Together with
Greetings Bitcoiner,
Welcome to Issue #700 of Bitcoin Breakdown, where it’s OPSEC Wednesday special, followed by the latest Quick Bits snippets. But first, today’s Top Stories:
LNbits shipped an emergency 1.7.0 patch after reported thefts, and says operators must rotate keys because updating cannot evict attackers. Poland's lower house voted for sanctions freezes that exchanges must enforce before any court rules, a case for self-custody. In Texas, a new bill would let every city and county put up to $10M into Bitcoin.
When Mercado Bitcoin froze withdrawals for 15 days, its customers could only wait. Coins held on someone else's platform can be paused by someone else.
Free multisig is back in the Blockstream app. Pair it with Jade Plus and your key stays on the device, off your phone. Add a backup key you keep offline and you can always spend without Blockstream. A thief with your phone or your recovery phrase still needs your 2FA code.
Our link takes 10% off Jade Plus automatically at checkout.
⚠️ LNbits Patch Cannot Evict Hackers Already Inside
LNbits shipped version 1.7.0 as a critical security update after attacks put funds on older versions at risk of theft. LNbits says updating alone cannot remove access an attacker already gained, so operators must rotate wallet keys, replace funding credentials and move to a fresh server if compromised.
Why it matters: LNbits shows that running your own Lightning server is sovereignty with homework, because a patch cannot revoke credentials an attacker already holds. Operators who rotate every key keep custody of their sats, while those who only update stay exposed. Read more→
From stolen sats, the threat shifts to state freezes...
🇵🇱 Poland Votes to Freeze Assets Before Courts Rule
Poland's lower house passed a sanctions bill 240-202 that lets officials freeze Bitcoin and other digital assets held by people on a national list. A listing takes effect the day after publication and stays enforceable during any court appeal, while exchanges and custodians face fines if they fail to comply.
Why it matters: Exchanges and custodians become the state's freeze switch, because the bill describes no way for officials to obtain self-custodied keys. Holding your own keys removes the intermediary a Polish freeze order relies on, so censorship starts at the custodian. Read more→
From Warsaw's freeze switch, the story crosses to Texas...
🤠 Texas Bill Would Let Cities Hold $10M in Bitcoin
Texas state representative Ron Reynolds filed House Bill 815, which would let each city and county invest up to $10M of public money in Bitcoin. The bill has only been filed, sets no rules for how the coins would be held, and would take effect September 1, 2027 if enacted.
Why it matters: Texas already funds a $10M state Bitcoin reserve, and this bill pushes treasury policy down to cities and counties. Taxpayers win only if officials choose self-custody, because with no custody rules a treasurer could settle for paper bitcoin. Read more→
Keystone says an attacker reached its online store in October and took buyers' names, contact details, shipping addresses and order details. The hardware wallet maker had promised to delete shipping data after 180 days. In its own words, it "failed to fulfill" that commitment.
Another wallet maker's shipping partner kept 2019 orders it had promised in writing to erase. A new password fixes nothing, because the leaked record points at your front door.
Most buyers never learn how many companies saw their order. There is a free way to find out who still holds yours, and a way to buy your next device so a stolen record leads nowhere.
This week's OPSEC Feature Article shows you how to trace every copy of your hardware wallet order and make the next one worthless to whoever steals it.
Get instant access to this special feature by becoming a premium supporter here.
Mercado Bitcoin, one of Brazil's largest exchanges, resumes Brazilian real deposits and withdrawals via Pix, the country's instant payment network, 15 days after hackers drained an estimated $49M.
Vagabond, a Bitcoin Magazine columnist, profiles 278 Washington merchants accepting bitcoin, as part of his article series documenting real-world Bitcoin adoption across the country.
Two solo miners find blocks on solo mining pool CKPool seven hours apart, according to Mononaut of Mempool(dot)space.
Strategy, Michael Saylor's Bitcoin treasury firm, buys 1,036 BTC for $81.9M while repurchasing $188.3M of STRC preferred, lifting holdings to 850,364 BTC.
Amundi, Europe's largest asset manager, raises its stake in Strategy, the biggest corporate bitcoin holder, by 44% to 1.9M shares worth $291M at Sept. 30, a Nov. 6 filing shows.
Strive, the Dallas-based Bitcoin treasury firm led by Matt Cole, adds 29 BTC for $2.2M, lifting holdings to 43,153 BTC as weekly purchases slow after October's 15,124-coin buying sprint.
Hyperscale Data, an NYSE American-listed data center firm, sells its final 211.56 BTC for $16M to fund a Michigan AI site, ending its $100M Bitcoin treasury plan.
Trump Media, operator of Truth Social, adds 1,510 BTC in Q3 to reach 15,649 BTC, posting a $409.7M net profit driven by bitcoin's 42% price rise.
Trump Media pledges 11,385 BTC to an options program whose counterparty can reuse the coins, as $1B convertible note holders gain cash redemption rights Nov. 30.
North Korean launderers are moving $430,000 stolen in the $6.34B Binance hack through six throwaway meme tokens on a sh!tcoin chain, according to analytics firm Elliptic.
Binance warns that worse_query, a public iOS flaw, lets apps installed outside the App Store read other apps' files, exposing bitcoin wallet seed phrases and private keys.
BlackRock, the world's largest asset manager, says large holders are swapping self-custodied bitcoin for iShares Bitcoin Trust shares at a record pace, citing kidnappings and hacks as key drivers.
AntPool, a major Bitcoin mining pool, mines Bitcoin's second-busiest block with 11,255 transactions, 984 shy of a 2015 record, collecting just 0.0024 BTC, worth about $180, against its fixed 3.125 BTC subsidy.
Richard Blumenthal, incoming chair of the US Senate Permanent Subcommittee on Investigations, gives Binance, Tether and two Trump-linked firms until Jan. 4 to turn over records or face subpoenas.
Miami-Dade County Tax Collector Dariel Fernandez in Florida, US now accepts bitcoin for property taxes online and in person, while converting each payment to dollars.
