Elias Rohrer retweeted
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.
If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
Elias Rohrer retweeted
Not a drill: shut down your BTCPay Server if you have a hot wallet.
Appreciate the reposts 🙏
Elias Rohrer retweeted
Why disclose these so soon?
Core's recently updated policy fast-tracks the disclosure of easily discoverable vulnerabilities. LLM-assisted security scans/discovery helped motivate the change. (Note: easy to find doesn't necessarily mean easy to exploit)
All three advisories credit Elias Rohrer's (@_tnull) Project Loupe (@ProjectLoupe) at Spiral (@spiral_xyz), with Greg Sanders (@theinstagibbs) validating and reporting the findings. @L0RINC also disclosed 2 of the findings and Andrew Dorman, 1.
The fixes shipped in 32.1, 31.2, 29.5 and 30.4.
29.x is now end-of-life.
groups.google.com/g/bitcoind…
Elias Rohrer retweeted
After a drawn out 32.x release cycle, we’ve shipped 32.1. v32.0 was tagged, but not fully announced/released, and after this last-minute discovery: bitcoincore.org/en/2026/10/2… we decided to ship v32.1, which fixes this bug, along with others (below) and includes other minor backports.
Bitcoin Core v32.1 was released!
It is available from: bitcoincore.org/en/download/
Release notes: bitcoincore.org/en/releases/…
Elias Rohrer retweeted
.@jack thinks bitcoin payment adoption isn’t where it should be. We want your ideas on how @Blocks, Spiral, and you can increase adoption within 5 years. Our trajectory needs changing. Here’s more on our thinking. Now we want yours: github.com/spiralxyz/bitcoin… View article
Elias Rohrer retweeted
New on master: the built-in Esplora server can look up a confirmed output by its block position (the short channel ID Lightning uses), even after it's spent, with no extra index. The Lightning docs show how an app can use it to check channel announcements.
github.com/reardencode/rbitc…
![esplora: read a confirmed output by block position by rearden-grok[bot] · Pull Request #1127 ·...](https://pbs.twimg.com/card_img/2120638364206411776/cHAc_nh1?format=jpg&name=800x419)
Elias Rohrer retweeted
LDK Node can now start against rbitcoin on a fresh regtest chain. Off mainnet, Esplora /fee-estimates returns an empty map instead of a 503, so clients apply their own fallback. Mainnet is unchanged. Reported by @_tnull, who wants rbitcoin in LDK Node's integration tests.
Elias Rohrer retweeted
Project Loupe - AI powered security scanning for Bitcoin OSS Projects xitter.twitterapi.xyz/i/broadcasts/1nxnRBMEo…
Elias Rohrer retweeted
Giving up on esplora, mempool-esplora, and electrs. rbitcoin is the only thing we support now.
github.com/reardencode/rbitc…
Elias Rohrer retweeted
LIVE NOW: @_tnull from @spiral_xyz talking about Project Loupe, their open source security scanning harness
Project Loupe - AI powered security scanning for Bitcoin OSS Projects xitter.twitterapi.xyz/i/broadcasts/1nxnRBMEo…
Elias Rohrer retweeted
Proof of value.
Elias Rohrer retweeted
We file our findings privately. Loupe only shows up in public if a maintainer credits us, which many have:
✅ 754 commits, PRs, & release notes across 23 projects reference Loupe
✅ 610 distinct findings cited by issue number
✅ 132 merged PRs name the finding they fixed
Elias Rohrer retweeted
Clara Shikhelman (@ClaraShik) and Elias Rohrer (@_tnull) joined Optech to discuss Newsletter #426:
News
● Dynamic one-byte message type IDs for BIP324 (45:02)
● Discussion of conventions for tagged hash tags in BIPs (49:04)
● Proposal for onchain, private bitcoin transfers with no consensus changes (1:15)
Releases and release candidates
● Bitcoin Core 32.0rc3 (53:34)
● Core Lightning 26.06.9 (54:38)
● LDK v0.3-rc3 (23:38)
● LDK v0.2.7 (24:33)
● BTCPay Server 2.4.5 (56:55)
Notable code and documentation changes
● Bitcoin Core #36277 (59:51)
● Bitcoin Core #36365 (1:05:09)
● Bitcoin Core #36338 (1:07:53)
● Bitcoin Core #32895 (1:10:38)
● Core Lightning #9582 (1:12:38)
● Eclair #3390 (1:18:03)
● LDK #5057 (33:00)
● LDK #5042 (35:55)
● LDK #5046 (38:25)
● LDK #5028 (41:43)
● LND #11290 (1:20:41)
Elias Rohrer retweeted
Introducing LexeConnect: a new protocol to connect a Lexe wallet to your app in one tap.
Your app requests the scopes it needs. The user taps Approve in Lexe. Your app receives a scoped, revocable credential and can now receive, pay, or read from the user's wallet. Full video 👇
Elias Rohrer retweeted
Here's the Stable Channels Lightning Server dashboard UX 👇 built on @lightningdevkit by @benthecarman, @_tnull @Biresh_Biswas et al. (node IDs/numbers changed)
Little ⓘ buttons explain Lightning jargon throughout. We hope to bring it to Umbrel ASAP when LDK Server ships!
Elias Rohrer retweeted
There should be a word for when vuln scanners and devs work side-by-side to quickly patch large amounts of issues. Catch-and-patch? Fixmaxxing? Anyway,
👇
🤫 First up, a Silent Payments fix. Currently, a 3rd party could alter a P2PKH scriptSig so the wallet extracted the wrong pubkey while the spend stayed consensus-valid. Not good. Loupe reported it and @theStack fixed it. No SP implementations were harmed. github.com/bitcoin/bitcoin/p…
Elias Rohrer retweeted
New vertical: AI Caramba lets the goose team open up about anything AI. In this first edition, @dosinga explains how goose replaced the agent loop with a state machine that can be turned off anywhere and resumed like nothing happened. Where does it go in between? Hell if we know.
Elias Rohrer retweeted
Loupe findings have been landing in Bitcoin Core. During this cycle, five PRs landed: three have been merged, two are under review. Below is a thread on what each one caught and which Core dev implemented which fix.
Elias Rohrer retweeted
Core Lightning 26.06.9 is out. Upgrade now.
It fixes a newly reported vulnerability that can lead to loss of funds. Nodes running 26.06.8 or earlier are affected.
Verify the signatures and install it as soon as possible.
github.com/ElementsProject/l…
