The day's tech, sifted: Aug 2, 2026

What matters today: Officials now say Iran-linked cyberattacks on US water systems have spread past the seven states first reported and could run wider still, with attackers hijacking programmable controllers by resetting passwords and reassigning IPs. A firmware flaw dating to 2021 let hackers drain $70M from over 1,000 Coldcard bitcoin wallets in a 41-minute sweep without touching a single device, and Reuters traced $4B in Iran sanctions evasion to an unlicensed Dubai crypto exchange plugged into more than 2,000 illegal gambling sites. Separately, Epoch AI says the world's roughly 20 million AI chips will keep doubling about every nine months, putting 200 million online by 2028.

Security & Privacy

• The scope of Iran-linked cyberattacks on US water utilities has widened past the seven states first reported and may be far broader still, officials say; Minnesota was simply first to disclose publicly. CISA has since detailed the mechanism: attackers targeting programmable logic controllers by resetting operator passwords and reassigning their IP addresses to lock staff out, an escalation from earlier coverage that hadn't confirmed how the intrusions worked. No water supply has been reported unsafe.
• A five-year-old firmware bug let attackers drain $70M from 1,196 Coldcard bitcoin wallets in a 41-minute sweep without touching a single device: a 2021 integration error routed seed generation to a software pseudorandom generator instead of the hardware RNG, making some wallets' keys computable from nothing but the public blockchain. Coinkite shipped an emergency fix, but it can't repair a seed already generated, only a fresh one on patched firmware is safe.
• Reuters traced $4B in Iran sanctions evasion since May 2024 to Shelbit, an unlicensed crypto exchange run from an office above a Dubai budget hotel, tying it to more than 2,000 illegal gambling sites plugged into Iran's central bank payment rails and wallets linked to the IRGC. Dubai's regulator issued a cease-and-desist a week before the report.
• A federal judge let Minnesota's first-in-the-nation ban on AI "nudify" apps take effect, rejecting xAI's bid to block it, largely because xAI waited until three days before the deadline to ask. The law fines violators $500,000 per generated image; a hearing on xAI's underlying challenge is set for August 19.

AI / LLMs

• Epoch AI: the world's roughly 20 million AI chips will keep doubling about every nine months, putting 200 million online by 2028, a tenfold jump the New York Times frames as the physical bill coming due for the AI boom's spending and power draw.
• ByteDance shipped Seedance 2.5, generating a single 30-second video from up to 50 reference images, clips and audio files with timestamp-level editing, up from 2.0's 12-reference limit; it's rolling out inside Doubao and Jimeng AI first, with a Volcano Engine API to follow.
• An AI-generated Lean proof appeared to disprove the Collatz conjecture, but was exploiting a soundness bug in Lean's kernel, not real math: nested inductive types with unused ("phantom") parameters could dodge type-checking entirely, and a fix landed about an hour after a researcher isolated it. Lean's creator called it a preview of a recurring problem, AIs are unusually good at finding kernel bugs to exploit, a pointed caution the day after this digest covered a math model's verified proofs.

Startups & Industry

• Trump Media launched a paid Truth Social data feed priced up to $100,000 a month, days after senators Warren and Schiff asked the SEC to investigate whether it lets Wall Street trade ahead of the public on the president's posts; Trump holds roughly 41% of the company through a revocable trust.

Devtools & Infra

• NetBSD 11.0 shipped as the project's first stable release with 64-bit RISC-V support, alongside POSIX.1-2024/C23 compliance, deeper Linux syscall compatibility, and a new MICROVM kernel built for fast VM boot.

Elsewhere

• Engineers are working out how to save Link, the fridge-size satellite sent to rescue NASA's $500M Swift observatory, after it spun out of control mid-approach last week, losing two of three reaction wheels and its steady link to the ground.
• A bootleg of Spider-Man: Brand New Day racked up 5.9M views on X in seven hours before Disney got it pulled, a footnote to a film already breaking preview-week records with $72M.
• Leaked specs peg the Pixel 11 lineup at a $100 price hike from $899 for double the base storage, alongside Google's new Tensor G6 and Titan M3 chips, ahead of an August 12 event.
• Questions are swirling over whether Fenix Flexin's Billboard Hot 100 hit "Rubberz" is AI-generated; the artist denies it but hasn't addressed the evidence people are pointing to.

Hacker News

Google's neglect of its own platforms ran through several threads today: a resurfaced 2023 piece on how Google helped destroy adoption of RSS feeds traced the arc from Google Reader's shutdown through FeedBurner's slow rot, paired with a lighter companion, a directory of people who love RSS, a small nostalgia-driven roundup. The same thesis extended to search: Google News is just Forrest Gump's shrimp boat now argued the product has been left adrift as Google's attention moves to AI, with filters broken and results increasingly overrun by social media noise rather than actual news.

Elsewhere, Cursor removed cost information from its usage page and CSV export, read by commenters as another step in its rocky pricing history since usage-based billing arrived. MIT Sloan research on AI financial advice found it beats expectations on savings and diversification, though it still struggles with messy real-life curveballs like layoffs or medical bills. On the human side, the Silicon Valley founder meat grinder and Charlie Stross's essay on the non-use of AI in his writing process both pushed back on industry pressure, one on founder burnout culture, the other defending non-AI craft. Smaller entries rounded out the page: the Diátaxis documentation framework, a new edition of The Art of 64-bit Assembly, and a gallery of Anime User Interfaces.

Threads

• Three security failures landed at three different layers of the stack on the same day: critical infrastructure (water utility controllers), consumer self-custody (Coldcard's firmware), and state-level financial crime (Shelbit's sanctions evasion), one theme, trust boundaries breaking down wherever they're tested.
• AI's physical buildout and its output kept scaling together: Epoch AI's compute-doubling forecast and ByteDance's heavier, more controllable Seedance 2.5 both point the same direction, capability and infrastructure both compounding, not just headline benchmark scores.
• The Lean kernel soundness bug is a live rebuttal to yesterday's celebrated AI math proofs: an AI can find a genuine kernel exploit as fast as it can find a genuine proof, so a verified result is only as trustworthy as the kernel verifying it.
• Two stories about attention and access collided from opposite directions: Trump Media charging Wall Street up to $100,000 a month for early access to the president's posts, and a judge letting Minnesota bar apps that generate nonconsensual images without consent, both tests of who gets to profit from unequal access to something everyone else can see.