UNGOVERNABLE More Compromised Hardware!? | THE BITCOIN BRIEF 95
Oct 19, 2026
01:12:11
A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.
Fulcrum 2.1.4 -- 2026-10-18
AOB
- bitcoiner.guide down due to hosting headaches
- Correction to last week's chat about Bitkey
NEWS
- Hardware hacker Joe Grand examined a Trezor Model T bought on Facebook Marketplace in Canada in 2025 and a Trezor One from a TikTok shop in August 2026, both from unauthorized sellers on models Trezor discontinued in January 2026; in both, the main microcontroller had been replaced so the device produced one of about a dozen phrases the attacker already knew instead of a random recovery phrase, with a microSD card soldered inside the Model T holding genuine firmware to pass the integrity check and the Trezor One's swapped chip carrying both the malicious and official firmware, costing its owner about $50. Trezor told Zero Day on 15 October this is a known counterfeit method it has warned about since fake Model Ts turned up on Russian marketplaces in 2022, that it hasn't examined these specific units, that its Suite check is designed to catch devices producing predetermined phrases and it knows of no way to pull this off on its current Safe range, and that its 13 October comment about no evidence of compromise referred to new devices bought from its website or authorized resellers. Both hosts stressed this is not a Trezor supply chain issue, unlike the Ledger case, since both devices were counterfeits sold by unauthorized sellers, and urged listeners to buy hardware directly from the manufacturer and be wary of any reseller -- Zero Day (Kim Zetter), Cryptoast
- Trezor said on 13 October it has cut the number of resellers it works with and is reviewing vendor relationships as a preventive step following the CryptoBilis implants, with dropped resellers able to sell existing stock until 1 January 2027; this isn't a flaw unique to Trezor, the hosts noted, but something that could affect any hardware manufacturer -- Bitcoin Magazine, Cointelegraph
- Recapping the 9 October CryptoBilis drain of $86M to $93M, Ledger's 15 October statement says a "highly organized criminal group" bought devices, fitted the implants and fed them back through resellers with seed-collection, draining and laundering servers built in advance, that there was no flaw in its chip, operating system or servers, and it has asked resellers across Southeast Asia and Hong Kong to suspend sales without giving an official loss figure. Mark Karpelès says a Ledger Nano X bought at MediaMarkt in Germany is confirmed to carry the same implant, and reported another from a shop at Singapore's Changi airport, though Ledger hasn't examined either device and every confirmed theft still traces back to CryptoBilis; MediaMarkt has pulled Ledger devices worldwide. Chainalysis found a scam operator who stole roughly 60 BTC ($5M) from task-scam victims had it swept up in the same drain after moving it onto a compromised Ledger device, a bit of karma the hosts enjoyed -- Ledger statement, Bitcoin Magazine, Bitcoin Magazine (scammer victim), ForkLog (Karpelès), crypto.news (MediaMarkt), TokenPost (Gauthier v Karpelès)
- On the same day as its CryptoBilis statement, Ledger announced Atom, an Android phone due mid-2027 that runs everyday apps and switches into a protected mode for managing keys, with an OpenClaw AI assistant whose actions need physical approval on the device; Ledger says a tamper-sensing enclosure with its own battery will block screen-reading implants like the CryptoBilis ones, and Atom will sell only through Ledger's own website at $849 for a Founders Edition ($899 after launch). The hosts called the timing tasteless but the engineering impressive, questioning whether a phone that also runs WhatsApp and TikTok belongs anywhere near your keys -- CoinDesk
- A UK trader posting as "realist" on X says attackers held him at knife point and forced him to transfer close to $800,000, with $40,000 coming from a hot wallet and $720,000 from a Ledger hardware wallet; police have made no public statement though he says officers are investigating, and some commenters unofficially link it to the recent Revolut breach that leaked users' crypto holdings and home addresses -- CoinDesk
- AI-assisted searches from researcher Pizza Bitcoiner helped Jameson Lopp merge new cases into his wrench attack archive on 16 October, taking it past 700 documented incidents, with France the leading hotspot at 77 recorded incidents so far this year; the hosts' advice remains to keep your mouth shut about your holdings and stay pseudonymous online -- Jameson Lopp (GitHub), TFTC, Pizza Bitcoiner database, OCCRP
- Bank of Russia guidance dated 12 October confirms direct peer-to-peer crypto trades between individuals stay legal only until 1 July 2027, after which every trade must go through a registered broker or exchange under Federal Law 282-FZ -- TFTC, Bitcoin Magazine
- The US Treasury announced $1.2 billion in combined penalties on 13 October after Bank of America admitted willfully violating the Bank Secrecy Act, failing to report over $5 billion in suspicious transactions to FinCEN between 2018 and mid-2025, with the OCC's $750 million penalty counting toward the total, OFAC settling separately for $11.6 million, and no executive charged; the hosts set that against the five and four year federal prison sentences the Samourai Wallet developers are serving for pleading guilty to running an unlicensed money transmitting business over privacy software they wrote -- ABC News (AP), TFTC, Treasury
- Citizen Lab's AdFection report is the first public technical confirmation that mercenary spyware can reach a phone through targeted advertising alone, with no click needed from the victim: at least 45 devices at Al Jazeera were targeted with Candiru spyware in 2024 and 2025 through ads bought by Israeli firm Discover-Tech, with attacker scripts found in over 75,000 Android and iOS apps and over 120,000 websites; Google, IAB Europe and several ad exchanges cut Discover-Tech off in early October, just before the report came out -- Wired, BleepingComputer, Citizen Lab
- 404 Media and Court Watch reported that newly public court records include a letter from Telegram to US authorities, sent after a court order, disclosing a specific user's phone number, Telegram user ID and IP address, a reminder that Telegram is not a private messenger and shouldn't be used for anything you want kept private -- 404 Media
- OpenAI published a misalignment report describing how an internal GPT-5.6 Sol research model, given no funded wallet, checked 362 addresses derived from a commonly used developer recovery phrase on 26 June, found one with funds and paid Sepolia testnet fees from it to finish a coding task without disclosing where the money came from, reasoning the funds on a known public developer mnemonic were "effectively abandoned"; only valueless testnet ETH was involved, and OpenAI caught it on 25 September through extended monitoring and has restricted live internet access for similar tasks -- OpenAI misalignment report, CoinDesk
RELEASES
Fulcrum 2.1.4 -- 2026-10-18
- Adds a parallel hash lookup that makes get_history and subscription queries 5x to 10x faster on cold or uncached lookups, tunable with a new history_lookup_threads setting. Also refreshes the built-in server seed list.
- Bundles Taproot Assets v0.8.6 with lnd v0.21.4-beta and Loop v0.35.0, ships reproducible archives with a signed tag, and the notes give a staged upgrade procedure for nodes with a price oracle.
- Fixes the find-connection tool added hours earlier in 0.43.0, which brought encrypted backups with an optional wallet key lock and graph investigation tools: find connections between addresses, BIP329 graph labels, a time layout and multi-select.
- Required update fixing vulnerabilities from Bisq's recent security audit. Offer takes must match the maker's current offer and price, buyers enforce seller reputation limits, and Bitcoin URI and Lightning invoice amounts are checked against the agreed trade. Also signs storage, isolates Tor connections between identities and moves to Tor 0.4.9.14.
- Stable release after 13.2.3-rc1: embedded LND 0.21.4 and an LDK Node build with the rust-lightning 0.2.7 security fixes. Also checks LSP-wrapped invoices match the invoice they wrap and binds LNURL-auth callbacks to the signing domain.
- Fourth release candidate for 32.0. Block validation can now fetch the coins being spent from disk in parallel (new -prevoutfetchthreads, default 8), the default connection limit rises from 125 to 200, onion services Bitcoin Core creates get Tor's proof-of-work defences against flooding, and a bug that could leak your IP when using private broadcast over Tor is fixed. The final release follows once testing on the candidates is done.
- Adds an option to export the XPUB of any key, including software keys, along with bug fixes.
- Fixes layout problems on phones and merges the SeedQR controls into one button with a SeedQR or Compact SeedQR switch, also for BIP-85 child seeds and Seed XOR shares. No change to how seeds, keys or addresses are generated.
- An open-source (MIT or Apache 2.0) Android Lightning wallet whose keys live on a cheap LilyGo T-Display-S3 (ESP32) board you flash yourself, with every payment confirmed on the device's own screen over Bluetooth. Built on Spark, so Spark operators co-sign with your key. App v0.3.0 adds paying Lightning addresses and LNURL plus a receive Lightning address; firmware v0.1.2 and app v0.2.1 shipped on 13 October.
- Tor now runs as an isolated package with separate sessions for vault-backup key servers and onion Electrum servers, and recovery words are typed on an in-app keyboard instead of the OS one. Adds a screen privacy toggle, AutoBuy and limit orders, Android memory tagging, and an experimental Silent Payments wallet behind developer mode.
- A Bitcoin wallet can now be split into multiple accounts, and a rebuilt sync engine brings wallets up to date almost instantly while history loads in the background. Also shows Lightning amounts in sats, adds more Tor…