Weekly Brief 2026/33

Last week the story was that AI had started probing the entire Bitcoin stack. This week the damage was confirmed: BTCPay Server disclosed that the exploited vulnerability had cost real funds, Cuba's privacy-first Lightning rail shut down indefinitely under sustained attack, and a volunteer red team's own numbers showed the open-source stack is more exposed than assumed. And yet the payment layer kept shipping — Wallet of Satoshi moved to self-custody, Blink added non-custodial receiving to its BTCPay plugin, and everyday sats purchases widened across Africa. Security is now a permanent, machine-speed discipline, and this was the week that became undeniable.

The same pressure took a rail offline entirely. Cuba's lnp2pBot, a non-custodial P2P Lightning exchange, halted all activity indefinitely after months of security work and, per its operators, insufficient resources to keep facing AI-assisted attackers. Crucially, they said pending payments would be resolved and losses absorbed so no user was left short. This was not a government ban — it was attrition. Cuba_BTC (@Cuba_BTC) said the service had let hundreds of families send person-to-person help for necessities including medicine, without surrendering personal data. When a privacy tool this useful can be worn down by attacks and cost, resilience and funding become adoption issues, not footnotes.

Underneath the security headlines, everyday sats spending kept turning listings into receipts.

• Small-ticket spend, real receipts: A purchase at T-Junction fast food in Randfontein went through over Lightning on a Blink address; in Calabar, lunch was paid over Lightning at Chef Green Signature; in Livingstone, Bitcoin bought goods at Andrews Grocery and City Market. The common rail is a Blink Lightning address plus a BTC Map listing — and the widening list of sectors (fast food, groceries, produce, personal care) is the real signal, even if none of these posts disclose sat amounts.
• Dominican Republic — bill pay for household services: Bitcoin Dominicana (@btcdominicana) says users can now pay electricity, water, internet, telephone and recharges from a wallet while the platform settles the provider in Dominican pesos — naming EDENORTE, EDESUR, CAASD, INAPA, Claro and others. This is an availability announcement (the guide carries an affiliate link), not a disclosed usage metric, but a recurring household-bill category is exactly the kind of repeat use that acceptance listings can't prove on their own.
• Named venues, honest caveats: Several BTC Map records this week were older than their posts or showed name mismatches — a reminder that the directory is a starting point, not proof of live acceptance. We flag the ones we can't independently confirm rather than counting them as fresh wins.

The defensive half of the week is as important as the disruption — and receiving Bitcoin got easier to self-host at the same time.

• Blink adds non-custodial BTCPay receiving: Blink's (@blinkbtc) BTCPay plugin (v1.1.0) now lets a merchant connect a non-custodial Blink Lightning address without a node or API key and receive on mainnet. It is receive-only — refunds, payouts and other outbound Pull Payments aren't supported, and settlement is detected by polling (usually within seconds, occasionally about a minute). It requires BTCPay 2.4.2+, which dovetails with this week's mandatory security update.
• The stack scans itself: Calle (@callebtc) reported that the volunteer Bitcoin Red Team — 25 developers over 108 hours — scanned 501 projects and produced 7,958 findings, including 1,280 rated high or critical, with roughly 29% already reported to the affected projects. He also warned that Lightning code looked "more broken than the average." These are defensive findings, not payment failures — but they quantify exactly why BTCPay, Boltz and others spent the month hardening.
• Continuity under pressure: Machankura (@Machankura8333) temporarily disabled some receive paths while it applied a fix, then restored two-way payments; BTCPay hosts like LunaNode gated access until instances upgraded. Not growth milestones — but proof that operators are treating patch discipline as a condition of staying online.

The clearest adoption loops still come from communities that earn and spend in the same place.

• Mossel Bay — a first restaurant payment: Bitcoin Ekasi (@BitcoinEkasi) described a visitor paying at Blaize & Barrel using a self-hosted BTCPay Server and a Bolt Card — the same self-host-your-own-rail model the security week argues for, running at the level of a single restaurant tab.
• Kenya — earn it, then spend it: Bitcoin Chama (@Bitcoinchama) kept rewarding members in sats and adding Masimba merchant endpoints, extending the same earn-and-spend loop week over week.
• Education keeps feeding the pipeline: From Bitcoin Karoo's education block in De Rust to workshops onboarding new merchants, the funnel from learning to spending stays full — the unglamorous groundwork that turns a listing into a habit.

South Africa produced the week's clearest policy signal — and the first organized industry pushback against it.

• South Africa — a draft cross-border reporting framework: A National Treasury/SARB draft (published August 3, comments due September 30) would require offshore crypto payments to be declared through authorised providers and reported to SARB's FinSurv arm. It treats movement from a local provider such as Luno or VALR to an offshore network or a self-custody wallet as a cross-border transaction, within existing FX allowance ceilings (R2m Single Discretionary, R10m Foreign Capital). Worth stressing: this is a draft, it governs cross-border flows, and it covers crypto broadly, not Bitcoin specifically. The underlying Capital Flow Management Regulations aren't final, and purely domestic transfers between local providers are described as non-reportable.
• Industry pushes back: MoneyBadger CEO Carel van Wyk (@MoneyBadgerPay) called the draft's restrictions "disproportionate and poorly justified," warning they could stop South African companies from using crypto for legitimate cross-border payments and push them back toward conventional banking. That's an interested party's view — but it's the clearest sign yet that the industry will contest the draft before the deadline.

A confirmed exploit, a P2P rail worn down to nothing, thousands of vulnerabilities catalogued, and a custodial giant handing users their keys — all in one week. The pattern from the last two briefs is now the operating reality: security is continuous and machine-speed, and the services still standing will be the ones that self-host, patch fast, and hold their own keys. And through all of it, someone in Randfontein still bought lunch with sats. See you next week.