Together with
Greetings Bitcoiner,
Welcome to Issue #627 of Bitcoin Breakdown, where every Tuesday and Thursday, we bring you the latest must-read Bitcoin thought leadership articles and the newest tools and projects you should know about. But first, today’s Top Stories:
Binance's reported customer-data handover shows how centralized identity records can outlive an exchange's public exit. BitBox's firmware update brings the responsibility of self-custody into focus, while Jane Street's large Bitcoin ETF position reveals institutional liquidity that a long-only filing cannot fully explain. Together, they test privacy, custody, and market interpretation.
|
A multi-key vault with keys spread across devices from different vendors eliminates single points of failure. No single bug, theft, or mistake can touch your bitcoin.
If your setup depends on one device being perfect forever, what is your plan for the day it is not?
Casa's security team is running free consultations to review your setup, show you what a multivendor multisig wallet would look like for you, and help you plan a calm migration, including pairing hardware you already own.
Casa holds your hand, not your keys. The strongest self-custody is the kind with no single point of failure.
Book a security consultation with Casa Advisors here.
🗂️ Binance KYC File Became a State Data Dossier
Binance allegedly shared a Russian user's customer data with investigators after publicly exiting Russia. The file allegedly included identity, contact, passport, and residency details, turning routine customer checks into a detailed government-ready dossier for investigators.
Why it matters: Centralized exchange convenience can leave both coins and identity records within an intermediary's reach. Self-custody reduces one dependency, while minimizing retained personal data protects the privacy that makes financial sovereignty durable. Read more→
🔧 BitBox Makes Wallet Updates a Security Duty
BitBox urges all hardware wallet users to install firmware version 9.26.5 after saying AI-assisted vulnerability discovery makes bugs faster to find and understand. The company is also comparing outdated wallet firmware with an old smartphone that no longer receives security updates.
Why it matters: For self-custody users, BitBox's old-smartphone comparison frames firmware maintenance as part of protecting personal signing authority. The company's AI warning makes update guidance a security practice, not an optional technical chore. Read more→
📊 Jane Street's ETF Position Needs Context
Jane Street reported Bitcoin ETF exposure equivalent to about 15,394 BTC at cited prices, without holding those coins directly. Its June 30 long-only filing excluded shorts, derivatives, and hedging activity that could change the economic exposure.
Why it matters: The position shows substantial Bitcoin-linked liquidity inside institutional markets, but fund shares are not sovereign ownership. A market maker's inventory may serve clients and liquidity needs rather than express a simple bullish bet. Read more→
Handre van Heerden, author of Economic Heretics, writes that rendered animal fat, not shells or gold, served as humanity's original money, surviving no fossil record because it was consumed rather than hoarded, unlike modern fiat currency (Aug 18 | 13 min read).
Jameson Lopp of Casa writes that BIP-110 failed because its anti-spam soft fork lacked economic support, misunderstood Bitcoin incentives, couldn't stop arbitrary data, and exposed the Puritan movement’s flawed game theory and overconfident predictions (Aug 17 | 38 min read).
Isaiah Austin of Bitcoin Magazine argues that the CLARITY Act mainly protects self-custody and shields developers from liability while opening a statutory door for banks to custody bitcoin, rather than serving as a genuine price catalyst (Aug 14 | 5 min read).
Chris Ritter of ZEUS wallet details the August 5th BTCPay Server breach that gave attackers access to Olympus infrastructure closed LSP channels, and drained ZEUS's own operational wallets, while confirming no customer funds were ever lost or at risk, and outlines concrete fixes that were made (Aug 14 | 8 min read).
Gui of Casa explains how to buy a hardware wallet using aliases, dedicated emails, PO boxes, hotels, or Amazon Lockers, keeping legal names and home addresses off vendor order records (Aug 14 | 12 min read).
Arkade explains how its Intents protocol standardizes payment and exchange requests across providers, letting products offer more choice while Bitcoin settlement keeps routes secure, replaceable, and independent from any single provider (Aug 14 | 4 min read).
Praveen Perera of Cove Wallet reconstructs Coldcard's Wave 1 theft, tracing 328 weak RNG seeds behind 949 BTC of the 1,082 BTC stolen, exposing the attacker's tooling while 153 addresses holding 133 BTC remain unexplained (Aug 13 | 24 min read).
Orangesurf of Mempool(dot)space warns Bitcoiners against shipping hardware wallets to home addresses or using main emails, recommending PO boxes, aliases, in-person purchases, and account codes to avoid data leaks and wrench attacks (Aug 13 | 3 min read).
Remix7531, a Bitcoin cryptography researcher, proves that new post-quantum signature code for Bitcoin is both bug-free and unforgeable, marking a first step toward mathematically verified hash-based signatures for future BIPs (Aug 11 | 14 min read).
Eugene, a Bitcoin Brink grantee, experiments with fuzzamoto, a fuzz-testing tool that hunts for bugs in bitcoind, finding that smarter snapshot placement roughly doubles testing speed and could help catch software bugs faster (Aug 7 | 7 min read).
Joko of BitBox explains why AI-assisted vulnerability research makes regular firmware updates essential for BitBox and other hardware wallets, helping users install security fixes quickly, avoid phishing, and keep keys protected offline (Aug 4 | 5 min read).
Radar, a Signal-based private messaging app with Spark-based Lightning payments, launches on Google Play after 45 days of review delays.
Developer t-bast discloses a fixed LND vulnerability where nodes closed channels after one confirmation, risking full fund loss during blockchain reorgs.
Matthew Vuk is working on a Bark integration for Proton Wallet, adding Second’s Rust-based Ark implementation for Lightning payments within Proton’s encrypted wallet architecture.
Nix-bitcoin, a NixOS based Bitcoin infrastructure toolkit, announces version 0.0.139 as its final release after eight years, urging developers to fork the open source code.
JoinMarket, a bitcoin coinjoin privacy tool, patches a directory node vulnerability found by 1440000bytes that let attackers hijack maker nicknames, causing denial of service eclipse attacks with no funds at risk.
RY3T, a Swiss energy hardware company, builds the Nova, the first commercial product running Mujina, the 256 Foundation's open-source Bitcoin mining firmware.
Bringin relaunches its web app with a cleaner design, faster speed and easier Euro bank transfers via Lightning Network.
Eric Voskuil, longtime libbitcoin developer, teases libbitcoin-server, a new Bitcoin node supporting Core, btcd, and Electrum interfaces with sub-30-minute full chain sync.
PictureRoom, a Stacker News user, launches a peer-to-peer Bitcoin-backed loan tracker to help friends borrow cash without selling BTC or using centralized lenders.
SwapMarket, a bitcoin swap frontend, continues smaller Boltz swaps after Boltz halted service over attacks, aiming to preserve Lightning, Liquid, and on-chain exchange options.
Cashu(dot)me, a Cashu ecash wallet, integrates npub(dot)cash so that Nostr users can choose any Cashu mint for Lightning address payments across the ecosystem.
