4000 BITCOIN HACKED | THE BITCOIN BRIEF 89

0:00Biccoin is close to becoming worthless. Biccoin is gone! Now what's the Biccoin? Biccoin is like rap poison. Yeah! The greatest scam in history. Let's get it! Biccoin will go to fucking zero! Yeah! Yeah! Yeah! Welcome back to the Biccoin Brief. The show where me and Q&A catch up every two weeks to talk about Biccoin, privacy, open source, keeping your Biccoin secure and the news and software updates that matter. I just wanted to say a massive thank you to everyone

1:00who's been supporting Ungovernable Missfits and a big thank you to Foundation Devices for supporting the show. If you haven't already checked them out, go to foundation.xyz. They make cipherpunk tools for fuck quits and anyone can use this even me. If you have any questions or you want to reach out, feel free and I'll be happy to go through things with you. For anything super technical, I'll pass you on to Q. If you want to buy one of these incredible passports, use the code Ungovernable. It will get you a discount and it will let them know that I'm shilling. I'd also like to say a huge thank you to the K-QOLIT team. Not only are they supporting this show, but they're also bringing out some incredible features. For those of you who actually use Biccoin and actually care about their privacy and security, K-QOLIT make it incredibly simple for you to live outside of the traditional financial system.

2:01You can use K-QOLIT pay within the app to buy gift cards, for food, petrol, and whatever else you might need day to day. You can use silent payments, and of course, you can use Monero. You can connect both Biccoin and Monero nodes, use Coin Control, and this team are constantly innovating. And I'm really excited to be working with them. If you have any questions, you can reach out to me, but check them out at kakewollit.com, download the APK or start using this today on Mac, Windows, Linux, iPhone, or of course your Android device. Enjoy the show. Hello and welcome to the Biccoin Brief, a live and interactive show taking place every Monday at 9 a.m. Eastern and 2 p.m. UK time across the ungovernable network. Each week we go through the news, the releases, and the developments that actually matter in Biccoin.

3:01This of course includes self-custody, privacy, the tools that you run yourself and the people that are unfortunately trying to make all of that harder. If it affects your ability to hold and spend your own money without asking permission, then we want to talk about it. This show and the topics that we cover are powered by Freedom.Tech, a daily news desk that uses AI to monitor hundreds of sources so that we can continue to bring you the signal every single week. We'd love to have you help steer the conversation by commenting live, asking questions, boost in the show, or just sharing it with your friends. My name's Q&A and I'm head of customer experience at Foundation, and as always I'm joined by my friend Max, the head honcho of the ungovernable network. Without further ado, let's dive into the very first live Biccoin brief. Max, how the devil are you? Wow, what a change from a year and a half ago, we're never going to do a live show. It's almost all our shows in our lives.

4:01And here we are. The monthly going to the brief and the brief going to a weekly. It seems that it's good timing as well because there is never a dull moment in Biccoin and Freedom.Tech land at the moment. It is fucking. I keep saying, like, I just sit in the evening and once the kids are quiet for half of a second or say to my Mrs. Lay. Oh, there was another hack today. All those things. Oh, there was another hack today. All those things. And she's like, what the fuck is going on? All right. Good question. Tune in on Monday to find out. Yeah, indeed. We are ungovernable, or the ungovernable network is now the perfect way to start your weekend with FreedomTech Friday. Yes. And also to start your week with the Biccoin brief. We've got you covered now. We do. But yeah, it's what a week to pick to go for our first live show

5:05was a lot to talk about. For those of you that knew here, we obviously covered the kind of last week or seven days worth of Bitcoin news. We read out boosts from the ungovernable network and we also talk about the releases that actually matter. Before we do that, Max and I normally have a little bit of a natter, but I just just catch up and see if we've got any a OB. So Max, did you have a busy weekend? Did you have you had any kitchens fall on your head this weekend? No, it fitted a dishwasher. I hadn't had a dishwasher for a long time. So that was really nice. And that was it, mate, really. Just sort of like fixed stuff around the house with the help of children, which is extremely helpful when they want to help you. Trying to do plumbing and they're like throwing things in the way and all that kind of stuff was good. But yeah, it was nice, mate. What about you? Pretty restful one.

6:05Thankfully, did a bit of work on the website, as always. Yeah, yeah. Have grinding. We now have, so all of the cool clips that you produce in the background and post onto socials. We now have the options to publish those to the site so that we start to build up a little bit of a clip archive. But rather than just sitting there like, you know, YouTube shorts and just scrolling through 60 second clips of our shows, they're actually a lot more useful. You can obviously get a feel for what we're talking about. But then you'll see the transcript from the clip and you'll also see a link to take you straight to that episode so that you can view that episode, watch it, and also go straight to the time stamp of that clip because the clip might cut short. If it, you know, we're talking about a specific topic and we just give you a quick 60 second snippet and to entice you. If you want to click, click that link and then go straight in here, the full conversation, you now can and they've all got their own unique URL. It was on the website. So keep that up and go ungovernable.network. Did you get chance to look at these over the weekend, Matt? I haven't had a proper look through it.

7:07I saw the spec and what you'd built and, yeah, plants have a proper look through today. But just as a general nod, the site and functionality is epic. It's so fucking useless. Everything I wish I had eight, nine years ago, whenever it was, when I started trying to learn about Bitcoin, it's fucking brilliant. Good, good. Glad to hear it. Like I say, we're only just getting started. So ungovernable, keep your ideas coming forward. We've already had quite a few of you help shape some features on the website and love being able to respond to feedback like that. So keep it coming. The only other, um, that they'll be for me is we've been talking for the past couple of weeks about the KOS 1.4 beta. That is now public release available as of Friday last week. And it is literally our biggest release in company history and certainly in Passport Prime. The headline amongst many others is new user interface, new app icons,

8:07but most importantly app side loading. So you can now go and install any app you want, whether it, whether or not it's built by foundation or whether you built it yourself or whether you've got some core developer friends who like to build apps for Passport Prime and KOS. The world is literally your own stand out. All you need to do is install the relevant developer certificate. So let's say if Max was the one making the application, he would sign the application and give you know, he publishes developer certificate so that when Passport Prime installed that app, you can, or the device will verify that the installed app or the app being installed. Excuse me, is actually signed by Max so that you know it's, you know, you're not installing something from somebody else. So yeah, the, the, the, the floodgates are open now. I've been installing every single app possible just to see the limits and stuff like that. There's lots of proof of concepts on the foundation website. If you just go to app dash showcase, you'll be able to see all of the ones I've been vibe coding and there's loads of the party contributors that have already been building even before this side loading became a true reality as of Friday.

9:18So super, super happy to see this live and I think we're going to see a bit of a kind of app Renaissance and you're really going to be able to customize KOS to suit whatever you want. You know that that ranges from everything from a Bitcoin only signer where you've just got one, two, three or four apps, the basic ones and you just use it with sparrow cool go for it. Or you can have 50 apps for all of your different personal security needs like the world is literally your oyster use the device you want based on your threat models and your. What you need out of the device basically so very, very exciting and will be providing lots more updates as the week go by i'm going to be short selecting some of the cool apps that I see people building and will do little showcases on across the young government washers as well. Yeah that's awesome is there going to be like a central point that they can find these apps like a you know like we had dojo bay on Friday where people can like go on and have a look and see what they want to connect to fire nims etc like is there going to be a similar kind of almost app store or like you know like a.

10:31Rating system of the people who build the apps or some way that people who aren't as sort of plugged in to the groups is maybe your i would be. And no roughly you should trust on not you do i mean like you know you build an app or go yeah you build an app or go yeah yeah there's others i'd like maybe not. I'll answer that in two two phases what's ready now and what the end state looks like so what's ready now app it apps are side loading only so you have to go out and find the app that you want to install and there are no. Additional foundation signed apps yet so it's a case of if you build your own sign your own app and install on your own device or you know somebody who's building apps and you do the same but with the applications that they're building it's true side loading it's just like an APK on Android basically where it's up to you what you and saw what you've got to go and find it yeah now obviously that's great it gives you this freedom but it's also we're not kind of best serving more.

11:38Newcomers that need that kind of app discovery or that app store experience so yeah end state there will be more of a white listed kind of foundation app store that will be slower moving for two reasons number one we plan to add our own apps in there as well which obviously takes developer hours to do that properly. And number two is that if we move to feature third party applications which we do plan to do so we obviously need to. To vet those because if you know if we're given those they can a white list treatment we want to be confident that if they're in our app store that we know that they are not doing anything nefarious. Now with all of that said key OS is built such that even if you do install in a fairies application it only has access to the specific things that you give it access to anyway right so you you have very granular permissions on what every app can do as you install and you can change them at any time in the future but.

12:39If we're going to put our name to it and say hey look here is a cake wallet app that you can download directly from our app store so that you can secure your money or offline then we obviously want to check that code right so obviously that's the end state and that's how we would like things to be because it is much easier and it would allows us to kind of. Cure 8 the user experience and highlight specific applications that we know and we're confident in but obviously that's going to take a little bit more time and then the third part of it I guess is there's absolutely nothing stopping somebody spinning up something like an froid but for. Yeah possible primaps where they do their own curation they have their own kind of signing schemes and stuff like it's completely open and if somebody wants to build that or vibe code that. It'd be pretty easy to do so really and then people could submit their own to you know I don't know prime droid or whatever they want to call it and have like a third party. App store that offers the same sort of or a similar user experience but it just hasn't gone through the curation that we would do if we were to put our name to it a foundation.

13:47Yeah but we could just be called to see wouldn't it like a bit of a. Most downloaded or highest rated or yeah absolutely. Trouble you know somewhat trusted developers and and all that kind of stuff so yeah we could see how that builds out. I also still want what what a cake doing with this development of this app because I really would like one I'd like an offline banero device and I know this cupcake and all of that but it should be really useful. Yeah I mean I can't share too much details other than they have a developer working on it I don't want to give any time to girls I mean obviously it's it's not available yet and it's slower than we would like but obviously the cake team have their own priorities as well so yeah yeah. They are working on it is also can kind of share basically. Okay alright they've got I think they've got eight new workers have just joined KK. Gold boxes yeah they never ask for a toilet break is all that no yeah and they were 24 seven for free yeah just feeding with some power and some electricity and away they go.

14:59Well mate it's less diving to the news it's been one hell of a whirlwind week yet again yeah. So the headline news article for the week and you'll see that scrolling across the bottom roughly 4000 yes you heard that right 4000 Bitcoin was withdrawn from the liquid network after a software bug allowed LBTC that shouldn't exist to be accepted as valid. The initial reporting valid the withdrawal at somewhere like 320 million dollars and I must stress before I go into the details here this is still unfolding as we speak it hit Twitter last night. So it's little under 12 hours old and it's still unfolding so there may be some. And items that come out of this or some truths that come out of this after we record so bear in mind when we're recording this or when we are live that I'm dealing with what I have in front of me but anyway.

16:02So the attacker exploited the liquid validation software that redeems the resulting liquid Bitcoin for real Bitcoin that was previously held in the liquid federation reserves. And to be clear this 4000 BTC is pretty much everything on liquid. I think there was somehow like 150 or 200 Bitcoin left so it's like the entire network with Bitcoin essentially. So how quick recap on how liquid works because it's not something that we talk about often on on the brief but liquid is a separate network that's kind of connected to Bitcoin. Some people call it a side chain uses deposit Bitcoin into it's kind of backing arrangement and they receive liquid Bitcoin or LBTC which they can then move around on the liquid network that's faster cheaper and more private thanks to or can be more private thanks to confidential transactions. You can kind of think of LBTC as like an IOU or a claim ticket each of those IOUs or tickets is supposed to represent one bit called the equivalent I'm at Bitcoin held by a group of organizations called the liquid federation and I believe there's 15 people or sorry 15 companies organizations that that take part in that.

17:21And so you can hold LBTC in your own liquid wallet using your own keys and the Bitcoin back in it remains under the federation's control until it doesn't unfortunately as we've seen in the last 24 hours. To withdraw your your LBTC you can have go through a redemption process where those coins are removed from circulation on the liquid network and then the the core of the federation I believe again it's 11 out of the 15. Pays that Bitcoin from their reserves back to your actual on-chain Bitcoin address that process is called a peg out. So basically an LBTC liquid Bitcoin holder depends on the federation to keep the equivalent reserve secure whilst they have the liquid IOU and obviously they rely on the federation to keep the software secure and make sure that all of the accounting is accurate so that you know you don't have a run on the bank so to speak.

18:22So moving forward the liquid network has a pretty cool privacy feature called confidential transactions quite analogous to to Monero which hides transaction amounts. The the network still needs to check that users aren't artificially creating money when they transact and it does that through what you call like mathematical proofs which let let it verify certain properties of the amounts without seeing the amount itself. Kale had a pretty cool explanation on this which is useful here because it separates two checks. First off when you send a liquid transaction the transaction needs to balance the amount going in must match the amount going out apart from fees. And the second one is each hidden amount must fall within a permitted range and so you might be thinking why the hell does that matter. Well imagine I put one coin into a transaction and I created two outputs.

19:26One worth 100 coins and one worth minus 99 coins. The the math balances 100 minus 99 is one but that would give me 100 coin output to spend. Balance against a negative amount that should never have been allowed and these range proofs that they have built into the system are supposed to help prevent that. Those numbers are obviously just illustrative of just why the checks are necessary but it does lead me into what went wrong. So friend of the show Orange Surf as always is on the ball with this sort of stuff you can see I've got is one of his many tweets on the sort of screen. Yeah, according to his analysis the problem was in a short cut designed to save processing time. Checking these range proofs that I just spoke about takes work it's computationally intensive. Once the software and the this is the element software here by the way that that kind of powers the liquid network.

20:31Once that's successfully checked one it remembers the results so it can avoid repeating the same calculation makes sense. That memory is what the system calls a cache which you'll hear used quite often in anything to do a computing. To look up a result in that cache the software needs a label identifying what it checked. The label has to include all of the details that could affect whether or not the proof is valid. So another analogy would be imagine a ticket inspect the check and a ticket and recording its barcode. The next time that they see that barcode the inspect the waves it through. But that becomes a problem if the inspector record leaves out which event the ticket belong to and approval for one event could be reused on another. And so what Orange Surf said in his analysis basically is that liquids cache identified and checked the proof using the proof itself and a mathematical representation of the amount.

21:33It emitted any other relevant information including the asset type and the conditions control and how the output could be spent. So that allowed the software to reuse a successful result in a situation where a fresh check would ordinarily fail. So the cache operates on an output and its proof and the mistake was in how the software identified whether or not something had already been checked. So I appreciate that all this is pretty complex but like it's worth double clicking on this because once you understand how it works you can kind of then look at how the attacker and welcome onto who the attackers are later. How they turn that into Bitcoin. So the the reported mechanism starts with a valid proof that I've just been talking about being checked and its successful result stored in memory in the cache. I carefully constructed invalid output then matches the incomplete description of that cache. The software finds the earlier check that it did and is like yeah that's fine go ahead.

22:35So that's the reported route by which the invalid liquid bitcoin passed the validation of the element software and became spendable. Obviously we're waiting for a complete and full technical post-mortem on all of this and I'm just going off other people's research here that are far cleverer than me because we do still need to establish the full kind of construction and sequence. Side swap has also given a direct account of the withdrawal and it said basically that a customer submitted a 4000 liquid bitcoin to its pegout service which is like to basically saying here's some liquid. Give me some real Bitcoin. Yeah, they're not just some all. If we all start the entire network yet and I'm not having a side swap saying. I'm pegging all users. Yeah side swap says those coins are being created through a Borgian elements and the software which is as I said the software that kind of powers liquid. It's service accepted them as ordinary liquid bitcoin. They were removed from circulation through the withdrawal process and the federation paid approximately 3,996 bitcoin to the customers.

23:43Well, I say customer the attackers bit coin address. So basically if we flick back to that ticket analogy bogus tickets have been accepted in exchange for real money from the till. Oh boy. What else have we got here because we've got some lengthy notes on this. So some people might think well why didn't multiple signing keys prevent this because as I mentioned we have 11 of 15. Signatories in the federation well as I said earlier liquid reserves they're protected by these multiple keys. Side swap says it's authorization key wasn't compromised. The withdrawal had valid authorization because it went through the normal service. The failure happened earlier when the network accepted the liquid bitcoin that should never have existed. The signers across the federation relied on the software's view of the liquid chain and once that software treated the coins the liquid coins as valid the withdrawal could proceed.

24:46Several organizations running the same faulty validation code can reach the same incorrect the conclusion. The number of signing keys doesn't resolve that because it's a shared software failure essentially. So the attacker therefore didn't even need to steal any of the federation keys to get the bitcoin paid out. Which I think is is one of the headlines here is like on the surface of it an 11 of 15. Multicig to to peg out some bitcoin sounds super secure like how are you going to compromise 11. Geographically distributed companies right it's what they didn't even need to. Yeah. Moving on or in surf again he's pointed to a fix that had a commit date in August. Sorry August the third and I pull request with that kind of fix open on September the 1st. So basically what we said what I think he's saying here is that they knew about the problem but they didn't fix it fast enough.

25:49And somebody else found the problem and exploited it immediately. But the problem is the fix that where this public pull request is open is public. So somebody has clearly seen the fix that hasn't been merged into the software and distributed and thought ah that's that bug that they are looking to fix is still live on the network I'm going to go and and exploit it again all of this is moving target here so there's still a lot to uncover but um what else have we got um I think that's it basically um this should be complete a complete mess um there has been no blocks you know they they obviously because it's a centralized service they've stopped all the blocks they haven't been any blocks for like 24 hours now. If you want to transact on liquid you can't um so hopefully you didn't have much funds or any funds on liquid. I'll have been here. I reckon I had someone liquid so really yeah I've been

26:51being interested to see like what what experience you have when you load the wallet. Yeah well I could I'm pretty sure I had a little bit because uh I had to swap I had to swap into liquid to use a service a while back and then I couldn't I couldn't use liquid on that service anymore and then I couldn't swap out from liquid to lightning on the wallet that I was using because bolts went down and I was I thought I'm pretty sure I was just like well what the fuck do I do with this now and just sort of was like I can't swap it. I can't use it I can't do a swap fuck it I'll just I'll come back to this later so that probably is gone it wasn't it wasn't a lot like I'm not gonna cry about it's probably like a meal out or something but like yeah yeah I mean at least at least litigation as always yeah but fuck I mean like I don't know who but I assume some people would have kept a lot on there

27:55and yeah it will have affected so I'm not sort of joking around and fucking around about something like this because it's another one where I don't think anyone that we really spend time with probably is keeping all their uh turtler amount of coins or vast amounts of coins are on liquid they might use it for a swap pair or for something or part of a rootgoalberg machine of privacy on Bitcoin but um it's fucking I mean 4000 Bitcoin is so much Bitcoin and it's like oh yeah it's just this weird sense then we keep talking about it every week but it's like now that people have these clankers and they're becoming so fucking good at this kind of stuff and they work 24 hours a day like we said and they don't have toilet breaks you cannot you cannot have a company that has 4000 Bitcoin plus of users Bitcoin and then find an issue with it and go yeah yeah we do that later

28:59mate like you can't I mean like the the only thing I can think is maybe whoever's found the bug internally has not understood fully the the potential ramifications and that it could allow for a complete and utter drain of the entire network essentially that's I am not saying that I can think of no I'm what I'm saying is I imagine not because that would be mental but I wouldn't put anything past anyone at this stage but like I imagine not but still if you're a company of that size you know you would think that you have a decent amount of compute that you can throw at securing everything that you have all the time and if you have any bug it should automatically in this weird day and age that we're in now that we weren't in six months ago if you're holding funds and you're doing anything on Bitcoin or any other chain

30:04I don't think you can afford at this point not to have your own team of AI bots just working around the clock and yeah people then controlling those bots around the clock and that they are constantly reviewing all code and everything all the time cross checking each other and like it's war it's fucking like it's so above my like understanding the actual code side and how people are actually doing this but all I know is if you leave anything someone else has the compute and they have a massive incentive to throw their compute at all these Bitcoin businesses they're they're going to be the targets before anything else because you know what else you know it's like oh you don't need to worry about Bitcoin you need to worry about nuclear launch codes no I don't because most people don't want to fucking fine nukes what they want is 4,000 Bitcoin that's what they want so people are going to attack that first and we're seeing it

31:09yeah absolutely cosine and I think the only other thing like I agree with everything you just said but it's especially true somebody as well funded as blockchain arguably the most well-funded company in Bitcoin right and a couple of the details that I missed out they're very interesting as part of this something now has a good timeline which I've got up on screen now and basically the attacker when they did the withdrawal or the peg out for the almost 4,000 Bitcoin they put an op return in the transaction basically supposed an message to say we are white hats contact us on chain which is interesting and then blockchain responded about an hour later with another transaction in another op return I love that like speaking to each other through the chain yeah basically said please contact security at blockstream.com what's your name and yeah another six hours later blockstream then sent an encrypted message via

32:13op return to the hackers pgpkey and obviously it was encrypted so we don't know what they said and then an hour later after that the hackers the hackers matters they're sending most back to and then a Bitcoin address is that okay and then no response from blockstream and then an hour later the hackers again said the bug first the chain is under risk at latest commit right now make sure every node is patched then we will transfer the money back safely after confirming the fix and then three minutes later blockstream said yes thank you although I think that final message from blockstream is to the earlier message saying you know is it okay if I send them back to this address not to fix your shit essentially and then the status as I've right now the the 4,000 Bitcoin still hasn't moved so I presume they're basically waiting for blockstream to merge in for all of

33:16the federation nodes to to be fixed and I'm going to call this one and say I find it highly unlikely of that Bitcoin gets returned really yeah I think it's someone why would the why would the attack are even enter negotiations for a laugh really like you to come away with like 300 million pound or dollars and and you think they're they're not running for the hills don't don't underestimate the value of a good laugh and I think that you'll see it and you know like it's a Zack XBT who does all of this incredible work to find these scammers who will call up innocent people and get them to part with their Bitcoin and these these kids are making we've talked about that on the show before but millions tens of millions hundreds of millions they're they're fucking

34:19retarded they'll they'll go and get like 10 million a hundred million dollars worth of Bitcoin and rather than shutting the fuck up and going and living a really blessed life they flex about it they'll call the people that they've scammed and rub it in their face they'll they'll go on to other chat rooms and laugh about what they're doing and give little clues and like oh here's a picture of my arm just got very fucking specific tattoo and their idiots so you can be good at stealing money and be a fucking idiot and my guess is that these people are really good at stealing money they're just still 4,000 Bitcoin but they're also fucking idiots and for the sake of a laugh they're doing all this I can't believe this that's so much money how how tempting when no one currently knows who

35:19you are and you've got all that money you can you can live you can live however you want for the rest of your life and so can your family and everyone you love and everyone you care about for the rest of your life and then your children and their children and their children can all live a really fucking great life as well why would you go you know what I'll give it back to block stream because they're a bit skin so we've got to make sure that we don't fuck block stream over and yeah let me give it back and just go back to my fucking office cubicle I don't see it mate I don't think it's going to happen I'm going to take the opposite side of that back and I didn't really think they're going to come back because I again well if assuming that they do give the money back to block stream block stream well let's be clear it's not all block stream funds is it people have deposited into the liquid network but block stream are well funded I mean and if it was me I'd be like okay do I want to spend the rest of my life looking over my shoulder or do I take a little gamble to be like hey you can have all this back you send me 10 and I'll you know as a thank you

36:25for for being responsible 10 bit coins going to change life yeah and then you don't have to look over your shoulder um ultimately we don't know I'm sure there'll be a lot more details uh out as of by time we were called next week do you have the thing I want to say on this look on screen now I'm just looking at the hackers address and everybody I say everybody does a lot of people dust in the address and posting messages into what return it says hacker is not a white hat this is an inside job the next one says france's pulio knew about the funrability the next one says this is an inside job to cover up block stream another one says white hats 50k for fireworks they say out they say out white hats in front of capital hill tonight and protest there's just loads of messages being sent through without return that's quite funny I think you're on mute max uh well it'd be interesting to see who wins this bear I'm not going to put any actual money on it

37:29because I keep losing money I keep I keep having little mini hacks of my own which I won't go into too much but but this this block stream one was one of them and keep I just keep getting fucked at the moment so um damn many sats but let's see who wins I hope it gets returned because I'm sure that there are good people who have got money on there and um we'll desperately need it back and I think the whole bitcoin scene has had enough pain in the last few weeks as it stands and the final thing I was going to say is as you were laying out your case my probability of me being right did go lower slightly because it reminded me of was it mahu'd or something like that there was a there was a young guy who on lightning maybe four or five years ago did he did he exp- what did he do did he i think he like attacks the network and shut shut a lot

38:32of the network down and um do you do you remember what i'm talking about i had no idea what you're talking about it was like four or five years ago maybe quite a young guy mahu'd or oh fuck what was his name anyway he he found a way to like attack lightning and I don't think he stole funds but I think he like shut it down and oh your act that oh maybe it's that was it be you are a k or something yeah but rock yeah it was him yeah and just reminding me of that because I remember people getting all up in arms about him doing what he did but then it got people talking and it it sort of like delivered a message differently to just like oh by the way fix your shit so it could be that there's value for this hacker in a like you said not looking over your shoulder because you don't know what's going to happen to you if you fucking still fall

39:33that as a bit coin like someone could really be quite upset with you um and uh and also maybe you want a bit of exposure and be like hey like look at me give me some sats and look at me so I would say my confidence in my initial assessment is lower after you said it but I still think I'm right well on government balls let us know in this comments what you think what would you do all right we need to rattle through now to keep the time yes next on the list we have a report from from TFTC there's seven million dollars reportedly missing from a Chilean exchange Orion X after they halted withdrawals due to the outputs of a forensic audit found roughly seven million dollars in customer cryptocurrency had been moved to external wallets between 2018 and 2021 a criminal complaint a use is founding partners of of using customer funds for unauthorized speculative

40:33trading a tale as all the time the report puts a number of affected users at around 100,000 so is Chile's financial regulator confirmed that the exchange operated without a license the accusations still need to obviously go through all the legal process customers are already dealing with the effect of the you know the immediate consequence the obviously cannot withdraw their money and they're not they're going to get anything back is still completely uncertain obviously this is another reminder you're weekly reminder to get your funds off an exchange and take them into self custody get your funds it gets a little bit more complicated now than it used to be get your funds off exchange get them on chain don't probably use lightning because you might get hacked I would not use liquid it's probably not safe so don't use a side chain don't use a second layer bring them into self custody but make sure that your entry is good and think very very carefully about who you trust as your hardware provider consider multi-sig but if you are using must it's just like

41:39it's not a very simple thing to say anymore I'm afraid my my thing I'm going to say I think going forward is have self custody don't have all your eggs in one basket tune in every week ask the questions and and just don't trust any kind yes or simply advise of a reputable professional if you're not confident doing it yourself yeah and never under any circumstances share your seed words with anybody that's a good one yeah never do that and don't go so balls deep in on Bitcoin or crypto that it could ruin your life because yes you might be thinking to the upside it could change my life but we are seeing that it can really fucking change your life the other way so just have some food in the freezer like own some shit like be able to like look after your family please go sign that all right circling back on something we started to talk about last week or the week before coin desk is reporting that better Bitcoin backed mortgage product with Coinbase oh yeah

42:47yeah it allows better the company better to reuse Bitcoin borrowers pledge as collateral shock horror re-hypothication who could have seen this coming not me um collateral is an asset a lender can claim if you fail to be prepared alone and re-hypothication takes that a step further the lender can use your pledge asset in additional finance agreements for more risk this which obviously creates another layer and I could potentially affect your ability to recover the Bitcoin in the event that something goes wrong and you don't keep up with your mortgage payments or whatever basically they're lending your Bitcoin out for all the purposes that may or may not be a worth of investment investment essentially yeah yeah so as we as we said first time around like tread very very carefully with the shit like this

43:49okay quick update on the clarity act for us enjoyers although I don't think there'll be many on today because it's Labor Day they're probably lost in bed um the US House has cancelled its final two weeks of September voting sessions leaving a narrow window before the mid to recess meanwhile the clarity act procedural vote is scheduled for 15th September are you weak tomorrow this is about on whether the legislation can move forward with 60 votes needed to overcome the procedural hurdle it doesn't by itself make the bill law quick reminder that the legislation aims to clarify how digital assets and Bitcoin are regulated including the division of responsibility between the SEC the CFTC and all the three letter or seven letter agencies over there as well um the the downstream of this because ordinarily this isn't something that we were traditionally covered but like this could have big ramifications as to how the whole industry is regulated and how

44:54you know that can have downstream effects on the tools that we use day-to-day basically so it is something I'm keeping a quiet eye on but as we say each and every week it's been pushed back yet again all right next on the list another quick recap um unfortunately this time on the the Treza leak Bitcoin magazine have reported that Treza's shipping partnership monk they retain customer records that shouldn't have been they should have been deleted allegedly exposing an additional 67,000 US customers so combined with the earlier disclosure of roughly I think it was like 13 or 14,000 that brings a total to around 80,000 people the exposed information includes a mix of names postloaddresses phone numbers and email addresses not great um I wish we had more positive stuff to talk about Treza has come out saying you know its devices remain secure this is more of a

45:56of a leak in the third party customer sorry shipping service having not handled their ship correctly um so again like we said last when we first talked about this um it's difficult I feel for Treza a little bit because like if you ship physical products you have to have a relationship with somebody who handles shipping information and as soon as you give that information away it's outside of your control and you can have the most secure procedures possible but if they don't then your is leaking anyway so well you like I said as well you can't really have your own in-house logistics it's just it's not something that you can do um so you kind of have to be in the hands of other people I think there needs to be a push though um we've always said it but I think any sort of push is like just do not get this stuff sent to your personal address just don't do it like I just don't send it to a company a PO box a friend who's in a military base like we said before

47:03just somewhere where someone can't come and knock on your door because having your funds swept because of some Canadian cunt is one thing um but having it um having having people turn up at your door where your family sleep that is a totally different kettle of fish it's it's real it's fucking scary we see it in France and all over the world and you know this is this is why this is so scary phone numbers okay you can change it it's it's a pain in the ass you can change it email okay you can change it moving house that's a little bit harder and um this is a real fucking problem and so yeah I'm not here to slag treasurer off but I think any listener who's thinking about ordering any hardware and if you do obviously it should be foundation obviously you should use the code uncomfortable but if you do do not get it sent to your house please yeah and on that a lot of these manufacturers foundation included now have the option to either send to a PO box or to send to things like UPS access points as well and we added that in the last

48:07week or so for a few us residents and we're working on adding that globally as soon as possible so always long for that sort of option first add one thing when you do go to these boxes what do you call them not community boxes access points that's what you get calls and anyway UPS um do you have to sign for it is to one of those like at like a corner shop or whatever um I do know what I don't know because I was a US only I've not a chance to to try it but I believe um you just have I think it might be a cure good you get on your phone and it's like a lockable boxes or something like that probably yeah well I don't even know if it's that I think um the short the top and bottom of it I'm pretty sure you can use somebody else's you know not your real name okay fine so don't use your real name and when you do go there be COVID safe make sure you're masked up um yeah spreading those Jeremy germs when you go and collect because CCTV is everywhere and these flock cameras and all the other bullshit so um top tips yes sir right next on the list um another

49:13breach unfortunately pocket bitcoin uh has said that it a breach of its support system exposed compliance record for 200 and 91 customers connecting identity information and documents to bitcoin addresses a separate group of 5,120 customers had bank transfer details exposed including names iban and payment amounts no private keys were compromised crucially um obviously the the address linkages especially significant because of bitcoin transaction history being completely public um an address obviously on its own doesn't necessarily identify a person but this one literally does leak customer record can supply that missing connection um yeah not great um I don't actually know where pocket bitcoin I think they're just solely in the EU um but yeah my my heart goes out for those 291 customers um and again heart back to interact with bitcoin with his little

50:17information um as you possibly can that includes buying bitcoin or buying bitcoin related hardware as well isn't it crazy to find a point on all this kind of kind of negative stuff but isn't it crazy that the safest way to possibly use bitcoin is the way that causes you the most trouble and buying peer-to-peer and holding your own funds and jumping through hoops not to link it's your identity or other addresses and managing UTXOs and blah blah blah blah blah and all the stuff that we do and try to do is the safest thing for you and your family yet you can't then use that bitcoin in normally world because you can't prove its provenance and because you can't prove its provenance you can't use it so by using it safely you outcast yourself from the rest of the financial system and that is that is the cost of KYC that is the cost of all of these

51:21stupid cunts making these stupid decisions for your safety they are putting people at risk these bits of information are leaked because they have to be collected and it's it's fucking disgusting it's literally killing people like that's not a um over stretch or me being bombastic that is these regulations and these people who don't even know how bitcoin works so anything about it making these decisions for your safety are literally putting your life at risk yeah certainly is cosine at no KYC only if you can if you can if you can indeed um all right back to the call card attack um TFTC reporting at the attacker associated with the wave 3 exploit um has moved roughly 20 and a half bitcoin into Ethereum through 34 all chain transactions on september the second and third what the fuck are they doing

52:24that's a little over 1% of the reported 1789 bitcoin that were stolen total most of the funds remain untouched after the reporting cutoff um for those of you that don't know author chain kind of let users exchange assets across different blockchains um you know in practical terms somebody that can send bitcoin into the swap and receive an asset on the other side like Ethereum or whatever for the investigators obviously that adds another kind of systems to follow and can make tracing a little bit more complicated although it's not foolproof it does obviously doesn't you know automatically erase the connection um or the amount you know you can have timing analysis um amount analysis and stuff like that and swap protocols you know may also keep records as well but i just thought that was an interesting little bit that some of it's gone over to Ethereum odd odd move yeah indeed right last this last one yeah last one on the news um tether getting sued

53:26over a 42.4 million dollar freeze two tie businessmen are suing tether over free the freezing of 42.4 million dollars in usdt across 10 Ethereum addresses uh according to coin desk reporting on this lawsuit the plaintiffs alleged that tether acted on an informal request from home land security investigations more than three months before a seizure warrant was issued they also say that the acquired took they acquired the tokens to legitimate secondary market transactions uh and their allegations include the timing and the legal basis of the freeze remaining uh you know obviously this remains for the court to uh to imagine sorry to examine should i say um the technical point here that i wanted to kind of double click on is that tether basically just blacklisted and address and froze the account on a verbal from the home land from home land security so um just another highlight

54:32that it's a centralized tool and your balance can be taken away from you instantaneously through uh a phone call essentially so once again i mentioned the term risk mitigation if you do want to use stablecoins um all of the ones that i know about are centralized um and can be to switched off quite literally at will as we've just seen here 42.4 million dollars yeah well okay that brings us to the end of the news we should probably do some boosts now my friend um now two things number one we've got loads of boosts so thank you all so much for the thing i think now that we're live and that we're getting so many boost which is a very very good problem to have we appreciate each and every one of you even if you just send ones that like the message is very important to us but we're at the point now where sitting and reading them all

55:35is probably gonna bore everybody to tears so my suggestion to you Mac is that after this week we'll read them all this week because we haven't notified everybody yeah uh as of next week we'll pick like the top five or six uh to be read for each week well i think so yeah i think so because you know we're trying to keep these to an hour we're already at 55 minutes um we are getting more boosts and we're very grateful for that we do now have a place that they will uh be there for eternity on the website um so everyone can still read through we can still see them it's just um with the amount of boost i think it'll end up being a 15 minute section that we then miss out on the other bits but yeah thank you to everyone and will we're gonna read them all today anyway yeah there's the the wall of fame or say wall of fame this is in chronological order but yeah before we get into into the the boost from the last show i do have two apologies to make because i missed some on pre the shows prior to that so i'm gonna start with those um first ones from

56:36anonymous you said 25.92 dollar 25 26 dollars let me round it up um worth of xmr and they boosted bit cumbri 87 and they said wild and fast developing times that we're living in and it will accelerate yep we've seen that already um so i think you're feeling right about a weekly show is needed well no play we are no preference about a live show or not because i normally work at the time and can't tune in anyways that's no problem as you say we record it um you can catch up afterwards but thank you for your support and the other one comes from friend of the show xp patriotic who said 64 dollars thank you sir in xmr and he said please make the bitcoin brief weekly the best show and bitcoins based by a league especially the robot max is a cunex Tuesday though by the way what shells weigh hundreds of kilos holy shite mate unreal what shells i promise you because they were like solid hardwood um and then backing was all like swollen and everything it was

57:37and it was all one run like a all screwed in together so this mate you wouldn't have survived it and let me just tell you that all right onto the top boosters for for the last show top of the shop eight misrandeer sent 50 dollars in xmr by the way bitcoin boosters what you do in the the manero boys are out shining you want a bitcoins you're way you're gonna let that happen that has that has always been the case like not even not even close they are big big boosters well we appreciate you nonetheless um yeah eight misrandeer 50 dollars in xmr weekly is the way how much xmr do i have to boost to get you guys to read xmr boost on every show i promise i use the show tags to make it easy for your clankers well ape mission accomplished your top of the shop and we truly appreciate that that's a lot of a lot of dogs so thank you mate we do yeah thank you very much ape i think ape just this year has paid for our hosting and the bits and pieces that

58:41we need to record etc so um yeah thank you mate we really really appreciate it uh Jordan go on should we do what one and one and one yes yeah all right so Jordan sent 6172 sats and he said i don't really like the dollar amounts if i'm honest with you i like i like sats and p-codes i can uh well we've got all of the above so you can just read the sats and outs okay all right um and Jordan said it's 4.32am and q has me doing node testing the things i do for him haha team work makes the dream work thank you mate appreciate your help as always um late stays hovel 6,06 sats please go back to the ad reads that say x y z i love those also yes your listeners do need a weekly discussion between my two favorite english gentlemen however seven

59:41chainsaws is entirely too many chainsaws also i boosted on the website last week asking for custom boost amount in sats unless i just missed it last week then i see it now good work you updating that as well can you also make the message box more than one single line see i love this this is like a proper fee but yeah absolutely i think i might have already done that um if i haven't i will i'm pretty sure it if i if i just keep typing it i'm pretty sure it wraps no it doesn't okay yeah i'll fix that thank you for your support and your your feedback look at this this is so good uh your btc story sent 5,000 sats was nicely surprised to hear my seat sign am oh my btc story huh that's future yeah i was going to say uh was nicely surprised to hear my seat sign and mini script for convention on the last episode of Uncoverable thanks q for the shout out i appreciate it mate i've been tweaked i've been tweaking my clanker away to get

1:00:44that that sounded okay mate listen what you doing private is uh is between you and your clanker i've been tweaking my clanker away to get the PR one step closer to the finish line you can just build things no permission ask what a time to be alive they've got his hands up at the end like they're up nice uh chad pharoah 3,383 sats thank for shouting out my podcast gents it's simply called chad and reeds podcast i teamed up with reed from local bitcoins podcast to see what kind of cool shit we can build well keep up the good work mate i know you do a lot for podcast thing uh is he's the god of podcasting i still haven't tuned in i keep thinking about it and i'm like ah next time i'm driving next time i'm doing something i'm going to have a listen so i will do it i will have a listen and give some uh thoughts on it but yeah excited that he's got one that's very cool anonymous uh see this the dyslexia getting me where's the sats that

1:01:50two thousand five hundred and fifty three sats thank you mate uh that's two fucking funny that you guys were recording during my last boost i really appreciate that the ungovernable crew puts in or what the ungovernable crew puts in and the new website has been a huge level up keep up the great work jensenman this must be nasty gang the nature forgot to put their naming because you remember yeah yeah yeah yeah pop dog beautiful timing yeah that was amazing all right thank you mate right i'm just going to quickly rattle through all of the rest of them because there's so many um read btc two thousand one hundred and forty three sats listen to ungovernable if you're not already we want to the most valuable additions to your podcast feed i absolutely agree you've got great great taste well there is two thousand two hundred and twenty two sats anonymous two thousand one hundred sats banana man one thousand two hundred eighty nine sats and i said weekly show will be great in my opinion don't do it live well sorry about that free tech Friday is great but a more polish show is nice too okay uh i n pc one thousand one hundred and

1:02:55eleven sats yabba daba do etc appreciate the lack of macro phony cheese you are welcome linking part rules one thousand and twenty two sats i wish the descriptions i'm found it didn't look so weird when they are compressed yeah me too user two five four nine eight one oh four one thousand sats um they said yes luke jim johm does something you guys said two episodes ago from a boost and you guys didn't know who or in what reference it was to stay ungovernable my guess is that's not the gang as well yeah uh rivians rivian i was that one wrong stokes all of riven stokes five hundred sats let's fucking go arrow stay ungovernable forgot my name on the last boost a lot what you've just been read out as anonymous thank you for your support Code 27, 500 sets, rev huddle, 431 sets. They said, very cool that HRF is recognizing NOS that as a worthwhile avenue for freedom. NOS that is the killer Bitcoin app, NOS the keys are Bitcoin keys after all,

1:03:55hashtag 40 hours per week. On that, can any primal users that are also ungovernable tell me if primal has been hot garbage for you in the last week or so? It just doesn't loan anything for me these days. What has changed? I've never had anything but a subpar experience on any fucking NOS tool thing. Local Bitcoiners, 420 sets, local Bitcoiners, listen to the breeze to keep up with all the updates as velocity continues to increase. You can say that again. Shadrack, 323 sets. I may be boosted on XMR pod, but doing it again here for the social capital. Hashtag 40 hours per week. Anonymous 210 sets. Testing as the text didn't add to the last boost. Oh, that was from Cruz, thank you sir. Sylas 4121 sets. Loving the weekly show gentlemen. Cheers to you both and the ungovernable crew. Always ungovernable, stay free.

1:04:56NOS the gang, 101 sets. Jim Jones is literally where the term drinking the cool aid is derived from. It was laced with satinite and almost 1,000 people died. Oh, thank you. See, I love talking to the young governor and all through the boost. This is amazing. We learned so much. We do. And then the last one user, 19129, 31825, 100 sets. And it just gave us a thumbs up and a salute. Thank you all very, very much. It's so good to see all the love. But again, as of next week, we're just going to have to read out the top five or six because otherwise these shows will be never ending. Keep on coming. We love all of you back. Truly appreciate all of it. Okay, right. We're nearly done. We are going to talk about some releases. KOS, version 1 before, I've already talked about at the top of the show. Oh, by the way, when this comes out on the podcast feed, the release notes or, well, the show notes are incredibly long.

1:06:00There's some loading useful shit in there. Why don't you just highlight notes up? You don't put any show notes up. Yeah, somebody called me out on Noster for that. And then I sent them a screen recording saying, have you seen all of this? Like did you want to try and click around? Anyway, as I was saying, the show notes are very, very in depth. There's loads of releases in there. And again, if we talked about all of them, we'll be here until Friday. So I just pick out the highlights, but like this isn't everything that didn't list. So KOS 1.4, I've talked about that at the top of the show. Next one, Cakewallet 6.4.4, I've added native Treza hardware wallet support for Bitcoin call storage and offline signing. Very cool. Nunchuk Android 2.8.5 has added BitBox 02 connectivity over Bluetooth and over USB. They've also added support for the Crooked hardware wallet. And they've also introduced emergency push notifications with home screen alerts. And finally, Robosat Alpha version 0.87. This is a major release adding three new coordinators,

1:07:03Elia Terria, Freeport and Amanyana. I budget that last one, but it's close enough. A Federation consensus mechanism, Enter and encrypted image uploads in the in the order chat via Noster blossom servers. Coordinators are now ranked live by DevFund donation value and multiple security fixes, including PGP verification. And then just to wrap us up, we have some educational pieces that you may find useful if you want to sit down and take a read. We've got orange service technical notes, which I referenced at the start about the liquid vulnerability or attack that is ongoing. And there's also some deep dive research by somebody called Yuval Cogman, who works at Spiral, doing a deep dive on certain coin joins structural privacy failures. I haven't checked that one out yet, but it sounds very much on my street. And the last one is Bitcoin Optek, episode or issue number 421,

1:08:05covering silent payments and mining core Coinbase payouts. Max, we're at the end of the very first live Bitcoin brief. How do you think that went? I think it went very well mate. I'm very happy we've gone live. It means I don't have to sit and edit at the end of this. Very, very happy to see all the changes on the website. Very happy to see us constantly in the charts and all the new listeners. So yeah, I'm a happy boy mate. Yeah, I checked fountain a few times this week and we had multiple shows in the top trending bit. And that's all down to you guys listening for showing your support. So again, I know we say it all the time, but we genuinely really appreciate it. It really helps us get this covered. And the kind of growing listener base is proof of that. So thank you all for your help. Very good. Well, we'll catch you, well, we'll catch you on Friday and then next week and keep it ungovernable. We will indeed see you all Friday for free and tech Friday folks.

1:09:05And if not, we'll catch you next Monday for more Bitcoin signal. Before you go, you can go to www.mimbox.io and help keep your online presence hidden. They provide anonymous server hosting solutions, virtual private and dedicated servers, domain registration and DNS parking. They don't require any of your personal information and you can purchase using Bitcoin, Lightning or Monero. No personal information required. None. Miningbox.io. Stay ungovernable.