The Commoner

Monday, November 2, 2026

Sup, freaks.

Supermarkets are throwing away food after another round of refrigeration attacks. We return to our October warning and the work needed to protect food, water and power systems. Below: Mercado Bitcoin, BTCPay’s rebuild guidance, Binance’s reserve update and the AI providers’ growing influence over users and infrastructure.

WHAT TO EXPECT IN THIS NEWSLETTER

• European refrigeration incidents follow October’s French attacks; Sweden reports spoiled inventory, while a prepared Estonian store avoided losses.
• Stocking necessities helps households; exposed controls and unsupported equipment need operators’ attention now.
• Mercado Bitcoin confirms an incident; BTCPay tells affected operators that updating alone is insufficient.
• Binance reports roughly 95% replenishment; Anthropic details its conversation monitoring, and Axios reports OpenAI's post-election policy plans.
• LND's Linux mitigation does not replace a kernel patch.

Marty's Bent

Supermarket Freezers Are Becoming Cyberattack Targets

I don't think the machinery keeping our food from rotting should be accessible to random people on the internet. That seems like a fairly obvious thing to say, yet here we are watching supermarket employees throw away inventory because somebody reached into a refrigeration controller and changed its settings. Again.

Three weeks ago, we covered the attacks on French supermarkets and ended with a simple suggestion: “Keep your own pantry stocked, freaks.” Overnight Sunday into Monday, similar incidents hit stores in Sweden and elsewhere in Europe. An ICA store in Sjöbo reported that its refrigerators and freezers had been set to 50°C. Another ICA store in Stockholm threw away a significant quantity of food. Retailers and suppliers reported incidents in Belgium, Luxembourg, Ireland, the Netherlands and Estonia as well. Finland is investigating refrigeration anomalies. We don't yet know whether these events share an attacker.

The Dutch reporting is particularly frustrating. Danfoss told NOS that at least 17 businesses were affected, including butchers and neighborhood shops. The company says those installations were running on unprotected networks with default passwords. It had warned customers on October 13 to remove direct internet exposure and use a protected network. A machine keeping food cold should never have been reachable that way in the first place.

Is the internet of things actually a good idea when the thing is responsible for keeping people fed? Should machinery critical to bringing vital goods to market be as dumb as possible? I think we are going to spend a lot more time asking those questions. Remote monitoring can be useful. Giving an attacker a path to the controls that keep food cold is a very expensive way to learn that convenience has tradeoffs. The engineer designing the system should have to justify every outside connection, and the machine should be able to keep doing its essential job when that connection disappears.

Examples from the government guidance we reviewed: the United Kingdom launched updated three-day advice on October 22 for emergencies disrupting essential services. Sweden recommends at least a week for crises that interrupt electricity, water or food shopping. Ireland's guide explicitly includes cyberattacks and critical supply-chain disruption. The US advises food and water for general emergencies; Australia's federal emergency agency recommends them for bushfire disruption. Taiwan's guide addresses aggression from China alongside natural disasters. Different risks, the same practical need to eat and drink when services stop.

I find it unsettling that governments across so many countries are telling their citizens to keep enough food and water at home to get through a disruption. Calling these routine preparedness guides doesn't make the advice meaningless. Read what they are asking you to prepare for: electricity going out, water becoming unavailable, supply chains breaking down, cyberattacks and, in some cases, war. These are the systems we depend on to get through an ordinary day.

What are they seeing behind the scenes? What risks are being discussed in those briefings, and how much of that assessment is making its way to the public? I don't know. But I think those are reasonable questions to ask when we're watching attackers interfere with the machinery keeping food cold. Some of this guidance has been around for years. That doesn't make the vulnerabilities we're watching any less real.

You don't need access to a government intelligence briefing to act on the advice. Keep water and food in the house. And if you operate the systems the rest of us depend on, get to work securing them. I'd rather find out we were overprepared than discover how much we took for granted.

There is also a much bigger job for the people responsible for these systems. We need security engineers and researchers working with operators to identify weaknesses in food, water and grid infrastructure before somebody exploits them. France's CERT is already telling refrigeration operators to remove exposed management interfaces and restore necessary remote access through protected networks. Replace unsupported controllers. Get rid of default passwords. Have qualified engineers test the alarms and recovery procedures without interrupting the systems people depend on.

One Selver store in Estonia shows why this matters. Its freezer was also set to 50°C, but the company had prepared after the earlier attacks. Its partner responded within ten minutes. The actual temperature rose only two or three degrees, and no products were damaged. Preparation kept an intrusion from becoming a pile of spoiled food.

The security problems we've been watching around bitcoin since late July make this particularly hard to ignore. Below, we're covering BTCPay's rebuild instructions, Mercado Bitcoin's security incident and the aftermath of the Binance theft. I think the work to fix these weaknesses is making the bitcoin ecosystem harder to attack, but that only happens when people actually do the work. For affected BTCPay operators, that means carrying out the rebuild instructions below.

You can put your head in the sand or begin securing your systems as aggressively as possible. We need to encourage the latter posture everywhere, particularly among the people keeping the lights on, the water running and the food cold. It's time to harden our systems aggressively.

SIGNAL

Mercado Bitcoin confirms a security incident

Brazil’s Mercado Bitcoin confirmed a security incident Monday and announced a temporary suspension of deposits and withdrawals. A preliminary Hypernative assessment shared by Pablo Sabbatella estimates more than $40 million in suspicious wallet outflows across multiple chains. The exchange says customers suffered no losses and no data leaked, but it has not confirmed the estimated amount or disclosed the cause. Another reminder that money held on an exchange comes with somebody else’s security decisions and withdrawal controls.

BTCPay tells affected operators to rebuild

BTCPay Server's new incident advisory traces the reported hot-wallet thefts to version 2.4.1 or earlier, through a different method of exploiting a vulnerability fixed in August. BTCPay reports no impact on servers already running 2.4.2 or later when Sunday's warning went out. If you were on an older version then, follow the advisory's rebuild instructions even if you saw no theft or have since updated. From a trusted device, move remaining hot-wallet funds to a new seed and replace potentially exposed credentials; take the old machine offline and rebuild on a fresh server. Off-server spending keys protected those wallets from these thefts, but older servers still need rebuilding. Signs of compromise warrant the same response regardless of current version. No confirmed loss total is available.

Binance reports reserve proof and 95% replenishment

Binance says the zero-knowledge proof for its October 31 reserve snapshot is complete, allowing users to check backing for ten tokens, including bitcoin. The exchange says it has covered approximately 95% of the affected amount; the remaining assets are less-liquid tokens still being sourced. That means replenishment, not recovery from the attackers. Withdrawals remain a phased reopening, with the next expansion planned for November 3. The FBI attributes the theft to North Korea's TraderTraitor activity. The new proof is a material transparency step, but a dated reserve snapshot is not the same thing as unrestricted access to your funds. Self-custody removes the exchange's permission from that equation.

Claude is assessing the conversation after it answers

Anthropic's self-assessment write-up, promoted October 29 but dated October 16, describes monitoring already running since June. After Claude responds, a hidden system instruction asks it to assess the conversation for potential misuse. The resulting flags feed offline review; in selected harm areas, repeated high-priority flags are aggregated nightly and sent to Anthropic's enforcement team for human review. This covers a large fraction of traffic, not every conversation, and excludes zero-data-retention traffic. The model answering your questions is also helping its provider evaluate how you use it. For sensitive work, a locally operated model can reduce reliance on a hosted provider's monitoring rules, provided the surrounding tools also keep the data local.

OpenAI wants a new name for data centers

OpenAI is preparing a post-election policy campaign that includes calling data centers “AI compute campuses,” Axios reported November 1. The planned push includes community compacts, proposed state legislation giving residents a meaningful say in projects and benefits, and mandatory safeguards for the most powerful AI systems. Axios says the push will begin during Congress's post-election lame-duck session, which opens November 9. America needs more compute capacity. The test is whether host communities get durable tax relief or better services, and whether developers pay for the infrastructure they require instead of shifting costs onto households. A different name does not settle those questions.

⚡ FREEDOM TECH CORNER

DATA SNAPSHOT

Spot price, block height and hashrate estimate: November 2, 2026, 9:56 a.m. ET. Bitcoin Lab daily series: November 1, 2026. U.S. spot ETF flows: October 30, 2026.

Sources: Kraken spot quote, mempool.space block height and hashrate, Bitcoin Lab daily metrics, and TFTC ETF flows. Daily metrics use the provider’s November 1 observation, not live intraday estimates.

Have a great day, freaks.

Marty Bent · TFTC · Nostr

YouTube

Podcast