Matt Luongo ✜

Thrilled to announce that we've acquired @trylolli! For me, this is a homecoming. After helping start the Bitcoin rewards space @fold_app in 2014, I’m doubling down on our vision to help the world stack sats. Here’s why this acquisition is HUGE for Bitcoin rewards 👇

I find it frustrating that none of these "guardians" of Linux and open source have reacted to the OS-level age verification law: - Linux Foundation - Open Source Initiative - Free Software Foundation - Software Freedom Conservancy

Everyone complying with these draconian age-verification laws in free and open source software is weak-willed and spineless. They should be ostracized.

Suck a fucking dick @RedHat. Spineless chickenshit little fucking cowards.

accidently typed in gail.com instead of gmail, and its my new favorite website.

This is massive. Atomic swaps between Lightning and USDT on shitcoin chains is huge privacy and security upgrade. Under the hood, this is cypyerpunk AF. Even if I don't like it, USDT is undeniably part of the sovereign individual toolkit.

We shipped a lil something today: USDT Swaps ⚡💵 Lightning ↔ USDT. No custody. No accounts. No KYC. Move from sats to stablecoins in seconds, across a growing number of networks. 👉 beta.boltz.exchange 👈 Read the full announcement: blog.boltz.exchange/p/introducing-…

Big shout-out to the teams behind @USDT0_to and @tBTC_project 🙌 You are providing essential infrastructure that makes non-custodial Bitcoin ↔ stablecoin flows possible in the first place 🙏

@tierotiero @gringokiwi Ah Ethereum did channels back in the ICO days (Raiden). Just raised way too much and sputtered about before there was PMF

There is something ironic about Bitcoin moving toward L2 blockchains/rollups, while Ethereum and Tempo are now discovering state channels for payments. It’s like, folks, could you just talk?

Excited to work together with good friend @arshbot Bitcoin-aligned service providers such as @magnolia_rails can leverage the architecture in a self serving manner to improve the Bitcoin user experience of their customers

Banking rails are coming to Arkade. We're collaborating with @magnolia_rails to bring US banking (soon Europe) infrastructure into the ecosystem. Regulated coverage across all 50 states. ACH, wires, crypto conversion through a single API.

We've been focused on open protocols from day one. We're not trying to corner the stack and build walled gardens. We look for the best partners in their respective fields and build together towards a common vision.

@DennisonBertram Good luck ser

This is the end folks.

March 1st incident report On March 1, 2026, Bitrefill was the target of a cyberattack. Based on indicators observed during the investigation - including the modus operandi, the malware used, on-chain tracing and reused IP + email addresses (!) - we find many similarities between this attack and past cyberattacks by the DPRK Lazarus / Bluenoroff group against other companies in the crypto industries. The initial access originated through a compromised employee laptop, from which a legacy credential was exfiltrated. That credential provided access to a snapshot containing production secrets. From there, the attackers were able to escalate their access to our broader infrastructure, including parts of our database and certain cryptocurrency wallets. We first detected the incident after noticing suspicious purchasing patterns with certain suppliers. We realized that our gift card stock and supply lines were being exploited. At the same time we found some of our hot wallets being drained and funds transferred to attacker-controlled wallets. The moment we identified the breach, we took all of our systems offline as part of our containment response. Bitrefill operates a global e-commerce business with dozens of suppliers, thousands of products, and multiple payment methods across many countries. Safely switching all these things off and bringing them back online is not trivial. Since the incident, our team has been working closely with top industry security researchers, incident response specialists, on-chain analysts and law enforcement to understand what happened and how we can prevent it from happening again. A sincere thank you to @zeroshadow_io, @SEAL_Org, @RecoverisTeam and @fearsoff for their rapid response and support throughout this ordeal. What about your data Based on our investigation and our logs we don’t have reason to think that customer data was the target of this breach. There is no evidence that they extracted our entire database, only that the attackers ran a limited number of queries consistent with probing to understand what there was to steal, including cryptocurrency and Bitrefill gift card inventory. Bitrefill was designed to store very little personal data. We are a store, not a crypto service provider. We don’t require mandatory KYC. When a customer chooses to verify their account - e.g. to access higher purchasing tiers or certain products - that data is kept exclusively with our external KYC provider, with no backups in our system. Still, based on database logs, we know that a subset of purchase records was accessed and we want to be transparent about that. Around 18,500 purchase records were accessed by the attackers. Those records contained limited customer information, such as email addresses, crypto payment address, and metadata including IP address. For approximately 1,000 purchases, specific products required customers to provide a name. That information is encrypted in our database. However, since the attackers may have gotten access to the encryption keys, we are treating this data as potentially accessed. Customers in this category have already been notified directly by email. At this time, based on the information currently available, we do not believe customers need to take specific action. As a precaution, we recommend remaining cautious of any unexpected communications related to Bitrefill or crypto. If this assessment changes, we will of course immediately inform those affected. What we are doing We have already significantly improved our cybersecurity practices, but vow to continue to draw learnings from this experience to make sure user and company balances and data remain maximally safe. Specifically we’re: -Continuing thorough cybersecurity reviews and pentests with multiple external experts and implementing recommendations; -Further tightening internal access controls; -Further improving logging and monitoring for faster detection and more effective response; and -Continuing to refine and test our incident response procedures and automated shutdown procedures. The bottom line Getting hit by a sophisticated attack sucks (a lot). We’ve been in business for over 10 years and it’s the first time we’ve been hit this hard. But we survived. Bitrefill was designed to limit the impact if something like this ever happened. Bitrefill remains well funded, has been profitable for several years and will absorb these losses from our operational capital. Almost everything is back to normal: payments, stock, accounts. Sales volumes are also back to normal, and we are eternally thankful to our customers for your continued confidence in us. We will continue to do our best to continue deserving your trust. Thank you!

@z0r0zzz @thedaofund @ethereum @Bashir_AbuAmr Obvious downsides * adding a permissioned or semi-permissioned layer to deployment * a bunch of auditors would likely lose money. You can see this as good or bad depending on how you view markets I guess :)

@z0r0zzz @thedaofund @ethereum If it worked, I think auditors would get a longer-term, more scaleable business model, and the chain would be a safer place. We never got to test it though. cc @Bashir_AbuAmr

how to solve smart contract security once and for all: safe-factory: anyone can send bytecode through this create2/create3 factory *but* it must include signature from audit software *then* the contract is deployable users can trace all deployments to this "safe" factory

@z0r0zzz @thedaofund @ethereum We played with something like this for Mezo. There are... downsides ha. Also need alignment between auditor and users, etc.

@thedaofund could even secure this for @ethereum To make this sustainable: Fee can be attached to deployment which pays for audit To make this a public good: "queue" system: Everyone can publish through safe-factory, they just might have to wait 1-2 days if no fee

I’m going to keep harping on this. Meta’s push to remove encryption and lobby for age verification laws feel like two sides of a very ominous coin.

Ep 3 of Beyond Digital Gold is out! Will the real Bitcoin DeFi Please Stand Up?? Everyone disagrees with what Bitcoin DeFi is. Some say it already exists through wrapped Bitcoin on Ethereum. Others argue it will happen on Bitcoin Layer 2s, while disagreeing on what Bitcoin Layer 2s are. And some believe the only real Bitcoin DeFi must happen directly on Bitcoin itself. In our latest episode in our Beyond Digital Gold documentary series with @StarkWareLtd , we map the entire ecosystem and break down the six competing models trying to unlock Bitcoin’s trillion-dollar liquidity. Watch here 👇🏻 Full episode: youtu.be/cBHh1Fq9GjU?si…

The federal government is buying your private data to avoid getting a warrant. Today, I introduced the Government Surveillance Reform Act to close the data broker loophole and require a warrant for every search of Americans’ data. wired.com/story/us-lawma…