INVESTIGATION UPDATE Many of you have asked how personal information ended up in the phishing emails, particularly those who ordered from us years ago. Here is what we have found so far. Phishing emails: We have identified more than 23,000 phishing email attempts across our email systems, including 19,057 messages delivered through Mailgun and 1,503 messages sent through Google Workspace. Some addresses received multiple messages, and some attempts failed or were stopped before delivery. These numbers do not tell us how many people had personal information exposed. We are still determining that number and will share it once we can confirm it. Older orders and abandoned carts (WooCommerce): Before moving to Shopify in May of this year, our store ran on WooCommerce. We had configured automatic redaction of customer details 60 days after shipping. When we viewed those orders in our store admin, the customer details were no longer visible and the orders showed as redacted. During past database migrations, orders were copied into a new set of tables, but copies remained in the old tables. The redaction process updated the newer tables, which were also what our store admin displayed. Orders therefore appeared redacted even though older copies still contained personal information. We also found personal information in other order and refund records, as well as abandoned carts. This included shipping details entered by someone who never completed a purchase. We are still checking the historical settings and redaction process to understand why these records retained data. Those older records were held in systems the attackers were able to reach. We relied on the redaction shown in our admin dashboard, and we now know that was insufficient to verify that the underlying data had been removed. Whatever the shortcomings in the tools we used, protecting your information was still our full responsibility. We plan to share our findings with WooCommerce and the relevant plugin developers. When an order is marked as redacted, its personal information should not remain in another table in the same database. For other WooCommerce store owners: do not rely solely on what your admin dashboard shows when personal data is redacted. Have your developer or agent check the entire database for information left behind, including legacy tables, refund records, and abandoned carts. This is especially important if you have used WooCommerce for years or have been through database migrations. Recent orders (Shopify): Customer details from orders placed on our Shopify store since May may also have been exposed. We are still investigating the extent of any unauthorized access. These orders had not yet been manually redacted. We updated our privacy policy when we moved to Shopify and were building a tool to automate redaction, but automatic deletion was not yet active. Other possible sources: We have received reports of phishing emails containing personal details that customers say they never shared with us. We are investigating whether the attackers combined information from our systems with data obtained elsewhere, but we have not confirmed a connection to breaches at other companies. Historical support records are also part of our investigation. What we have done: We have revoked affected email credentials, cleared queued phishing messages, and taken affected legacy services offline while preserving evidence. Our investigation into the full extent of the compromise is continuing. We have found no evidence that this incident compromised Passport devices or the private keys they hold. The phishing emails are designed to trick you into revealing your recovery phrase, and including your correct personal information makes them more convincing. Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation. We will continue sharing confirmed findings and publish our full report when the investigation is complete.

Stronger models are out. I wonder which piece of critical Bitcoin infrastructure will get exploited in the next few days. Time to watch X like a hawk.

‼️ Pocket Bitcoin (Swiss exchange) leaked identity documents, source of funds records, postal addresses, IBAN numbers, and bitcoin address of customers. KYC is the biggest threat to your safety.

Gal Gadot defends starring in Doug Liman's "Bitcoin" movie with AI sets and lighting because "the train has left the station. You’re going to work with it or be out of the game completely." “This was the longest contract I have ever worked on. It was six months for my lawyers to go through every scenario we could think about as far as the AI component of it. I did not want AI to have anything to do with my performance. We had to protect that... I am afraid of AI, but I am going to be afraid and look away? No. I am afraid but I am playing with it and learning it and trying to educate myself. The train has left the station. You’re going to work with it or be out of the game completely. I am trying to make the best of it and protect what I can protect. The AI component in this movie is for sets and the lighting. We had a broad crew and a lot of people were working on this movie.” “It felt like a pure art form of creating a movie. I haven’t seen a single shot. As an actress, I wait so much. There’s the legendary quote: ‘You are being paid to wait as an actor.’ Here we would film nonstop because we didn’t have to wait for lighting. We would film on and on and on for 10 hours. It was amazing… as actors you’re always hot. You don’t cool off. We’ll see. It’s crazy.” variety.com/2026/film/news/g…

🟥 URGENT: Critical vulnerability in Core Lightning Blockstream developers urge users to shut down CLN Lightning nodes right NOW! Please let everyone know!

Bitcoin-SHA256 has been made obsolete by capture, Bitcoin-BLAKE2b is now Bitcoin.

I've conducted some preliminary analysis of the ~600 BTC which have moved in a 15 minute period this morning. What we know: - 1,324 UTXOs were swept across 500 transactions all within a 3 block window (594.48 BTC). - From there, 562 BTC was swept again to a new address which has not moved since to: bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r - The UTXOs that were swept span from 2021 to 2026 100% of the addresses swept were single sig, NONE of the addresses stolen from were taproot. At a glance, this looks like there was flawed entropy in wallet generation somewhere along the way.