KYC: KILL YOUR CUSTOMER | THE BITCOIN BRIEF 90

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q.

AOB

Max: spent a full day and roughly $100 in API credits on a marketing project using lower-end models rather than his normal Claude subscription -- couldn't use it due to privacy concerns around Ungovernable content; a warning that frontier model quality costs real money per token Q: quiet weekend -- kids party Saturday, christening Sunday; off to Portugal on Friday

NEWS

Revolut hands passports and Bitcoin histories to a spoofed government request: attackers used a real government agency's email domain to extract passport scans, verification selfies, home addresses, and full transaction histories including Bitcoin activity; Revolut refuses to confirm the number of affected customers, the market, or the agency involved; attacker is now leaking customer files daily on Telegram and demanding 10,000 BTC -- CoinDesk, TechCrunch, Decrypt

Liquid exploit recovery: 3,400 BTC returned to block 965950 on September 7 via on-chain OP_RETURN negotiation; ~598.5 BTC (~$47M) remains with the exploiters; Blockstream refused the demanded 10% bounty, called it theft, and says it will work with law enforcement; block production resumed September 10 but peg operations remain suspended -- Bitcoin Magazine, news.bitcoin.com, CoinDesk, The Bitcoin Manual

Final CLARITY Act text drops: ethics deal done, developer protections narrowed; the Blockchain Regulatory Certainty Act now covers civil enforcement only with criminal protections removed -- including the charge brought against the Samourai developers; cloture vote is September 15 at 2:15pm ET, needs 60 votes; prediction markets put passage at ~25% -- The Crypto Times, The Block, The Hill, CoinDesk

Chinese quantum benchmark drops secp256k1 attack to 835 logical qubits, down 60% from the 2020 estimate of 2,124; current best hardware reaches 94 logical qubits; addresses with exposed public keys face the greatest future risk -- TFTC, CoinDesk

Alby Hub authentication bypass lets attackers drain Lightning wallets: critical flaw in v1.7.0 through v1.18.5 allows unauthenticated remote takeover when port 8080 is internet-accessible; at least one user confirmed compromised; update to v1.24.0 and block external access to port 8080 -- The Hacker News

Brevo breach lets attackers send phishing from Trezor, BitBox, and CoinTracking domains: attackers created API keys inside Brevo customer accounts allowing emails from real sending domains that passed SPF, DKIM, and DMARC; the lure was a fake STM32 Entropy Vulnerability alert targeting hardware wallet owners; Trezor and BitBox both confirmed the breach on September 9 -- CryptoTimes, Decrypt

RELEASES

Highlights

Electrs v0.12.0 -- 2026-09-13 Switches to the bindex indexing library. Requires Bitcoin Core 31 or later and a full reindex -- upgrade Core first and plan for downtime, especially on lower-powered hardware. Fedimint v0.12.1 -- 2026-09-12 Security release fixing a vulnerability in the Lightning gateway's LNv1 payment handling. Gateway operators should upgrade immediately. The fix is consensus-neutral so federation participants and wallet users do not need to coordinate an upgrade. Radar v1.0.7 -- 2026-09-12 Adds BOLT11 invoice payments alongside lightning addresses, scan-to-pay from the send screen, on-chain receive via bitcoin: URI, full balance hiding across the app, and Signal backup migration on a single device. Bitcoin Seed Tool v2.4.0 -- 2026-09-11 Adds SeedQR scanning, Seed XOR splitting into 2-8 Coldcard-compatible shares, NIP-06 Nostr key derivation, BIP-44/49/84/86 descriptor export, and blank backup template printing. Also fixes seed leakage bugs -- existing users should update before use. Phoenix v2.8.2 -- 2026-09-08 (Android), 2026-09-07 (iOS) Adds Italian, Japanese, Polish, Ukrainian, and Korean language support. Android users can now manually set feerates on outgoing on-chain transactions, matching iOS parity