2026-08-31
Major update adding three new coordinators (Eleuteria, Freeport, Ammanaya), a federation consensus mechanism, and end-to-end encrypted image uploads in order chat via Blossom. Coordinators are now ranked live by DevFund donation value. Multiple security fixes including PGP verification.
Everything else

Aqua Wallet v0.5.3 -- 2026-09-01

BasicSwap DEX v0.18.6 -- 2026-09-06

BitBox02 Firmware v9.27.1 -- 2026-09-04

Bitcoin Knots v29.4.1 -- 2026-09-02

Blockstream Green Desktop 3.5.4 -- 2026-09-04

Bull Bitcoin Mobile 6.13.4 -- 2026-09-04

Cashu CDK v0.18.0 -- 2026-09-02

Cashu TS v5.0.0-rc.9 -- 2026-09-04

Coldcard Firmware v5.6.2 and v1.5.2Q -- 2026-09-03

Flint v1.0.4 -- 2026-09-02

JoinMarket-NG v0.39.1 -- 2026-09-06

LDK v0.3-rc1 -- 2026-09-04

Lightning Terminal v0.17.4-alpha -- 2026-09-03

LND v0.21.3-beta -- 2026-09-02

Mostro v0.18.7 -- 2026-09-05

Specter-DIY v1.10.5 -- 2026-09-06

Tails 7.12 -- 2026-09-05

Zeus v13.2.1 -- 2026-09-02

EDUCATION

Liquid explainer: cached validation versus key compromise
Use OrangeSurf's technical notes alongside the DeFi Prime explainer. Treat early reporting as provisional, not a completed postmortem.
The reported flaw lets an invalid proof receive a cached pass; confidential amounts do not make validity unknowable. OrangeSurf reports one explorer rejected the transaction, with the cause of divergence unresolved.
Do not describe this as cryptographically bypassing federation signatures, or assert that Confidential Transactions hid issuance from every observer.
Liquid trust model: validation, custody and recovery
The SpendNode discussion can frame key compromise versus invalid issuance, but its incident details need the qualifications above.
Holding an L-BTC wallet key still leaves the underlying BTC dependent on the federation and the system's validation rules. Mainchain self-custody avoids that particular peg exposure; it does not eliminate all software or consensus risk.
Pair with Mow's on-chain message chronology: an offer to return most funds is not completed recovery, and an acknowledgement is not proof of a complete patch.
Bitcoin Optech #421: Silent Payments for Mining Pool Coinbase Payouts -- Bitcoin Optech
Published: 2026-09-04
Explains how mining pools could use BIP352 silent payment addresses to pay miners directly in coinbase transactions, replacing xpub-based payouts and improving miner privacy. The newsletter also covers the full CLN ping-flood DoS disclosure and post-quantum signature proposals.
A concrete, actionable application of silent payments moving from theory to real infrastructure. Shows how the protocol can improve miner privacy without new consensus changes. The CLN disclosure detail is also worth mentioning as follow-up to last episode's CLN coverage.

TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate

HELP GET SAMOURAI A PARDONSIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/

VALUE FOR VALUE

Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.

You can support this episode using your time, talent or treasure.

TIME:

- create fountain clips for the show
- create a meetup
- help boost the signal on social media

TALENT:

- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!

TREASURE:

- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/

FOUNDATION

https://foundation.xyz/ungovernable

Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.

As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.

Thank you Foundation Devices for sponsoring the show!

Use code: Ungovernable for $10 off of your purchase

CAKE WALLET

https://cakewallet.com

Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.

Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.

Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.

Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.

Thank you Cake Wallet for sponsoring the show!

MYNYMBOX

https://mynymbox.io

Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.

Explore benefits such as No KYC, complete privacy & security, and human support.

(00:00:00) INTRO
(00:00:58) THANK YOU FOUNDATION
(00:01:38) THANK YOU CAKE WALLET
(00:02:44) Not Just Weekly, Live Weekly!
(00:07:44) KeyOS 1.4.0
(00:14:59) NEWS
(00:15:07) The Liquid Exploit
(00:40:02) MORE NEWS
(00:55:05) BOOSTS
(01:05:44) UPDATES & RELEASES
(01:07:29) EDUCATION
(01:09:10) THANK YOU MYNYMBOX