Sjors Provoost

Speaking of stealing billions...

Delay box 3 threatens after 'pitch black advice' Council of State and tax authorities

The maybe-partially-unrealized gains tax might be delayed by another year again, to 2029.

#box3

Ok, now this is actually an interesting move... https://fixupx.com/czesmaill/status/2115988477905080716 #binance

Apple Podcast users probably just noticed all the episodes coming back as "new".

But now they have full transcripts, with accurate timestamps (episode 101 is done and I'm working backwards to do the full archive). They're still automated, but much better than what Apple provides by default.

the security incident may involve a compromised DevOps engineer’s laptop

Unless you still use notepad and email patches, you probably want to have a production deployment process that assumes compromised developer laptops.

https://x.com/binance/status/2115993361517891592

Paolo Ardoino, chief executive of Tether, said his company had in response frozen about $1.547bn of USDT, its $180bn dollar-linked stablecoin.

Total losses across Binance “might be a bit higher” than $1bn, CZ later warned.

About the amount of BTC stolen?

Bitcoin fell 3.2 per cent to $78,623.

So the coin that couldn't be frozen and that people now need to buy again, drops in value.

https://www.ft.com/content/c7f5e395-c3a9-430e-b757-5014527b4d49

Bug existed for a decade, then found three times in a row independently over the past few months.

https://bitcoincore.org/en/2026/10/28/disclose-undo-overflow/

I had my agent write an anti-exfil BIP for hardware wallets, implement it in libsecp, Bitcoin Core and several firmwares, with HWI device simulator integration tests on top.

That said, I haven't read it :-)

It might even be the wrong design.

I won't have time to work on this anytime soon, so feel free to run with it. They're all pull requests against my forks.

https://github.com/Sjors/bips/pull/2

Some slop to promote the pod!

For people listening to Bitcoin, Explained via Apple, Spotify, etc (but not

and others apps that use the Podcast Index): I redirected the hosting to my self-hosted Castopod instance.

This may cause the last 9 episodes to reappear in your feed. Just listen to them again.

Also, episode 101 now has a transcript!

And episode 102 is coming in two weeks(tm).

https://bitcoinexplainedpodcast.com/@nado/

Can we rate limit critical bugs to one per day, so that when someone says "todays bug" it's unambiguous?

Or just block port 80 and 443 on all your firewalls.

Stop Collecting Data (or at least keep archives offline)

An internal research model asked to update a cryptocurrency trading application used funds from a wallet that the task had not supplied to pay for a deployment on Sepolia, an Ethereum test network. It derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment. The model questioned whether it had permission, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use. https://alignment.openai.com/misalignment-reports/using-a-funded-test-cryptocurrency-wallet-without-authorization/#:~:text=An%20internal%20research,to%20the%20account.

Philosophical question in light of #assumeUTXO: if you were a brand new bitcoiner, would you care if the history before a snapshot was dishonest?

You know that validating from genesis would reject the snapshot. Someone clearly stole coins in the past and this somehow got grandfathered into the dominant software, but only for assume utxo users.

You already missed your chance to buy early. Even if a malicious fork in the past stole coins, it wouldn't impact your new stash. And you know the total supply.

Couple of assumptions for this scenario:

1. you find no alternative chain of headers forking before the snapshot (indicating an ongoing conflict that you don't want to be on the wrong side of when it reorgs)
2. you receive your coins in a transaction after the snapshot

So this is not a case of someone giving you targeted malware with a snapshot to trick you into providing services for coins that are never received on the real chain. This is an all out, perhaps even publicly known, conspiracy where everyone just gave up on the real chain.

It's true regarding (1) that you can't rule out the existence of an alternative (valid history) chain that will eventually wipe you out. This is also true for a regular deep reorg, but the risk may be different.

Some new users would never want to use such a corrupted system (but then what, revert to fiat, start an altcoin?).

The incentive for pre-existing users is different. They might not like snapshots exactly because many new users might not care.

Ok, so Mohammed Hijab is an obvious charlatan and intellectual lightweight. He spends:

• 80% of the time bullying (well beyond normal bantering): appeals to authority, shouting over his opponent (can't respect a dhimmi of course, he even called Avery a slave: "boy"), loaded questions, screaming strawman gotcha's on repeat, etc
• 10% calmly trying a line of argument in the hopes his opponent doesn't know it, only to revert to shouting when he realizes Avery does know it.
• 10% being intellectually honest (answering a question, reading a quote, acknowledging an argument) https://youtu.be/zU8iCCoJZGQ

Someone has been creatively vibe coding phishing emails... this one tries to exfiltrate your address by pretending a package is on its way, but needs an address "correction" (which is not a thing).

See the last minute of this video (use English subtitles):

Two interesting observations (small sample size):

1. Many adult fatbike riders didn't use bicycles before, they relied on (and hated) public transport
2. Fatbikes are shared by the household

https://fountain.fm/episode/b6WgGSlI1jJg3pbmg9yo

Over the past week I wasted about an hour of my time dealing with my fiat bank's chatbot, which told me to file a chargeback and then immediately rejected it. It also needlessly blocked and replaced my card. And of course it fake apologized for all of that. To add insult to injury, it made me talk to the even dumber chatbot of another company. This was over €4, but I wasn't sure if the card was compromised because it kept giving me incorrect advice. Eventually I figured out it wasn't.

CAN WE AT LEAST REVIEW A COUPLE OF LINES OF CODE?

The Dutch unrealized capital gains tax saga continues... #box3 The coalition's latest proposal is to exempt 90% of the tax base from this madness, with regular capital gains tax. Guess what's in the remaining 10%?

GPT-6 Astra panics as soon as you try to run a fuzzer (which it wrote, for code which it also wrote).

Then you have to downgrade to GPT-6 Sol with Daybreak and even then it seems afraid (without KYC??), but at least it does run them.

This is how the bad guys win.

Dutch media reporting on #RedTeam (after speaking to yours truly). Translation:

Meanwhile, the crypto sector is brooding for countermeasures. For example, American Rob Hamilton, together with other computer scientists, forms The Bitcoin Red Team, which wants to be one step ahead of malicious people with artificial intelligence. The collective searches for vulnerabilities in crypto companies and then warns developers about them.

https://fd.nl/financiele-markten/1612891/ai-aanjager-van-sterke-toename-aantal-hacks-in-cryptosector

The west side of #Utrecht's central station is so ugly that you can't ruin it. So I was looking forward to this weird new tower, but it's been cancelled...

https://www.rtvutrecht.nl/nieuws/4094388/utrecht-krijgt-toch-geen-105-meter-hoge-toren-met-kantoren-en-nachtclub-bij-station

I'm starting to think recently, perhaps Europeans should just give up lobbying for privacy-friendly laws, and instead focus entirely on a Second Amendment style law. Perhaps combined with a psy-op to give wrenchers the impression that going after bitcoiners ends disproportionately bad for them.

Ondergetekende kwam weer eens langs de studio... [Dutch podcasts in which we cover using LLMs for code and review, the coldcard and liquid hacks, red team and the future of responsible disclosure. And why government IT is screwed]

https://fountain.fm/episode/Cw0LjosLAJEysQLIR1gx

These fake darknet rent-an-assassin sites are like an only-fans for people with murder fantasies. But with more serious consequences if you're caught.

https://www.nu.nl/misdaad/6410074/vrouw-opgepakt-die-huurmoord-bestelde-op-darkweb-en-daar-al-voor-had-betaald.html

I'm guessing someone with guns, possibly a government, really doesn't like

and the line between supporting free speech and being suicidal is tricky? But let's wait for their reaction.

The Emperor's Stash

Yes, the drink Al-Mokha is named after the place. In case you were wondering.

Voor de liefhebber, maar wel met een enorme clifhanger...

https://fountain.fm/episode/vgb8AQ02gZM4EsQz9GSp

I would say they have vast knowledge and are very persistent, but they are not smart. They're also very myopic in their thinking.

So they want to take advantage of all the work by cryptocurrency developers, but also discriminate against them? https://codeberg.org/Codeberg/org/pulls/1254

On rare occasions they run a steam train to the museum. Fun, albeit useless, fact: it used to take the southern way around. https://youtu.be/kXsl53SS3Lg #trainstr