This was the week the security warnings became confirmed damage.

BTCPay confirmed an exploited bug cost real funds. Cuba's non-custodial lnp2pBot shut down indefinitely under sustained attack. A volunteer red team logged 7,958 findings across 501 projects.

And the payment layer kept shipping anyway: Wallet of Satoshi moved to self-custody, Blink added non-custodial BTCPay receiving, and everyday sats purchases widened across Africa.

The lesson holds — self-host, patch fast, hold your own keys.

https://www.blink.sv/blog/weekly-brief-2026-33

There is exactly one piece of information that can empty your Bitcoin wallet: your backup phrase.

Nobody needs it typed into a website. Not Blink. Not "Blink support." Not any wallet asking you to "verify," "restore," or "sync."

New blog post on backup phrase phishing and the one rule that keeps you safe:
https://www.blink.sv/blog/backup-phrase-seed-phrase-phishing-warning

The Blink plugin for BTCPay Server now supports non-custodial accounts.

No node. No API key. Connect your Blink Lightning address and start accepting Bitcoin, receive-only, on mainnet.

Same battle-tested plugin. Now without handing over any keys.

https://www.blink.sv/blog/blinks-btcpay-server-plugin-with-non-custodial-accounts

AI-assisted attacks forced the swap provider Boltz offline, took Satora down briefly, and had BTCPay shipping an emergency patch for a critical, actively-exploited bug.

The twist: the same AI is now hardening the whole open-source Bitcoin stack. The lesson — self-host, stay patched, build redundancy.

https://www.blink.sv/blog/weekly-brief-2026-32

The Blink Terminal is here: a cash register in a browser. Open a link, take Lightning payments — nothing to install.

BTCPay rebuilds multisig for teams, a Salvadoran town adds tuk-tuk rides in sats, and the hardware-wallet fiasco shows why real open source — not just readable code — wins.

https://www.blink.sv/blog/weekly-brief-2026-31

Your non-custodial Blink wallet is safe.

Blink is not affected by the recently discovered vulnerability of hardware wallet vendor Coldcard.

Your 12 words are created only from your phone's secure hardware randomness — and if that randomness isn't available, the app refuses to create a wallet.

Read more about security at Blink:
https://www.blink.sv/blog/know-your-keys

Accepting Bitcoin just got easier: the new BTCPay plugin turns a Blink Lightning address into a full merchant setup — no node, no API key, your keys.

Lightning Labs ships Wavelength, pooled sats buy a cow, and a town in El Salvador pays for laundry, juice, and coffee in bitcoin — this week's brief.

https://www.blink.sv/blog/weekly-brief-2026-30

Accept Bitcoin on BTCPayserver with Blink — now with non-custodial accounts. Connect with just your Blink lightning address, keep custody of your funds, and skip the technical hassle. See it work in under 5 minutes

Get started → blink.sv/btcpay
Plugin → https://plugin-builder.btcpayserver.org/public/plugins/blink
Docs → https://dev.blink.sv/examples/btcpayserver-plugin

$49.3M pushed through open-source BTCPay rails in a year. A Salvadoran school canteen improvising NFC cards so kids can tap to pay in sats. New merchants in Cuba and the Dominican Republic.

Bitcoin payments, proving themselves at every scale — this week's brief.

https://www.blink.sv/blog/weekly-brief-2026-29

A payment app demanded a Lightning sender's real name — or your money back. A sharp reminder of why self-custody matters.

This week's brief also covers Bitcoin at the travel counter, a Salvadoran coast with 170+ merchants, and townships running their own payment networks.

https://www.blink.sv/blog/weekly-brief-2026-28