Weekly Brief 2026/31

This week was about payments you can verify. Blink shipped the Terminal — a cash register that lives in a browser tab. BTCPay Server rebuilt multisig for teams. Machine-to-machine commerce got its own protocol site. And a hardware-wallet fiasco reminded the whole ecosystem why real open source — not just readable code — is the foundation everything else stands on.

Grassroots acceptance kept filling in the gaps between merchants — this week, the spaces between arriving somewhere and settling in.

• El Salvador — the whole trip on Bitcoin: In Berlín, Bitcoin Berlín SV (@BitcoinBerlinSV) added Erick's tuk-tuk at the bus terminal to the town's Bitcoin options — riders arriving can pay for the trip in sats. Paired with Hostal Brisas de Berlín (rooms, breakfast, coffee), a visitor can now arrive, ride, sleep, and eat without touching fiat. The last-mile gaps are where a payment culture becomes livable.
• South Africa — a spending challenge: A "Proof of Spend" challenge (@MoneyBadgerPay, introduced by @NickDarlington) asks 100 participants to support small businesses through an online circular-economy model — deliberate demand creation, not just merchant onboarding.
• Dominican Republic — first transactions and a tech-week seat: Nearly 30 people made their first Bitcoin transactions at Bitcoin en la Zona (@btcdominicana), while Bitcoin Dominicana joined Dominicana Tech Week 2026 — putting Bitcoin in front of the country's developers and entrepreneurs.
• Africa — the address is still the storefront: Eight new merchant payments were documented this week via Blink Lightning addresses with BTC Map listings and video: from a contactless Bitcoin POS at a food-and-wine shop in Calabar, Nigeria, to youth tapping cards at Ekasi's Ebenezer Shop after class, to a sweet bought at a Kenyan shop. Same pattern, more places.

Beyond the multisig spotlight, the week's other big infrastructure move was giving machines a place to pay.

• L402 gets a protocol site: Lightning Labs (@lightning) launched l402.tech, positioning L402 as "the protocol for machine-to-machine commerce on Lightning" — agents pay with bitcoin and authenticate with no accounts, no intermediaries, no API keys.
• ...and a store to shop at: Lightning Enable opened an Agent Commerce Store — 55 pay-per-call endpoints across 14 categories (weather, markets, scholarly search, and more), priced at 1 to 10 sats each and machine-discoverable, with every spend producing a receipt. A live catalog for machines that pay their own way.
• Under the protocol: A review of the last 18 months of Bitcoin Core work highlighted payment-relevant gains — better relay for time-sensitive Lightning and Ark transactions, cheaper and more private MuSig2 multisig, silent payments, and FROST threshold signatures.

The clearest adoption signal came from a chicken coop.

• Kenya — the loop closes on a chicken farm: Bitcoin Chama (@Bitcoinchama) said Jusper bought chickens from the community's own chicken-coop project — in Bitcoin, not cash or mobile money. The community grows the food, sells it, pays in Bitcoin, and saves in Bitcoin: earning, selling, paying, and saving inside one local loop, no banks or middlemen. That closed loop is a stronger signal than any single acceptance announcement.
• South Africa — learning that pays: Bitcoin Ekasi (@BitcoinEkasi) reported that 7 of 9 Bitcoin Diploma students returned after the holidays and earned 10,000 sats during the week, with postgraduate attendance climbing from two students to six. Education that puts sats in pockets keeps the circular economy fed.
• The pipeline keeps filling: AfribitKibera introduced Bitcoin to a new Kibera community; Mavapay's CEO ran hands-on Lightning cross-border settlement at a developer bootcamp in Addis Ababa, Ethiopia; and Bitcoin House Bali prepared My First Bitcoin classes across Indonesian cities.

A hardware-wallet fiasco put the week's real subject — who controls your keys, and how safely they're made — front and center.

• What happened: Block's Bitcoin engineering and security teams reported a vulnerability in Coldcard firmware — a random-number generator that could fall back to a predictable software source instead of the device's hardware randomness — and said active exploitation was under way. They also cautioned that their testing was not yet complete and that the advisory reflected Block's current opinion; independent researchers said the exact attack mechanism was still unclear and described a small minority of users as affected. Critically, upgrading firmware does not repair a seed that was already generated on a vulnerable device.
• The lesson: Two things the ecosystem took away. First, entropy quality is everything — a seed is only as secure as the randomness that made it. Second, and sharper: being able to read the code is not enough. Coldcard's firmware was source-available, not open source — the code was public, but the license withheld the rights to freely use, modify, and redistribute it. Those rights are what give independent researchers, builders, and competitors a real stake in scrutinizing code; open source works because its licenses create that incentive to review. Strip the rights away — especially when responsible disclosure is treated as hostile — and the review system breaks down no matter how public the code is. For savings held long-term, transparent seed generation with genuinely open tools — community resources like seedpicker.net among them — lets you verify exactly how your entropy is produced.
• Where Blink stands: Blink (@blinkbtc) confirmed that non-custodial Blink wallets are not affected. The 12 words are created only from your phone's secure hardware randomness — and if that randomness isn't available, the app refuses to generate a seed at all rather than fall back to something weaker. That's the exact failure mode this incident was about. Blink also reiterated the basics for users moving to self-custody: lose your phone and you can recover; lose your seed phrase and the bitcoin can be gone for good.

One live policy thread from South Africa.

• South Africa — taxing the coffee: MoneyBadger (@MoneyBadgerPay) noted that in South Africa, spending Bitcoin — even on a coffee — counts as a taxable event requiring a tax calculation. Carel van Wyk has proposed exempting small everyday-spending wallets, with comments open to SARS until August 31. It's a proposal and a consultation, not a change in law — but how it lands will shape whether routine low-value Bitcoin spending stays practical.

A cash register that's just a link. Multisig that finally coordinates itself. A security fiasco that made the case for real open source better than any argument could. The thread running through all of it: the more you can verify, the more the money is yours. See you next week.