New zine drop 🐱 OP_CAT! 🐱

Pages 1 - 4 of the OP_CAT zine

New @satsie zine dropped!! All about OP_CAT!

Lillian Wang of @mitDCI publishes her report: "A Comparison of Bitcoin Covenant Proposals for Vaults" dci.mit.edu/posts/bitcoin-va…

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link. We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.

Quick explanation and thoughts on yesterday's Liquid hack: nehanarula.org/2026/09/07/li…

The widely used @mempool fee recommendation algorithm looks at your nodes next 3 projected blocks, finds the median fee rate of each and computes priority tiers. In contrast, Bitcoin core has historically only used *confirmed* blocks for it's fee estimate, but a new mempool based fee estimate algorithm has now been merged. This new bitcoin core approach is only used to *lower* the fee estimate meaning estimates quickly drop if the mempool clears out, but won't instantly rise if a flood of high feerate transactions come in after a period of low fees. github.com/bitcoin/bitcoin/p…

New from our Bitcoin Wizards division: The Many Headaches of CoinJoin. The anonymity set you were promised assumes an adversary with no memory and no block explorer. Real adversaries have both and who knows what else.

Thanks to everyone that came out last night! Never forget when we were talking about the future of Boltz, opened up Twitter, and this was the first thing that appeared.

.@weikeng is building Private Information Retrieval (PIR) for bitcoin: query the UTXO set without revealing what addresses you are interested in. It’s a rare way to gaze into the bitcoin abyss without it gazing back.

LLMs are used very successfully to find vulnerabilities in Bitcoin software. Can they also help prove the security of a modern cryptographic library for Bitcoin? To explore this question, @remix7531 and I are publishing libshrincs. delvingbitcoin.org/t/libshri… libshrincs is a handwritten C library implementing WOTS+C, the one-time signature used by SHRINCS. It is a proof of concept and should not be used in production. Its machine-checked proofs connect the C implementation to an unforgeability theorem. The current theorem does not yet give a full post-quantum security bound. The post and review tutorial describe its current limits. Code and proofs: github.com/remix7531/libshri… Review tutorial for the security proof (no Rocq or SSProve background required): github.com/remix7531/libshri… @remix7531 has written three excellent posts on the library and verification work: Towards libshrincs remix7531.com/post/towards-l… The grind was the only detector remix7531.com/post/the_grind… Choosing a verification toolchain remix7531.com/post/choosing_…

Bitcoin Core v32.0 is targeted for release in October: - Up to 3x faster initial sync. Block validation now fetches transaction inputs from disk in parallel instead of one at a time - The libevent external dependency is fully removed, continuing Core's push to cut third-party dependencies - Max peer connections raised from 125 to 200 to have more open slots for new nodes to sync from, faster block propagation, and a harder network to eclipse or partition - Mempool-based fee estimation to cut fee overestimation (in progress) - Transaction relay rate limiting is now global instead of per-peer, keeping a node's CPU and memory usage steady when transaction volume spikes - Ships with features from libsecp256k1 0.8.0 with verification up to 11% faster, plus the new Silent Payments module (BIP 352) - PSBTv2 (BIP 370) support, now the default for PSBT-creating RPCs for better coordination of unsigned transactions for multisig and hardware wallet setups - New exportwatchonlywallet command to export a wallet as a watch-only file, no private keys, and restore it on your online node - Core now enables Tor's proof-of-work DDoS defense on the onion service it creates for your node, where the Tor daemon supports it Additional tests, bugfixes, and features included as well. Feature freeze is ~August 20, rc1 ~September 10, final release targeted for ~October 10. (Test the release candidates when they ship!)

Anything interesting happening in bitcoin lately? Join us for Boston BitDevs this Thursday August 13 at Fidelity to talk about it! RSVP here 👇 app.evento.so/e/evt_9fcVYNxo…

Excited about the newly released version 2.5.0 of the Ledger Bitcoin app. Upgrade! For many taproot🥕 miniscript policies it brings a long-awaited UX improvement: human-readable policy description, in addition to the descriptor template (which is opaque for most users). 🧵

🚨PSA for LND + BTCPay Server users🚨 Don’t assume you’re safe after upgrading. You’re going to want to explicitly destroy your macaroons and macaroons.db and recreate them fresh. This also applies to auth mechanisms for other LN backends. Also, if you generated a hot on-chain wallet in BTCPay you want to move those funds.

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds. Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer. If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.

⚠️ This repo gained many stars in 24h. DO NOT RUN IT. It claims to reproduce the vulnerable COLDCARD RNG, but an LLM-assisted review found a dependency that downloads and executes an infostealer that searches for wallet seeds, private keys and passwords. github.com/domaup/coldcard-p…

Not intending to Monday morning quarterback, but I wanted to sharing my approach to defensive coding around RNGs: 1. Identify each source of entropy used by the RNG and instrument them. Measure how much min-entropy each source provides across different environments. /1

there was more entropy in the commit history than in the code