CK and The Revolution

Layered in-person talks with FreedomTech builders & independent thinkers, exploring the people behind the ideas.

[Ben Arc 🏴󠁧󠁢󠁷󠁬󠁳󠁿✊⚡️ @arcbtc]

Please forward to anyone you know who might be running an LNbits instance. Patches should be merged and available within 24-48hrs. Better to be safe than sorry 🙏
Sorry for any inconvenience.

[Uncle Rockstar Developer @r0ckstardev]

Not a drill: shut down your BTCPay Server if you have a hot wallet.

Appreciate the reposts 🙏

[CK @realckx]

'Everything is broken. And I’m not joking. I’m not exaggerating.' @callebtc

Are we prepared for what’s coming?

A fascinating and unsettling conversation.

🎙️ Recorded at @btcplusplus Berlin.

New episode of @CKandTheRev. Watch now 👇

https://t.co/GRrvUIAbcG

[Trezor @Trezor]

CryptoBilis update

We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.

No CryptoBilis buyer has reported a loss of funds to us.

IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:

Already using it?

Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.

Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.

We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.

On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far.

NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.
If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://t.co/5EasOVDDQh

We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.

For more information, visit our blog: https://t.co/2LmFV8L2oe

[CK and The Revolution @CKandTheRev]

👀

[Coinbase Support @CoinbaseSupport]

Coinbase has not had a data breach.

Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.

We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.

We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.

[CK and The Revolution @CKandTheRev]

@Halia0__ 100

[CK and The Revolution @CKandTheRev]

Cyber pandemic.
Act accordingly.

[7NEWS Melbourne @7NewsMelbourne]

A major cyber security flaw has forced government websites worldwide offline, affecting 70% of identifiable sites including those in Australia, Japan, Europe and the USA.

[CK and The Revolution @CKandTheRev]

21 million bitcoin.

https://t.co/FMevciQAGE

[Caitlin Long 🔑⚡️🟠 @CaitlinLong_]

Coincidence or timed???🤔

[calle @callebtc]

Bitchat is now the nr 1 social app in the French app store.

Bitchat is a messenger that uses peer-to-peer mesh to communicate with others without the internet.

[CK @realckx]

I'm thinking about renaming the podcast. If you were me, what would you call it?

Here's the backstory.

When we started, we made a rookie mistake. We registered the domain, but not the podcast name on the platforms.

Ten days before launching, we ran a campaign announcing: “On January 29th, All In Bitcoin launches with Adam Back and Peter Todd explaining what Bitcoin is.” Some of you might remember that.

On launch day, we were at Plan B El Salvador 2025, interviewing guests. Just as we were about to register the podcast and upload our first two episodes with Adam Back and Peter Todd, we found out someone had registered a podcast called All In Bitcoin the day before and uploaded their first episode.

By then, All In Bitcoin was already everywhere: on our Nostr and X handles, in our branding, and embedded in our first two episodes. So we added “Pod” to our handle, launched, and later added “with CK” to the name. But it hasn’t worked. Even today, people tell us they’ve accidentally subscribed to the wrong podcast.

From day one, there were two podcasts with almost identical names. Ours was the second one, and it still is, even though the other podcast stopped publishing a few months later.

I’m tired of fighting the odds of being the second All In Bitcoin podcast.

We pour so much time, energy, and love into this show that I don’t want people to miss it because of a name.

So it’s time for a fresh name. Not another version of All In Bitcoin, but something completely different, with zero chance of confusion.

What would you call it? Please, surprise me! 👇

[CK and The Revolution @CKandTheRev]

RT @allinbitcoinpod: She's going to need privacy to work out what she thinks. She's going to need control over her money to act on it. And…

[CK @realckx]

“I have nothing to hide.”

But privacy was never about having something to hide.

Perfect Sunday watch with @erskingardner on privacy, @whitenoisechat & the future of private communication.

Full episode 👇

[Stephan Livera @stephanlivera]

Unauthorized hardware implant confirmed by Ledger

[CK @realckx]

What if Signal had no central servers?

No phone number
No email
No login

Just private, end-to-end encrypted messaging for humans & AI agents.

@erskingardner & Max are building @whitenoisechat

https://t.co/3M3FYPKGVa

[Blink Wallet @blinkbtc]

Full post-mortem of the September 19 attack, and a 50% bounty — up to 3.3 BTC — on the stolen funds:
https://t.co/8iRFY7Q13G

Bounty terms:
https://t.co/aF8d2L29Kv

On Saturday September 19 an attacker used a flaw in our admin tools to take over 35 Blink accounts and withdraw about 6.61 BTC from 24 of them. A customer called one of our engineers at 11:39 UTC. Fifteen minutes later the whole custodial service was off. By that evening the hole was closed and the service was back. By Thursday September 24 every affected customer had their exact balance back, in bitcoin and in dollars, paid for by Blink's shareholders. No customer bears any loss.

This was our fault. Not Bitcoin's, not our users'. To the 22 customers whose bitcoin was taken, and to the 3,817 people whose account details were looked up: we are sorry.

How it happened:

From October 2023 until that Saturday, anyone with a free Blink account and a web browser could give themselves the powers of our support staff: change the email or phone on any account, log in as that customer, raise their limits. Three unremarkable mistakes in how our admin tools checked permissions, stacked on top of each other, in code we inherited.

The whole team was busy moving tens of thousands of users to self-custody under new regulation. Monitoring built to catch outages didn't catch an administrator doing things no administrator should.

What it didn't touch:

The money came out of our hot wallet. Most customer funds sit in multi-signature cold storage that nothing in our admin tools can reach. Non-custodial accounts were never in play: we don't hold those keys.

What the attacker saw:

They also read the details of 3,817 other accounts, in some cases a phone number or email address. Not names, not IDs, not addresses, not passwords, not seed phrases. We wrote to every holder we could reach, saying exactly what was seen.

What stopped them:

Two-factor authentication. The attacker logged in to nine accounts that had it on and tried eighteen times to move money. Zero loss.

None of the 24 drained accounts had it on. If you take one thing from this post: Settings → Security and Privacy → Two-factor authentication. Then turn it on for your email too.

What we changed:

The flaw was fixed the same day and a third layer added two days later. The admin tools are off the public internet. The functions that change a customer's email or phone are switched off for everyone while we redesign them. All customer API keys were revoked.

The hot wallet now holds a fraction of what it did. Security fixes are developed privately and published once deployed; the code stays open source. A standing security reporting channel is live, with rewards of up to 0.1 BTC for critical findings.

Where the money is:

Some still sits where it was withdrawn to. About 5 BTC has gone through a cross-chain swap service; a small amount reached an exchange that is cooperating.

Criminal complaints are filed in El Salvador and Próspera, the regulators are notified, and we have traced the funds continuously. We are not expecting the money back.

So we are putting a 50% bounty on it.

Whoever provides the information that leads to a recovery gets 25% of what is recovered. Another 25% of anything recovered goes to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and the circular economies they choose. No cap, no end date, paid only out of funds that actually come back. Write to [email protected].

We would far rather have spent this money on grassroots Bitcoin adoption than lost it to a thief. Shame on the attacker.

One more thing:

Ignore any email or SMS about this incident that contains a link: we contacted affected users only through messages in the Blink app. We will never ask for your PIN, password, seed phrase or a login code.

The full post-mortem has the timeline, the technical detail for anyone running code derived from ours, and the bounty terms (links at the top).

[Lyn Alden @LynAldenContact]

Ya'll are so crazy I'm writing another sci fi novel to remain sane.

You're going to love it, though.

[CK and The Revolution @CKandTheRev]

❤️

[Julian Assange @JulianAssange]

#OctoberSurprise
this new life is thanks to everyone who fought for my freedom

[CK and The Revolution @CKandTheRev]

https://t.co/lXqkLYpfyj

[CK and The Revolution @CKandTheRev]

https://t.co/FGrywjTLA3