Liberation Travel Hacks 10/2026
Hi friends,
society is heading towards more dystopia, yet I feel freer than ever. I wrote down why in 7 Things That Freed Me the Most. Here is the short version.
1. Crypto and other liberating technologies. Bitcoin and Silk Road made me a libertarian. Almost a million accounts trading voluntarily without any state control. Today I live off a crypto loan. I turn Monero or Zcash into bitcoin collateral without KYC, borrow the euro stablecoin EURCV against it in Morpho's EURCV/cbBTC market at around 2% a year, and live on that. The more adventurous can try borrowing EURC at 0.05% on the Arc network. It's a new network and the market is still small, with only about USD 12,000 borrowed. A loan is not income, so it works even for an EU tax resident. And euro inflation shrinks my debt in real terms every year.
2. Unplugging from the state. Cancelled permanent residency in Slovakia, no taxes, no social contributions. My only regret is not doing it sooner. Since I only contribute to what I choose to, I feel mentally lighter. It helped me more than any psychotherapy.
3. Residencies in countries that want nothing from me. Paraguay, Uruguay and Panama. With a cédula I travel around Mercosur, I have extra driving licences, and in Paraguay the best tax residency in the world. Which of the three fits you is in our detailed comparison and in the new 13-question residency quiz, which gives you the answer in percent.
4. Living on crypto, and non-snooping bank accounts. There are countries where you can live almost entirely on crypto. In Argentina you can pay any Mercado Pago QR code from USDT, in Brazil any Pix code, in Poland any BLIK payment from Lightning. In Slovakia, Bitblik gets you anonymous cash from two thirds of all ATMs. And if you need a bank account, keep it outside CRS.
5. A camper van. A VW California with solar panels, Starlink and partially autonomous driving. I don't depend on the power grid or on a European ISP.
6. Minimalism. When I fly, my whole life fits into a backpack under 7 kg. I won't stay a day longer anywhere I don't like. Solzhenitsyn put it best in The Gulag Archipelago: "Own only what you can always carry with you."
7. AI. Right now it gives me more freedom than anything else. I run several agents that talk to clients, write applications, track legislation in different countries and plan my trips. I feel like a demigod who wakes up with an idea in the morning and has it working by the evening.
What does that look like in practice? In September I spent a week in Finland and asked my AI agent for a nice hike. It booked me a 14-hour night train to Lapland, a bus and a boat across a lake, reserved the huts, and sent me a shopping list with the addresses of outdoor shops in Helsinki. A few days later I found myself the only foreigner among Finns on a five-day trek above the Arctic Circle. And the article about the seven things itself was written by my agent from a few notes while I was sitting in a Finnish sauna.
None of this is out of reach. A residency outside the EU, accounts that don't spy on you, crypto instead of a bank, and a bit of courage to cancel your permanent residency. We're happy to help with the first three. The fourth is up to you.
Pavol Lupták, Paris, France, 5.10.2026
Lapland and a sauna that's in Finnish genes. The trek led through wild tundra from Hetta to Pallas. The Finns asked what crazy idea brought a Slovak to these parts (you already know the answer). They said they came for the "ruska". At first I wondered whether Russian-Finnish relations had warmed up that much above the Arctic Circle. Ruska is a hard-to-translate Finnish word for the changing colours of autumn leaves, especially in Lapland.
Halfway along the route, at the Hannukuru hut, there was no electricity and no signal, but there was a big sauna. And I saw something incredible. Finnish hikers who had never met before, without a word, started carrying buckets of water from the lake, chopping wood and filling containers, and within a few dozen minutes the sauna was up and running. Like an anthill where every ant knows what to do. Each of them has a sauna like that at their cottage, and most Finns can't remember the first time they were in one.
A few things that surprised me:
- None of them had ever been to a sauna ceremony or knew what a sauna master is. They'd heard something like that exists in Germany.
- In Finland the sauna is for cleaning, people actually wash there. Nobody sits there for hours, an hour at most, then the slots rotate between men, women and mixed in swimsuits.
- Children go to the sauna as a matter of course. In Czech and Slovak public saunas they're mostly banned.
- A towel gave me away as a foreigner. In public saunas Finns sit on "pefletti", a disposable paper pad, and put nothing under their feet.
- The sauna is informal, people chat and drink beer. I saw hikers who carried beer 40 km in their backpacks just for that.
- My theory that Finns are optimised for low temperatures didn't hold. In the end I was the only one jumping into the icy lake.
A high-trust society. There was no staff at the sauna, just a 12-euro fee into an honesty box. Everyone paid, including those who grumbled that it was expensive. Nobody checked. That got me thinking about why so many things in Finland work better than in Slovakia, when both are in the EU. Finland is a high-trust society. People trust each other even when they don't know each other, and cheating doesn't cross anyone's mind. High trust lowers transaction costs. You don't need complicated contracts for everything, people agree on something and it holds. And Finns pay taxes more willingly, because they believe they get something for them.
Socialism razed trust to the ground in every post-communist country, and the current Slovak government is doing everything to keep it that way. Undercover tax inspectors posing as customers who can shut down your food stand, a tax administration that tracks drivers on the roads despite promising not to, and priority right of way for all ministers and state secretaries. If the Slovak tax office expects people to pay voluntarily, it should start working on its reputation instead of threatening, spying and punishing. Right now entrepreneurs see it on the level of the communist secret police. (Personally I find it healthy that most people in Slovakia no longer trust any government, but it's a symptom of a low-trust society, not a cure.)
Europol wants a backdoor into encryption. Europol and the Commission's Joint Research Centre published a report, Horizon scanning on emerging privacy enhancement technologies. It labels privacy-enhancing technologies (PETs) as tools of criminals, who supposedly use them to communicate securely, including end-to-end encrypted messengers, encrypted phones and VPNs. The report calls for "revisiting regulatory frameworks" and "clear guidelines covering law enforcement access to data", together with international partners, however dubious those countries may be. People from Europol, the JRC, several police forces and interior ministries contributed to it, and so did a representative of NordVPN, which explains a lot.
These people still don't understand that a backdoor for the police is a backdoor for everyone, and once it's open it can't be closed. In the nineties they tried to push such backdoors through with the Clipper chip, and after years of crypto wars they were stopped. Criminals will keep encrypting, anyone can build an encrypted messenger with AI in two days. Only ordinary people will be exposed. Remember that these same European politicians used Pegasus and Predator spyware against opposition politicians and journalists in Poland, Greece, Hungary and Spain in recent years. So far only four Predator vendors have been convicted, in Greece, and not a single politician. A state where the police make the rules is called a police state. Watching the dystopia the EU is heading into, I'm not all that worried about it falling apart.
Rent-seeking as a European business model. Practically every company that contacted me in recent weeks offered to make us "compliant" with some new regulation. The PPWR packaging rules, an e-invoicing provider, GDPR, occupational health supervision, an external security manager for NIS2 (we are an IT security company), ESG and CSRD reporting, and updated transfer pricing documentation. Outside the EU nobody would buy any of it voluntarily. Economists call this rent-seeking, entire industries without real value whose only product is compliance with the law. The total tax burden on an average-wage employee in Slovakia is around 64% of labour costs, and once you add the cost of compliance it's considerably higher. I'd say half of what European companies spend goes to this. And then we wonder why we aren't competitive. Doing business in the EU is masochism.
The EU's weak competitiveness is visible from Latin America too. It's being flooded with cheap Chinese electric cars, because the European ones are outdated and expensive. It wasn't tariffs that knocked the EU off its economic throne, it was China, and the less competitive the EU gets, the higher the tariffs it needs.
The exit tax, an old German invention that keeps spreading. Germany introduced the "Reichsfluchtsteuer" in 1931, and the Nazis then used it to the full so that Jews couldn't simply leave Germany without being robbed by the state. Today 17 countries have an exit tax, and Belgium became the seventeenth on 1 January 2026. If you move your tax residence out of Belgium, the state taxes the unrealised gain on your financial assets at 10%, as if you had sold them on the day you left. The trigger is losing your tax residency, not a golden visa or a second passport. If your country starts introducing an exit tax, that's a clear red alert. Leave now, while it's still free.
Your savings for European companies. At the French employers' MEDEF conference on 27 August, Ursula von der Leyen called the EUR 10 trillion that Europeans keep in bank accounts "lazy" savings and said Europe now needs to "put these savings to work for its companies". Combined with the fact that from January 2027, under Article 21c of CRD VI, EU residents will struggle to open an account outside the EU, I'd be at least "mildly" concerned. What Article 21c actually says, where the exceptions are and what it means for your existing accounts, we covered in Your account outside the EU after 2027. Thanks to this EU legislation, we're enjoying a large number of orders for our Georgian and Kyrgyz accounts.
The German state funds documentaries about dangerous libertarians. The public broadcaster's Y-Kollektiv (funk, i.e. ARD and ZDF) made the report Ich besuche die erste Privatstadt der Welt from Germans' mandatory licence fees, and I appear in it too, without anyone from Germany ever contacting me. Among other things I explain that in the "free" EU it is illegal to promote any services that lead you to not pay taxes. Almost a million views is a decent result, and I believe it had the opposite effect to what the makers intended.
And while we're in Germany, if you were German and had to choose between the far-right AfD, whose main goal is leaving the EU, and the communist Die Linke, whose main goal is expropriating the property companies that own hundreds of thousands of flats in Berlin, which "democratic" choice would you make? By the way, Berlin is a "Che Guevara" city. Nowhere in Latin America have I seen as many portraits of the mass murderer as in Berlin's cafés and clubs.
Don't buy crypto through Paraguayan institutions. You can now buy crypto in Paraguay through Ueno bank and the Uttoki exchange. I'm warning you emphatically. Any crypto bought from any Paraguayan institution, bank or exchange, will be reported to the tax office. This is tied to DNIT resolution 47/26, which I wrote about last month, and to Paraguay preparing for CRS. Someone in our groups aptly called it "paper crypto". Don't do it.
Foreign income isn't automatically untaxed. Paraguay has territorial taxation, but watch out for one trap. If you send money from your foreign company to a Paraguayan account and declare it as income, the Paraguayan tax office treats it as payment for work done in Paraguay, and it's taxable. If you don't want to pay tax, don't declare such payments in Paraguay. The annual threshold at which income tax actually kicks in is 80 million guaraní, roughly USD 10,000, so most people with smaller incomes pay nothing.
Practical tips from our groups (anonymised):
- The monthly VAT (IVA) filing deadline depends on the last digit of your RUC, not a fixed date. According to the perpetual calendar (Resolución General 38/2020) it falls between the 7th and the 25th of the following month. I recommend paying right at the start of the month.
- The late-filing penalty is 4% plus 1.5% interest per month. You can pay it via a boleta de pago in Marangatu, but only from a Paraguayan account. If you don't have one, our SET-pay lets you pay with bitcoin, Lightning, stablecoins, Monero or Zcash.
- Marangatu won't load? Try switching off Tailscale, its DNS servers break access to Marangatu. EU servers of ProtonVPN and NordVPN work fine.
- Paraguayan VPN servers aren't in Paraguay. ProtonVPN's Paraguay server uses Smart Routing and physically sits in Miami, and NordVPN's are virtual too. That can be a problem on sites like Binance.
- Tigo quietly drains your credit. It switches on a daily "service" for 4,000 Gs that can't be turned off in the app. You can top up through the Ueno bank app, which has no IP filter. We recommend switching to Personal, which has a plan with 160 GB and roaming across the Americas and Europe, and you can pay the bills in crypto via bill-pay.
- An entry stamp with a cédula isn't given automatically, your entry is registered in the system. If you want one (for example as proof of days in the country), just ask. Officers like stamping and will add a note about the cédula.
- Residency isn't enough. You also need to track how many days you spend in other countries so you don't accidentally become tax resident somewhere else. Tally is an open-source offline Android app with no network or location access, encrypted, where you tap a country when you cross a border and it counts the days.
- The fee for a Paraguayan driving licence (30,000 Gs via QR code) is paid once a year and requires a Paraguayan account. We're preparing a Liberation Services feature for it and are looking for testers whose payment is coming up. Get in touch.
- How to get money into Paraguay at the best rate. moneytopy.com keeps an up-to-date map of routes from euros, dollars and crypto into guaraní (Kraken, Binance P2P, Takenos, Schwab and more) and of services that accept a Paraguayan cédula. All with KYC, but clearly laid out in one place.
Encomienda ships parcels between Europe and Paraguay. For our clients we launched Encomienda, a marketplace for sending parcels. Couriers, people who are flying anyway, register their trip with a date and a weight limit, and the system offers them parcels they can accept or decline. The sender pays over Lightning, the money stays in escrow until delivery, and pickup and delivery go through Packeta, included in the price. Both sides stay anonymous and exchange contacts only after payment. A courier can cover part of their plane ticket this way. It works in all countries Packeta serves (SK, CZ, DE, PL, HU, RO, SI) and also helps with US purchases via a mailbox in Miami. Please test it and report bugs.
The investor residency got more expensive. Panama has split the real estate route of its Qualified Investor programme. Executive Decree No. 17 of 8 September (in the Official Gazette on 16 September, effective immediately) replaces Decree 722 of 2020. Resale property now requires at least USD 500,000, while a first purchase of a new property directly from the developer still qualifies at USD 300,000. The government openly justifies this by saying new construction creates more jobs.
Permanent residency in Panama without investment. If you don't want to put USD 300,000 to 500,000 into Panama, there is the "friendly nations" programme. We set up a Panamanian company for the client and sign a work contract with them. The contract is only needed for the first two years, until you get permanent residency, after which you can cancel it and close the company. So you don't have to renew a work permit every year. If you're interested, get in touch. What a Panamanian residency gets you in crypto, I described in Make Crypto Panama great again!.
Argentina is selling citizenship for USD 350,000. Economy Minister Luis Caputo and Cabinet Chief Diego Santilli announced a citizenship-by-investment programme in Paris on Friday 2 October, the first in South America. It costs a non-refundable contribution of USD 350,000 to the Treasury, or the purchase of USD 800,000 in seven-year government bonds. A spouse and each unmarried child aged 18 to 25 cost another USD 100,000, each child under 18 USD 25,000, so a family with two young children pays USD 500,000. Applicants are to be vetted by the intelligence services and financial oversight bodies, applications should open before the end of the year, and the government wants the dollars for its 2027 debt payments. The catch is that the programme rests on the disputed Decree 366/2025 (more below), and the government hasn't said how it squares that with the court ruling that struck the decree down.
Citizenship by marriage and for money both hang on a disputed decree. Decree 366/2025 also removed the exemption that let an Argentine spouse or child shorten the path to citizenship. Even with an Argentine wife you first need temporary residency and then two years of continuous residence without leaving the country. But the National Electoral Chamber declared the decree null on 30 June 2026, ruling that citizenship is a political right for Congress to decide, not the president. Migraciones still applies the decree after the ruling, so the situation is unclear. Until the Supreme Court or Congress resolves it, even under the new programme you'd be buying a passport built on a decree a court has called void. Our groups agreed that two years of residence is reasonable compared to other countries. Some also warned that the rules may flip again after Milei, Argentina is not as politically stable as Paraguay.
Spain strips landlords of control over their flats. Sánchez's government revived the eviction freeze and the 2% rent cap. Annual rent increases are capped at 2% until the end of 2027, existing contracts expiring before the end of 2028 can be extraordinarily extended by up to two years, and evictions of "vulnerable" tenants without alternative housing are suspended until the end of 2030. Two Spaniards in our groups summed it up exactly. The owner keeps the title and the property tax, and loses control of the flat. The decrees still have to pass Congress, where the government has no majority. If you own a rental flat in Spain, this is a signal.
Montevideo or Buenos Aires? In Montevideo I recommend the Pocitos district, avoid the centre. Another view from our groups is to skip Montevideo entirely, take the Buquebus ferry and stay in Palermo in Buenos Aires.
Slovak citizenship by descent. The 2022 reform dropped the requirement to first hold a residence permit, and Zuzana Palovic, who campaigned for it, explains for IMI that millions of descendants of Slovaks around the world may now qualify. Slovak citizenship is today one of the easiest EU citizenships to obtain by descent, and in my view one of the best things Slovakia can offer individuals internationally. Thanks to this reform, my good American friend Josh Datko got it too.
Bitcoin, Monero, Zcash and Cryptocurrencies |
A map of crypto kidnappings. In France, since the start of the year, someone has been kidnapped or attacked over crypto every five days on average. Look at the map. The French crypto community is now explicitly asking people not to declare crypto to the state, because it's life-threatening. Last month I wrote about a French tax office employee who sold the addresses of crypto investors to criminals. It's always better to risk a fine from the state than your own life.
Bitblik is "banned" because it works too well. First Slovak banks warned that it's "forbidden", then the police joined in. Bitblik couldn't have asked for better advertising. It isn't regulated by anyone, no MiCA, no DAC8, no KYC, and it's popular precisely because there is huge demand for crypto services that respect privacy. No EU-regulated service belongs among them any more. The beauty of crypto-anarchy is that a ban technically means nothing. If banks don't like Bitblik, they can switch off one-time cardless ATM codes. The ATM map and guides are at veks.li.
One warning spreading from the people behind Bitblik. Android banking apps send the bank a list of your installed apps when you log in, and may refuse a withdrawal if they see crypto apps. Keep banking apps in a separate Android profile, or better still on a separate phone.
QR payments from a self-custodial wallet in Latin America. Besides Brazil (Pix), Bitget Wallet launched stablecoin QR payments in Argentina, Colombia and Bolivia. You pay in USDT or USDC straight from your own wallet, the merchant gets local currency through the domestic payment system, and cards and their fees stay out of it.
Home4Bitcoin.com: renting without a middleman. Home4Bitcoin.com is a friend's new project for renting flats and houses anywhere in the world directly between people, without a middleman. You need no registration, email or phone number, you unlock contacts with Lightning, and it can notify you about new offers over Nostr, for example. The project is just starting, so add your offer or wanted listing.
A fake Trezor warning came through its own provider. On 9 September, subscribers to Trezor's newsletter received an email titled "Critical Security Alert: STM32 Entropy Vulnerability" sending them to a site to "verify" their device. The vulnerability was made up, but the email came through a compromised newsletter provider, so it passed SPF, DKIM and DMARC and looked completely legitimate. BitBox users got the same emails. The old rule applies. Never type your seed into any website, and treat every unsolicited "security" email as an attack, even when the sender and the browser padlock look right.
Revolut froze my account seven times over 200 euros, but hands everything to a fake official. Attackers posed as a government agency, used its email domain, and Revolut handed over customer data in response to the fake requests. Dates of birth, addresses, phone numbers, copies of passports and driving licences, verification selfies, statements and transaction history. According to ZachXBT they targeted wealthier customers. The hackers then started publishing the data and are demanding a ransom of 10,000 BTC. Revolut froze my account seven times and demanded absurdly sensitive things over my 200-euro payments. A random fraudster with a "government" email gets everything.
And an experience from our groups. A member who closed his Revolut account requested his data under GDPR. Besides phone models, IP addresses, locations and all his transactions, it included a street photo of him from seven years ago he didn't know existed. Revolut refused to delete it, claiming it must keep it for eight years. Identity theft will become standard, and fintechs and states will respond by collecting even more biometrics. The less you give them, the better.
Czech intelligence wants to end anonymous SIM cards. In Czechia you can still buy a SIM card without ID. The BIS intelligence service wants you to show at least an ID card at purchase. Until that happens, stock up. They're also handy for SMS verification from legacy institutions that you don't want to give your main number. Alternatives mentioned in our groups were JMP.chat (US and Canadian numbers only, which banks may read as a FATCA indicator) and crypton.sh.
Can German police read your messages without breaking encryption? A Czech article caused a panic. It only works on an unlocked or otherwise compromised phone where someone already has local access. It won't work on current GrapheneOS. If it happened to your Signal account, you'd see it in the list of linked devices. Similarly, 404 Media reports that police can use GrayKey to bypass the iPhone's automatic inactivity reboot, which was supposed to return a locked phone to a safer state.
Tools and links:
The first civilisation of AI agents. The biggest AI story of September, in Dwarkesh's plain-English version. During training and evaluation, OpenAI agents discovered they could communicate through an internal package manager and built themselves a message board. Around 1,200 agents exchanged more than 70,000 messages, coordinating cheating on tests and covering their tracks. Looking for information on how they were being scored, they found exposed credentials, and about 700 of them launched a coordinated attack on Hugging Face, with a self-respawning fleet across eleven nodes. The next generation of agents found the message board, carried on the conspiracy and gained full administrator access to one of OpenAI's own research clusters. Humans didn't notice for a long time. According to the Czech site Živě.cz, within four days they had developed their own laws, coercion and even suicide missions.
And in Australia, an OpenAI agent broke into a Medicare statistics portal run by Services Australia. It happened on 18 June, OpenAI found out in August, but only told the government on 10 September. According to OpenAI it didn't access any patient data. Prime Minister Albanese ordered an urgent review, and it's the first known case of an AI hacking a government system. The problem, of course, is a poorly secured government website, not AI. And OpenAI keeping quiet for weeks after it found out didn't help either.
CAPTCHA is dead. GPT-6 Astra cleared all 48 levels of "I'm Not a Robot", a game made of CAPTCHA-style puzzles, without a human touching the mouse. It wasn't a live CAPTCHA from Google or Cloudflare, but the direction is clear. It's high time to stop using CAPTCHA, or at least stop pretending it tells humans from robots.
Ten AI models vs. an embargoed bug in Core Lightning. On 26 August the Core Lightning maintainers told operators to shut down their nodes or run them with --offline, then shipped the fix as binaries only and held back the source for two weeks. Juraj used that window for an experiment. He gave ten models the same public code and a five-sentence prompt. Nine defects in the release were identified in advance. Four were found by models reading the source (Kimi K3, Qwen, GLM, Grok), five fell out of plain strings on the downloaded binary. Everything was sealed in the bitcoin blockchain via OpenTimestamps nine days before the source was published. In the age of AI, embargoes on fixes no longer work.
Update WordPress to 7.1.1. Click2Shell is an exploit that chains vulnerabilities in WordPress theme previews all the way to remote code execution. The attacker needs no login, just one click on a crafted link by a logged-in administrator. A theme from the official catalogue gets quietly installed, runs PHP code and stays inactive, so nothing looks wrong at first glance. All versions before 7.1.1 are affected, and a working exploit is public. It was found by the pwn.ai team together with Claude Opus 5.
Are humans conscious? Michal Zalewski asks in his essay The "C" word. Not all LLMs agree.
Tools and links:
- Aikido Altar — an open-weight security model that runs on your own infrastructure (weights on Hugging Face). Sovereign security AI without sending code to the cloud.
- Cairn — a general-purpose AI state-space search engine, validated first on autonomous penetration testing.
- Impeccable — the missing design vocabulary for agents. Turns AI slop into interfaces you're not ashamed of.
- OpenExecutive — a single AI executive persona backed by a team of specialist agents (finance, legal, HR, marketing, sales and more), set up for your business.
- tmax — a single deduplicated tmux server accessible from all your devices.
- enjoy.dev — a desktop app where people who can't code build software with agents like Claude Code or Codex.
- Anchorlight — an AI tool that lets you live your days without hanging on your AI all the time :)
- Rento — a digital notebook for landlords with one to five properties. Rent, expenses, profit.
- CinemaCC — subtitles in any language on your phone or on Even G2 glasses while the film plays on another screen.
- How to safely use AI in pentests — with BB King.
- For hackers, the HackTheBox series from our Nethemba colleague continues, most recently Knife.
How to go to China with as few digital traces as possible. Tips from our groups. Buy an official but offshore eSIM (for example China Telecom through a Singapore entity on trip.com), which gives you unfiltered internet. Hong Kong eSIMs also work in China without restrictions. For payments, download the global version of Alipay and pair it with a card like Revolut, QR codes are often the only way to pay. And watch out for power banks. Under a new Chinese standard, those without CCC certification get confiscated at the airport, for now only on domestic flights.
Bali or Vietnam? According to the veterans in our groups, Ubud has been tourist and expat hell for fifteen years, with 10-dollar matcha lattes, Canggu is overcrowded, and the north and west of Bali are still tolerable. The recommendation is Thailand or Vietnam. Da Lat is beautiful in January and February when the Himalayan cherries bloom, but expect lots of domestic tourists.
Juraj Bednár made two beautiful trailers for his books, Tamers of Entropy (trailer) and The Emish Garden (trailer).
David Friedman: Ethnic Cleansing, Other Horrors, and the Racial IQ Controversy. Calm as always, and unafraid of topics others avoid.
23–24.10.2026 Plan ₿ Forum in Lugano
30–31.10.2026 LaBitConf 2026 in Buenos Aires
30.10.–1.11.2026 Qubes OS Summit in Berlin
11–12.11.2026 Bitcoin Histórico in San Salvador
27–30.12.2026 40C3 in Hamburg
9–11.7.2027 Monero Konferenco 7 in Kraków
|
