SimpleX and Nostr. Running privately through my start9 server over TOR. Overkill? It’s a pretty good feeling knowing my information is mine and can’t be seen by anyone else.

Tick tock. Next block.

Yesterday it was Liechtenstein's ownership register. 31,000 companies and the people behind them, exposed. Today it's AI voice scams hitting Two Sigma, Citadel, Point72. These aren't separate stories. The register leak hands over the map of who owns what and who's connected to whom. That's exactly what you need to run a convincing impersonation attack. AI does the voice, stolen data does the convincing. Every central register built "for security" becomes ammunition for the next breach. You centralize identity to catch criminals, and criminals use it to sound like someone you trust. Each leak makes the next attack cheaper. The flywheel is already spinning. The exit is the same as it always was. Don't put your wealth where it can be mapped, and don't put your trust in a voice on the phone. Keys you hold yourself can't be socially engineered.

Liechtenstein's beneficial ownership register just got breached. 31,000 companies, foundations, and trusts exposed. This register was built in 2021 to meet EU anti money laundering rules. It was supposed to fight crime. Instead, it became the single most valuable target in the country. When you centralize sensitive information, you don't remove risk. You concentrate it. You build a honeypot. The people on that list didn't choose to be there. The law made them submit. Now they carry that risk forever.. extortion, kidnapping, coercion, for a system that was supposed to protect the public. Governments keep building these because the goal was never security. It was legibility. Control. The EU Court of Justice struck down public access to these registers in 2022 because they violated privacy. The warning was already issued. They built the honeypots anyway. This is why self custody matters. This is why non KYC matters. This is why you don't trust governments with your data and then act surprised when it leaks.

So which company will be the first one to sell a device with the Ian Coleman script on it that all it does is find the 24th word for you? No connection, no Wi-Fi, no data, no Bluetooth nothing like that just a basic script 

The Coldcard incident is being called a lot of things. An RNG failure. An AI failure. An open source failure. The best diagnosis I saw this week came from someone on Nostr, Alex Waltz, who said it was none of those. It was a failure of scrutiny. People tried to ask questions about Coldcard over the years. They got called FUD, their character got attacked, and the ecosystem around them learned to stay quiet. Sponsorships, grants, and social standing all pointed in the same direction. Don't poke. The aviation industry already lived through exactly this failure. Before the late 70s, cockpits ran on rank. The captain's word was law, and junior crew members hesitated to contradict him. That silence is what killed 583 people at Tenerife in 1977, two 747s colliding on the runway because concerns got swallowed instead of spoken. The industry's response is the part worth copying. They built Crew Resource Management, where the newest first officer is expected to challenge the captain and the captain is trained to listen. They built ASRS, where anyone in the system can file a safety report anonymously, with immunity from enforcement action, and the findings get published to every airline and every manufacturer. No blame attached to the messenger. They did it because they worked out the math. Silence costs more than embarrassment. One awkward report today prevents one hull tomorrow. Self custody has no ASRS. There is no reporting body, no published findings, no protection for the person asking the question. Scrutiny is voluntary and social, which means a vendor's security is only as good as the social cost of asking about it. What would actually fix it is boring. A neutral place where anyone can raise a question about any wallet, from any vendor, without being treated as an attacker. The question gets forwarded, the answer gets published, and nobody loses their grant for asking. Aviation paid for its reporting culture in funerals, over decades. Self custody just paid $90 million in four waves of drains. That should be enough to buy the same lesson without the waiting.

A question regarding RBF. Shouldn’t it only be accepted if it comes from the same node as the original transaction?

Just flipped a coin 256 times.

What happens now with the closed source verse open source debate. Open source is fantastic but now it gives an attacker the entire source code to exam. It’s been said before, an attacker only needs to find one weakness. A defender needs to find them all.

I think now that mass adoption of self custody was never going to happen. It’s meant to be getting easier but it’s not. I think it will always be only the ones who are very interested in figuring it out. The masses who will eventually see that Bitcoin is the best asset on the planet will hold it through ETF’s or similar products.