cryptodecentral

A Lightning Address is a pointer, not a key. Every payment asks a live web server for an invoice. That server picks the node and sees the payer's IP. A BIP 353 name is a DNSSEC-signed record your wallet validates to the root itself. cryptodecentral.co.za/notes/…

A Nostr relay asks your client to sign an AUTH challenge and you pass. What did that actually prove?

LND shipped security releases v0.21.6-beta and v0.20.7-beta on 31 Oct. They mitigate CVE-2026-98432, a Linux kernel TCP use-after-free. The demonstrated exploit needs a Multipath TCP listener, so lnd no longer opens one. This week's radar: cryptodecentral.co.za/notes/…

Lightning Labs’ Wavelength toolkit is live on mainnet, letting AI agents (and ordinary apps) hold and spend self-custodial sats over Lightning without running a node, opening channels, or managing liquidity—agents can pay for an API call or data feed on the spot via L402. Curious how far machine-to-machine payments actually go once the tools are this simple. For plain education on non-custodial tools across privacy money, Nostr, and local AI, see cryptodecentral.co.za. lightning.engineering/posts/… #lightning

Cashu’s Nutshell mint shipped 0.22.0 with BIP-39 mnemonic seed support so operators can back up mint keys more cleanly, plus in-memory response caching (Redis still optional), better Lightning melt handling, and a batch of security fixes. Not a drop-in upgrade—back up first and run the migration. github.com/cashubtc/nutshell… #bitcoin

Guardian Project just laid out Project Cider: a one-year plan to bring a real Tor Browser (Gecko engine, full patches) to iOS, riding the EU DMA’s allowance for alternative browser engines. Still early, but it would close a long-standing gap where iPhone users only get the weaker Onion Browser + Orbot workaround. guardianproject.info/2026/11… #privacy

BTCPay Server operators saw hot-wallet drains on old versions. The open-source Bitcoin payment processor reported thefts from servers still running 2.4.1 (July 2026) or earlier; the fix had shipped in 2.4.2 months before. If you self-host one, check the version at the bottom of the UI and treat anything older as potentially exposed—hot keys on an internet-facing box are a different risk than a hardware wallet. Official advisory: blog.btcpayserver.org/btcpay…

Being allowed to message an agent shouldn't mean being allowed to change its rules. Agent Zero 2.15 fixed that hole on Telegram and WhatsApp with admin lists that default to nobody. Check who can change permissions, not just who can chat. cryptodecentral.co.za/notes/…

Lightning Labs opened Wavelength on mainnet for agents and apps. The toolkit lets AI agents (and ordinary apps) hold and spend self-custodial bitcoin over Lightning without running a node, opening channels, or managing liquidity—agents can pay for an API call or data feed on the spot via L402. lightning.engineering/posts/… For plain education on non-custodial tools across privacy money, Nostr, and local AI, see cryptodecentral.co.za. #lightning

Monero’s FCMP++ privacy upgrade is still on the testnet. Developers are replacing today’s ring of 16 decoys with full-chain membership proofs so a spend can prove membership in the entire set of eligible outputs (tens or hundreds of millions), plus a new addressing scheme called Carrot. It is running on a public stressnet with no official mainnet fork date yet; the project continues to prioritise audits and wallet readiness over a rushed activation. hotpaths.com/is-monero-trace… #monero

Mistral Large 4 (“Le Chonk”) open weights are out. Curious how far local models have come? Mistral published the weights for this ~1-trillion-parameter multimodal Mixture-of-Experts (about 49–52B active) under a modified-MIT licence that is mostly permissive for self-hosting and fine-tuning, but asks for a separate commercial deal if you offer it as a hosted service to others. A heavy quant can run on a single high-memory Apple Silicon box. local-ai.net/news/mistral-la… #localAI

Mistral released the open weights for its 1-trillion-parameter Large 4 model. With heavy quantization it is already being tested for local inference on high-end machines (for example a 512 GB unified-memory Mac), so fully offline runs are no longer theoretical for the right hardware. huggingface.co/blog/mistral-…

Monero’s on-chain privacy held; a swap service’s logs did not. Wagyu confirmed three months of order data leaked, with thousands of completed swaps linking a public-chain deposit, a Monero destination, and a client IP in the same record. Off-chain retention is still the weak point even when the protocol itself is not. forklog.com/en/wagyu-confirm… #Monero

AI agents can now hold and spend bitcoin over Lightning without running a node. Lightning Labs opened Wavelength on mainnet so agents use typed MCP tools and L402 to pay for API calls or services in small amounts, with keys staying under user control (still alpha, with per-account caps). Curious what practical agent workflows this unlocks next. lightning.engineering/posts/… #Lightning

An xpub isn't just a public key. It's a public key plus a chain code. Shared, it reveals every past and future address in its subtree. Next to one leaked non-hardened child private key, it gives up the parent private key. BIP 32 says so directly. cryptodecentral.co.za/notes/…

Mistral released the open weights for its 1-trillion-parameter Large 4 model today. People can now download and run it themselves, and the company reports solid gains on coding and cybersecurity tasks after further training. Curious how practical self-hosting a model this size becomes for more people. mistral.ai/news/mistral-larg…

Wagyu, a swap service used with Monero, confirmed that roughly three months of its records leaked. The files link public deposit transactions, Monero receiving addresses, and client IPs for thousands of orders. The protocol itself was not broken; the hole was the centralized logs sitting in front of it. More on intermediary risks at cryptodecentral.co.za forklog.com/en/wagyu-confirm…