Three weeks of security warnings have turned into something more useful: a working blueprint. This week a duty-free shop at Oslo Airport settled its Bitcoin sales directly to a non-custodial wallet, BTCPay's founder put feature development on hold to shrink the attack surface, ZEUS's post-mortem showed customer custody holding through a real breach, and a 600-person South African town showed what everyday acceptance looks like at scale. The tooling is getting concrete — and so is the discipline around it.
From duty-free to self-custody, in one checkout: Tax Free Norway's shop at Oslo Airport now routes all of its "freedom money" sales through BTCPay Server directly to a non-custodial Blink account, per @NorthOfTheWalls — no custodian between the till and the merchant's wallet. It's a live deployment at one store (no sales figures disclosed), but it's exactly the integration path Blink opened up last week, running at an international airport. Meanwhile Nicolas Dorier (@NicolasDorier), BTCPay's founder, said the project will put the brakes on new features — future releases may even remove features or break compatibility — because combining features creates attack surface. And ZEUS's post-mortem on its August 5 breach confirmed the design held: the attacker closed most of its LSP channels via the exploited BTCPay vulnerability, but channel closures settled balances back to their owners and no customer funds were lost or at risk.
The pattern across all three: self-hosted, non-custodial paths survived contact with reality. The airport checkout removes a custody layer instead of adding one. Dorier is trading feature velocity for attack surface. ZEUS lost channels and weeks of operations — but not a sat of customer funds. That's the trade the whole stack is now making.
Spotlight: Witsand — What a Bitcoin Town Actually Looks Like
Witsand, Western Cape — roughly 600 residents, about 45 establishments accepting Bitcoin across groceries, restaurants and fuel. Money Badger (@MoneyBadgerPay) called it a tiny South African town going "all in." The honest caveat comes with the story: the linked report dates that count to April 2025, so treat it as a footprint baseline, not current-period growth.
What makes the model interesting isn't the headline number — it's the plumbing. Merchants receive guaranteed fiat exchange rates, removing volatility exposure; the effort started with a local programmer and restaurant owner rather than a national program; Garden Route tourism gives businesses a visitor-spend channel beyond the village itself; and the community has begun facilitating Bitcoin-denominated loans. No transaction volumes are reported — but as an adoption template, it's the most complete one we've covered.
1) Merchant & Enterprise Adoption
The grassroots layer keeps producing named venues and priced purchases.
- Calabar — a purchase with a price tag: A member paid less than 0.00001 BTC at Food and Wine Shop, describing instant settlement with "no third party, central bank or bank involved." The venue also reports dinner payments becoming a "daily norm" at Chef Green Signature. One priced transaction isn't throughput — but it's rarer evidence than another acceptance listing.
- The everyday-goods list keeps widening: A haircut at De-Palace Barbershop in Akatsi, a charging cable at Viwa Accessories in Nairobi, family food at Grandsmatt, fruit in Randwest, a samosa at Haven food court. Same lightweight stack everywhere: a Blink Lightning address plus a BTC Map listing. Worth repeating our standing caveat: several directory records predate these posts or still need location verification, so this is endpoint reach, not a fresh-onboarding count.
- Dominican Republic — a local merchant playbook: Bitcoin Dominicana's new guide walks merchants through browser-based BTCPay point of sale on any phone or tablet and says more than 100 Dominican businesses already accept Bitcoin this way. That's the guide's own claim, not an independent count — but it pairs with real legislative movement (see Policy).
- Cuba — travel services join the map: Cuba_BTC promoted BitrideGo, described by the event sponsor as Cuba's first motorcycle-rental agency taking Bitcoin, alongside a 25,000-sat Yu-Gi-Oh! tournament. Category expansion for travelers; usage numbers don't exist yet.
2) Payment Infrastructure & Usage Metrics
Hardening continued below the headlines — and one team stress-tested machine payments properly.
- Machine payments pass a real benchmark: Lightning Enable ran its isolated Lightning settlement suite through 30,000 consecutive paid flows and 42,562 total settled payments with zero failures, plus reconciled runs at 1,000 / 100,000 / 1 million iterations. Important framing: this is a controlled regtest engineering benchmark, not network volume — but it's the kind of repeatability evidence agentic-commerce infrastructure needs before production.
- AI moves into node operations:
ldk-server-mcp (pre-release) exposes LDK node RPCs as tools for AI clients like Claude Code — the example being querying low-outbound-liquidity channels. An operations interface today; potentially a big operational burden-cutter if it hardens.
- Custody clarity for merchants: The Dominican guide draws the line precisely — on-chain receiving goes to a wallet the merchant controls via xpub (which can generate addresses but can't spend), while using a third-party host's internal Lightning node sends Lightning payments to that host's wallet. Custody depends on configuration, not the BTCPay label.
3) Circular Economy & Ground-Level Proofs
The earn-to-spend loop now has numbers attached.
- Mossel Bay — from classroom to restaurant table: Bitcoin Ekasi's latest cohort update: 10 Diploma students, 31 attendances, 15,500 sats in learning rewards — and after graduation, some students paid for restaurant meals with the Bolt Card, some visiting a restaurant for the first time. Education metrics, not payment volume — but the bridge from learning rewards to a card tap at a restaurant is now demonstrated end-to-end.
- Kenya — the full loop in one business: Bitcoin Babies profiled Joyce, whose Beauty Secrets shop sells products for sats, sells bitcoin liquidity to her neighbours, and teaches them how to use it — merchant, liquidity provider and educator in one person.
- El Salvador — funded care keeps paying out: BitcoinSmiles says 2,971 donors raised 1.97 BTC for dental care that is still funding treatment, with a second treatment room planned in Santa Ana. Donation-funded delivery, not retail — but recurring, and expanding.
4) Regulatory & Policy
The Dominican Republic moved from stalled bills to statutory mentions — without becoming regulation.
- Dominican Republic — recognized, not regulated: Two enacted laws now mention cryptoassets. Law 74-25 (effective August 2026) contains the country's first statutory reference to digital assets — inside its pyramid-fraud provision; it defines nothing, licenses nothing. Law 30-26 (June 2026) adds digital goods and cryptoassets to the Tax Code's capital-asset definition: holding Bitcoin isn't taxed; a profitable sale is a capital gain. The peso remains the only legal tender, accepting Bitcoin remains voluntary and legal, and two sectoral bills remain stalled in Congress. Recognition, not regulation — merchants keep building meanwhile.
- South Africa — off the wire this week: The Treasury/SARB cross-border draft we covered in the last two briefs saw no material development; comments remain due September 30. We'll pick it back up when there's news.
An airport checkout settling straight to a non-custodial wallet, a founder trading features for attack surface, a town of 600 showing the full playbook, and a cohort of diploma students tapping a Bolt Card at a restaurant. After three weeks of pressure-testing, the stack isn't just surviving — it's converging on the shape it needs: self-hosted, non-custodial, boring in the best way. See you next week.
