Taurus

Red government. Blue government. Left government. Right government. Bitcoin does not care. Tick tock. Next block.

Might be a good time to post this little gem I read long ago ...Treat a crypto exchange like a filthy public toilet.. go in, do your business and get out as fast as possible, touching as little as possible....

just checked... Bitcoin didnt get hacked.... tick tock next block

A question for the Nostr devs and the SimpleX devs. Nostr is a great communication bus. Profile, discovery, broadcast, coordination. But its chat is structurally poor. Relays see who talks to whom. NIP-17 hides the content, not the graph. That is the price of public keys being identity, and it cannot be patched away. SimpleX solves exactly that problem. No stable identity at all. Relay operators see encrypted envelopes with no address. But it has no public layer. You cannot find anyone on it. I want one app that carries both. Public side is Nostr. Notes, profile, feed. Someone wants to talk privately, the app hands them a one-time SimpleX invite. They accept, a queue pair forms, and every message after that rides SimpleX relays. Invisible to everyone, including the relay operator. The pieces exist already. simplexmq is built as an embeddable stack, chat app, agent library, client library, messaging protocol. Nostr client libraries are everywhere. What is missing is the app and the invite flow. The hard parts are the handshake. The invite itself is the one metadata leak. And there is no way to verify the person in the private chat actually is the npub they claim to be. In-chat key exchange and a signature challenge would close that gap, if anyone bothers. Anyone building this?

The Bitcoin Policy Institute put out a proposal for Ukraine to mine Bitcoin with about 750 MW of stranded nuclear capacity. The reactors can't export to Europe's grid, so the power sits unused. Mining it turns that dead capacity into roughly a billion dollars over five years for the rebuild, plus jobs for veterans. No government capital required. What makes this worth paying attention to is that France is already doing it. Their nuclear is stranded for a different reason, but the conclusion was the same. Left, center, and right all agreed the power should go to mining. The thing I keep thinking about is the order this happens in. People assume Bitcoin gets adopted as money first. It doesn't. It gets adopted as a buyer of last resort for energy nobody else wants. The energy comes first, the money understanding comes later. Daniel Batten put it well. When a financial system fails, it can be disguised for years. When a grid fails, everyone knows. The fastest billion for rebuilding a nation sits in its stranded reactors, not its banking system.

Tick tock. Next block.

Yesterday it was Liechtenstein's ownership register. 31,000 companies and the people behind them, exposed. Today it's AI voice scams hitting Two Sigma, Citadel, Point72. These aren't separate stories. The register leak hands over the map of who owns what and who's connected to whom. That's exactly what you need to run a convincing impersonation attack. AI does the voice, stolen data does the convincing. Every central register built "for security" becomes ammunition for the next breach. You centralize identity to catch criminals, and criminals use it to sound like someone you trust. Each leak makes the next attack cheaper. The flywheel is already spinning. The exit is the same as it always was. Don't put your wealth where it can be mapped, and don't put your trust in a voice on the phone. Keys you hold yourself can't be socially engineered.

Liechtenstein's beneficial ownership register just got breached. 31,000 companies, foundations, and trusts exposed. This register was built in 2021 to meet EU anti money laundering rules. It was supposed to fight crime. Instead, it became the single most valuable target in the country. When you centralize sensitive information, you don't remove risk. You concentrate it. You build a honeypot. The people on that list didn't choose to be there. The law made them submit. Now they carry that risk forever.. extortion, kidnapping, coercion, for a system that was supposed to protect the public. Governments keep building these because the goal was never security. It was legibility. Control. The EU Court of Justice struck down public access to these registers in 2022 because they violated privacy. The warning was already issued. They built the honeypots anyway. This is why self custody matters. This is why non KYC matters. This is why you don't trust governments with your data and then act surprised when it leaks.

The Coldcard incident is being called a lot of things. An RNG failure. An AI failure. An open source failure. The best diagnosis I saw this week came from someone on Nostr, Alex Waltz, who said it was none of those. It was a failure of scrutiny. People tried to ask questions about Coldcard over the years. They got called FUD, their character got attacked, and the ecosystem around them learned to stay quiet. Sponsorships, grants, and social standing all pointed in the same direction. Don't poke. The aviation industry already lived through exactly this failure. Before the late 70s, cockpits ran on rank. The captain's word was law, and junior crew members hesitated to contradict him. That silence is what killed 583 people at Tenerife in 1977, two 747s colliding on the runway because concerns got swallowed instead of spoken. The industry's response is the part worth copying. They built Crew Resource Management, where the newest first officer is expected to challenge the captain and the captain is trained to listen. They built ASRS, where anyone in the system can file a safety report anonymously, with immunity from enforcement action, and the findings get published to every airline and every manufacturer. No blame attached to the messenger. They did it because they worked out the math. Silence costs more than embarrassment. One awkward report today prevents one hull tomorrow. Self custody has no ASRS. There is no reporting body, no published findings, no protection for the person asking the question. Scrutiny is voluntary and social, which means a vendor's security is only as good as the social cost of asking about it. What would actually fix it is boring. A neutral place where anyone can raise a question about any wallet, from any vendor, without being treated as an attacker. The question gets forwarded, the answer gets published, and nobody loses their grant for asking. Aviation paid for its reporting culture in funerals, over decades. Self custody just paid $90 million in four waves of drains. That should be enough to buy the same lesson without the waiting.

Couldn’t RBF have some kind of check such as needing to originate from the same Node. Is that possible. Does it do that already. How does someone else RBF a transaction from a person?

Making your own seed seems easy. It is for the most part. I flipped a coin. 256 times. 256 bits of entropy. It’s the final word that is the hardest part. You have options. Use a device (which I don’t have) or you can use a tool like the Ian Coleman tool. I did that. I followed the best practise. Downloaded the HTML from his github. Checked the signature. Turned off the internet. Opened the tool in a browser. Entered my numbers. It gave me my full 24 words. I checked the results against the word list with my original coin toss results. They all checked out. But…… I can’t bring myself to use it. I had to use a tool that I downloaded from the internet onto a computer that has had and will have access to the web. It’s probably safe. But there will always be that question in my mind. Is it really? Self custody should be getting easier, not harder.

What happens now with the closed source verse open source debate. Open source is fantastic but now it gives an attacker the entire source code to exam. It’s been said before, an attacker only needs to find one weakness. A defender needs to find them all.

Its been interesting to see discussions around quantum computing and Bitcoin. Bitcoin will eventually need to move to quantum resistant signatures.... this is being discussed in the Bitcoin community and people are trying to solve it. The larger problem at hand however is that just about everything else in the digital world will probably become a target before it gets to Bitcoin. Mythos has found weaknesses in HAWK, one of the proposed post quantum signature schemes being considered for broader cryptographic use. While this doesn't directly affect Bitcoin's migration plans (which use different NIST standardized algorithms), it demonstrates that AI is already finding weaknesses in schemes designed to be quantum resistant.... this is not a quantum computer but the latest AI release. If mythos is finding weaknesses in proposed quantum safe signatures then what will it find in the systems guarding the worlds wealth now?

I think that’s enough of parroting news. No one reads it anyway.

CoinMortgage just launched something interesting, Bitcoin purchase financing. Unlike traditional Bitcoin backed loans where you need to already own BTC, this lets qualified borrowers finance their first Bitcoin purchase. The structure, loan proceeds buy Bitcoin, held in custody during the loan term, transferred to your wallet after repayment. No rehypothecation, they're not lending out your collateral. Each borrower gets a unique on chain address to verify their holdings. No margin calls, no prepayment penalties, mortgage-style repayment terms. FinCEN registered, Florida licensed. Essentially applying the mortgage model to Bitcoin accumulation, structured financing for long term ownership rather than requiring full upfront capital. The custody approach is the key differentiator. Traditional lending often rehypothecates collateral, creating systemic risk. This keeps it simple: your Bitcoin sits there, verifiable on chain, until you've paid it off.

Australian brewery figured out how to turn Bitcoin mining into beer. Hawkesbury Brewing Co. had solar panels producing excess energy. Could sell it back to the grid for pennies. Instead, they mine Bitcoin with the surplus, capture the waste heat, and redirect it straight into the brewing process. Solar energy that was worth almost nothing now does double duty. Generates crypto rewards and eliminates the gas or electric heating they'd normally need for production. This is what people miss about Bitcoin mining. It's not just "computers using electricity." It's a flexible energy sink that can integrate with existing industrial processes. The brewery gets cheaper heating, Bitcoin rewards, and a story that even crypto skeptics can appreciate. Real world utility looks like this.

Apple is facing a lawsuit after three users lost over $1.8 million to a fraudulent crypto wallet app downloaded from the App Store. The case directly challenges Apple's claims that its multi stage app review process effectively protects users from deceptive applications. Apple has long marketed its review system as a key safety feature that distinguishes it from open app stores. The lawsuit argues that Apple's review process failed to catch an app specifically designed to steal cryptocurrency. The users trusted the App Store's vetting process, only to discover that trust was misplaced. This isn't an isolated incident. Misleading cryptocurrency apps continue to appear in major app stores, targeting users who assume platform approval means legitimacy. The crypto space is particularly vulnerable because transactions are irreversible and wallets concentrate significant value. Apple's defense will likely focus on the difficulty of catching sophisticated fraud and the steps they take after apps are published. But the core question remains. If the review process can't catch an app that stole $1.8 million, what is it actually protecting users from? The case highlights a fundamental tension in app store governance. Platforms want the revenue from app sales and in-app purchases, but they also need to maintain trust by keeping malicious apps out. When they fail at the latter, the former becomes a liability.