I should scan more codebases

Filed a critical vulnerability today, under exposed to Bitcoin

Summary of the Pod: @AnchorWatch 🤝 @hellmoneypod

meeting @layertwolabs irl

It’s time boys

I’m on a plane heading to the north east

Come out Canada, we have you surrounded.

Secret from my old production days at MLG is to make sure you bribe the production team

Honored to join @watchbmtv live in studio with @GraceRemiTV and @realseanhagan as their first outside guest (sorry @isaiahdaustin). We covered @AnchorWatch, Bitcoin Security using AI with the Red Team, and the quantum threat.

😱

My shoes

Was listening to @bitcoinoptech and heard my PR get a shoutout! Contrary to the giggling of @bitschmidty and @bitschmidty, I found this bug as a human!!!

I see @typesafeai is going for the make your eyes bleed if you try to read the T&Cs approach 😂

My father was a truck driver. I'm a TRUC driver.

Blessed X Timeline

Day 2 of the @PresidioBitcoin Open Source AI summit is underway! This has been an amazing conference with great talks and fascinating conversations. Lots of learnings and opportunities ahead!

me irl

Im in SF for the @PresidioBitcoin Open Source AI summit! Excited to do a panel later today on Securing Open Source Software with @moneyball @jordanmecom and @_tnull!

Good security model

2 Days from observing a crash locally to writing the patch, submitting a PR, going through some rounds of reiview and getting merged! Such a privilege to get multiple commits supporting the bitcoin core wallet in the past month! 🥳

Me working with @OpenAI Astra for cybersecurity

Blockstream "white hat" just sent an unencrypted OP Return " :( "

I’m more of a pink hat myself

3,400 BTC just returned to the liquid federation. Looks like ~600 BTC stayed behind.

Entering Day 39

It looks like ~4,000 BTC just moved from the Liquid Network bridge all at once with an OP Return saying, "we are whitehats. contact us on chain". TXID: c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19

I went to create a wallet on Bitcoin Core this morning and my client crashed. I took the verbose error logs, and dumped it into GPT 5.6 Daybreak, which isolated it to a one line of code change. I then had GPT Astra write a draft PR, and when @L0RINC confirmed it was a real issue, I pushed the PR! +1 -1 for the fix, 68 lines of code added for tests, making it a +69 -1 PR

The year is 2050, I’m in my basement using my analog libsecp256k1 computer to sign a HTLC to buy a cup of coffee

its so over

nvm we're so back

Maybe not?

Across any sizable volume it'd fall to under 1/9000th the price

#NewProfilePic Thanks for the still @WalkerAmerica! May have dropped the suit, but still on team Big Bitcoin.

This is how your email finds me

Heavy is the head that wears the crown

A message for @stutxo and his @lxdev_ project

I already have one! I upgraded to an orange cummerbund and pocket square for my evening wear

On the latest @hellmoneypod we learn that @realizingerin agrees with @Truthcoin because he CHARMMOGGS @rodarmor

4 years! Was right when I found out about miniscript, seedsigner of all signers was best positioned to adopt it because it used the embit library which is the first to add miniscript signing support

Red teaming the @WalkerAmerica podcast by eating a rack of ribs on camera

Everything is good for BIG BTC®🟥 Trust the plan

WR Cozy% Took 5 minutes in @opencode

New WR Fable%

Cron member btw

😂

Fable Cooked

I'm on it

As I bury myself out of backlogged emails and notes to myself, I wanted to give a special shoutout to @awayslice and the entire Nostr community who sent me a 5 pound pastrami. I followed Josh’s advice of, “the key ingredient for a pastrami sandwich, is too much pastrami”

Thank you very much @Otis_Bitmeyer for the fresh beans! Enjoying a nice pour over right now.

On Friday Anthropic came out with their Claude Code plugin which will do a sweep of codebases. I did some scans across different codebases both internal and of FOSS libraries and wanted to share my thoughts. The pros: 1. If you have not done any codebase scans up to this point, this is the most straight forward experience I've found up to this point. 2. It does find issues! There was 1 or 2 things that were not picked up from other scans that I've done up to this point. 3. It does a very thorough job to screen out false positives. 4. You are able to pick different levels of effort that were clearly explained (picture below) The Cons: 1. It is comically expensive, I ran a max scan that was ~$1,000, easily would have been a third to run this scan with open models. This was in line with the estimates I asked the plugin to provide prior to kicking off the analysis, so if you're curious yourself, just ask for a cost estimate before starting the scan at the level of effort you're interested in. 2. While the precision (true positive) rate was high, the recall (identifying of total confirmed issues) was quite low. The plugin is definitely steered to only showing confirmed true positives, but in a security landscape I'd rather see the larger universe of possible issues than be blinded from seeing the reality. 3. Even as a member of the Trusted Cyber Access program in Anthropic - I WAS STILL DOWNGRADED FOR CYBER CONCERNS USING THEIR PLUGIN SPECIFICALLY MADE FOR CYBER SCANS! 72% of tokens were used by Opus 4.8 after getting numerous downgrades. Opus 4.8 came out in May, using FOSS models that came out in the past month is clearly a better ROI when you consider they are cheaper and better performing. This last one gives me pause, since Anthropic has now granted the ability for enterprises to enable Mythos for scans. As much as I'd love the chance to pony up for the scan, do I have to use their harness for the mythos scans? The model is for sure a critical part of analysis, but the harness I'm finding can be just as important for being able to focus the model to find critical issues. If it is an on rails tool just like this plugin, I'm skeptical that it'd be worth it. Between this plugin and OpenAI's Codex Security SDK, I'd go for OpenAI's. It is also a lengthy and costly scanner you can't control, but the level of insights I got between the two repos was a meaningful difference. For multiple large codebases, I've had the Codex Security Harness fail on occasion and never finish, but its findings were thorough and more additive to my findings when compared to Anthropic's plugin.

"Have You Said Thank You Once @stutxo?"

💀

Uh guys, why is my @OpenAI Chat GPT Daybreak Blue speaking mandarin to me?

This bitcoin core commit is a nice security improvement! Before checking out new code, this script verifies that each commit in the chain is signed by a trusted key, stopping once it reaches, or is proven to predate, a trusted root. The issue was that a divergent history, or even a Git error, could be mistaken for a commit that predated the trusted root, causing the script to fail open and return success without completing the intended verification. Bitcoin Core has a robust human review process, so there wasn't much real risk, but this fix closes an important gap in the code verification workflow. Belt and suspenders! Thank you again @L0RINC for shepherding this, all of the reviewers for testing it, and Kimi K3 for finding it!

I got my first commit merged into bitcoin core today! Last week I started poking scans into bitcoins codebase looking for straight forward wins. Thank you @L0RINC for doing the heavy lifting after my clankers sifted for bugs. Just the start!

😂

pinging the group chat

indeed

This is proper bitcoin security. Either you do it yourself, or you pay someone to do it for you, but there is no escaping it.

Mood

Has anyone noticed that GPT Daybreak (Sol, more cyber access) constantly calls out to claude? Below this is a full tool call doing a re-prompt of the inital subagent process, but to sonnet 5.

People said self custody was dead and they'd just leave it on an exchange because it was safer.

Thank you @BeccaAmilee for the very kind gift! She and the rest of the team at @AnchorWatch have absolutely crushed it these past 2 weeks while I've been, "off at war". I've never been one for nice clothing/accessories, but its my namesake and I'll take good care of it!

"oh this is could be bad"

I have now set up my 2 councils. Monitoring the situation. Red Team: 🇨🇳 Deepseekv4 Pro Kimi K3, GLM5.2 Blue Team: 🇺🇸 GPT 5.6 Daybreak Blue Grok 4.6 Fable/Opus All made possible by @opencode

"says security researcher @rob1ham"

19 minutes later I have ben blocked from using Daybreak Blue for Red Teaming bitcoin infrastructure. I ALREADY AM PART OF TRUSTED ACCESS????

Just got access to OpenAi's latest cyber model "Daybreak Blue" Ready to have my heart broken again 🥺

Happy Eclipse Season! The vibe checks out for me @realizingerin Thank yoy for being my Bitcoin Bene Gesserit in this crazy past 2 weeks 🙏🙏

Thank you @cbspears & @AsILayHodling for having me on @blockspace today to discuss the Bitcoin Red Team efforts that have been ongoing for the last 2 weeks. We're at an inflection point with AI & policy in the United States. You can not ban math in a free country. Molon Labe.

DONT YOU DARE TAKE MY MATH AWAY

Another morning, another vulnerability found by Kimi K3, with the issue confirmed by the maintainer. While attempting to triage the issue, @PortlandHODL was using @AnchorWatch's Cyber Verification Program seat by @AnthropicAI and was downgraded off of fable. What is the point?