Lecture for Lunarpunk 2026 · Bratislava · Institute of Cryptoanarchy
Disruptive
crypto / AI
2026
Giving back the digital freedom that state and EU bureaucrats are taking from you.
SPEAKER: PAVOL LUPTÁK · ↔ NAVIGATION · N NOTES · T THEME
01 — Thesis
Regulation is a perimeter.
Freedom is designed outside it.
In recent years a continuous perimeter of control has been forming — over money, communication and even access to information and computation itself. Its timeline is on the next slide.
Disruptive technologies don't fight the perimeter. They are built so they don't fall inside it — non-custodial, decentralized, intermediary-free, self-hosted, open-weight. There's no one to license, no one to force to report, no one to shut down.
02 — Regulatory wave 2025–2029
The perimeter is closing — on schedule
In four years the EU and states will build a continuous perimeter of control over money, communication and access. Here is the timeline.
Age Verification In force (UK Online Safety Act + EU) — access to content in exchange for ID/face. · MiCA In force — licenses for exchanges, delisting of stablecoins.
DAC-8 In force — automatic reporting of crypto balances to tax authorities. · Chat Control 1.0 Temporary · contested (9 Jul) — the derogation passed despite a majority against (314:276), runs until 2028; E2EE carved out; the permanent CSAR is still a proposal, trilogues resume in September. · EU Age-Verification App Rollout — deploy by end of 2026 (EUDI Wallet).
AMLR Adopted (applies 10 Jul 2027) — €10,000 cash cap, CDD from €3,000, ban on privacy coins on regulated platforms.
Digital euro Proposal · pilot (CBDC) — pilot H2 2027 (36 banks/PSPs), first issuance 2029 at the earliest: programmable money and real-time surveillance of payments.
In force = already law / adopted · Contested · proposal = still stoppable
This lecture's answer is not to fight the perimeter, but technologies that bypass it.
03 — File contents
Part A · Main technologies
Main
technologies
Peer.xyz · CashuPayServer · Bitblik · AI vs. KYC · Kimi K3 · VPN
Peer.xyz
Buy and sell crypto via Venmo, PayPal, Revolut, Wise, CashApp, Zelle — straight from your wallet, no exchange, no KYC. Protocol ZKP2P · zkTLS · TEE.
How it works
The seller locks tokens in a smart contract (escrow).
The buyer signals intent — locks liquidity.
Pays fiat normally (Revolut/PayPal…) off-chain.
Generates a zkTLS proof; the enclave (TEE) verifies and signs it.
Escrow automatically sends the crypto to the buyer.
Why it's useful
- No one holds your funds — non-custodial, no exchange risk.
- Proof of payment is cryptographic, not trust in the counterparty.
- No KYC, no stored data = no honeypot to leak.
- You pay with tools you already have — no new exchange account.
CashuPayServer
A BTCPay-compatible gateway on the cheapest PHP hosting. „If WordPress runs there, this runs there." Core: Cashu — Chaumian e-cash, blind signatures, Lightning.
How it works
The customer gets an ordinary Lightning invoice — doesn't know about Cashu.
The payment lands on a Cashu mint as a blindly signed token; the mint doesn't know who pays.
Auto-withdrawal sends the satoshis straight to the merchant's wallet.
Why it's useful
- You accept bitcoin without an account and without KYC at any mint.
- The merchant isn't a regulated intermediary — your own gateway.
- Blind signatures = payment privacy by default.
- Trade-off: the third-party mint is custodial until you withdraw — withdraw quickly.
One mechanism, four countries
The same non-custodial P2P mechanism (maker → Lightning hold-invoice, taker → local payment, coordinator → atomic settlement over Nostr). Only the name of the local payment technology changes.
BLIK
National mobile payment system. 6-digit code — payment and cardless ATM withdrawal.
MB WAY
Portuguese instant mobile payment over the Multibanco network. Transfer by phone number.
TWINT
The dominant Swiss mobile payment (6M+ users). Payment via QR / phone number.
Cardless withdrawal
Tatra banka · SLSP · VÚB. A 6-digit code straight into the ATM.
Bitblik
A P2P BLIK/Lightning exchange over Nostr — swap bitcoin for ATM cash or a payment anywhere BLIK · MB WAY · TWINT works.
How it works
Funds a Lightning hold-invoice (BTC is locked, not sent).
Pays via BLIK — a payment or a cardless withdrawal at the ATM.
Atomically settles over Nostr (NIP-44): both, or nothing.
Demo from Poland
A real cash withdrawal from an ATM for bitcoin via BLIK — filmed live in Poland. No card, no KYC, no exchange.
▶ The video is right in the slide — hit Play on the thumbnail, fullscreen via the controls.
Anonymity is on the taker's side (no KYC); the cash comes from the maker's account — pseudonymous P2P.
Slovak banks are in Bitblik
PR #3 merged today — three new EUR markets on top of „cardless withdrawal" (Tatra · SLSP · VÚB), a first-launch market picker and a complete SK localization. 14 commits · 112 files · +11,022 lines.
Bitblik in Slovakia
A P2P BLIK/Lightning exchange over Nostr that already supports the Slovak market — Tatra banka · Slovenská sporiteľňa · VÚB via „cardless withdrawal".
Anonymity is on the taker's side (no KYC); the cash comes from the maker's bank account — pseudonymous P2P. The number grows as banks are added.
How it works here
The bitcoin buyer generates a one-time 6-digit cardless-withdrawal code in their banking app and submits it through Bitblik.
The seller types the code straight into the ATM and collects the cash — no card, no account.
The Lightning hold-invoice settles atomically over Nostr.
Code windows: Tatra 20 min · SLSP 15 min · VÚB 3 min
KYC won't protect you. It endangers you.
It can be beaten for a few dollars — and at the same time makes you a target. Two sides of the same coin: ineffective against criminals, dangerous for the innocent.
Concrete proofs-of-concept
- Deepfake + liveness bypass: Sensity AI (2022) defeated liveness at 9 of 10 leading KYC vendors.
- Camera / injection attack: a pre-rendered synthetic video stream is fed into the app instead of a real camera — per iProov the fastest-growing class.
- Generative document forgery: „OnlyFake" (404 Media, 2024) created photorealistic IDs and reportedly passed KYC.
- Fully synthetic identity: GAN face + ID + deepfake selfie = a „person" who never existed.
Why it's dangerous
- Honeypot: passport, selfie and documents in one place are a magnet for hackers. Pass KYC at an exchange that gets hacked one day → your privacy is compromised forever.
- Black market: stolen KYC documents sell for ~$15 each (100 identities ~$4,500) — identity theft and laundering through accounts in your name.
- Ineffective: per Europol only about 1% of criminal proceeds are seized in the EU. The price is surveillance of millions of the innocent.
- Biometrics are forever: you can change a password, not your face and fingerprint. Once leaked — permanently.
Therefore: lower thresholds, privacy-by-design and no-KYC tools (Bisq, RoboSats). Source of arguments: Nethemba — „How KYC/AML poses a serious threat to your privacy". This slide documents the threat, it doesn't provide a how-to.
Weights in your hands
Chinese open-weight models led by Kimi K3 (July 2026): weights out on Hugging Face since 27 Jul, top-tier agentic coding — and full control over computation.
Kimi K3 in numbers
Figures: VentureBeat · Global Times (July 2026). Announced 16 Jul 2026, weights out since 27 Jul 2026 (Hugging Face · Modified MIT) — downloadable today.
Why it's useful
- Local inference is outside the obligations the AI Act places on providers.
- Fewer false refusals when finding and fixing real vulnerabilities.
- Sovereignty over computation — no one to shut it down or ask for your prompts.
- Honestly: dual-use — less safety = also higher risk of misuse.
Note · Even the guardrailed Claude Fable model that prepared this presentation refused to process a guide to bypassing KYC. That is exactly why open-weight models (Kimi K3) matter — they run on your machine, without foreign guardrails.
VPN
Age verification is an architecture of mass identity verification and de-anonymization of the internet. A VPN routes your connection through another country — you reach legal content without handing over an ID.
How it works
The client encrypts your traffic and sends it to an exit node in another country. The content provider sees the exit node's IP, not yours — and a jurisdiction where the age-verification rule doesn't apply.
dVPNs (e.g. Mysterium, Orchid, Sentinel, NymVPN) do the same without a central provider that could be coerced.
The day after it took effect: VPN and age-verif. apps = half of the top 10 downloads in the UK.
Part B · Further technologies of freedom
Further
technologies of freedom
Money · communication · computation · devices · network
Monero + atomic swaps
XMR is untraceable by default (ring signatures, stealth addresses, RingCT). Regulated exchanges delist it — atomic swaps exchange it directly between people.
How it works
An atomic swap (BTC↔XMR) via hash/time-locked contracts runs directly between two wallets — either it completes fully, or everything is returned. No exchange, no intermediary, no KYC.
The hard ban from 10 Jul 2027 targets platforms, not you as a holder.
Why it's useful
- Fungibility: every XMR is the same — no „dirty" coins.
- Privacy of balance and history — no one tracks you along the chain.
- Delisting from exchanges doesn't mean a ban on ownership — you swap P2P.
Zcash + shielded swaps
In the shielded pool (zk-SNARK, Orchard) the sender, recipient and amount are hidden. As a UTXO chain with Bitcoin scripting it supports atomic swaps with Bitcoin — just like Monero.
How it works
An atomic swap BTC↔ZEC via hash/time-locked contracts (ZIP 300 / XCAT) runs directly between wallets. 2025–26: Zwap (trustless shielded swaps), THORChain native ZEC swaps, Zashi/Zodl Swaps + NEAR Intents for direct BTC↔ZEC.
You get cryptographic privacy in the shielded pool; transparent addresses don't offer it.
Why it's useful
- zk-SNARK shielding: hidden sender, recipient and amount.
- Delisting from exchanges doesn't cancel ownership — you swap P2P via atomic swaps.
- Honestly: only the ZEC leg is protected — cross-chain routing outside Zcash stays visible.
RoboSats · Bisq · Vexl
Non-custodial no-KYC exchanges. RoboSats runs exclusively over Tor, no registration; Bisq is a desktop P2P exchange with more fiat depth; Vexl trades through your contacts network (web-of-trust) — no account and no KYC.
How it works
For each trade a temporary avatar — trades can't be linked. Escrow is a Lightning hold-invoice, settlement almost instant. Communication end-to-end encrypted over Tor.
RoboSats trade cap ~0.04 BTC (Lightning routing limit); Bisq also handles bank transfers.
Why it's useful
- Buy/sell BTC without handing your identity to anyone.
- Tor + temporary avatars = resistance to censorship and tracking.
- Non-custodial escrow — the counterparty can't cheat or rob you.
- Vexl (by the SatoshiLabs team) connects people via contacts and contacts-of-contacts — E2E encrypted, no account, no stored data.
Self-custody stablecoins & DeFi
Under MiCA, exchanges delist stablecoins (USDT) for the EU. A self-custody wallet + DEX move dollar value without a regulated intermediary.
How it works
You hold the stablecoin in your own wallet, swap via a DEX (smart contract, not a company). DeFi without a central intermediary today mostly sits outside MiCA's scope — there's no one to license.
Why it's useful
- Dollar value and liquidity without a bank account.
- 24/7, cross-border, permissionless and delisting-free.
- Caution: smart-contract and de-peg risks — pick proven protocols.
DeFi loans · On Aave you borrow stablecoins against crypto collateral anonymously (pseudonymously via your wallet) — no KYC, no credit check, no bank and permissionless, 24/7 and globally. The smart contract replaces the entire licensed process and completely undermines the regulated lending business.
Cash & bitcoin vs. the digital euro
A CBDC gives the center a real-time view of payments and the potential for programmability. Cash and bitcoin are bearer instruments — no intermediary, no record.
What's coming
- Digital euro: rulebook 2026, pilot H2 2027 (36 banks/PSPs), first issuance 2029 at the earliest; holding limit €3,000, anonymity only up to €50.
- AMLR (10 Jul 2027): €10,000 cash cap for businesses; identity verification for cash from €3,000.
Why the antidote is useful
- A payment no third party or central bank sees.
- Money that can't be programmed, restricted or expired.
- Works without internet and without permission.
Signal / SimpleX
On 9 Jul 2026 the EU approved Chat Control 1.0 (until 2028); the permanent regulation (CSAR) returns in September 2026. Signal: it would rather leave the EU than introduce on-device scanning.
How it works
SimpleX assigns the user no identifier — not even a random number. Contact via a one-time link/QR, data only on the device, messages via relays with no sender↔recipient link. Audited by Trail of Bits.
Why it's useful
- Not only the content is private, but also the metadata — who talks to whom.
- No phone number = no identity tied to the account.
- Client-side scanning has nothing to scan without a backdoor.
Nostr
Your identity is a cryptographic key, not a company account. Dorsey ranks it alongside Tor and Bitcoin as a scalable censorship-resistant technology.
How it works
You sign a post with your key and send it to multiple independent relays. If one kicks you out, the others keep running. 2026: rapid growth, Blossom for decentralized media. Bitblik also runs over Nostr.
Why it's useful
- You take your identity and audience with you across apps.
- There's no central kill switch or network-level „ban".
- The same key for social, payments (zaps) and login.
Meshtastic · MeshCore · Reticulum
Communication without mobile networks and without a provider. LoRa radios form a self-organizing network; MeshCore is its fast-growing alternative with more efficient routing; Reticulum adds E2EE with forward secrecy over anything.
How it works
Meshtastic: cheap LoRa radios, range of kilometers, AES-256, managed flooding. MeshCore: new LoRa mesh firmware (since 2025) with more efficient repeater routing — same hardware, different protocol. Reticulum: a cryptographic stack with per-packet forward secrecy over LoRa, the internet and the local network — messages, files, calls.
Why it's useful
- Works during a blackout, shutdown and without coverage.
- No operator that could be forced to wiretap.
- Resilient, cheap, community-operable.
- MeshCore is spreading massively — strong communities in Slovakia and Czechia (their own presets) and across Europe (Netherlands, Germany, Belgium, UK…).
Personally tested: MeshCore also runs on my LilyGo T-Watch Ultra watch (LoRa · GPS · MCLite firmware) — an encrypted mesh on the wrist, no SIM, no carrier. With it I'll survive even the apocalypse — write-up: opportunist.global.
Local open-source LLMs
Ollama / llama.cpp run open-weight models (Llama, Mistral, smaller Kimi) directly on your computer. Prompts never leave the device.
How it works
You download the weights and run a local runtime. Inference runs on your CPU/GPU — no call to the cloud, no account, no log at a provider.
Why it's useful
- Works offline and is private — the data stays with you.
- Local inference sits outside most AI Act obligations.
- No output censorship and no risk of the service being shut down.
GrapheneOS
A de-Googled, hardware-hardened Android without telemetry. The phone is the biggest surveillance sensor you carry — here you switch it off.
How it works
Replaces stock Android without Google services; granular permissions, per-app network/sensor permissions, sandboxed Google services (optional). By default nothing phones home.
Why it's useful
- Radically lower exposure to corporate telemetry.
- Less dependence on mandatory ecosystems and device-bound digital ID.
- Top-tier security and full control over apps.
Self-hosting
Umbrel / Start9 turn a home computer into a sovereign server: your own node, Nostr relay, Cashu mint, cloud, VPN. You are your own intermediary.
How it works
On your own hardware (or a Raspberry Pi) runs a stack of services you'd otherwise rent from the cloud. Access via Tor/VPN. Regulation targets intermediaries — here there is none.
Why it's useful
- Data and services on your hardware, under your rules.
- No third party that can read, subpoena or shut them down.
- The foundation for everything else: node, relay, mint, coordinator.
Tor · dVPN · Starlink
The network layer of freedom: anonymity (Tor), a VPN without a central provider (dVPN) and a connection from the sky beyond the national operator (Starlink).
How it works
- Tor: traffic through 3 random nodes — the destination doesn't see your IP, the ISP doesn't see the destination.
- dVPN: a marketplace of exit nodes (Mysterium, Orchid, Sentinel, NymVPN) — no central provider.
- Starlink: internet from satellite, independent of the local operator.
Why it's useful
- Access to content without filtering and without handing over an ID.
- Resistance to the national firewall and to internet shutdown.
- No one along the route can centrally track you.
Part C · What to do
What to do
Regulation matrix · calls to action · manifesto
C1 — Matrix: technology × regulation
What undermines what
| Technology | MiCA | DAC-8 | KYC / AML | AI Act | Chat Control / DSA | Age Verif. | CBDC / cash |
|---|---|---|---|---|---|---|---|
| Peer.xyz | ✕ | ✕ | ✕ | · | · | · | · |
| CashuPayServer | ✕ | ✕ | ✕ | · | · | · | ✕ |
| Bitblik | ✕ | ✕ | ✕ | · | · | · | ✕ |
| RoboSats · Bisq · Vexl | ✕ | ✕ | ✕ | · | · | · | · |
| Monero · atomic swap | ✕ | ✕ | ✕ | · | · | · | ✕ |
| Zcash · shielded | ✕ | ✕ | ✕ | · | · | · | ✕ |
| Stablecoins · DeFi | ✕ | ✕ | ✕ | · | · | · | ✕ |
| Signal · SimpleX | · | · | · | · | ✕ | · | · |
| Nostr | · | · | · | · | ✕ | ✕ | · |
| Meshtastic · MeshCore · Reticulum | · | · | · | · | ✕ | · | · |
| Kimi K3 · local LLM | · | · | · | ✕ | · | · | · |
| VPN · dVPN · Tor | · | · | · | · | ✕ | ✕ | · |
| GrapheneOS · self-host | · | · | · | · | ✕ | · | · |
✕ = the technology exempts itself from the given rule by design (mapping is indicative). Pattern: non-custodianship + decentralization solve several regulations at once — they remove the intermediary the regulation targets.
Build a strong SK community
A market lives on liquidity. The more people use it, the better it is for all bitcoiners in Slovakia.
Liquidity first
Motivate makers to keep offers for SK banks around the clock. Fair spreads → takers; volume → makers.
More coordinators
Let more coordinators run, including SK ones — no single point of failure.
Education
An SK guide „withdraw cash for bitcoin", videos, onboarding at meetups. Zero barrier.
Physical hubs
Paralelná Polis, meetups, merchant onboarding to Lightning. Freedom needs places.
Distribution
Nostr, Telegram, SK groups. Let Bitblik be the default answer to „how do I buy BTC without KYC".
Contribute code
It's open-source. Translate, report bugs and contribute code — every contribution strengthens the whole project.
Let's write support for SK/CZ banks
Peer.xyz / ZKP2P today targets US rails (Venmo, PayPal, Zelle) and Revolut/Wise. The protocol is open — adding a bank = writing a payment prover (zkTLS/TEE proof of payment). Let's do it for our banks, exactly as the community added the Slovak market to Bitblik.
What needs doing
- Write payment provers for Tatra banka, SLSP, VÚB, ČSOB, mBank.
- Add SEPA Instant as a European fast scheme.
- Test the flows and document them in Slovak.
Why it's worth it
- Non-custodial fiat↔crypto in EUR without KYC for SK and CZ.
- An open protocol = write it once, everyone uses it.
- Who: developers (integrations), testers, community (pressure + docs).
The model is proven: the Slovak contribution to Bitblik showed that one good pull request opens a whole market.
Use a VPN. Bypass Age Control.
Age verification conditions access to legal content on handing over an ID or face that get stored. It's not about age — it's about de-anonymizing the internet. A VPN restores the default: access without handing over identity.
How to do it right
- Choose a no-log, independently audited provider (e.g. Proton) or a dVPN (Mysterium, Orchid, Sentinel, NymVPN).
- Turn it on by default on mobile and computer.
- Combine it with a fingerprint-resistant browser.
What you gain
- Access to content without a honeypot of your ID and face.
- Protection on public Wi-Fi and against ISP tracking.
- You also bypass geoblocking and DNS blocking.
Fact: after the rule was introduced, Proton VPN signups in the UK rose over 1,400% within hours. People are already voting with their feet.
„Won't criminals abuse it?"
Four most common objections — and answers that hold up.
„Won't criminals and terrorists abuse it?"
Encryption, cash and VPNs have been used for ages — and they have resources. Regulation won't stop them; it lands on 99% of the innocent. Europol: only ~1% of criminal proceeds are seized.
„If you've done nothing wrong, you've nothing to hide."
Privacy isn't about hiding, it's about control. You have curtains, envelopes and a password — not because you're committing a crime.
„It's only for a few enthusiasts."
The same was said about encryption and email. After Age Control, VPN signups rose 1,400% within hours — the masses vote with their feet.
„Isn't it illegal?"
No. Holding bitcoin, using a VPN, encrypting messages or running open-source is legal. These tools simply fall outside the regulatory perimeter — they aren't a breach of it.
Install tonight
Four tangible steps instead of an abstract matrix. Pick at least one and do it today.
1 · Bitcoin without KYC
Bitblik — buy/sell BTC and withdraw cash from an ATM (Tatra · SLSP · VÚB) without a card and without KYC. Alternatives: Vexl · RoboSats.
2 · Private communication
SimpleX or Signal — move sensitive conversations out of scanning's reach. SimpleX needs no phone number.
3 · Free access
Proton VPN or a dVPN — turn it on by default on mobile and computer. You bypass Age Control and geoblocking.
4 · Your own money
A non-custodial wallet + a little BTC/XMR (Cake · Feather). You hold the keys — no exchange.
For advanced users: a local LLM (Ollama) · GrapheneOS on a Pixel · your own node (Umbrel/Start9). Freedom is a habit, not a one-off purchase.
C7 — Manifesto
Stolen freedom
is not requested.
Freedom is taken back
with technology.
Regulation targets the intermediary. So we remove it. Non-custodial, decentralized, self-hosted, open-weight — architecture, not permission.
Pick one thing from today's matrix and deploy it this week.
Sources & verification