Libbitcoin is coming

Infinite money glitch: Claim your XBT Blake2b airdrop Sell the XBT Blake2b airdrop Deposit your BTC on large exchange that doesn’t list XBT Blake2b Withdraw BTC that most likely wasn’t used for claiming XBT Blake2b Repeat until XBT Blake2b goes to 0

Mt.Gox + Coldcard (+ Claude + multichain)... Qué podría salir mal? 🤔

Urgent security advisory for iOS users! Install the latest iOS update immediately. Security researchers report that financially motivated attackers are now using a complete, in-the-wild exploit chain that can quietly steal cryptocurrency private keys and mnemonic seed phrases from iPhones. The reported attack begins when a target is socially engineered into opening a malicious page in Safari. That page is said to abuse a memory-corruption flaw in WebKit / JavaScriptCore to gain arbitrary read/write access from JavaScript, then bypass Pointer Authentication Codes (PAC) to run native code, break out of the WebContent sandbox, and escalate to kernel/root privileges. With that access, attackers can pull data from the device Keychain and from local crypto wallet apps. The claimed impact range is iOS 13 through iOS 26.5; that range has not been independently confirmed in full. Until more is known, treat any unpatched device as potentially exposed and update as soon as a newer build is available. Also avoid untrusted links in Safari, especially if you keep wallet keys or seed phrases on the phone.

Would you like to help make the Bitcoin ecosystem more secure? Download v2 of the WalletScrutiny.com app from ZapStore or GitLab (links below). You’ll be helping obtain binaries of wallets so that our Build Server can check if the binary can be reproduced from the sources.

Sparrow v2.5.5 has been released with a number of bug fixes following recent security reviews, and adds a system theme option following the OS light or dark setting. Thank you to all the contributors and security researchers who provided input on this release. Changelog: github.com/sparrowwallet/spa… Download: sparrowwallet.com/download

Que Bitcoin es dinero para el mercado negro, por lo tanto no tiene nada que ver con leyes que hagan los políticos. Es más, la razón de ser de Bitcoin son las leyes que hacen los políticos. Única y exclusivamente.

> but random enough entropy is only one small piece of what makes cryptography safe. Interestingly enough, @heavilyarmedc's and @btcpavao’s posts are themselves huge oversimplifications of security. As if reproducible builds are all there is to security. Guix attestations prove the binary matches the source. They don't prove the source is secure. And not all code in a project gets reviewed equally in depth. As if software is all that matters. The hardware running the software might actually matter a lot more. (General-purpose computers are already fighting an uphill battle.) That general-purpose computing has a significantly larger attack surface than single-purpose computing has been a known fact, and the basis of security best practices, for decades. The overall trend is moving towards dedicated security devices like YubiKey for everything digital. Going against the trend is just silly. And yes, buying a signing device can reveal that you own Bitcoin, and every extra vendor adds another leak. That's a privacy problem with known mitigations: pay privately, ship to a pickup point. A compromised general-purpose computer is a much bigger problem, and it doesn't go away after checkout. Luke Dashjr lost > 200 BTC from hot wallets after his systems were compromised. If it can happen to one of the most experienced devs in Bitcoin, "just use a clean general-purpose OS" isn't a security model. As if one well-built binary solves the single-point-of-trust problem. A Core wallet on one laptop is still a single point of failure, however reproducible its build. Multisig across independent signing devices is the actual answer. A backdoored binary on one device can't move funds on its own. As if UX doesn't matter for security. As if specialization doesn't matter. Rarely in software engineering, or in any engineering discipline, is the "best tool" for one type of job also the best tool for a bunch of other types of jobs. Satoshi's mistake was to bundle consensus and infrastructure code (arguably Bitcoin Core's main reason for existing) with networking/P2P code, with application layer code, with mining code. With even a poker game and a marketplace. With a wallet that was meant to be a reference client. Let me repeat: the fact that a wallet and a bunch of unrelated software were included in Core was AN ACCIDENT. It's not like this thing was designed with awesome foresight from the get-go. All of that was fucking dumb, despite how genius Satoshi might have been in other areas. You don't go around shopping for the best car by looking at who makes the best engine, which is 1/100th of what makes up a final car. You don't go around looking for the best end-user security products by looking at protocol layer code. Funny enough, Nunchuk's Bitcoin code reuses Bitcoin Core exclusively. But we're not under the illusion that just because libsecp256k1 is one of the finest engineered pieces of software on the planet, Bitcoin Core is a good choice for end-user wallets. Lastly, did you know I have a couple of commits in the Bitcoin Core wallet? I bet not, because none of you actually looked. Code that goes into the Core wallet, while it still needs to pass stringent reviews, does NOT get held to the same quality bar as code such as consensus code. Question everything. Security is a complex, multi-faceted topic. Reducing it to just software running on general purpose computers is extremely naive.

If you told me in 2011 that The Clarity Act would fail I would have asked you why the fuck you're looking to the government for permission to use Bitcoin.

Security Advisory: We are investigating reports of a potential issue affecting experimental features in Core Lightning that may impact user funds. We urge all Core Lightning users running experimental features to disable them immediately while we investigate.

Today is the 10 year anniversary of the production release of @opentimestamps I created OpenTimestamps in a few weekends because I was frustrated that no-one else had created such an obvious and necessary tool. Since then it has become the global standard for secure timestamps: if you ask an LLM how to create a timestamp, it'll almost certainly suggest using OpenTimestamps. OpenTimestamps has grown to the point where everything from art, to forum posts, to software releases, to war crimes evidence is getting timestamped with OpenTimestamps. Along with some applications I won't be able to talk about for at least a few years... fortunately that data is timestamped! While I have no way of knowing for sure how many documents in total are getting timestamped per second – merkle trees – I can say that as of the past two weeks (beyond that I automatically delete logs) the public calendars I run have averaged about 5 timestamp requests per second from about 60,000 distinct IP addresses. I have no idea what all these people are using OpenTimestamps for. But clearly it's getting fairly popular! Thanks goes out to @realSimpleProof, $TIME, and all the people who have donated directly to the public calendars for their support. OpenTimestamps costs a few hundred a month to run now, along with my time. Without your help keeping OpenTimestamps running would be a lot more painful. If you want to donate, you can do so right here: alice.btc.calendar.opentimes… Thanks also goes to @RCasatta and @BULLBITCOIN_ for running two of the four public calendars. They're one of the reasons why OpenTimestamps doesn't have a single point of failure. Finally, thanks goes to the many people who have contributed code to OpenTimestamps over the years, including entire libraries in languages like java and JavaScript that I have no experience with. In fact, the majority of OpenTimestamps clients are quite possibly using code I didn't write at all! petertodd.org/2016/opentimes…

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link. We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.

I built a messaging app to watch the conversation between the Liquid hacker "white hats" and Blockstream. Follow along here: liquid-imessage-chat.seen-sh…

Actualiza tu Alby Hub 🚨 CON URGENCIA 🚨

LIQUID NETWORK UPDATE: INCIDENT REPORT Status as of September 8, 2026, 19:10 UTC What Happened? On September 6, 2026 at 15:53:10 UTC (Liquid block 4,050,336), a vulnerability in the open-source Elements software related to how Liquid nodes cache range proof verifications was exploited, resulting in the creation of ~4,000 LBTC that were not backed by bitcoin held in reserve. The individual(s) responsible for the exploit then used the SideSwap service, a Liquid Federation member that holds a peg-out authorization (PAK) key, to convert the unbacked LBTC to BTC via Liquid’s standard peg-out mechanism. Because the validation failure occurred at the transaction level before the peg-out was initiated, both SideSwap’s node and the Liquid Network’s globally distributed functionary nodes accepted the LBTC as valid. The functionaries processed the peg-out as authorized, releasing approximately 4,000 BTC through SideSwap’s whitelisted bitcoin address, which SideSwap then forwarded to the address specified by the exploiters. Before the incident, the Liquid reserve held approximately 4,205 BTC. Following this peg-out and additional peg-outs processed before operations were halted, the reserve balance fell to 197 BTC. Key Clarifications No keys were compromised. The Liquid Federation functionaries were not hacked, and no private keys were compromised. The peg-out mechanism that authorizes withdrawals to whitelisted addresses operated as designed. Other Liquid-issued assets were not affected. USDT and other tokens issued on the Liquid Network were not impacted by the vulnerability, though they are temporarily unavailable while the network remains paused. Investigation is ongoing. As is common in complex critical-system failure investigations, this incident arose from the convergence of several individually low-probability factors that interacted in ways that ultimately defeated the system's built-in redundancies. More detail will be shared in forthcoming communications. What Steps Have Been Taken To Recover The Assets? The individual(s) responsible for the exploit left a public message on the bitcoin mainchain identifying themselves as white-hat security researchers and requesting contact to address the vulnerability. Patch deployed. Blockstream identified and deployed a patch to the Liquid Network’s bridge nodes, which was completed on September 7 at 01:09 UTC, ensuring the vulnerability is no longer exploitable. Partial fund recovery. On September 7 at 16:09:25 UTC (Liquid block 965,950), the exploiters returned 3,400 BTC to the Liquid Federation peg wallet. Approximately 598.5 BTC (15% of the total) remains outstanding. Discussions between Blockstream and the individuals responsible are ongoing to secure the return of the remaining funds. What Comes Next? Our immediate priorities are recovering the remaining funds and resuming normal network operations safely and as quickly as possible. Software update in progress. A fix for the exploited vulnerability has been developed and is undergoing multiple rounds of internal and external review. Blockstream is preparing an emergency release of Elements (v23.3.4), which is expected to be released as soon as possible, but within approximately 48 hours. Network restoration. Once the software update is finalized, Liquid Network functionary operators will perform additional adjustments to resume full functionality and restore the corrected network state, including rejection of the invalid peg-out. Ongoing updates. We will continue to provide detailed updates as the situation progresses. What You Should Know The Liquid Network remains offline at this time, while we work on reviewing the security fixes and network resumption code and coordinate with the white hat hacker towards timely resumption of the network with 1:1 backing for BTC. While the network is paused, users cannot transact on Liquid. If you operate a Liquid node, please watch for the emergency Elements release and follow the upgrade instructions when available. Users do not need to take any proactive steps to protect their funds at this time. The Liquid Federation and its members are committed to resolving this incident in coordination with Blockstream and to resuming normal operations as soon as it is safe to do so.

Shit if you can keep your coins secure for the next 10 years you deserve $10M/coin. You basically have to go off the grid to avoid wrench attacks from database leaks and be extremely paranoid when using a computer to avoid AI hacks. Even then, you can fail.

The problem is that Liquid is not a sidechain as defined in the original Sidechain paper.. Sidechains require proof-of-work. Rootstock forces a 36-hour delay for peg-outs, and that's good enough for the miners to stop mining Rootstock in case of a consensus failure. Rootstock is actually an HSM-enforced drivechain plus a federation majority approval requirement. Better than a drivechain and better than a federation.

My dropbox account was compromised via this vulnerability. Thankfully I encrypt my files locally before uploading to dropbox! nitter.net/9to5mac/status/2094770… blog.lopp.net/how-to-securel…

ah yes 91 discord users with the pseudonym "Sybil" voted for the thing.

BREAKING: Bitcoin may already be quantum-safe According to peer reviewed new research by Oxford Physicist Tim Palmer, there likely exists a fundamental ceiling of roughly 400 coherently entangled qubits. The latest estimates require at least 835 logical qubits to break Bitcoin’s signatures with Shor’s algorithm. References in comments. Elon Musk and Steve Jurvetson have commented positively on this research.