Episode notes
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
Electrum 4.8.4 -- 2026-11-06
AOB
- Foundation suffered a data breach: attackers chained two bugs in its self-hosted cal.com booking software to reach internal credentials and sent more than 23,000 phishing emails, spoofing a Passport recall, to 21,500 email addresses. No Passport or Envoy funds or software are affected, but names, order details and, for some customers, postal addresses, phone numbers and partial card details were exposed. Q posted a full incident report to the community forum and is offering help to anyone affected at hello@foundation.xyz.
- Max recaps BTC Amsterdam at the Sugar Factory, where he gave a talk on human authority hardware and joined a panel with Derek Ross and Seth.
- Max is heading to Manchester this week for Freedom Fest, where Freedom Tech Friday will go live from the show with Derek Ross talking through the mobile Linux distro he's been vibe-coding.
NEWS
- LNbits, the open-source Lightning wallet software that sits behind a huge number of tipping bots, paywalls, point-of-sale setups and community wallets most people have never heard of, told every operator to shut down after a wave of attacks drained one of those tipping bots. At around 12:33 UTC on 8 November LNbits flagged a possible vulnerability in its Paywall extension and told operators to disable it; about 80 minutes later it escalated to telling every LNbits service to stop immediately, taking its own hosted my.lnbits.com offline too. The one confirmed victim so far is BitTipBot, whose operator Kevin Ravensberg says new accounts using the exploit withdrew around 2.2 million sats between 09:22 and 14:00 UTC before the shutdown warning went out; he has pledged to repay users himself. A fix titled "centralize SSRF protection and block self-targeted requests" was merged into the dev branch around midday on 9 November, but there is still no patched release, no security advisory and the cause has not been confirmed. Both hosts said anyone running LNbits should stay offline until a proper release lands and, as always, keep as little as possible sitting in a hot wallet -- TFTC, Bitcoin.com News, LNbits on X, Kevin Ravensberg on X, PR #4310
- Back to the original BTCPay Server hot-wallet hack: a new route into the same bug has swept through servers that were never updated. Attackers drained the first wallet of BTC and Litecoin on 1 November, the first theft report came in that morning and a community warning followed roughly an hour later. The flaw was fixed in version 2.4.2, so servers already on 2.4.2 or later were untouched, as were any wallets whose keys live off the server, such as a hardware wallet connected as watch-only. BTCPay has given no loss figure and hasn't described the new method, and the incident landed just three days after 2.4.7 fixed 85 separate security findings. Both hosts repeated the same advice: if you're on 2.4.1 or older, treat the server as compromised and get funds off it, and don't keep Bitcoin hot on a payment server unless you genuinely have to -- BTCPay Server blog, Unchained, TFTC
- A week on from the Binance hack, the picture is getting clearer and it dwarfs everything that came before it: hot wallets backing customer balances in Binance's own proof-of-reserves were drained across several chains in about 20 minutes, including 18,270 BTC (around $1.4B) split across 19 wallets nobody can freeze. Total estimates run from $5.8B to $6.4B, with Binance itself citing $6.34B, by far the largest exchange hack on record. The FBI has attributed it to North Korea. Withdrawals reopened in phases from 1 November and users pulled a net $3.6B in the first hours; Binance says losses are covered from its SAFU fund and company money. On 6 November Elliptic reported the hackers had swapped about $50M of stolen XRP, mostly into bitcoin through THORChain, with about $3.1B still sitting in identified wallets; by 7 November around 2,300 BTC from those swaps had moved and 88 BTC had gone through a CoinJoin, while the main 18,270 BTC stash has not moved in bulk. The hosts noted the drain was still only around 5% of Binance's roughly $129.4B in customer assets, and wondered aloud why the attackers haven't pushed harder into bitcoin or privacy coins, landing on liquidity as the likeliest reason -- TRM Labs, CoinDesk, CoinDesk (19 wallets), BleepingComputer (FBI), Bitcoin.com News (Elliptic)
- A post-mortem from Binance traces the hack back five months, and no key was stolen in the classic sense: the attackers drove Binance's own wallet-signing system from the inside. In June, a wallet DevOps engineer looking for a popular AI coding tool installed a tampered copy of the Homebrew package manager found through a search result; Binance caught it, replaced the laptop and rotated credentials. In September a second engineer was approached by a fake recruiter on a legitimate job platform, and a second-round coding task carried malware that replaced the pyenv tool with a malicious copy. On 20 October the attackers used that machine, plus an internal AI tool, to take over two more engineers' machines, which gave them the wallet-signing service used in the 29 October drain. Both hosts flagged that fake recruiters and poisoned dev tools target anyone who writes code, not just exchange staff, and that any take-home coding task should be run in a disposable, keyless environment -- BleepingComputer, CoinDesk, Bitcoin Magazine, SafeDep
- Chainalysis, which builds the surveillance datasets exchanges and police forces use to screen Bitcoin addresses, had its own breach widen considerably. Having first disclosed on 30 October that an attacker using "offensive agentic techniques" had accessed user IDs, names, emails and organisation roles, it took its KYT and Address Screening products offline on 4 November after what it called "abnormal activity", then said that night that names, usernames, password hashes and live tokens for every Chainalysis user had been exposed. The products came back on 7 November and every user now has to reset their password and rotate their API keys; no attacker has been named, and Chainalysis says it has found no access to investigation content. For three days, exchanges that rely on its screening were running without it. Both hosts enjoyed the irony of the company that builds tracking datasets on Bitcoin users being unable to protect its own customers' data -- Chainalysis, The Rage
- Bull Bitcoin says it's the first exchange to make payjoin the default on deposits and withdrawals: every on-chain buy or sell made through BULL Wallet's built-in exchange is now a payjoin, built on the Payjoin Foundation's tools. In a payjoin both sides contribute coins to the transaction, which breaks the common-input-ownership heuristic chain analysis relies on to assume every input in a transaction belongs to one owner. It hides the transaction from outside observers, though not from Bull Bitcoin itself, which is still a party to it; a first buy into an empty wallet is a normal transaction, since there's nothing yet to contribute. Q wondered whether the exchange is running something close to per-customer wallets to make this work -- Bitcoin Magazine, Bull Bitcoin, Stacker News
- A rare bit of good news: FinCEN and the Federal Reserve have formally withdrawn their October 2020 proposal to cut the recordkeeping and Travel Rule threshold for cross-border transfers from $3,000 down to $250, a change that would also have written crypto explicitly into those rules. The $3,000 threshold stays, and the agencies say any similar future proposal would need a fresh comment period. Coin Center counts it as the latest in a run of withdrawals, following the unhosted-wallet proposal and the 2023 mixing proposal dropped earlier in October -- Coin Center, FinCEN, Federal Register, TFTC
- On-chain investigator ZachXBT flagged a roughly $133M theft from Crédit Mutuel Arkéa, a French bank, days before the bank said anything, spotting the flows on public blockchains. The bank confirmed it shortly after, saying attackers had compromised a service provider, used the bank's own accounts to wire money to other banks, then converted it into crypto through exchanges; some of the converted funds have since been frozen. The hosts noted this ran the opposite way to most crypto hacks: the theft itself happened entirely inside the banking system, with crypto used only as the exit, and they pointed out it's the transparency of a public chain that let an outsider size up the theft before the victim disclosed it -- The Record, The Block
- A 23-year-old crypto holder in France, targeted for the second time since 2022, fired a pistol at men trying to kidnap him at his father's home in the Vendée on 31 October. On 4 November he was sentenced to 30 months in prison and a 15-year weapons ban, because prosecutors argued the attackers were already fleeing when he fired; both hosts were furious that defending himself, after the state failed to stop a second attack on him, landed him in a cage. Separately, Russian police reported on 3 November the arrest of five men accused of picking a programmer as a target from photos of his luxury cars on social media, holding him in a garage for five hours in September and forcing him to send 10.4 BTC (around $800,000). The advice stands: don't flex your holdings online -- Bitcoin.com News, CoinTurk
RELEASES
Electrum 4.8.4 -- 2026-11-06
- Security update, the "15th Anniversary Edition". Malformed onion messages sent by anyone could make Electrum disconnect from its Lightning channel peer, so it now drops incoming onion messages entirely. It also refuses channel announcements where both node IDs are the same and fixes restoring pre-2.0 seeds, broken since 4.6.1.
- Adds BitBox02 Nova support over Bluetooth on iPhone and iPad with a pairing-code check, a built-in BTC Map, Zcash on Ledger, faster launch and a fix for BTC wallets stuck connecting.
- Point release fixing vulnerabilities reported by a number of sources, in dual funding and splicing (including signature checks on the peer's tx_signatures), onchaind HTLC resolution, gossip limits, connectd, runes, plugin hooks and hsmd, plus remote-crash fixes. The third Core Lightning security release in three weeks, so anyone running a CLN node should upgrade as soon as practical.
