Episode notes
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
AOB
Max: spent a full day and roughly $100 in API credits on a marketing project using lower-end models rather than his normal Claude subscription -- couldn't use it due to privacy concerns around Ungovernable content; a warning that frontier model quality costs real money per token
Q: quiet weekend -- kids party Saturday, christening Sunday; off to Portugal on Friday
NEWS
Revolut hands passports and Bitcoin histories to a spoofed government request: attackers used a real government agency's email domain to extract passport scans, verification selfies, home addresses, and full transaction histories including Bitcoin activity; Revolut refuses to confirm the number of affected customers, the market, or the agency involved; attacker is now leaking customer files daily on Telegram and demanding 10,000 BTC -- CoinDesk, TechCrunch, Decrypt
Liquid exploit recovery: 3,400 BTC returned to block 965950 on September 7 via on-chain OP_RETURN negotiation; ~598.5 BTC (~$47M) remains with the exploiters; Blockstream refused the demanded 10% bounty, called it theft, and says it will work with law enforcement; block production resumed September 10 but peg operations remain suspended -- Bitcoin Magazine, news.bitcoin.com, CoinDesk, The Bitcoin Manual
Final CLARITY Act text drops: ethics deal done, developer protections narrowed; the Blockchain Regulatory Certainty Act now covers civil enforcement only with criminal protections removed -- including the charge brought against the Samourai developers; cloture vote is September 15 at 2:15pm ET, needs 60 votes; prediction markets put passage at ~25% -- The Crypto Times, The Block, The Hill, CoinDesk
Chinese quantum benchmark drops secp256k1 attack to 835 logical qubits, down 60% from the 2020 estimate of 2,124; current best hardware reaches 94 logical qubits; addresses with exposed public keys face the greatest future risk -- TFTC, CoinDesk
Alby Hub authentication bypass lets attackers drain Lightning wallets: critical flaw in v1.7.0 through v1.18.5 allows unauthenticated remote takeover when port 8080 is internet-accessible; at least one user confirmed compromised; update to v1.24.0 and block external access to port 8080 -- The Hacker News
Brevo breach lets attackers send phishing from Trezor, BitBox, and CoinTracking domains: attackers created API keys inside Brevo customer accounts allowing emails from real sending domains that passed SPF, DKIM, and DMARC; the lure was a fake STM32 Entropy Vulnerability alert targeting hardware wallet owners; Trezor and BitBox both confirmed the breach on September 9 -- CryptoTimes, Decrypt
RELEASES
Highlights
Electrs v0.12.0 -- 2026-09-13
Amethyst v1.15.2 -- 2026-09-12
BasicSwap DEX v0.18.8 -- 2026-09-13
BasicSwap DEX v0.18.7 -- 2026-09-10
BDK FFI v3.1.0 -- 2026-09-12
Citrine v3.1.1 -- 2026-09-10
Core Lightning v26.06.7 -- 2026-09-11
Fedimint v0.11.3 -- 2026-09-12
JoinMarket-NG v0.39.2 -- 2026-09-12
LDK v0.2.6 -- 2026-09-10
LNbits v1.6.1 -- 2026-09-09
ngit-cli v3.0.0 -- 2026-09-08
Ride The Lightning v0.15.12 -- 2026-09-09
RoboSats v0.8.7-alpha -- 2026-09-10
Tor Browser 15.0.22 -- 2026-09-10
Trezor Suite 26.9.1 -- 2026-09-11
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
HELP GET SAMOURAI A PARDON
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) INTRO
(00:00:41) THANK YOU FOUNDATION
(00:01:29) THANK YOU CAKE WALLET
(00:03:50) The Privacy Tax
(00:12:08) Kids Parties and Christenings
(00:15:56) NEWS
(00:16:14) KYC: Kill Your Customer
(00:28:00) MORE NEWS
(00:52:42) BOOSTS
(01:02:36) UPDATES & RELEASES
AOB
Max: spent a full day and roughly $100 in API credits on a marketing project using lower-end models rather than his normal Claude subscription -- couldn't use it due to privacy concerns around Ungovernable content; a warning that frontier model quality costs real money per token
Q: quiet weekend -- kids party Saturday, christening Sunday; off to Portugal on Friday
NEWS
Revolut hands passports and Bitcoin histories to a spoofed government request: attackers used a real government agency's email domain to extract passport scans, verification selfies, home addresses, and full transaction histories including Bitcoin activity; Revolut refuses to confirm the number of affected customers, the market, or the agency involved; attacker is now leaking customer files daily on Telegram and demanding 10,000 BTC -- CoinDesk, TechCrunch, Decrypt
Liquid exploit recovery: 3,400 BTC returned to block 965950 on September 7 via on-chain OP_RETURN negotiation; ~598.5 BTC (~$47M) remains with the exploiters; Blockstream refused the demanded 10% bounty, called it theft, and says it will work with law enforcement; block production resumed September 10 but peg operations remain suspended -- Bitcoin Magazine, news.bitcoin.com, CoinDesk, The Bitcoin Manual
Final CLARITY Act text drops: ethics deal done, developer protections narrowed; the Blockchain Regulatory Certainty Act now covers civil enforcement only with criminal protections removed -- including the charge brought against the Samourai developers; cloture vote is September 15 at 2:15pm ET, needs 60 votes; prediction markets put passage at ~25% -- The Crypto Times, The Block, The Hill, CoinDesk
Chinese quantum benchmark drops secp256k1 attack to 835 logical qubits, down 60% from the 2020 estimate of 2,124; current best hardware reaches 94 logical qubits; addresses with exposed public keys face the greatest future risk -- TFTC, CoinDesk
Alby Hub authentication bypass lets attackers drain Lightning wallets: critical flaw in v1.7.0 through v1.18.5 allows unauthenticated remote takeover when port 8080 is internet-accessible; at least one user confirmed compromised; update to v1.24.0 and block external access to port 8080 -- The Hacker News
Brevo breach lets attackers send phishing from Trezor, BitBox, and CoinTracking domains: attackers created API keys inside Brevo customer accounts allowing emails from real sending domains that passed SPF, DKIM, and DMARC; the lure was a fake STM32 Entropy Vulnerability alert targeting hardware wallet owners; Trezor and BitBox both confirmed the breach on September 9 -- CryptoTimes, Decrypt
RELEASES
Highlights
Electrs v0.12.0 -- 2026-09-13
- Switches to the bindex indexing library. Requires Bitcoin Core 31 or later and a full reindex -- upgrade Core first and plan for downtime, especially on lower-powered hardware.
- Security release fixing a vulnerability in the Lightning gateway's LNv1 payment handling. Gateway operators should upgrade immediately. The fix is consensus-neutral so federation participants and wallet users do not need to coordinate an upgrade.
- Adds BOLT11 invoice payments alongside lightning addresses, scan-to-pay from the send screen, on-chain receive via bitcoin: URI, full balance hiding across the app, and Signal backup migration on a single device.
- Adds SeedQR scanning, Seed XOR splitting into 2-8 Coldcard-compatible shares, NIP-06 Nostr key derivation, BIP-44/49/84/86 descriptor export, and blank backup template printing. Also fixes seed leakage bugs -- existing users should update before use.
- Adds Italian, Japanese, Polish, Ukrainian, and Korean language support. Android users can now manually set feerates on outgoing on-chain transactions, matching iOS parity.
- Breaking-change release: NFC payments disabled by default at checkout, zero-amount invoices blocked by default, and Boltcard desktop setup removed in favour of the dedicated Boltcard app. Review the breaking changes before upgrading.
- Major catch-up release. Fixes broken HTTPS connectivity in earlier builds (missing crypto modules broke all outbound connections). Adds in-app update checking with signature verification, a guided tour, dice-based passphrases, and stronger Dojo node verification. Existing users on older versions must download manually.
- Updates compatibility to BTCPay Server 2.4.4 and enforces Breez SDK Spark release gating. Upgrade alongside BTCPay 2.4.4. All artifacts signed with Sigstore build provenance.
Amethyst v1.15.2 -- 2026-09-12
BasicSwap DEX v0.18.8 -- 2026-09-13
BasicSwap DEX v0.18.7 -- 2026-09-10
BDK FFI v3.1.0 -- 2026-09-12
Citrine v3.1.1 -- 2026-09-10
Core Lightning v26.06.7 -- 2026-09-11
Fedimint v0.11.3 -- 2026-09-12
JoinMarket-NG v0.39.2 -- 2026-09-12
LDK v0.2.6 -- 2026-09-10
LNbits v1.6.1 -- 2026-09-09
ngit-cli v3.0.0 -- 2026-09-08
Ride The Lightning v0.15.12 -- 2026-09-09
RoboSats v0.8.7-alpha -- 2026-09-10
Tor Browser 15.0.22 -- 2026-09-10
Trezor Suite 26.9.1 -- 2026-09-11
TO DONATE TO ROMAN'S DEFENSE FUND: https://freeromanstorm.com/donate
HELP GET SAMOURAI A PARDON
- SIGN THE PETITION ----> https://www.change.org/p/stand-up-for-freedom-pardon-the-innocent-coders-jailed-for-building-privacy-tools
- DONATE TO THE FAMILIES w/ USD ----> https://www.givesendgo.com/billandkeonne
- DONATE TO THE FAMILIES w/ BTC ----> https://pay.zaprite.com/pl_JpxtkLv95T
- SUPPORT ON SOCIAL MEDIA ---> https://billandkeonne.org/
VALUE FOR VALUE
Thanks for listening you Ungovernable Misfits, we appreciate your continued support and hope you enjoy the shows.
You can support this episode using your time, talent or treasure.
TIME:
- create fountain clips for the show
- create a meetup
- help boost the signal on social media
TALENT:
- create ungovernable misfit inspired art, animation or music
- design or implement some software that can make the podcast better
- use whatever talents you have to make a contribution to the show!
TREASURE:
- BOOST IT OR STREAM SATS on the Podcasting 2.0 apps @ https://podcastapps.com
- DONATE via Monero @ https://xmrchat.com/ungovernable
- BUY SOME STICKERS @ https://ungovernable.network/shop/
FOUNDATION
https://foundation.xyz/ungovernable
Foundation builds Bitcoin-centric tools that empower you to reclaim your digital sovereignty.
As a sovereign computing company, Foundation is the antithesis of today’s tech conglomerates. Returning to cypherpunk principles, they build open source technology that “can’t be evil”.
Thank you Foundation Devices for sponsoring the show!
Use code: Ungovernable for $10 off of your purchase
CAKE WALLET
https://cakewallet.com
Cake Wallet is an open-source, non-custodial wallet available on Android, iOS, macOS, and Linux.
Features:
- Built-in Exchange: Swap easily between Bitcoin and Monero.
- User-Friendly: Simple interface for all users.
Monero Users:
- Batch Transactions: Send multiple payments at once.
- Faster Syncing: Optimized syncing via specified restore heights
- Proxy Support: Enhance privacy with proxy node options.
Bitcoin Users:
- Coin Control: Manage your transactions effectively.
- Silent Payments: Static bitcoin addresses
- Batch Transactions: Streamline your payment process.
Thank you Cake Wallet for sponsoring the show!
MYNYMBOX
https://mynymbox.io
Your go-to for anonymous server hosting solutions, featuring: virtual private & dedicated servers, domain registration and DNS parking. We don't require any of your personal information, and you can purchase using Bitcoin, Lightning, Monero and many other cryptos.
Explore benefits such as No KYC, complete privacy & security, and human support.
(00:00:00) INTRO
(00:00:41) THANK YOU FOUNDATION
(00:01:29) THANK YOU CAKE WALLET
(00:03:50) The Privacy Tax
(00:12:08) Kids Parties and Christenings
(00:15:56) NEWS
(00:16:14) KYC: Kill Your Customer
(00:28:00) MORE NEWS
(00:52:42) BOOSTS
(01:02:36) UPDATES & RELEASES
