Premiere: Lunarpunk 2026 (31 Jul) · Bratislava · Institute of Cryptoanarchy · updated 10/2026
Disruptive
crypto / AI
2026
Giving back the digital freedom that state and EU bureaucrats are taking from you.
SPEAKER: PAVOL LUPTÁK · ↔ NAVIGATION · N NOTES · T THEME
01 — Thesis
Regulation is a perimeter.
Freedom is designed outside it.
In recent years a continuous perimeter of control has been forming — over money, communication and even access to information and computation itself. Its timeline is on the next slide.
Disruptive technologies don't fight the perimeter. They are built so they don't fall inside it — non-custodial, decentralized, intermediary-free, self-hosted, open-weight. There's no one to license, no one to force to report, no one to shut down.
Honestly: not everything is equally decentralized — this tag marks the trade-off for each technology.
02 — Regulatory wave 2025–2029
The perimeter is closing — on schedule
In four years the EU, states and platforms will build a continuous perimeter of control over money, communication and access. Here is the timeline.
Age Verification In force in UK (Online Safety Act, 25 Jul) — access to content in exchange for ID/face; in the EU so far DSA Art. 28 guidelines and a pilot app. · MiCA In force — licenses for exchanges, delisting of stablecoins.
DAC-8 In force — automatic reporting of crypto balances to tax authorities. · Chat Control 1.0 Temporary · contested (9 Jul): derogation extended to 2028, E2EE carved out. 314 MEPs voted against, but blocking needed 361. · Chat Control 2.0 (CSAR) Proposal: 6th trilogue on 29 Sep, no deal. · EU Age-Verification App Rollout — deploy by end of 2026 (EUDI Wallet). · Google developer verification In force (30 Sep) — Android apps only from identity-verified developers (BR · ID · SG · TH, global in 2027).
AMLR Adopted (applies 10 Jul 2027) — €10,000 cash cap, CDD from €3,000, ban on privacy coins on regulated platforms.
Digital euro Proposal · pilot (CBDC) — pilot H2 2027 (36 banks/PSPs), first issuance 2029 at the earliest: programmable money and real-time surveillance of payments.
In force = already law / adopted · Contested · proposal = still stoppable
This lecture's answer is not to fight the perimeter, but technologies that bypass it.
03 — File contents
Part A · Main technologies
Main
technologies
Peer.xyz · CashuPayServer · Bitblik · AI vs. KYC · Kimi K3
Peer.xyz
Buy and sell crypto via Venmo, PayPal, Revolut, Wise, CashApp, Zelle — straight from your wallet, no exchange, no KYC by the protocol. Protocol ZKP2P · zkTLS · TEE.
How it works
The seller locks tokens in a smart contract (escrow).
The buyer signals intent — locks liquidity.
Pays fiat normally (Revolut/PayPal…) off-chain.
Generates a zkTLS proof; the enclave (TEE) verifies and signs it.
Escrow automatically sends the crypto to the buyer.
Why it's useful
- No one holds your funds — non-custodial, no exchange risk.
- Proof of payment is cryptographic, not trust in the counterparty.
- The protocol does no KYC and stores no data = no honeypot to leak.
- Honestly: the fiat leg comes from your own account (Revolut, PayPal…), which is KYC'd — your bank and the counterparty see the payment.
- You pay with tools you already have — no new exchange account.
CashuPayServer
A BTCPay-compatible gateway on the cheapest PHP hosting. “If WordPress runs there, this runs there.” Core: Cashu — Chaumian e-cash, blind signatures, Lightning.
How it works
The customer gets an ordinary Lightning invoice — doesn't know about Cashu.
The payment lands on a Cashu mint as a blindly signed token; the mint doesn't know who pays.
Auto-withdrawal sends the satoshis straight to the merchant's wallet.
Why it's useful
- You accept bitcoin without an account and without KYC at any mint.
- The merchant isn't a regulated intermediary — your own gateway.
- Blind signatures = payment privacy by default.
- Trade-off: the third-party mint is custodial until you withdraw — withdraw quickly.
One mechanism, four countries
The same non-custodial P2P mechanism (maker → Lightning hold-invoice, taker → local payment, coordinator → atomic settlement over Nostr). Only the name of the local payment technology changes.
BLIK
National mobile payment system. 6-digit code — payment and cardless ATM withdrawal.
MB WAY
Portuguese instant mobile payment over the Multibanco network. Transfer by phone number.
TWINT
The dominant Swiss mobile payment (6M+ users). Payment via QR / phone number.
Cardless withdrawal
Tatra banka · SLSP · VÚB. A 6-digit code straight into the ATM.
Bitblik
A P2P BLIK/Lightning exchange over Nostr — swap bitcoin for ATM cash or a payment anywhere BLIK · MB WAY · TWINT works.
How it works
Funds a Lightning hold-invoice (BTC is locked, not sent).
Pays with a BLIK code from their bank — the maker uses it for a payment or an ATM withdrawal.
Atomically settles over Nostr (NIP-44): both, or nothing.
Demo from Poland
A real cash withdrawal from an ATM for bitcoin via BLIK — filmed live in Poland. No card, no KYC, no exchange.
▶ The video is right in the slide — hit Play on the thumbnail, fullscreen via the controls.
The cash comes from the taker's account (the BTC buyer); the maker withdraws it with no card and no account. The platform does no KYC — pseudonymous P2P.
Bitblik in Slovakia
A P2P BLIK/Lightning exchange over Nostr that already supports the Slovak market — Tatra banka · Slovenská sporiteľňa · VÚB via “cardless withdrawal”. Added through the open-source PR #3 (merged 31 Jul 2026, on the day of this talk's premiere) — 14 commits · 112 files · +11,022 lines.
The cash comes from the taker's account (the BTC buyer); the maker withdraws it with no card and no account. The platform does no KYC — pseudonymous P2P. The number grows as banks are added.
How it works here
The bitcoin buyer generates a one-time 6-digit cardless-withdrawal code in their banking app and submits it through Bitblik.
The seller types the code straight into the ATM and collects the cash — no card, no account.
The Lightning hold-invoice settles atomically over Nostr.
Code windows: Tatra 20 min · SLSP 15 min · VÚB 3 min
KYC won't protect you. It endangers you.
It can be beaten for a few dollars — and at the same time makes you a target. Two sides of the same coin: ineffective against criminals, dangerous for the innocent.
How it gets beaten
- Deepfake + liveness: Sensity AI (2022) fooled 9 of 10 leading KYC vendors.
- Generated IDs: “OnlyFake” (404 Media, 2024) produced photorealistic IDs that reportedly passed KYC.
Why it's dangerous
- Honeypot: passport, selfie and ID in one place. The exchange gets hacked one day — and your privacy is gone for good.
- Biometrics are forever: you can change a password, not your face or fingerprint.
Therefore: lower thresholds, privacy-by-design and no-KYC tools (Bisq, RoboSats). Source of arguments: Nethemba — “How KYC/AML poses a serious threat to your privacy”. This slide documents the threat, it doesn't provide a how-to.
Weights in your hands
Chinese open-weight models led by Kimi K3 (July 2026): weights out on Hugging Face since 27 Jul, top-tier agentic coding — and full control over computation. Smaller models run via Ollama / llama.cpp right on your laptop — prompts never leave the device.
Kimi K3 in numbers
Figures: VentureBeat · Global Times (July 2026). Announced 16 Jul 2026, weights out since 27 Jul 2026 (Hugging Face · Modified MIT) — downloadable. The full K3 (~1.4 TB) needs a server; smaller models fit a laptop.
Why it's useful
- Local inference is outside the obligations the AI Act places on providers.
- Fewer false refusals when finding and fixing real vulnerabilities.
- Sovereignty over computation — no one to shut it down or ask for your prompts.
- Honestly: dual-use — less safety = also higher risk of misuse.
Note · Even the guardrailed Claude Fable model that prepared the original version of this presentation refused to process a guide to bypassing KYC. That is exactly why open-weight models (Kimi K3) matter — they run on your machine, without foreign guardrails.
Part B · Further technologies of freedom
Further
technologies of freedom
Money · communication · computation · devices · network
Monero · Zcash · atomic swaps
Regulated exchanges delist privacy coins and AMLR bans them on platforms from 10 Jul 2027 — not for you as a holder. Atomic swaps and RetoSwap exchange them directly between people.
Monero (XMR)
- Untraceable by default: ring signatures, stealth addresses, RingCT — every XMR is the same (fungibility).
- Atomic BTC↔XMR swap via HTLC: it either completes fully or everything is refunded.
- RetoSwap: a P2P exchange over Tor, 2-of-3 multisig, no account and no KYC — even for a bank transfer or cash.
- Honestly: the Haveno protocol was exploited twice in 2026 (20 May, ~7,000 XMR); fix 1.8.0 from 20 Jun 2026 — keep your client updated.
Zcash (ZEC)
- In the shielded pool (zk-SNARK, Orchard) sender, recipient and amount are hidden.
- BTC↔ZEC swaps: ZIP 300 / XCAT, Zwap (trustless shielded), THORChain, NEAR Intents.
- Zashi: a shielded-by-default wallet.
- Honestly: privacy only inside the shielded pool; cross-chain routing outside Zcash stays visible.
RoboSats · Bisq · Vexl
Non-custodial no-KYC exchanges. RoboSats runs exclusively over Tor, no registration; Bisq is a desktop P2P exchange with more fiat depth; Vexl trades through your contacts network (web-of-trust) — no account and no KYC.
How it works
- RoboSats: a temporary avatar per trade, escrow via a Lightning hold-invoice, everything over Tor; cap ~0.04 BTC.
- Bisq: a desktop P2P network, escrow in an on-chain 2-of-2 multisig with security deposits from both sides; more fiat depth.
- Vexl: an encrypted offer board via your contacts — no escrow, you agree and swap directly.
Why it's useful
- Buy/sell BTC without handing your identity to anyone.
- Tor + temporary avatars = resistance to censorship and tracking.
- Escrow protects the bitcoin side of the trade — nobody holds your BTC.
- Mind the fiat: payment reversals (PayPal, Revolut) are the most common P2P scam — prefer irreversible payments (SEPA Instant, cash).
Self-custody stablecoins & DeFi
Under MiCA, exchanges delist stablecoins (USDT) for the EU. A self-custody wallet + DEX move dollar value without a regulated intermediary.
How it works
You hold the stablecoin in your own wallet, swap via a DEX (smart contract, not a company). DeFi without a central intermediary today mostly sits outside MiCA's scope — there's no one to license.
Why it's useful
- Dollar value and liquidity without a bank account.
- 24/7, cross-border, no bank — a DEX can't delist you.
- Caution: smart-contract and de-peg risks; the issuer (Tether, Circle) can freeze your address — a centralized stablecoin is not bearer money.
DeFi loans · On Aave you borrow stablecoins against crypto collateral pseudonymously via your wallet (everything on-chain is public) — no KYC, no credit check, no bank and permissionless, 24/7 and globally. The smart contract replaces the licensed process — credit without a bank, though only for those who have collateral (overcollateralized).
Cash & bitcoin vs. the digital euro
A CBDC gives the center a real-time view of payments and the potential for programmability. Cash and bitcoin are bearer instruments — no intermediary; cash also leaves no record (bitcoin has a public blockchain).
What's coming
- Digital euro: rulebook 2026, pilot H2 2027 (36 banks/PSPs), first issuance 2029 at the earliest; holding limit €3,000, anonymity only up to €50.
- AMLR (10 Jul 2027): €10,000 cash cap for businesses; identity verification for cash from €3,000.
Why the antidote is useful
- A payment with no third party and no central bank in between.
- Money that can't be programmed, restricted or expired.
- Cash works without internet; both work without permission.
Signal · SimpleX · White Noise · Bitchat
All four encrypt end-to-end. They differ in what the operator knows about you — and whether there is an operator at all. Chat Control 2.0 (CSAR): 6th trilogue on 29 Sep 2026, no deal; the pressure continues.
| Property | Signal | SimpleX | White Noise | Bitchat |
|---|---|---|---|---|
| No phone number | — number required | ✓ no ID at all | ✓ Nostr key | ✓ no account |
| No central operator | — Signal Foundation | ~ own servers possible | ✓ relays you choose | ✓ peer-to-peer |
| Works without internet | — | — | — | ✓ Bluetooth mesh |
| Encryption | Signal Protocol | Double ratchet + PQ | MLS (RFC 9420) | Noise (X25519) |
| Audit / security analysis | ✓ formal analyses | ✓ Trail of Bits | ✓ Least Authority 4/2026 | — not yet |
| Maturity | Mainstream | Stable | Beta | Young, growing fast |
← scroll the table →
Signal: would rather leave the EU than add scanning (M. Whittaker). · Bitchat: on 23 Jul 2026 India asked GitHub to block its code (330,000+ users during the Delhi protests); China pulled it from the App Store in 4/2026.
Nostr
Your identity is a cryptographic key, not a company account. Dorsey ranks it alongside Tor and Bitcoin as a scalable censorship-resistant technology.
How it works
You sign a post with your key and send it to multiple independent relays. If one kicks you out, the others keep running. 2026: rapid growth, Blossom for decentralized media. Bitblik also runs over Nostr.
Why it's useful
- You take your identity and audience with you across apps.
- There's no central kill switch or network-level “ban”.
- The same key for social, payments (zaps) and login.
Meshtastic · MeshCore · Reticulum
Communication without mobile networks and without a provider. LoRa radios form a self-organizing network; MeshCore is its fast-growing alternative with more efficient routing; Reticulum adds E2EE with forward secrecy over anything.
How it works
Meshtastic: cheap LoRa radios, range of kilometers, AES-256, managed flooding. MeshCore: new LoRa mesh firmware (since 2025) with more efficient repeater routing — same hardware, different protocol. Reticulum: a cryptographic stack with per-packet forward secrecy over LoRa, the internet and the local network — messages, files, calls.
Why it's useful
- Works during a blackout, shutdown and without coverage.
- No operator that could be forced to wiretap.
- Resilient, cheap, community-operable.
- MeshCore is spreading massively — strong communities in Slovakia and Czechia (their own presets) and across Europe (Netherlands, Germany, Belgium, UK…).
Personally tested: MeshCore also runs on my LilyGo T-Watch Ultra watch (LoRa · GPS · MCLite firmware) — an encrypted mesh on the wrist, no SIM, no carrier. With it I'll survive even the apocalypse — write-up: opportunist.global.
GrapheneOS + Zapstore
The phone is the biggest surveillance sensor you carry. GrapheneOS switches off its telemetry, Zapstore gives you apps without a gatekeeper — together, a phone that belongs to you.
GrapheneOS — the system
- De-Googled, hardware-hardened Android (Pixel) — nothing phones home by default.
- Granular permissions, per-app network/sensor toggles; Google services only sandboxed and optional.
- Less dependence on mandatory ecosystems and device-bound digital ID.
Zapstore — the apps
- An open app store on Nostr: the developer signs the release, Zapstore checks the signature and APK certificate → tampered builds fail.
- No registration or fee; discovery via your social graph; zap the developer.
- Apps a store would pull on command stay available.
Since 30 Sep 2026 (BR · ID · SG · TH, global in 2027) Google blocks apps on certified phones from developers without identity verification (ID, $25) — otherwise only via a flow with a 24-h wait. On GrapheneOS this verification doesn't apply.
Self-hosting
Umbrel / Start9 turn a home computer into a sovereign server: your own node, Nostr relay, Cashu mint, cloud, VPN. You are your own intermediary.
How it works
On your own hardware (or a Raspberry Pi) runs a stack of services you'd otherwise rent from the cloud. Access via Tor/VPN. Regulation targets intermediaries — here there is none.
Why it's useful
- Data and services on your hardware, under your rules.
- No third party that can read, subpoena or shut them down.
- The foundation for everything else: node, relay, mint, coordinator.
Honestly: for private use platform obligations don't apply to you; whoever runs a public relay or mint for others may become a hosting provider under the DSA.
Tor · dVPN · Starlink
The network layer of freedom: anonymity (Tor), a VPN without a central provider (dVPN) and a connection from the sky beyond the national operator (Starlink).
How it works
- Tor: traffic through 3 random nodes — the destination doesn't see your IP, the ISP doesn't see the destination.
- dVPN: a marketplace of exit nodes (Mysterium, Orchid, Sentinel, NymVPN) — no central provider.
- Starlink: internet from satellite, independent of the local operator — but it is a single company under US jurisdiction that can restrict the service. A crutch, not decentralization.
Why it's useful
- Access to content without filtering and without handing over an ID.
- Resistance to the national firewall and to internet shutdown.
- No one along the route can centrally track you.
Part C · What to do
What to do
Regulation matrix · calls to action · manifesto
C1 — Matrix: technology × regulation
What undermines what
| Technology | MiCA | DAC-8 | KYC / AML | AI Act | Chat Control / DSA | Age Verif. | Blocking / shutdown | CBDC / cash |
|---|---|---|---|---|---|---|---|---|
| Peer.xyz | ✕ | ✕ | ✕ | · | · | · | · | · |
| CashuPayServer | ✕ | ✕ | ✕ | · | · | · | · | ✕ |
| Bitblik | ✕ | ✕ | ✕ | · | · | · | · | ✕ |
| RoboSats · Bisq · Vexl | ✕ | ✕ | ✕ | · | · | · | · | · |
| Monero · Zcash · swaps | ✕ | ✕ | ✕ | · | · | · | · | ✕ |
| Stablecoins · DeFi | ✕ | ✕ | ✕ | · | · | · | · | · |
| SimpleX | · | · | ✕ | · | ✕ | ✕ | · | · |
| White Noise · Bitchat | · | · | ✕ | · | ✕ | ✕ | ✕ | · |
| Nostr | · | · | · | · | ✕ | ✕ | ✕ | · |
| Meshtastic · MeshCore · Reticulum | · | · | · | · | ✕ | · | ✕ | · |
| Kimi K3 · local LLM | · | · | · | ✕ | · | · | · | · |
| VPN · dVPN · Tor · Starlink | · | · | · | · | ✕ | ✕ | ✕ | · |
| GrapheneOS · Zapstore | · | · | ✕ | · | ✕ | ✕ | · | · |
| Self-hosting | · | · | · | · | ✕ | · | · | · |
← scroll the table →
✕ = the technology exempts itself from the given rule by design (mapping is indicative). Pattern: non-custodianship + decentralization solve several regulations at once — they remove the intermediary the regulation targets.
Build a strong SK community
A market lives on liquidity. The more people use it, the better it is for all bitcoiners in Slovakia.
Liquidity first
Motivate makers to keep offers for SK banks around the clock. Fair spreads → takers; volume → makers.
More coordinators
Let more coordinators run, including SK ones — no single point of failure.
Education
An SK guide “withdraw cash for bitcoin”, videos, onboarding at meetups. Zero barrier.
Physical hubs
Paralelná Polis, meetups, merchant onboarding to Lightning. Freedom needs places.
Distribution
Nostr, Telegram, SK groups. Let Bitblik be the default answer to “how do I buy BTC without KYC”.
Contribute code
It's open-source. Translate, report bugs and contribute code — every contribution strengthens the whole project.
Let's write support for SK/CZ banks
Peer.xyz / ZKP2P today targets US rails (Venmo, PayPal, Zelle) and Revolut/Wise. The protocol is open — adding a bank = writing a payment prover (zkTLS/TEE proof of payment). Let's do it for our banks, exactly as the community added the Slovak market to Bitblik.
What needs doing
- Write payment provers for Tatra banka, SLSP, VÚB, ČSOB, mBank.
- Add SEPA Instant as a European fast scheme.
- Test the flows and document them in Slovak.
Why it's worth it
- Non-custodial fiat↔crypto in EUR for SK and CZ — the protocol does no KYC (your bank does).
- An open protocol = write it once, everyone uses it.
- Who: developers (integrations), testers, community (pressure + docs).
The model is proven: the Slovak contribution to Bitblik showed that one good pull request opens a whole market.
Use a VPN. Bypass Age Control.
Age verification makes access to legal content conditional on handing over an ID or your face — which then gets stored. It's not about age — it's about de-anonymizing the internet. A VPN restores the default: access without handing over identity.
How it works
The client encrypts your traffic and sends it to an exit node in another country. The content provider sees the exit node's IP, not yours — and a jurisdiction where the age-verification rule doesn't apply.
dVPNs (Mysterium, Orchid, Sentinel, NymVPN) do the same without a central provider that could be coerced.
How to do it right
- Choose a no-log, independently audited provider (e.g. Proton) or a dVPN.
- Turn it on by default on mobile and computer.
- Combine it with a fingerprint-resistant browser.
- Bonus: protection on public Wi-Fi and against ISP tracking, and you also bypass geoblocking and DNS blocking.
+1,400% Proton VPN signups in the UK within hours (25 Jul 2025) · 550k+ signatures on the repeal petition · the day after it took effect, VPN apps were half of the UK top-10 downloads.
“Won't criminals abuse it?”
Five most common objections — and answers that hold up.
“Won't criminals and terrorists abuse it?”
Encryption, cash and VPNs have been used for ages — and they have resources. Regulation won't stop them; it lands on everyone — and per Europol only ~1% of criminal proceeds get seized anyway.
“If you've done nothing wrong, you've nothing to hide.”
Privacy isn't about hiding, it's about control. You have curtains, envelopes and a password — not because you're committing a crime.
“It's only for a few enthusiasts.”
The same was said about encryption and email. After Age Control, Proton VPN signups rose 1,400% within hours — the masses vote with their feet.
“Isn't it illegal?”
No. Holding bitcoin, using a VPN, encrypting messages or running open-source is legal. These tools simply fall outside the regulatory perimeter — they aren't a breach of it.
“Isn't this tax evasion?”
No. DAC-8 targets reporting by intermediaries — your tax obligation stays. Privacy from surveillance is not a tax exemption: you declare gains as before.
Install tonight
Four tangible steps instead of an abstract matrix. Pick at least one and do it today — the links are clickable.
1 · Bitcoin without KYC
Bitblik — buy/sell BTC and withdraw cash from an ATM (Tatra · SLSP · VÚB) without a card and without KYC. Alternatives: Vexl · RoboSats.
2 · Private communication
SimpleX, Signal or White Noise — move sensitive conversations out of scanning's reach. SimpleX and White Noise need no phone number.
3 · Free access
Proton VPN or a dVPN (NymVPN, Mysterium) — turn it on by default on mobile and computer. You bypass Age Control and geoblocking.
For advanced users: Ollama · GrapheneOS + Zapstore · Umbrel / Start9. Freedom is a habit, not a one-off purchase.
C7 — Manifesto
You don't ask
for stolen freedom back.
Freedom is taken back
with technology.
Regulation targets the intermediary. So we remove it. Non-custodial, decentralized, self-hosted, open-weight — architecture, not permission.
Pick one thing from today's matrix and deploy it this week.
Sources & verification