Boltz is the non-custodial swap provider connecting Bitcoin mainchain, Lightning, and Liquid, used as backend infrastructure by ZEUS, Aqua, and Bull Bitcoin. On August 3 they pulled the plug on everything, not because of a breach, nobody lost funds since they never hold custody, but because they said months of AI-assisted probing had escalated to a pace their small team couldn't keep patching against.

Their statement was blunt: "Attackers now iterate faster than a team our size can find and patch. This is not a response to a single incident."

Three wallets lost swap functionality within hours with basically no warning. Blockstream announced Blockstream Swaps a week later, on August 10, clearly moving to fill the gap.

Worth being honest that this is Boltz's own account, no independent technical report has been published yet, but the broader pattern lines up with other recent data points. Blockaid reported over a billion dollars lost to hacks in just the first half of 2026, already surpassing all of 2025. Coinbase scaled back its own bug bounty payouts because AI tooling flooded it with low quality duplicate submissions.

I also went back and checked the Coldcard vulnerability I covered a few weeks ago, the loss figure has climbed from 38 million to over 111 million since then. Not clear if that's newly identified historical losses or ongoing exploitation, and I didn't want to guess, so I flagged the uncertainty directly in the piece.

Full writeup connecting both stories:

https://davidebtc186.substack.com/p/ai-vs-ai-how-boltzs-shutdown-reveals

Not directly a Lightning story, but the mechanics here are relevant to anyone who cares about how Bitcoin base layer changes actually happen, since Lightning depends entirely on that layer staying stable and predictable.

BIP-110 tried restricting non-financial data, mainly Ordinals and BRC-20 tokens, from Bitcoin transactions. Used a user-activated soft fork, same mechanism as SegWit in 2017, with a 55 percent signaling threshold instead of the usual 95 percent supermajority.

Support never got anywhere close. Around 0.42 percent of hashrate signaled between May and early August. When the mandatory window started August 7, it was around 2.5 percent. The chain split off anyway. Because Bitcoin's difficulty only adjusts every 2016 blocks, the minority chain inherited full mainnet difficulty with almost no hashrate behind it. Within two days it was 48 blocks behind mainnet, producing blocks every 6.9 hours instead of ten minutes.

What's actually instructive here: 2017's SegWit UASF worked because of economic alignment that already existed before the formal activation, exchanges, wallets, and businesses had effectively already agreed. BIP-110 used the identical mechanism without anything close to that alignment first. Adam Back called it out directly for lacking both technical and ecosystem consensus. Jameson Lopp flagged the risk of unspendable UTXOs through Taproot edge cases specifically.

For anyone running LND or thinking about base layer dependencies for Lightning infrastructure, this is a decent real-world reminder that the base layer's stability isn't guaranteed by good intentions or a procedurally valid mechanism, it requires actual broad buy-in across miners, node operators, and the wider ecosystem before anything changes.

Full writeup, also connects this to a hardware wallet vulnerability from the same week with a similar underlying failure pattern:

https://davidebtc186.substack.com/p/two-bitcoin-failures-one-week-apart

On July 13, US government-linked wallets moved 3,940 Bitcoin and 30,014 Ether, roughly 297 million dollars combined, into Coinbase Prime custody. Sale speculation followed immediately.

The detail almost nobody is explaining clearly: Executive Order 14233, which created the Strategic Bitcoin Reserve, only protects Bitcoin from sale. Ether and other seized digital assets fall under a separate framework where Treasury has discretion. So the 244 million in Bitcoin here is protected on paper, the 53 million in Ether is not.

The Bitcoin traces to two forfeiture cases, roughly 2,875 BTC from a dark web dealer known as Xanaxman and about 925.5 BTC linked to the old BTC-e exchange. The Ether comes from a former Oracle employee's money laundering case.

Worth noting too that a deposit to Coinbase Prime is not proof of an impending sale. The Marshals Service has an active custody contract with Coinbase Prime specifically for managing seized assets, and similar transfers in January, May, and June this year did not result in confirmed liquidations.

The bigger structural point is that Executive Order 14233 is policy, not statute. Congress introduced a bill in May to codify the reserve with a 20 year holding requirement, but it has not moved out of committee. Until it does, Bitcoin's protected status here rests on one administration's choice, reversible by the next.

Full writeup with sourcing:

https://davidebtc186.substack.com/p/the-us-government-just-moved-297m

Most coverage treats ETF flows and Lightning usage as separate stories. Put them side by side and something interesting shows up.

ETF flows in the last three weeks: a ten day outflow streak that drained 2.73 billion dollars in late June, then a reversal on July 2 with 221 to 223.5 million coming back in, then 510 million across three sessions with BlackRock's IBIT leading, then a fresh 424.66 million in outflows on July 13. Year to date net outflows still sit around 5.4 billion, essentially unmoved by the July bounce.

Meanwhile Lightning Network volume is up 266 percent year over year despite public channel count declining. Average transaction value has nearly doubled to around 223 dollars. Merchant adoption of Lightning payments reached 15 percent of Bitcoin transactions by mid 2024 and kept climbing through 2025.

The interesting part is that these two trends look increasingly disconnected. ETF flows are macro driven, tracking dollar strength and Fed policy on a day to day basis. Lightning volume growth looks adoption driven, growing regardless of what price is doing. That is arguably a healthier signal than previous cycles where everything correlated with speculation.

There is also a consolidation trend worth watching. Average channels per node dropped roughly 30 percent between 2020 and 2024, meaning the network is routing through fewer, more concentrated hubs rather than a wide peer mesh.

Full breakdown with sources and a section on what to watch going into August:

https://davidebtc186.substack.com/p/the-numbers-nobody-is-connecting

One of the most underrated unsolved problems

in AI infrastructure: autonomous payment.

AI agents can write code, search the web,

orchestrate workflows — but when they need

to pay for a premium API or a data feed,

they hit a wall. Credit cards require human

identity. That doesn't scale for agents

making thousands of micropayments per hour.

Lightning Labs released a toolkit in 2026

that solves this with Bitcoin Lightning.

The key piece is the L402 protocol: an agent

sends an HTTP request, receives a 402

"Payment Required" with a Lightning invoice,

pays it automatically via lnget, and gets

access. Under one second. Zero humans.

Compared to stablecoin alternatives (Coinbase

Agentic Wallets with USDC, Stripe x402):

Lightning micropayments cost fractions of a

sat, stablecoin transactions on Ethereum or

Solana cost cents to dollars. For true

micropayments, the economics are clear.

The toolkit also supports MCP — so agents

built on Claude or GPT can query and interact

with a Lightning node directly.

It's early, but the infrastructure is real

and open source.

Full breakdown:

https://davidebtc186.substack.com/p/ai-agents-are-starting-to-pay-in

Revolut just announced Lightning integration via Lightspark for UK and European users. 35 million people will soon use Lightning. The Bitcoin media is celebrating. I think we should slow down.

Here's what Revolut is actually doing:

• NOT giving you a Lightning node
• NOT giving you channel keys
• NOT giving you any sovereignty

It's custodial Lightning. Revolut holds the keys, manages the channels, can freeze your funds, and reports every payment to regulators. It's a bank account with Lightning rails.

The real comparison nobody publishes:

Revolut Lightning vs Self-Custodial LND:

• Key custody: Revolut vs YOU
• KYC: mandatory vs none
• Fund freezing: anytime vs impossible
• Privacy: zero vs strong (Tor)
• Routing fees: Revolut keeps vs you keep
• Sovereignty: none vs complete

There are things the Revolut integration does validate: Lightning works at scale, network liquidity grows, Lightning Addresses get normalized. That matters. But 35 million surveilled custodial users is not what Lightning was designed for.

Full article:https://davidebtc186.substack.com/p/revolut-lightning-good-news-or-a

Donaet; zap@shadowbip.com

Inflation in Italy hit 3.2% in May 2026, the highest since September 2023, mostly driven by energy prices. Eurozone is at the same level, well above the ECB's 2% target. US is worse, at 3.8%.

In practical terms: €10,000 sitting in a current account today has the purchasing power of roughly €9,690 in a year. The number on screen doesn't move. Your ability to buy things with it does.

I went through the traditional options people default to — bank accounts, Italian government bonds (BTP), real estate, gold — and why each one is struggling to actually protect purchasing power right now.

Then I get into where Bitcoin realistically fits into that picture — not as a hype pitch, but weighing it against the same criteria I used for everything else.

Full post here: https://open.substack.com/pub/davidebtc186/p/your-savings-are-losing-value-is?utm\_source=share&utm\_medium=android&r=4gald6

A couple of month ago I put together a small offline BIP39 seed generator as a personal project. It worked, but after looking at it again recently I realized there were quite a few things I'd do differently today.

Instead of patching the old code, I decided to rewrite it from scratch and focus on keeping the implementation simple, transparent and easy to review.

The current version includes:

• Mandatory OS CSPRNG
• Optional supplemental entropy (manual input, dice rolls and timer jitter)
• HKDF-SHA512 for entropy mixing
• BIP39 checksum validation
• Interactive mnemonic verification
• Built-in self-test
• Automated test suite
• Windows and Linux support
• GitHub Actions CI

I'm deliberately not claiming it's the "most secure" seed generator or anything like that. My goal was to build an offline tool with conservative design choices and code that's straightforward to inspect.

If anyone has experience with BIP39, cryptography or secure software in general, I'd really appreciate a code review or any suggestions for improvement. I'd rather hear criticism now than discover a mistake later.

Repository:
https://github.com/shadowbipnode/Seed-Phrase-Generator-with-Multi-Source-Entropy

Most people think Bitcoin is anonymous. It isn't.

Every transaction is permanently on a public ledger.

Companies like Chainalysis earn $100M+ per year mapping

Bitcoin addresses to real identities — paid for almost

entirely by governments.

The techniques they use:

1. Common Input Ownership Heuristic (CIOH) — if multiple

inputs are in the same transaction, they assume one owner

2. Change output detection — round numbers, address type

mismatches, transaction graph analysis

3. Address reuse — every reuse permanently links your history

4. Network surveillance — your IP before the tx even hits

the blockchain

The defense is a layered stack:

→ Never reuse addresses (free, takes 0 effort)

→ Run your own node (no third party sees your addresses)

→ Tor on your node (strips IP from broadcasts)

→ CoinJoin — Wasabi 2.x or JoinMarket-NG (breaks UTXO history)

→ PayJoin BIP77/78 (invisible on-chain, breaks CIOH)

→ Silent Payments BIP352 (public address, zero linkable history)

→ Lightning for daily spending (zero on-chain footprint)

Full guide with practical setup for each layer:

👉 https://open.substack.com/pub/davidebtc186/p/your-bitcoin-is-being-watched-how?utm\_source=share&utm\_medium=android&r=4gald6

Questions welcome in the comments.

Most Lightning node content is "here's how to install Umbrel." Nobody writes about what happens six months later when things start breaking.

I've been running a full LND node in production and documented every major problem I hit:

- Force closes from liquidity marketplaces the moment the 30-day guarantee expires

- Top nodes (ACINQ, Bitfinex) that drain your channel liquidity completely in hours

- LND bugs that don't announce themselves — including the btcd consensus divergence and UTXO sweep issues

- Tor under sustained DDoS — CPU spikes, degraded routing, and why you still need it over clearnet

First chapter is free, rest is behind a paywall. Worth it if you're running or planning to run a node.

👉 https://davidebtc186.substack.com/p/what-nobody-tells-you-about-running

Most people discover Nostr as a Twitter replacement. That's fine, but it's only the surface.

​

When you connect your LND node to Nostr via Nostr Wallet Connect (NIP-47), something more interesting happens: Zaps hit your node directly — no custodian, no KYC, no middleman.

​

The flow looks like this:

​

Nostr Client → encrypted NIP-47 request → Relay → your LND node

LND node → encrypted response → Relay → Nostr Client

​

The relay never sees the content. Nobody in the middle knows what's happening.

​

Full breakdown here:

👉 https://open.substack.com/pub/davidebtc186/p/nostr-and-lightning-the-protocol?utm\_source=share&utm\_medium=android&r=4gald6

​

⚡ zap@shadowbip.com

After running a Raspberry Pi node at home that died without warning, I moved everything to a bare metal VPS on Contabo. No prepackaged solutions — just Ubuntu 24, Docker, Bitcoin Core 28.1, LND 0.20.1, and a stack I assembled one by one.

The article covers the full setup including real bitcoin.conf and lnd.conf, SSH hardening, UFW + Fail2ban, channel strategy mistakes (don't open to big nodes — learned the hard way), ZeroTier private network for monitoring without exposing any public ports, automatic channel.backup redundancy, BOS via Telegram, and LiT for auto fee management.

7 channels live, node visible on Amboss if you want to verify it's not theoretical.

Full guide (paid): https://davidebtc186.substack.com/p/how-i-built-my-own-bitcoin-lightning

Happy to answer questions here.

⚡ donate@shadowbip.com | 🛠 github.com/shadowbipnode

Following up on the Silent Payments article from last week — several people asked about the spending privacy side.

Honest answer: SP + Lightning is already a strong combo. But if you ever need to spend on-chain, you want CoinJoin'd UTXOs as inputs. Otherwise CIOH heuristics can still reconstruct your history.

The stack I'd recommend in 2026: receive via sp1q... address, CoinJoin with Wasabi + OpenCoordinator or JoinMarket/Jam before any significant on-chain spend, route everyday payments through Lightning. Each layer attacks a different part of the surveillance graph.

Full guide here: https://davidebtc186.substack.com/p/you-fixed-your-receiving-privacy

Curious if anyone here has a different approach for the on-chain spending layer.

⚡ donate@shadowbip.com | 🛠 github.com/shadowbipnode

Most of us have been in this situation: you want to share a Bitcoin address on your website, your Nostr profile, or your email signature — but you know that a static address is a privacy nightmare. Anyone can see every payment you've ever received.

Silent Payments solve this elegantly. One static address (sp1q...), every payment lands on a different on-chain address, completely unlinkable. No centralized servers, no notification transactions, no coordination with the sender. Just cryptography.

I wrote a full technical breakdown covering how the ECDH derivation works, current wallet support (Cake Wallet, Dana, BlindBit, Sparrow), the scanning tradeoff, and how it compares to BIP47/PayNym.

https://davidebtc186.substack.com/p/silent-payments-bip352-the-complete

Posted a new guide in my sovereign-linux-tools repo. The short version: most nodes I've seen have no firewall configured at all. Default Linux accepts connections on every port.

The guide covers:

- Default policies (deny incoming is the only sane starting point)

- Exactly which ports to expose: 8333 for Bitcoin P2P, 9735 for LND P2P

- What to never expose: RPC (8332), LND gRPC (10009), REST (8080)

- SSH tunnel pattern for remote gRPC access instead of opening the port

- Rate limiting + Fail2ban on Ubuntu 24 (there's a known issue with banaction that breaks banning after enabling UFW)

- nmap audit command to verify what's actually visible from outside

All commands are copy-paste ready, tested on Ubuntu 24 LTS.

Repo: https://github.com/shadowbipnode/sovereign-linux-tools

Feedback welcome — especially if you run a different stack (CLN, Umbrel, etc.) and the port list needs expanding.

A few weeks ago I shared the first beta here while experimenting with the idea of a browser built around Nostr, Lightning and privacy-first workflows.

Since then the project evolved a lot faster than expected.

This new release adds:

• built-in update checker
• multi-theme engine
• improved popup/interstitial blocking
• overlay ad cleanup
• improved NIP-07 permission handling
• automated Linux + Windows releases

Now shipping:

• AppImage
• deb
• rpm
• Windows installer
• portable builds

Still beta, but the project is starting to feel much more stable and usable compared to the early builds.

Really appreciate all the feedback people gave on the previous post — a lot of fixes and ideas came directly from community comments and GitHub issues.

Repo:
https://github.com/shadowbipnode/Zap-Browser