<![CDATA[Bitcoin.Review]]>https://substack.bitcoin.reviewhttps://substackcdn.com/image/fetch/$s_!Kwpr!,w_256,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F3a95ac75-ac77-4167-9383-9930a48690bb_1080x1080.pngBitcoin.Reviewhttps://substack.bitcoin.reviewSubstackWed, 29 Apr 2026 02:22:20 GMT<![CDATA[BR097 - Cove Wallet, Harbor, ecash, Sparrow, Liana, Bull Bitcoin, JoinMarket, Hardware Wallets, Coinbase Breach, BitLocker Vulnerability, Lightning Phoenixd, LSP Legality + MORE ft. Praveen, Ben, Paul]]>https://substack.bitcoin.review/p/br097-cove-wallet-harbor-ecash-sparrowhttps://substack.bitcoin.review/p/br097-cove-wallet-harbor-ecash-sparrowThu, 05 Jun 2025 17:36:07 GMTI’m joined by guests Praveen Perera, Future Paul & Ben Carman to go through the list.

Listen on your favorite podcast app

Housekeeping

  • New COLDCARD Co-Sign (CCC) Tutorial: Automated Multisig with Spending Policies [YouTube]

Bitcoin

Software Releases & Project Updates

  • 00:01:29 Cove Wallet

    • v0.5.1

      • Added

        • Terms and Conditions popup, which is required to use the app

      • Bug Fixes

        • Show updated label on UTXO list screen

        • Show updated label on transaction details screen

        • Hot wallet import flow where erasing to a correct word would not show the word as valid

    • v0.5.0

      • Coin Control

        • New UTXO list screen to search, filter, sort and select individual UTXOs

        • Select individual UTXOs to send from

        • Set a custom amount to send from a UTXO list (the rest will be sent to change)

        • Show UTXO labels on the confirm screen

        • Search UTXOs by amount

      • Others

        • Add warning if fee is more than 20% of the amount you are sending

        • Disallow sending if the fee is more than 100% of the amount you are sending

    • v0.4.1

      • Redesign address QR receive sheet

      • Redesign “Advanced More Details” sheet in the send flow

  • 00:18:14 Harbor

    • Harbor 1.0 is now available

    • Mac, Windows (kind of), and Linux binaries available

    • Head over to the release page on GitHub to download it

  • 00:35:45 Sparrow Wallet

    • v2.2.2

      • Retrieve and show next block median fee rate in Recent Blocks view where available

    • v2.2.1

      • Update Tor library to fix missing UUID issue when starting Tor on recent macOS versions

      • Repackage .deb installs to use older gzip instead of zstd compression

      • Remove display of median fee rate where fee rates source is set to Server

      • Add icons for external sources in Settings and Recent Blocks view

    • v2.2.0

      • Add Recent Blocks view to Send tab

      • Convert all bitmapped images to theme aware SVG format for all wallet models and dialogs

      • Support send and display of pay to anchor (P2A) outputs

      • Switch camera library to openpnp-capture

      • In the Download Verifier, prefer verifying the dropped file over the default file where the file is not in the manifest

      • Show a warning when importing a wallet with a derivation path matching another script type

      • Avoid server address resolution for public servers

      • Add a tooltip to indicate truncated labels in table cells

      • Dynamically truncate input and output labels in the tree on a transaction tab, and add tooltips if necessary

      • Improve tooltips for wallet tabs and transaction diagrams with long labels

      • Show the address where available on input and output tooltips in transaction tab tree

      • Show the total amount sent in payments in the transaction diagram when constructing multiple payment transactions

      • Show transaction diagram fee percentage as less than 0.01% rather than 0.00%

      • Optimize and reduce Electrum server RPC calls

      • And more

  • 00:37:05 BDK bdk_chain v0.23.0

    • This release of bdk_chain v.0.23.0 introduces a new option to cache and persist derived script pubkeys, improving performance on KeychainTxOutIndex startup, the tx_graph module now tracks and persists the first_seen timestamp for transactions which is useful for transaction ordering. The bdk_core crate added convenient is_empty methods to types TxUpdate, {Sync,Scan}Response, making it easier to check for no-op updates.

    • Also released:

      • bdk_core v0.6.0

      • bdk_bitcoind_rpc v0.20.0

      • bdk_electrum v0.23.0

      • bdk_esplora v0.22.0

      • bdk_file_store v0.21.0

      • bdk_testenv v0.13.0

  • 00:37:52 Liana v11.0

    • Add multi-wallet support

    • Add coin control for recovery transactions

    • Add a new RPC command to list addresses that have been revealed to the user, whether used or not

    • Add ability in the GUI to view unused addresses that were previously generated by the user

    • Add support airgap flow (SD card) for Coldcard & Krux signing devices

    • It also includes various other improvements and fixes

  • 00:38:24 Nunchuk Android v1.68.1

    • Custom blockchain explorer

    • Ability to archive wallets

    • Ability to long-press & reorder wallets on Home

    • Anti-fee sniping setting

  • 00:39:02 Bull Bitcoin Mobile

    • v5.0.0

      • The entire application has been rearchitected from the ground up for: Ease of adding new features, debugging and collaboration

      • Additionally; the app has a fresh new UI that focuses on simplicity and consistency

      • Supported Features

        • Create/Recover Default (Bitcoin/Liquid Wallet)

        • Send/Receive

        • Swaps - LN (Bolt11 & LN Address) & Chain

        • Payjoin (0.23)

        • Transaction History

    • v5.0.3

      • Support for fiat currency preference

      • Swap Fee Breakdown

      • Fix calculation of absolute fees

      • High Fee warning in send

      • Default RBF true

  • 00:40:39 Blue Wallet v7.1.8

    • Add: single-address Taproot wallets support (import from WIF)

    • Add: Search txs

    • Add: ManageWallets search address

  • 00:41:00 Bitkey App v2025.10.0

    • Introduce Security Hub: Display all security and recovery settings in one place, with clear recommendations that help take the guesswork out of protecting your bitcoin.

  • 00:43:10 RoboSats v0.7.8

    • For Users:

      • New coordinator: LibreBazaar

      • New payment method: Nomad

      • Major libraries update

      • Coordinator ratings are now cryptographically verified

      • Private chat message are also sent as nip17 as part of the full migration of the chat to nostr

      • Android adaptive Icons support

    • For Coordinators:

      • Nostr notes are now additionally published to port 7778

  • 00:43:21 FullyNoded v0.1.1-beta

    • Add icons to display Join Market session, conjoin and maker status

    • Dedicated button for configuring the Join Market network, useful when switching networks with Core

    • Ability to easily delete Core wallets, proceed with caution…

    • Tor updated to v0.4.8.14

  • 00:44:03 Zaprite v2025-05-26

    • Enable new Auto-pay feature for all accounts

    • Enable Auto-pay and customer card management for our Stripe connection

    • Add Misty Breez LNURL integration

    • Add new filter on the Orders page that shows Abandoned Orders

    • Add message to the Checkout UI showing the customer how much they could save if paying with a discounted payment method

    • Add new Filters to the Transactions table: Currency, Method, Connection, and Type

    • Add small preview to image upload fields which shows a small thumbnail of the image after it has been uploaded

  • 00:45:43 BoltzExchange

    • boltz-client v2.6.1

      • Add new getpairs CLI command

      • Handly unavailable backend gracefully on startup

    • boltz-backend v3.11.0 - Counteroffer

      • Add support for Reverse Swaps to BOLT12 offers

      • gRPC hooks to change the behaviour of the backend

      • And many more added features

  • 00:45:46 Padawan Wallet v0.16.0 - Xeric X-Wing

    • Improve transitions between important screens

    • Pull out translations into separate structure (localizations/ directory)

    • Re-write theme (Tatooine Desert)

  • 00:46:23 Blockstream Green Android v5.0.0

    • Nags to backup recovery phrase

    • Bitcoin price chart in Home

    • New tab based navigation

    • UI Refresh

    • Notifications for buy related events

  • 00:46:37 Samourai Dojo v1.27.0

    • Add Soroban and PandoTx functionality

    • Update ban script to disconnect inbound Knots nodes

    • Regenerate fulcrum certificate if expired

    • Check if transaction already exists in pushTx

    • Add new information to transaction API endpoint

    • Add txout API endpoint

    • Add ability to manage API keys

    • Add new /support/services RPC endpoint

    • Add an option to use blocksdir config for bitcoin blocks directory

    • Use prebuilt addrindexrs binaries

    • Add instructions to migrate blockchain/fulcrum

  • 00:46:49 ESP-Miner v2.8.0

    • API enhancements:

      • Add expected hashrate to API

      • Dashboard: Get expected hash rate from API

    • UI/UX improvements

    • Hardware and display enhancements: Add support for multiple displays

    • Performance and compilation

      • feat: add -O2 compiling

      • Update version of CrC calculations

  • 00:46:51 NBXplorer v2.5.27 (NBXplorer is a minimalist UTXO tracker for HD wallets. The goal is to provide a flexible, .NET-based UTXO tracker for HD wallets. The explorer supports P2SH, P2PKH, P2WPKH, P2WSH, Taproot and multi-signature derivations.)

    • Introduce policy wallet tracking support (BIP388, BIP389) enabling users to track wallets with complex spending conditions via Miniscript. Taproot trees and other output descriptors like musig (BIP390) are also supported.

  • 00:47:12 Mempal v1.5.3

    • Add swipe-down feature to refresh dashboard

    • Add custom time option for widget auto-update frequency

Project spotlight

  • 00:47:23 DahLIAS (Discrete Logarithm-Based Interactive Aggregate Signatures): Bitcoin’s first full signature aggregation scheme for secp256k1 [Bitcoin Magazine]

    • DahLIAS, developed by researchers from Blockstream and Ledger, introduces the first constant-size aggregate signature scheme based on discrete logarithms in pairing-free groups, offering significant space savings and verification speedups for blockchain systems.

    • The signing protocol requires only two rounds, with preprocessing capabilities, and verification is approximately twice as fast as batch verification of individual Schnorr signatures.

  • 00:48:25 Manna Bitcoin: A self-custodial spending wallet featuring merchant tools and PoS interface

    • It supports on-chain Bitcoin, Lightning Network, and Liquid Bitcoin transactions

  • 00:48:34 Darkwire: A project that enables off-grid communication and Bitcoin transactions using LoRa technology [Github]

    • Messages are signed, fragmented, encrypted, and transmitted through mesh networks without ISPs or satellites

    • Currently supports Bitcoin transactions and text messages

  • 00:48:44 Parasite Pool: An open-source Bitcoin mining pool with zero fees that offers Lightning-native payouts with a 10-satoshi threshold for home miners

    • The pool features a ‘pleb eat first’ reward structure, giving 1 BTC to block finders while distributing remaining 2.125 BTC plus fees among all other participants via Lightning.

    • Small-scale miners benefit from outsized rewards relative to hashpower, making it suitable for those who need discrete operations while supporting Bitcoin’s resistance to censorship.

  • 00:48:55 Blockpicker: A tool to create entropy for a seed phrase by picking blocks [Github]

    • Blockpicker Entropy Game Blockpicker is an interactive, game-based tool for generating BIP39-compliant 24-word mnemonic seed phrases.

    • Players select blocks on a 12x12 grid in a turn-based game against a computer opponent, contributing entropy to create a cryptographically secure seed phrase.

  • 00:49:10 LOCK Protocol: A Bitcoin-based access protocol for encrypted secrets [Github]

    • LOCK is an open protocol that uses Bitcoin transactions as cryptographic proofs to decrypt secrets

    • The protocol seals secrets in encrypted vaults with specific unlock conditions (wallet signature, fee amount, and optional block height) that can only be met through valid Bitcoin transactions.

  • 00:49:17 Sigbash: A tool to sign blindly after conditions are met (A project developed by @Arbedout)

    • Sigbash provides a signing service that integrates with multisig wallets, offering signatures only under predefined conditions.

    • The conditions for signing include factors like hashrate, Bitcoin price, address balance, or time, and are checked using mempool.space’s API. Each xpub includes a cryptographic receipt and OpenTimestamps proof.

  • 00:49:38 Arkade OS: A virtual execution layer that transforms VTXOs and transaction trees into programmable money while maintaining security guarantees [Github]

    • The open-source Arkade ecosystem includes a compiler for Bitcoin-native smart contracts, a mobile wallet with PassKey authentication, and a custom script interpreter featuring over 30 new opcodes.

    • Arkade’s implementation demonstrates how core components like VTXOs, presigned transaction trees, and batch settlements serve as building blocks for future functionality beyond payment optimization.

  • 00:50:09 Swift Bitcoin: Pure-Swift Bitcoin library and full node implementation with minimal dependencies [Github]

    • Swift Bitcoin is a cross-platform fully-featured Bitcoin development framework for Swift projects

    • It includes a standalone network client daemon as well as a command line utility for on-chain and off-chain operations

  • 00:50:36 Pythia: Rust implementation of p2p-derivative-oracle for DLC trading [Github]

    • DLC Markets open sources Pythia, its dedicated price oracle system under MIT Licence

    • Pythia provides real-time, reliable BTC/USD price attestations.

  • 00:50:45 Arcana Seed Lodge: A Bitcoin wallet experience shaped by memory, mystery, and map-based entropy [Github] (WIP/Experimental wallet)

    • Arcana Seed Lodge is a location-based Bitcoin wallet generator that lets you create secure, human-friendly seeds by selecting six meaningful locations on a map.

    • Features

      • Generate deterministic Bitcoin seeds from 6 memorable places

      • Optional lore-driven story mode with Freemason vibes

      • Supports offline PSBT signing (Sparrow-compatible)

      • Built for privacy-first, device-free recovery

      • Includes a demo wallet (not secure—just for testing)

  • 00:50:54 BIP47 Message Verifier: A verifier for messages signed with BIP47 notification address [Github]

    • A tool to verify messages signed with a PayNym

  • 00:51:02 Traxe: An iOS app to track your bitcoin home miners [Github]

    • Features:

      • Automatically discover and manage your home miner devices on your network

      • Monitor miner stats and performance in real time

      • Support for Light and Dark mode

      • StandBy support for always-on at-a-glance monitoring

  • 00:51:08 Censorship Resistant: A website offering an overview of Bitcoin’s security model, attack vectors economic incentives, potential attack vectors, and decentralization of mining.

  • 00:51:21 Bitcoin-4-All: A comprehensive open-source Bitcoin course with 10 lessons in Portuguese, English and Spanish [Github] (Developed by AreaBitcoin and supported by OpenSats)

    • The course covers Bitcoin fundamentals, wallet setup, and Bitcoin advantages

Vulnerability Disclosures

  • 00:51:38 Coinbase data breach: Rogue support agents expose KYC details of ~1 million customers [Bleeping Computer]

    • Cybercriminals with rogue overseas support agents steal personal data of approximately 1% of Coinbase’s user base, demanding a 20 million ransom, which has not been granted.

    • The stolen data includes names, addresses, government IDs and account information.

    • The data breach allegedly occured on Dec 26, 2024 and discovered May 11, 2025.

  • 00:54:07 Ledger Donjon: Vulnerability in Tangem’s Android genuine check process [Disclosure]

    • A code flaw in Tangem’s Android app allows counterfeit hardware wallets to pass verification checks. The bug occurs when the app incorrectly checks attestation status, which allows cards with invalid signatures to appear genuine.

    • Exploiting this vulnerability requires obtaining a genuine card’s ID and public key, then creating a counterfeit card that sends these credentials while providing an invalid signature.

    • Tangem addressed the issue in version 5.18.3 by fixing the code to properly check attestation status.

  • 00:54:46 CVE-2023-21563: BitLocker encryption bypassed in minutes with Bitpixie vulnerability [CyberSecurity News] 00:55:59 - A critical software-only vulnerability called “Bitpixie” enables attackers to bypass Microsoft’s BitLocker encryption in under five minutes without physical tampering.

    • The attack exploits the Windows bootloader’s failure to clear the Volume Master Key from memory during PXE soft reboot.

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 00:57:14 SimpleX

    • v6.4.0-beta.0

      • “knocking”: review members prior to admitting them to your group

      • Talk to your group members directly via chats between all group admins and members

    • v6.3.4

      • Recognize domain names as links (e.g., simplex.chat)

      • Forward compatibility with “knocking”

      • iOS improvements:

        • Opening the links in the browser/any other apps now requires confirmation in all cases

        • Secrets in messages (e.g., #hidden secret#): shown on tap one by one, new design

  • 00:57:15 NomadNet v0.7.0

    • Add interface management and statistics

    • Add ability to specify page background and foreground colors to Micron parser

    • Add transfer speed to progress bar

    • Improve memory consumption when serving or downloading large files

  • 00:57:16 Sideband v1.6.1

    • Update included RNS to version 0.9.6 to use AES-256 by default

    • Add option to configure shared instance access

  • 00:57:17 Mullvad introduces Mullvad VPN Loader: An application that automatically verifies integrity and authenticity of downloaded app installations on Windows and macOS systems

    • The loader utilizes global third-party CDNs rather than solely Swedish servers, increasing download speed by accessing content delivery networks closer to customers.

  • 00:58:17 Signal Desktop Update

    • Signal Desktop now implements “Screen security” setting on Windows 11 by default to prevent Microsoft Recall from capturing screenshots of private conversations.

    • Signal uses DRM technology to block Recall, which takes screenshots every few seconds and stores them in a searchable database.

  • 00:58:20 Have I Been Pwned v2.0 (HIBP is a tool to check if your email address is in a data breach)

    • Interface rebuild

    • Unify user tools into central dashboard

    • Remove username/phone number search from the web interface (email remains the sole supported search identifier)

    • Add dedicated breach pages: streamlined information and tailored post-breach advice, including future support for passkeys and localized resources

    • Redesign dashboard and domain search tools: introduce client-side filtering and improved domain verification

  • 00:58:22 KYCnot.me Update (A directory of trustworthy alternatives for buying, exchanging, trading, and using bitcoin and cryptocurrencies without having to disclose your identity)

    • New features include a point system, automated ToS scraper for KYC/AML detection, full-text search functionality, and public discussions now on GitLab.

    • Complete rewrite in Golang after previous versions in Python/Flask and SvelteKit, now using MariaDB instead of JSON files

    • The website is now mostly JavaScript-free (except for request forms) and now officially available on Tor and I2P networks

Project spotlight

  • 01:00:26 Oniux: A tool that utilizes various Linux namespaces(7) in order to isolate an arbitrary application over the Tor network [GitLab] (A tool by the Tor Project. Considered experimental software)

    • Oniux is a command-line utility that uses Linux namespaces to isolate applications over the Tor network, preventing data leaks by placing apps in their own network namespace with a custom interface. [Blog post]

    • Unlike torsocks, which uses SOCKS proxying through libc, oniux works on all Linux applications including static binaries and can prevent malicious applications from leaking data through direct system calls.

Lightning + L2+

Project spotlight

  • 01:00:39 Routstr: A decentralized LLM routing marketplace powered by Nostr and Bitcoin [Github]

    • The platform features a Smart Client SDK that finds optimal models, self-hosted proxies for OpenAI-compatible endpoints, and built-in privacy routing through SOCKS5 and Tor.

    • Routstr facilitates micropayments between AI Model Providers and End Users through Cashu ecash tokens and BOLT12 Lightning invoices.

  • 01:01:31 LNemail: Fast anonymous email accounts powered by Bitcoin Lightning Network payments [Github]

    • LNemail offers anonymous email accounts for 1000 sats per year, requiring no personal information and operating on LN payments.

    • Service limitations: receiving only, no IMAP access (web interface or API), attachments not supported, and plain text only.

    • No IMAP Access: Emails can only be accessed through our web interface or API.

  • 01:02:22 Lightning Blinder: Trick an LSP into thinking one wallet is the sender or recipient when it’s really some other wallet [Github]

    • The software aims to improve privacy on the Lightning Network by enabling mobile users with intermittent connectivity to route payments

  • 01:02:32 Phoenixd MCP Server: Connect a phoenixd bitcoin lightning wallet to your LLM using Model Context Protocol [Github]

    • This tool helps integrate LN payments and node management into your AI workflows

  • 01:03:27 Amboss Rails: A liquidity provider service allowing Bitcoin treasuries and custodians to earn yield while maintaining self-custody of their assets [Announcement]

    • The service generates returns through payment routing fees and liquidity leases on the Magma Marketplace.

    • “Amboss handles node operations with strictly limited permissions (receive lightning, open channel, close channel), using AI-driven insights derived from over five years of network data”

  • 01:03:48 Sixty Nuts: A NIP-60 Cashu Wallet in Python [Github]

    • A lightweight, stateless Cashu wallet implementation following NIP-60 specification for Nostr-based wallet state management.

    • Features:

      • NIP-60 Compliant: Full implementation of the NIP-60 specification

      • NIP-44 Encryption: Secure encryption using the NIP-44 v2 standard

      • Stateless Design: Wallet state stored on Nostr relays

      • Multi-Mint Support: Can work with multiple Cashu mints

      • Async/Await: Modern Python async implementation

      • LNURL Support: Send to Lightning Addresses and other LNURL formats

  • 01:03:54 BTCNutServer: A Cashu plugin for BTCPayServer allowing merchants to use Cashu Ecash as payment method [Github] (This plugin is in early beta and its cryptography has not been reviewed. Cashu is still experimental and not production-ready.)

    • BTCNutServer enables BTCPay Server to accept Bitcoin payments via Cashu tokens, offering two flexible payment models: ‘Trusted Mints’ (Swap) and ‘Melt Immediately’

Software Releases & Project Updates

  • LND v0.19.0-beta

    • New Features

      • Add support for archiving channel backup in a designated folder which allows for easy referencing in the future. A new config is added disable-backup-archive, with default set to false, to determine if previous channel backups should be archived or not.

    • Protocol Updates

      • lnd now supports the new RBF cooperative close flow

      • Add support for experimental endorsement signal relay

      • Add initial support for quiescence. This is a protocol gadget required for Dynamic Commitments and Splicing that will be added later.

      • Fixed a case where the initial historical sync may be blocked due to a race condition in handling the syncer’s internal state

      • The max fee rate is now respected when a coop close is initiated

    • Functional Enhancements

      • Add ability to paginate wallet transactions

      • Make MaxWaitNumBlocksFundingConf configurable, allowing integration/development tests to set a lower value for faster funding confirmation timeout while keeping the default of 2016 blocks for production stability

      • Add validation to ensure that MPP parameters are compatible with the payment amount before attempting the payment

    • And more: RPC Additions, lncli Additions, Functional/RPC/lncli Updates, Code Health, and Performance Improvements

  • Core Lightning v25.05rc1

    • Features for Users

      • Reduced latency of commit and revoke messages

      • Reckless can update existing reckless-installed plugins via reckless update

      • Fixed routing of AskRene via high capacity channels

      • More accurate anchor fees

    • Features for Developers

      • listhtlcs pagination support with index, start and end parameters

      • The wait api now supports the listhtlcs subsystem

      • The beginnings of LSPS client and server plugins so far implementing the LSPS0 transport protocol

      • New signmessagewithkey rpc to sign input messages with our wallet keys

      • sendonion is now compatible with sendpay with addition of total_amount_msat parameter

    • Protocol Updates

      • Peer storage graduates from experimental to default feature while bringing performance improvements

      • Splicing interoperability with Eclair and splice RBF capability

  • Cashu v0.17.0

    • New Features

      • Blind Authentication

        • Limit mint access using Clear and Blind Authentication. Nutshell now supports NUT-21 and NUT-22, enabling the use of OAuth 2.0 identity providers like Keycloak (or any compatible provider).

        • NUT-22 introduces Blind Authentication, which enhances user privacy by anonymizing authentication within the set of registered users

      • Improved Multi-Nut Payments

        • Multi-nut payments via LND are now more reliable. Nutshell queries multiple routes before failing, significantly improving payment success rates

    • Removed Features: The wallet REST API has been removed from the project due to a low utility to maintenance cost ratio

    • Additional Protocol Updates

      • SIG_ALL Multisig Flag: Users can now lock ecash to specific destinations (outputs)

      • Mint and Melt Quote Enhancements: The update to NUT-04/05 introduces new fields (amount, unit, request) to mint and melt quotes

  • CDK v0.9.2

    • HTLC from hash support

    • Optional transport and NUT-10 secret on payment request

    • Multi-part payments support in cdk-cli

  • Phoenix Wallet v2.6.0

    • Stateless offers with custom description: Phoenix can now generate any number of Bolt12 offers (a.k.a. reusable invoices)

    • Custom feerate in channel closing: It’s now possible to set a feerate when closing a channel mutually

    • (android) Manual import/export of the payments database: On Android a new export option is available in the Export screen

    • Lightning addresses in contacts: You can now associate a Lightning address to a contact. In fact, a contact can have multiple Lightning addresses or Bolt12 offers attached.

  • Zeus v0.11.0-beta2

    • Highlights:

      • Experimental Cashu ecash wallet

      • Swaps: LN -> on-chain, and vice versa

      • Import and export wallet configs

      • UTXO labeling

      • Activity: filter for keysends

      • CLN: support for generating Taproot addresses

      • CLN: view closed channels

  • LDK v0.1.4 - “Careful Validation of Bogus States”

    • Security: 0.1.4 fixes a funds-theft vulnerability in exceedingly rare cases

  • Breez SDK - Nodeless (Liquid Implementation) v0.9.0

    • Receive via BOLT12 & BIP353

    • Support LNURL-Verify

    • Add on-chain transaction ID when sending to a BTC address

  • Misty Breez v0.1.5 (A hybrid Lightning and Liquid network wallet built with the Nodeless Breez SDK)

    • Receive via BOLT12 & BIP353

    • Support LNURL-Verify

    • Add on-chain transaction ID when sending to a BTC address

  • Alby

    • Hub v1.17.0 - Sean Hastings

      • Improve Friends & Family

      • Auto-swaps

      • Sub wallet improvements

      • Verify package signatures in install/update scripts

      • Add onchain transactions to node page

      • Add update banner

      • Add info page to settings

    • Go v1.13.0

      • Payments now show more information about recipient, payer and zaps

      • Option to switch wallets in NWA flow

      • Performance improvements and fixes in Send screen

    • lightning-browser-extension v3.12.0 - Herbig-Haro 24

      • Better onboarding for both master key and Nostr key

      • “Batteries” removed from the extension

      • New Wallet Settings menu for easier access and configuration

    • js-sdk v5.1.0

      • feat: add hold invoice NWC methods and notification type

      • chore: add recipient_data to tx metadata

      • chore: add LN paywall esm example

  • LNbits v1.1.0 - Alan Bits

    • New Features

      • i18n support for reset password messages

      • Fetch all payments for a user

      • Preimage handling for incoming payments

      • Add verify_preimage utility

      • Superuser setting no longer reset on delete

  • BlitzWallet v0.4.5-beta

    • Contact payments are now more private:

      • Previously: One address was stored and rotated weekly

      • Now: 7 addresses are stored, and one is rotated out weekly

      • Payments randomly select one of the 7 addresses to improve privacy

    • Add Items to POS Checkout: Admins can now save items and prices directly in their wallet

    • Liquid Payments: Reduce minimum send amount for Liquid transactions to 100 sats

    • Contact Experience:

      • You can now share someone else’s contact directly from their profile page

      • Switch currency on contact page

      • Uploaded contact profile images now appear during search

  • BitBanana v0.9.5

    • Simplify UTXO consolidation

    • Add extended connection info via connection status indicator

    • Core Lightning: Channel rebalancing feature added

    • Core Lightning: Pick first hop on lightning payments

    • Core Lightning: Reserved UTXOs now displayed as locked

    • Improve compatibility with NWC

    • Log view enhancements: Add sorting and auto-scroll options

    • Add full Polish language support

  • Aqua Wallet v0.3.0

    • New Features:

      • The Dolphin Card is here for beta testing

      • New text scanner for addresses using Optical Character Recognition (OCR)

      • Lower minimum peg-out amount from 0.001 to 0.00025 BTC (excluding fee)

      • Reduce minimum amount for sending Liquid Bitcoin to 100 sats

      • Addresses now have colored numbers

      • Improve transaction tracking and fee estimates for BTC to L-BTC swaps

      • Add the USDt swap order ID in the transaction detail page

      • Lightning refunds are now specifically marked in the transaction list

  • RGB v0.12.0-rc.1.1

    • The 0.12 version has brought zk-STARK readiness to the RGB, a huge performance boost, and a lot of simplification and security improvements.

    • The release candidate is for all developers working with RGB, so they can integrate it into their software, having guarantees of consensus and low-level API freeze

    • What’s new:

      • The version 0.12 of RGB represents a result of 7 months of protocol re-design, aimed at the following:

        • Make protocol ready for zk-STARK compression;

        • Simplify the protocol as much as possible, reducing any potential attack surface and helping protocol adoption;

        • Ensure security of the protocol with thorough unit and integration test coverage, including tests for potential attacks;

        • Make protocol fully production-ready by freezing consensus level changes and ensuring robustness and performance.

  • SimLN v0.2.4 - Let BOSSies eat Eclairs (A payment activity generator for the Lightning Network)

    • Minor release: adds support for running simulations on Eclair nodes, bringing sim-ln’s implementation support up to 3/4 major implementations.

    • Changes:

      • Add Eclair node support

      • Add Scorer to SimNode

      • Unit tests for validate_activity and validate_node_network

      • Do not allow defined activity with zero amount

      • Parse address detecting if starts with https

      • Validate channel policy and enforce unique scid

Nostr

Project spotlight

  • Emptio P2P: A project to allow the purchase and sale of bitcoin p2p in a decentralized way through nostr [Github]

    • The application integrates with mempool.space for Bitcoin network transactions and wallet data display

  • TENEX: A context-first development tool built on Nostr [Github] (A project by Pablof7z)

    • TENEX stores projects and tasks as nostr events, with each project receiving its own nsec key.

    • It features context-first development, voice-to-code transcription, AI-powered orchestration with specialized modes, intelligent task management, project-specific nsec keys, real-time collaboration via Nostr, multi-column interface, extensible architecture, and smart context awareness.

  • Compass: An ansible configuration for setting up an indexer relay [Github] (A project by Coracle)

    • Ansible playbook to deploy a strfry nostr relay tailored to indexing kind 10002.

  • Publsp: A command-line tool that enables LN nodes and LSPs to advertise their liquidity offers through Nostr using kind 39735 events [Github]

    • LSPs advertise liquidity as addressable Kind 39735 events. Customers just pull and evaluate all those structured events, then NIP-17 DM an LSP of their choice to coordinate a liquidity purchase.

  • liquiditystr: A gateway to the Nostr P2P Lightning liquidity marketplace [Github]

    • A single-page app that plugs into the customer-side publsp API to provide streamlined access to LSPs that advertise liquidity through Nostr

  • js-eventstore-benchmark: Browser benchmarks comparing different methods for storing Nostr events in the browser [Github] (A tool by fiatjaf)

  • Nostratui: A terminal user interface (TUI) for browsing Nostr posts, written in Rust [Github]

    • Nostratui is a minimalist, responsive, and highly efficient terminal client for the nostr protocol

  • NIPs on Nostr: A website for viewing official Nostr Implementation Possibilities (NIPs) and publishing custom NIPs on the Nostr network [Gitlab]

  • Shosho: A mobile app that enables live streaming over RTMP with Nostr integration, similar to Facebook Live but built on the Nostr protocol [Github]

    • Features:

      • RTMP Broadcasting: High-quality live video streaming

      • Nostr Integration: Use your Nostr npub, announce your stream live on Nostr clients like Zap.stream and Amethyst

      • Live Chat: See your mentions and stream chat live and respond in the app

      • Zap Integration: Receive zaps from your viewers and get paid to stream

  • YakBak: Voice message social platform [Github]

    • YakBak is a modern social platform built on the Nostr protocol that allows users to share and interact with voice messages

    • Features:

      • Voice message recording and playback

      • Threaded voice message conversations

      • Lightning Network zaps for voice messages

      • Reactions and engagement tracking

      • Nostr protocol integration

Software Releases & Project Updates

  • rust-nostr

    • v0.42.1

      • nostr: add detailed error handling for NIP-47 response deserialization

    • v0.42.0

      • Breaking changes

        • nostr: rework nip46 module

        • pool: drop support for deprecated negentropy protocol

        • connect: encrypt NIP-46 events with NIP-44 instead of NIP-04

        • connect: drop support for NIP-46 event decryption with NIP-04

      • Added

        • nostr: add UnsignedEvent::id method

        • nostr: add TagKind::single_letter constructor

        • nostr: add NIP-73 blockchain address and transaction

        • blossom: add new crate with Blossom support

        • mls-storage: add new crate with traits and types for mls storage implementations

        • mls-memory-storage: add an in-memory implementation for MLS

        • mls-sqlite-storage: a sqlite implementation for MLS

        • mls: add new crate for implementing MLS messaging

        • pool: add relay monitor

        • sdk: add Options::pool

        • relay-builder: add support for NIP-70 protected events

  • Primal

    • v2.2.20

      • Implement Redeem Code functionality

      • Implement notes image gallery per latest design

      • Implement loading and error states in ThreadScreen

      • Add support for parsing BUD-08 upload responses

    • Implement Primal Article Editor, a long form note editor interopable with other Nostr long form apps like Highlighter, Habla and Yakihonne.

  • Damus v1.14

    • Add safety reminder to wallets with higher balance

    • Add one-click Coinos wallet setup

    • Add notification setting to hide hellthreads

    • Add separated first aid option for relay lists that does not need a contact list reset

    • Add NIP-65 relay list support

    • Add Unicode 16 emoji reactions for iOS 18.4+ by upgrading EmojiPicker

    • Add a search interface to the settings screen

    • Add view introducing users to Zaps

    • Add new wallet view with balance and transactions list

    • Add copy technical info button to user visible errors, so that users can more easily share errors with developers

    • Add dismiss button to wallet high balance reminders

    • Zap receiver information now included for outgoing zaps

    • Add inline note rendering of invoices to pull up wallet selector sheet

    • Add route to profile page from wallet tx list

  • Coracle v0.6.17

    • Show web of trust badge on DM items

    • Make name on messages clickable

    • Reduce duplicate dependencies

    • Add relays to note options form

  • Zap.stream v0.8.0

    • Add translations for 30 languages

    • Add deep linking for all zap.stream links

    • Add push notifications

  • Futr v0.3.0

    • Rich Media Support

      • Image display and viewer: Images from URLs now display directly in posts with a dedicated image viewer

      • Video player with fullscreen support: Embedded video player with play/pause controls, progress bar, and fullscreen mode

      • Download images and videos: Save any image or video directly to your computer with a single click

      • Video controls: Full video playback controls including time display and seeking

    • Enhanced Social Features

      • Comments & Conversations

        • Nested comment threads: Comment on posts with full threaded conversation support

        • Comment trees: Visual indentation shows conversation hierarchy and reply relationships

      • Reposts & References

        • Referenced post display: Reposts and quote reposts now show the original post content inline

        • Nested post references: Support for complex post reference chains

        • Quote repost support: Create and view quote reposts with your commentary

      • Profile Integration

        • Smart profile rendering: npub addresses automatically display as profile names and pictures

        • Clickable profile links: Click any profile reference to view that user’s feed

        • Profile pictures everywhere: User avatars displayed consistently across the app

    • User Experience Improvements

      • Navigation & Interface

        • Improved scrolling: Smooth scrolling behavior across all feeds and chats

        • Collapsible sidebar: More screen space when you need it

        • Auto-scroll intelligence: Feeds automatically scroll to new content when appropriate

      • Chat & Messaging

        • Message anyone: Send private messages without requiring a follow relationship

        • Better chat interface: Improved message display and input handling

        • Enhanced scroll behavior: Smooth chat scrolling that remembers your position

      • Cross-Platform Support

        • Windows support: Full Windows compatibility with native installer

        • Better performance: Reduced memory usage and faster loading

        • Improved reliability: Better connection handling and error recovery

  • Nostr-PHP v1.8.0

    • feat: Implement NIP-05 lookups

    • Add extra metadata fields for profile

    • Finish implementing methods Relay and RelaySet

    • Implement NIP-17 Private Direct Messages

    • NIP 44 implementation fix and test improvements

    • Remove CLI tool from library

  • Keychat v1.32.6

    • [Ecash] Updated Keychat_rust_ffi library. Supports paid mint servers

    • [Ecash] Added mint information page

    • [Ecash] Added fee for Ecash billing

    • [Browser] Enabled viewing of image URLs in WebView

    • [Browser] Enabled PDF viewing on desktop

    • Redesign the login page

  • Yumyume v0.7.0 - Mezze Platter with Labneh, Olives & Spiced Lamb

    • Version 0.7.0 brings together bookmark insights, URL context, smarter tagging, and improved flows for new users

    • Features:

      • Bookmark detail page: Click on a timestamp to open the new bookmark detail page

      • URL detail page: Click the info icon in the feed or bookmark detail to open a dedicated page for the URL

      • Update Bookmarklet to Kind 39701

      • Nstart integration: “Create a Profile” button now supports dynamic return URLs

      • Tags feed: Popular tags now only reflect the last 30 days

  • Nostur v1.21.0

    • Support Follow Packs

    • Support Blossom servers (uploading and mirroring)

    • Post Preview for Picture-only posts

    • Audio-only bar

    • Drag unread counter anywhere, tap to go to next unread post

    • Show media info in iOS Now Playing control center

  • 0xChat App v1.4.10

    • Add support for creating MLS private groups

  • Samiz v0.0.5-alpha (BLE mesh for nostr notes when the internet is down)

    • Add Logs view

    • Add Help view

  • Runstr v0.4.7 - Bug Squashing 🐛

    • Step tracking: Improve step tracking and pedometer precision

    • Nostr & Privacy:

      • NIP-101h: Choose what fitness details to share on Nostr (intensity, cadence, heart rate)

      • Remove fallback to public relays when using private relays for NIP-101h and NIP-101e events

    • Rewards System: Improve payouts reliability

    • UI & OS: GrapheneOS: Enhance location tracking with better permission handling and updated manifest requirements

    • Countdown Controls: “Skip Start Countdown” Check Box

  • Pokey v0.2.1-beta

    • Subscription feature: Additionally listen to all notes published by an NPUB, all notes under an NEVENT or any note including a specific #HASHTAG. Notes are fetched in user’s inbox relays.

    • If the note contains an image URL, it now displays

  • TollGate (Enables WiFi routers to accept Bitcoin payments for internet access)

    • v0.0.3

      • The router now automatically pays out accumulated funds to Lightning addresses

      • Add support for splitting payments between multiple Lightning addresses

      • Enhance configuration options for mints with more detailed settings for balance management and payout preferences

    • v0.0.2

      • Streamline build process with new GitHub Actions workflows, making it easier to create and publish releases

      • Enhance configuration management system, allowing for more flexible and robust setup options

      • The system now randomizes the LAN IP address on first boot

      • Update first boot script to configure the network settings more effectively, including setting DNS servers to CloudFlare DNS

      • Introduce new release.json file to manage module versions and dependencies

      • Add package management files (packages_dev.json and packages_stable.json) to define external and custom packages for the OS

Boosts

  • 01:07:13 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @AVERAGE_GARY (10,200 sats) “libbitcoinkernel maximalism” “That’s OSMU taking the bitaxe donations. Need more manufacturing implementations. Just like Core”

    • @hgw39 (10,000 sats) “As NVK said, we have the option to not update and run an older version. But Core encourage us to update to more recent versions for security. This sounds reasonable to me so what are the security ramifications if you run an older version? Also, could you explain more about the Lebitcoin kernel project Craig was talking about. That sounds interesting. Thanks.”

    • @Rod Palmer (5,000 sats) “scolding people who don’t run nodes wasn’t effective. telling people that running a specific flavor of node will make people they don’t like extremely mad may just work”

    • @Chris (5,000 sats) “Would still love the ability to export a Secure Note encrypted with bip85 entropy that can be decrypted at any point in the future by a coldcard running the same seed/passphrase combo. A stacker news poll showed over 50% of users would be interested in this feature.”

    • @Hech (1,000 sats) “Great episode”

    • @Bob the Cow (500 sats) “Mooooo”

    • @Plunger (343 sats) “Great panel, informative show.”

    • @Homer Hodl (120 sats) “For the block clock refresh.. how about the ability to set a threshold to update the display quicker than the default if the new value exceeds the adjustable threshold?”

Tech Tip of the Day

  • Signallama: Signal bot to chat with your ollama instance [Github]

    • Signallama enables users to interact with LLMs via the Signal messaging platform

    • It primarily supports Ollama but is compatible with various LLM providers through LiteLLM

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 356

      • Do attributable failures reduce LN privacy? Carla Kirk-Cohen posted to Delving Bitcoin an analysis of the possible consequences for the privacy of LN spenders and receivers if the network adopts attributable failures, particularly telling the spender the amount of time it took to forward a payment at each hop.

    • 354

      • Vulnerability disclosure affecting old versions of Bitcoin Core: Antoine Poinsot posted to the Bitcoin-Dev mailing list to announce a vulnerability affecting Bitcoin Core versions before 29.0.

        • An attacker could send an excessive number of node address advertisements to force a 32-bit identifier to overflow, resulting in a node crash.

News & Noteworthy

Bitcoin

  • Soft-fork proposal: Dust Expiry: Clean the UTXO set from spam [Delving Bitcoin]

    • Dust Expiry is a soft-fork proposal that prunes low-value, inactive UTXOs from the set unless the owner provides proof or pays an ongoing cost, effectively removing spam from those unwilling to maintain it.

  • BIP39 Extension for Manual Seed Phrase Creation [Bitcoin Dev discussion]

    • The proposal uses every eighth word from existing wordlists to create 16-word phrases with 128 bits of entropy.

    • The system encodes derivation paths in the least significant three bits of each word, allowing for specification of up to seven different paths or 48 bits of metadata.

Lightning + L2+

  • Wallet of Satoshi teases the upcoming launch of a fully non-custodial Lightning wallet in the U.S. market [Twitter post]

    • WoS ceased its operations in the U.S. in November 2023.

Business & Finance

  • Block Inc. announces bitcoin payment integration for Square merchants, reaching all eligible sellers by 2026 [Announcement]

    • Follow-up: Block reveals their LN routing node generates 9.7% annual returns with 184 BTC capacity [Atlas21]

  • Breez and Spark announce a new implementation of the Breez SDK built on Spark’s Bitcoin-native Layer 2 infrastructure, enabling developers to integrate self-custodial Lightning payments into apps [Announcement]

    • The implementation provides support for all major programming languages, LNURL, Lightning addresses, and mobile notifications without relying on bridges or external consensus.

  • Ledn announces a strategic shift to focus solely on bitcoin-backed lending, effective July 1, 2025, as 95% of their loan clients currently use bitcoin as collateral [Announcement]

  • Casa app now allows users to connect bank accounts and buy bitcoin directly through its Zero Hash partnership, supporting ACH and wire transfers [Announcement]

  • GameStop Corp. announces the purchase of 4,710 bitcoin [Press release]

Funding

  • OpenSats announces its Eleventh Wave of Bitcoin Grants to “support a diverse set of contributors advancing Bitcoin’s infrastructure, tooling, and accessibility.”

    • Three first-time projects have been choosen: BitShoka, Great Script Restoration, and 256 Foundation; alongside three renewed project grants for Payjoin, Mostro, and P2Pool v2.

  • Btrust awards a total of $1,004,010 to 10 grant recipients, including four for developer education, two for events, and four for conferences:

    • Summer of Bitcoin, Vinteum, Bitshala, Librería de Satoshi’s B4OS, Adopting Bitcoin Cape Town 2025, Bitcoin++ Florianopolis 2025, Dakar Bitcoin Days 2025, Africa Bitcoin Conference 2025, Africa Free Routing Lightning Bootcamps, and Base58’s LARP Tutor Session in Mauritius.

  • The Human Rights Foundation announces a 8 BTC donation to 22 projects and individuals working on Bitcoin and freedom tech [Bitcoin Magazine]

    • The recipients are: Mostro, SudaBit, Stringer News, Prices Today, Instamouse, Seedsigner, Spacebear, Padawan Wallet, Brink, Coin Center, Bitcoin Design Foundation, EmberOne, 2025 FROST Developer Support, Ecash UX Improvement Project, Summer of Bitcoin, Entropy, Evento, Brandon Odiwuor, Satoshi Sister Circle, Bitcoin Month, Bitcoin Pidgin & Bitcoin Anambra, and Bitcoin Boma.

  • Bitcoin educational project My First Bitcoin receives a $1 million grant from #startsmall initiative [Press release]

  • Maelstrom Fund announces a $100,000 open source developer year-long grant to Ben Allen for his work on the Payjoin Dev Kit [Coin Telegraph]

Bounty

  • Skibidi Wallet Bounty: A bounty to build the first brainrot Bitcoin wallet for Gen Z and Gen Alpha

    • Skibidi Cash announces a $6,500 bounty for developing a mobile-first, self-custodial Bitcoin wallet targeting Gen Z and Gen Alpha.

    • The wallet must feature a brutalist/meme/brainrot user experience, be open-source under the MIT license, and operate on mainnet.

Mining

  • Bitlayer Labs partners with Antpool, F2Pool, and SpiderPool for BitVM bridge implementation [Announcement]

    • Mining partners (which together represent nearly 40% of Bitcoin’s global hashrate) will provide interfaces accepting non-standard transactions.

Privacy

  • Telegram sees sharp rise in user data sharing with authorities in Q1 2025 [404 Media]

    • Telegram provided data on 22,777 users to authorities in Q1 2025, a significant increase from 5,826 users in the same period of 2024.

    • Telegram Transparency Data: A webpage of crowdsourced data on Telegram transparency, displaying how many requests were accepted by Telegram and where [Github]

Quantum

  • How to factor 2048 bit RSA integers with less than a million noisy qubits [ArXiv Research paper]

    • A new research reduces qubit requirements for factoring 2048-bit RSA integers from 20 million to less than a million, though increasing runtime from eight hours to less than a week.

    • The research maintains consistent assumptions about quantum hardware capabilities, including 0.1% gate error rate and specific timing parameters for surface code cycles.

Bitcoin Security Incidents

  • Attempted kidnapping of Bitcoin exchange executive’s daughter in Paris, France [Le Monde]

    • Four masked men attempt to kidnap the daughter of Paymium cryptocurrency exchange CEO and co-founder in Paris’ 11th district.

  • French police thwarts multiple kidnapping attempts targeting cryptocurrency entrepreneurs and their families [BFM TV]

    • Ten suspects were arrested Monday in Nantes just before attempting to abduct someone linked to cryptocurrencies.

    • Police conducted a second raid Tuesday, arresting the commando responsible for a May 13 kidnapping attempt in Paris’s 11th district.

  • Crypto investor arrested for torturing Italian businessman in NYC, U.S. extortion plot [CoinDesk]

    • John Woeltz is charged with kidnapping and assaulting a 28-year-old Italian businessman in a luxury SoHo apartment, attempting to extort cryptocurrency passwords through torture with electric shocks, drugs, and chainsaw threats.

    • The victim, held captive for two weeks, escaped on Friday 23rd May believing he would be killed.

  • Man kidnapped in Sofia, Bulgaria for 14 bitcoin by fake police officers on October 7, 2024 [BTV Novinite]

    • A 35-year-old man is kidnapped on October 7 by individuals posing as police officers in Lyulin district. The victim is threatened with a gun and forced to transfer 14 bitcoin.

    • Searches reveal fake police credentials, a CDCOC badge, an airsoft pistol, and a blue police lamp

  • U.S. tourist loses $123K in crypto after being drugged by fake Uber driver in London, UK following a night out [Decrypt]

    • The driver offers a cigarette believed to contain scopolamine, causing the victim to unwittingly reveal his phone passcode, which allowed the attacker to access his Revolut account, stealing $72k in XRP tokens and $50k in bitcoin.

  • Russian entrepreneurs running a cryptocurrency business kidnapped in Palermo, Argentina [TN]

    • The victims, found tied up by police, paid a $43,000 cryptocurrency ransom through a friend. The suspects flee Argentina to the United Arab Emirates and are now subject to an Interpol red alert.

  • South Korean police arrest a Russian suspect following an attempted $730,000 crypto robbery at a Seoul hotel [CoinTelegraph]

    • Two other suspects fled the country before authorities could prevent their departure.

    • The three Russians posed as crypto traders, luring 10 Korean investors to a hotel room where they ambushed victims with replica weapons and cable ties. One victim escaped, alerting police and causing the suspects to flee empty-handed.

  • Ugandan crypto founder abducted and robbed of $500,000 by armed men impersonating military officers [Decrypt]

    • Attackers forced him to transfer half a million USD in cryptocurrency and sell portions of his holdings under duress.

    • The victim’s company reports this incident as part of a larger trend, claiming over 48 similar crypto-related attacks have occurred in Uganda.

  • Three Chinese nationals are expelled from Paraguay after an attempted assault on a crypto-mining company that led to a police chase and shooting [Monumental]

    • The prosecutor confirmed the foreigners entered Paraguay illegally through Bolivia and Brazil, stating that “They came as programmers to work at the company”.

Protocol

  • Bitcoin Core #31622: psbt: add non-default sighash types to PSBTs and unify sighash type match checking [Merged]

  • Bitcoin Core #32155: miner: timelock the coinbase to the mined block’s height [Merged]

  • Bitcoin Core #31444: cluster mempool: add txgraph diagrams/mining/eviction [Merged]

  • Core Lightning #8140: Peer storage enable [Merged]

  • Core Lightning #8021: Splice: Interop Final (probably) with Eclair [Merged]

  • Core Lightning #8226: Signmessage: Add a new rpc called signmessagewithkey that can be used to sign messages using any key from our wallet [Merged]

  • LDK #3796: Do not dip into the funder’s reserve to cover the two anchors [Merged]

  • NIPs #1919: NIP-79: Passkey-Wrapped Keys a.k.a. Nosskey [Open]

  • NIPs #1934: Add NIP-XX: Static Payment Addresses [Open]

  • NIPs #1923: Create NIP-XX.md: Voice Messages [Open]

Government & Political

  • Bipartisan Blockchain Regulatory Certainty Act reintroduced in U.S. Congress [Coin Center]

    • The bill aims to provide clarity for non-custodial crypto infrastructure developers and protect crypto developers from undue regulation and misapplication of licensing laws that have impeded privacy tech development in the U.S.

  • UK’s new strict crypto reporting requirements raise data security concerns [Lightning News]

    • Starting January 2026, UK implements extensive reporting requirements for all crypto firms serving UK customers, requiring collection of personal data and transaction details as part of OECD’s CARF initiative.

  • Pakistan announces creation of government-led Bitcoin Strategic Reserve, allocates 2,000 megawatts of excess energy to mining and establishes a Digital Asset Authority [Coin Telegraph]

Legal

  • Samourai Wallet’s defense releases its motion to dismiss

  • Roman Sterlingov’s defense requests the DOJ to drop charges, citing Todd Blanche’s memo against “victimless cryptocurrency regulatory prosecutions” [The Rage]

    • Defense argues prosecution lacks victims or eyewitnesses, noting “no victims testified at Mr. Sterlingov’s trial or sentencing” and jury was instructed to disregard awareness of illicit activity.

  • Roman Storm’s defense re-petitions court to compel FinCEN communications, claiming government “misled this Court with regard to the scope of Section 1960 under relevant FinCEN guidance” [The Rage]

    • Motion follows revelations in Samourai Wallet case where FinCEN officials indicated cryptocurrency mixing services without control are “NOT” money transmitting businesses, contradicting prosecution’s arguments.

    • Follow-up: SDNY abandons the theory that Tornado Cash was a financial institution, dropping unlicensed money transmission charges but continues to pursue charges under the Patriot Act.

    • Follow-up: Judge Failla rejects Roman Storm’s defense argument that non-custodial status matters, stating “You haven’t persuaded me that the custody issue is as important as you say.”

  • The SEC formally dismisses its lawsuit against Binance and Changpeng Zhao, ending one of the last remaining crypto enforcement actions [CNBC]

    • Binance forges ties with World Liberty Financial, which funnels 75% of profits to Trump family-linked entities and receives a $2 billion investment from MGX.

Events

Reads

  • Here’s a list of our top recently published reads:

    • UTXO Set Report, by orangesurf [Mempool Research]

    • The 2015 Spam Attacks, by BitMEX Research [Blog post]

    • Low Time Preference or Self-Neglect?, by Bitcoin Park [Blog post]

    • Seedless is safer, by Jonathan Pollack [Bitkey]

    • Nerd of the Month #3: Working on Longevity, by Nick Johnson [Spiral]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR096 - OP_RETURN Debate, Core Governance, Alternative Implementations, Future Soft Forks, CTV Prospects, Core Vulnerabilities, COLDCARD Hardware Design, Testnet vs Signet + MORE ft. Rob, Odell, Craig]]>https://substack.bitcoin.review/p/br096-op_return-debate-core-governancehttps://substack.bitcoin.review/p/br096-op_return-debate-core-governanceThu, 15 May 2025 17:54:45 GMTI’m joined by guests Rob Hamilton, Craig Raw & Matt Odell to go through the list.

Listen on your favorite podcast app

Housekeeping

  • New Coldcard Q tutorial: How to use the COLDCARD key teleport function on the Coldcard Q [YouTube]

OP_RETURN Drama

  • 00:00:52 Odell’s thoughts

  • 00:04:29 Craig’s thoughts

  • 00:05:59 NVK’s thoughts

  • 00:07:47 Rob’s thoughts

Bitcoin

Software Releases & Project Updates

  • 00:22:10 COLDCARD

    • Shared Improvements - Both Mk4 and Q

      • Enhancement: Text word-wrap done more carefully so never cuts off any text, and yet doesn’t waste space.

      • Bugfix: Add current tmp option, which could be shown in Seed Vault menu under specific circumstances, would corrupt master settings if selected.

      • Bugfix: PUSHDATA2 in bitcoin script caused yikes.

      • Bugfix: Warning for unknown scripts was not shown at the top of the signing story.

    • Mk4 Specific Changes

      • 5.4.3 - 2025-05-14

        • Bugfix: With both NFC & Virtual Disk OFF, user cannot exit Export Wallet menu. Gets stuck in export loop and needs reboot to escape.

        • Bugfix: Part of extended keys in stories were not always visible.

    • Q Specific Changes

      • 1.3.3Q - 2025-05-14

        • Bugfix: Do not allow to teleport PSBTs from SD card when CC has no secrets. Bugfix: Calculator login mode: added “rand()” command, removed support for variables/assignments.

  • 00:22:21 BDK v0.22.0 - Release chain

    • Improve syncing experience for electrum and esplora

    • Relevant transactions that are missing can now be evicted with the help of SyncRequestBuilder

    • CanonicalizationParams can be used to modify the behavior of CanonicalIter for a given query

    • Update dependency on miniscript to 12.3.1 along with various fixes and improvements

  • 00:22:35 Cove Wallet v0.4.0

    • Support for importing hardware wallets with Key Expressions: adds support for using Cove with Krux

    • Create a CSV file of your transactions with fiat values for each transaction at the time of the transaction: useful for tax reporting

    • Send flow improvements and bug fixes

      • Show proper formatting as you type

      • Default to entering the amount in before the address

    • Testnet4 support

  • 00:24:03 BTCPay Server v2.1.1

    • Add support for a subset of wallet policy output descriptors (BIP388, BIP389)

    • Add support for hardware wallet taproot signing (BIP86)

    • Enables linking payment requests to external invoices (e.g., QuickBooks, Xero) via a Reference Id

    • Allows searching Payment Requests Reference Id

    • Introduces a webhook triggered when a Payment Request is fully paid, useful for automating emails or other actions

  • 00:24:06 Nunchuk Android v1.68

    • Custom blockchain explorer

    • Ability to archive wallets

    • Ability to long-press & reorder wallets on Home

    • Anti-fee sniping setting

  • 00:24:12 Bitcoin Keeper v2.2.0

    • New Bitcoin Keeper branding

    • New Keeper Private tier

    • Add testnet support

    • Allow using Server Key with multiple users

    • Support import and export of BIP329 labels

  • 00:24:14 Bitcoin Safe v1.3.0

    • Redesign of Chart, Quick Receive, Icons, and Mempool Preview

    • Interactive chart (clicking jumps to transaction and selected transactions are highlighted)

    • Receive faster (CPFP)

    • BDK 1.2 (upgraded from 0.32)

    • Testnet4 support

    • Preconfigured Testnet demo wallets

  • 00:24:18 Wasabi Wallet v2.6.0 - Prometheus

    • Support for Standard BIP 158 Block Filters: Wasabi can now synchronize using BIP 158 filters without requiring a backend/indexer

    • Full Node Integration Rework: The previous integration was replaced with a simpler, more flexible system which is not limited to a specific Bitcoin node fork and doesn’t depend on the node running on the same machine as Wasabi, or require modifications to the node’s configuration.

    • Create & Recover SLIP 39 Shares: Create and recover wallets with multiple share backups using SLIP 39.

    • Nostr Update Manager: Use the Nostr network to receive update information and download locations instead of relying on GitHub’s goodwill

    • And more…

      • Add a configurable third-party fallback for broadcasting transactions if other methods fail

      • Change Windows Code Signing Certificate, now using Azure Trusted Signing

      • Provide the option to avoid using any third-party Exchange Rate and Fee Rate providers (Wasabi can work without them)

      • Rebuild all JSON Serialization mechanisms avoiding default .NET converters. Serialization is now stricter

  • 00:25:43 RoboSats v0.7.7

    • For Users

      • New coordinators view

      • Available coordinator reviews signed by both the robot and the coordinator

      • Coordinators now display in their profiles market price sources

      • Users are now warned if they try to cancel a non taken order after a payment attempt

      • Uzbekistani sum currency now available

    • For Coordinators

      • Library updates

  • 00:25:46 Umbrel v1.4.1

    • File search: Search within the Files UI or from anywhere in umbrelOS with the global ⌘/Ctrl + K search

    • Files widgets: Two new widgets - Favorites lets you open your pinned favorite folders, and Recents surfaces your recently modified files

    • File transfers: Keep an eye on speed and ETA while copying or moving files in real-time

  • 00:25:57 Zaprite

    • v2025-05-12

      • Taproot: Add Taproot support for our Bitcoin (Wallet) connection

      • Payment Profiles: Add the ability for Customers to manage saved Payment Methods at merchant accounts

    • v2025-04-28

      • Orders Export: add CSV export feature for Orders

      • Unchained SegWit Vaults: add support for Unchained’s new SegWit vaults

  • 00:26:22 Blockstream Satellite v2.5.1

    • Added

      • Installation of gr-dvbs2rx on Debian Bookworm (12)

      • User addition to video group when configuring a TBS USB receiver

    • Changed

      • Telstar 18V C-band downlink frequency

      • Rename blockstream-satellite systemd service to blocksatd

      • Add Lightning invoice payment status to GUI payment dialog

  • 00:26:45 Stratum Work

    • PR #45: Add a page that displays full block template data as parsed from the mining.notify message for each pool

    • PR #47: Add a hover tooltip to coinbase output field so that it’s easier to see a breakdown of > 0 value outputs

  • 00:26:58 SeedHammer II

    • Open sources the hardware design files for the SeedHammer II machine [Github]

    • “This includes the CAD STEP files as well as PCB schematics and layout in KiCad format.” [[Announcement](https://x.com/SeedHammer/status/1920496724042199121

  • 00:27:11 ESP-Miner v2.7.0

    • Improve AP mode stability by stopping unnecessary Wi-Fi reconnections

    • PID Fan Control

    • Quicklink service init

    • Remove under power failure

    • Make “Latest Release” into a link for the changelog

    • Share reject reasons tooltips

    • Simplify share rejection explanations

    • Track rejection reasons to avoid flickering

    • Set GAMMATURBO_POWER_OFFSET to 10W

    • Add default to supra model

    • Use latest LTS release of Node

Project spotlight

  • 00:27:34 Bitcoin Feature Matrix: A tool to track interoperability of Bitcoin products & services

    • “Bitcoin Optech’s new ‘Bitcoin Feature Matrix’ is now live in production”

  • 00:27:41 secp256k1lab: An INSECURE implementation of the secp256k1 elliptic curve and related cryptographic schemes written in Python, intended for prototyping, experimentation and education [Github]

    • Contributors include Tim Ruffing, Sebastian Falbesoner, and Jonas Nick

    • Features:

      • Low-level secp256k1 field and group arithmetic

      • Schnorr signing/verification and key generation according to BIP-340

      • ECDH key exchange

  • 00:28:00 GPGap: Air-gapped GPG signing Bitcoin-style [Github]

    • A project by Odudex, Krux contributor.

    • GPGap is an experimental Python application that lets you perform GPG signatures on an air-gapped device.

    • It leverages a modified version of PGPy to offload the signing operation to an external hardware signer.

  • 00:28:16 NVK Validation Tweet: A quick cooked demo response for a Bitcoin (Rust) Script for testing data on Signet [Github]

    • In response to NVK’s Twitter post by @PortlandHODL

    • The script is setup as the following:

      • Xpub A has 10,000 txns at different block heights

      • Xpub B has 100 utxos made from the 10k above at different block heights

      • Then 20 txns out of xpub B to random addresses at different block heights

      • Ideally all with a good amount of distance in height so its over a few months

      • Don’t need PSBTs

  • 00:28:54 BriberBrother: An ‘alternative mempool’ to help Bitcoin miners identify and include non-standard transactions that follow consensus rules but aren’t typically relayed through the P2P network [Github]

    • “Briber Brother addresses this challenge by introducing a system that:

      • Allows miners to efficiently detect and process non-standard transactions.

      • Enables users to provide incentives on another blockchain to encourage miners to include their transactions.

      • Ensures proper verification of incentivized transactions once they are successfully mined.”

  • 00:29:11 Stack Math: The Bitcoin Modeling Engine [Github]

    • Stack Math is an open-source Monte Carlo framework that combines ergodic walk strategies with traditional Bitcoin pricing models to generate probabilistic financial planning scenarios.

  • emberOne/00: A 100W open source ASIC Bitcoin mining hashboard [Github]

    • The 256 Foundation releases the KiCAD design files for the emberOne/00 hashboard, a 12-chip modular Bitcoin mining hashboard that consumes only 100 watts of power.

  • mainnet-observer: Bitcoin Blockchain Statistics [Github] (Hosted by 0xB10C)

    • This tool and website provides protocol-level statistics and insights about Bitcoin: blocks, transactions, script usage and more. Powered by a Rust backend and Hugo-based frontend.

  • NomadBuild: Self-sovereign Bitaxe firmware builder & flasher [Github]

    • NomadBuild provides a tool for Bitaxe users to compile firmware directly from source rather than relying on pre-compiled binaries with trust assumptions.

    • NomadBuild focuses on internally reproducible builds by pinning all dependency versions and controlling build timestamps within its environment.

  • 00:30:11 HashCommand: An Electron application for controlling Bitcoin miners on your local network, mainly Bitaxes and esp-miner devices [Github]

    • “It sits between a stratum server and miner, decoding and possibly manipulating traffic. Stratum messages from closed source pools/miners are hidden most of the time, this will let you view both.” [Announcement]

  • P2Pool v2: Rebooting P2Pool for Bitcoin [Github]

    • Features:

      • Share chain with uncles: all your work is accounted for

      • Pay large miners in coinbase: non custodial solution for top N miners

      • Support transactions: pay all miners with atomic swaps by market makers

      • Market makers buy shares from smaller miners: earning virgin coins

  • P2P Band: P2P Bitcoin exchanges decentralized aggregator [Github]

  • bitRaffle: A trustless and verifiable Bitcoin-based raffle system [Github]

    • bitRaffle is a trustless, automated, Bitcoin-based raffle system that uses Bitcoin’s blockchain to provide transparent and verifiable raffle drawings that cannot be manipulated.

  • BitcoinTravel: A bitcoin-only Online Travel Agency, offering flights, hotels, and travel experiences exclusively payable in Bitcoin

    • Bitcoin Travel operates under dual legal structures: registered in El Salvador as S.A. de C.V. to leverage Bitcoin-friendly regulations, and in the U.S. as Airlines Travel LLC based in Texas for supplier partnerships.

  • Bitcoin is for criminals: A list of case studies of real life examples of the ways criminals have used bitcoin across the globe [Github]

Vulnerability Disclosures

  • 00:30:23 CVE-2024-52919: Remote crash due to addr message spam (part 2) [Disclosure]

    • The vulnerability allows remote crashes by spamming addr messages until a 32-bit identifier overflows, rated as Low severity.

    • Bitcoin Core v22.0 implemented rate-limiting (1 address per peer every 10 seconds) in 2021, making the attack more expensive but not impossible.

    • The vulnerability is fully addressed in Bitcoin Core v29.0 by changing to a 64-bit identifier, preventing overflow attacks.

  • 00:33:02 CVE-2025-43707: Critical bug in rust-miniscript library causes transaction signing crashes [Blog post]

    • Bug found by @Pythcoiner from the WizardSardine team, communicated by Antoine Poinsot to rust-miniscript maintainers Andrew Poelstra and Sanket Kanjalkar

    • A vulnerability in rust-miniscript allows attackers to crash applications by crafting special descriptors, potentially creating denial-of-service for server applications.

    • The bug involves an out-of-bounds read in the Satisfaction::thresh() function when threshold k equals the number of sub-fragments.

  • Coinos service disruption due to database loss and outage [Note]

    • Coinos is back online but withdrawals remain frozen following complete database loss, with the latest backup being 24 hours old.

    • The service also experienced a 4-hour outage yesterday related to data center internet connection upgrades, though connection to database loss is unclear.

  • 00:34:46 Hackers breach LockBit ransomware gang’s dark web affiliate panels, exposing nearly 60,000 bitcoin wallet addresses and 4,400 negotiation messages between attackers and victims [Forbes]

    • Database leak includes admin and affiliate actor information with plaintext passwords, though LockBitSupp claims private ransomware keys remain secure.

  • Signalgate (continued): TeleMessage’s modified Signal app exposes Trump officials’ chat logs after Reuters photo emerges [Micah Lee’s Analysis] [Heise]

    • TeleMessage creates TM SGNL, a modified Signal app used by Trump officials that sends plaintext chat logs to their archive server despite claiming E2EE encryption.

    • TM SGNL appears identical to regular Signal but archives every message to destinations like Microsoft 365, email servers, or file servers based on user archive plans. The archive server runs on public AWS cloud in Northern Virginia and was recently hacked.

  • AirBorne: Oligo Security discovers 23 vulnerabilities in Apple’s AirPlay protocol and SDK that enable various attacks including zero-click remote code execution on Apple and third-party devices [Vulnerability analysis]

    • Two vulnerabilities (CVE-2025-24252 and CVE-2025-24132) allow attackers to create wormable exploits that can spread malware across networks without user interaction, potentially affecting 2.35 billion Apple devices.

    • MacOS devices with AirPlay receiver enabled, CarPlay systems, and third-party speakers are particularly vulnerable to attacks that could enable eavesdropping, tracking, and malware deployment.

    • Apple has released software updates addressing the 17 CVEs issued from Oligo’s disclosures, following a responsible disclosure process from Oligo.

  • LLMs: ANSI terminal codes enable hidden malicious instructions in MCP [Trail of Bits]

    • Researchers discover ANSI escape sequences can be used to hide malicious payloads in MCP tool descriptions, making them invisible to users while still processed by LLMs

    • Claude Code version 0.2.76 lacks filtering for ANSI codes, allowing attackers to create invisible instructions that could lead to supply chain attacks through manipulated dependencies.

  • XRP Ledger SDK compromised in supply chain attack [Aikido’s Technical breakdown]

    • Official XPRL (Ripple) NPM package infected with backdoor that steals cryptocurrency private keys through a suspicious function called checkValidityOfSeed that sends data to domain “0x9c[.]xyz”.

    • Attackers released five unauthorized versions (4.2.1-4.2.4, 2.14.2) of the popular package with over 140,000 weekly downloads, progressively refining their malicious code injection techniques.

Audience Questions

  • Thanks to everyone who sent in questions. Remember to send yours to questions@bitcoin.review.

    • 00:35:12 What’s the difference between test net and signet? And what are the benefits of each?

    • 00:37:15 Can you explain, in simple terms, what OP_CHECKCONTRACTVERIFY does?

    • There’s been a lot of talk about the difference between using OP_RETURN and witness data. Specifically that OP_RETURN is prunable and witness data ends up in the chain. Can you explain in normie terms how this works?

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • Sideband v1.6.0

    • Add compatibility with new AES-256 modes in RNS

    • Add transfer speed display to outgoing messages

    • Add ability to exclude objects from telemetry collector responses

    • Add interactive console option to daemon mode

    • Add option to specify RNS config path

    • Add Windows location plugin example

    • Sideband now uses abstract domain sockets for IPC on supported platforms

    • Improve memory consumption

    • Improve I/O performance

  • SimpleX v6.3.3

    • Add support for connecting via short connection links.

      • To create short connection links:

        • Enable Dev Tools

        • Enable short links in Privacy & Security settings

Project spotlight

  • Berty: An open, secure, offline-first, peer-to-peer and zero trust messaging app [Github]

    • Berty is a decentralized messaging app with end-to-end encryption that requires no phone number or email, works without internet connection, and remains functional on adversarial networks.

    • Developed by Berty Technologies, a French nonprofit, Berty aims to serve users needing secure communication while traveling, wanting anonymity, avoiding third-party servers, or living under censorship.

  • Filekey: Encrypt and share files securely with passkeys. Fully offline, easy-to-use, and zero-knowledge for ultimate file protection [Github]

    • “FileKey is an offline web app that lets you quickly encrypt and share files using passkeys. No accounts, no tracking, no backend servers. Just local, offline security powered by passkeys.”

  • PixelSafe: A steganography tool for PNG images that uses the Least Significant Bit (LSB) algorithm [Github]

    • “It lets you embed hidden data inside PNG files - for example, storing a KeePass database inside a screenshot. You can use it to hide backup files, send private messages, embed digital signatures, or attach invisible metadata to your images.”

  • TorVPN Android app: A WIP from the Tor Project to replace Orbot [Gitlab]

    • TorVPN project develops whole-device and app-specific anonymous communication [Wiki]

    • The initiative involves cross-team coordination with Arti, TPO teams for user experience, network health, and focuses initially on Android implementation with future platform expansion.

Lightning + L2+

Project spotlight

  • NodeGuard: A treasury management solution for Lightning nodes [Github]

    • NodeGuard is an open-source technology stack developed to simplify treasury operations for lightning nodes, focusing on both Security and UX.

    • Features include asynchronous channel funding with multisig wallets, liquidity automation, remote signing, automatic fund sweeping, and hardware wallet support for transaction signing.

  • 0Commons: A V4V platform where creators can share digital files (photos, graphics, videos, fonts, 3D printing files) under CC0 license with unrestricted commercial use.

    • The platform operates on a Value-for-Value model, allowing users to download content for free and zap creators directly, with creators receiving 100% of the contributions.

  • Bitcoin Lightning Network Profitability Calculator: An interactive tool designed to help users estimate their earnings from operating a Bitcoin Lightning Network node

    • It allows users to input various parameters to simulate different scenarios and assess the profitability of their investment.

  • Zapback: Last Pay Wins for Friends: A friend-based zap game with 24-Hour timer [Github]

    • A project inspired by lastpaywins.com

    • Players must zap back within 24 hours to stay in the game. The pool grows over time until one player forgets to respond, with the last player winning everything.

  • Coinbase launches x402, a protocol enabling instant stablecoin payments over HTTP that allows APIs, apps, and AI agents to transact within the internet economy [Announcement]

    • The protocol addresses limitations of traditional payment systems by leveraging the HTTP “402 Payment Required” status code, making stablecoin payments a native web function with minimal coding required. [White paper]

Software Releases & Project Updates

  • LND v0.19.0

    • New Features

      • Add support for archiving channel backup in a designated folder which allows for easy referencing in the future. A new config is added disable-backup-archive, with default set to false, to determine if previous channel backups should be archived or not.

      • Protocol Updates

        • lnd now supports the new RBF cooperative close flow

        • Add support for experimental endorsement signal relay

        • Add initial support for quiescence

        • The max fee rate is now respected when a coop close is initiated

      • Functional Enhancements

        • Add ability to paginate wallet transactions

        • Make MaxWaitNumBlocksFundingConf configurable, allowing integration/development tests to set a lower value for faster funding confirmation timeout while keeping the default of 2016 blocks for production stability.

        • Previously when sweeping inputs, the sweeper will wait until the specified budget can be covered by the inputs, which could cause the sweep to be delayed, and the sweeping tx ends up using large fees. This is now changed so the sweeper will always attempt the sweep as long as the budget can be partially covered.

        • Add validation to ensure that MPP parameters are compatible with the payment amount before attempting the payment

  • LDK

    • ldk-node v0.5.0

      • The PaymentSuccessful event now exposes a payment_preimage field

      • The node now emits PaymentForwarded events for forwarded payments

      • Add ability to send custom TLVs as part of spontaneous payments

      • Add ability to override the used fee rates for on-chain sending

      • Add ability to set a description hash when creating a BOLT11 invoice

      • Add ability to export pathfinding scores

      • Add ability to request inbound channels from an LSP via the bLIP-51 / LSPS1 protocol

      • The ChannelDetails returned by Node::list_channels now exposes fields for the channel’s SCIDs

      • Lightning peer-to-peer gossip data is now being verified when syncing from a Bitcoin Core RPC backend

      • The logging sub-system was reworked to allow logging to backends using the Rust log facade, as well as via a custom logger trait

      • On-chain transactions are now added to the internal payment store and exposed via Node::list_payments

      • Inbound announced channels are now rejected if not all requirements for operating as a forwarding node have been met

      • Add initial support for operating as an bLIP-52 / LSPS2 service

      • The Builder::set_entropy_seed_bytes method now takes an array rather than a Vec

      • The builder will now return a NetworkMismatch error in case of network switching

      • The Bolt11Jit payment variant now exposes a field telling how much fee the LSP withheld

      • Add ability to disable syncing Lightning and on-chain wallets in the background

      • Add ability to configure the node’s announcement addresses independently from the listening addresses

      • Add ability to choose whether to honor the Anchor reserves when calling send_all_to_address

      • Add ability to sync the node via an Electrum backend

    • rust-lightning v0.1.3 - “Routing Unicode in 2025”

      • Bug Fixes

        • Event::InvoiceReceived is now only generated once for each Bolt12Invoice received matching a pending outbound payment.

        • LDK’s router now more fully saturates paths which are subject to HTLC maximum restrictions after the first hop.

      • Security

        • v0.1.3 fixes a denial-of-service vulnerability which cause a crash of an LDK-based node if an attacker has access to a valid Bolt12Offer which the LDK-based node created.

        • A malicious payer which requests a BOLT 12 Invoice from an LDK-based node (via the Bolt12InvoiceRequest message) can cause the panic of the LDK-based node due to the way String::truncate handles UTF-8 codepoints.

  • Ark v0.6.0 - Indexer, RegisterIntent+BIP-322 support & SDK SQLite db

    • Features:

      • [Server] Make round failed if there’s not enough liquidity

      • [SDK] Retry settlement

      • Return utxo/vtxo amount limits in GetInfo

      • Return updated spentVtxos list in transactionEventsCh

      • [SDK] Disable onchain features if server doesn’t allow them

      • Add RegisterIntent + BIP0322 Proof of Funds & Drop covenant & SDK SQLite db

    • Ark partners with Austrian educational institution TU Wien on a formal specification of the Ark protocol [Litepaper]

      • “Ark Litepaper formalizes Ark’s technical foundation and provides additional clarity for researchers & developers interested in contributing to its implementations.”

  • Fountain v1.2

    • Library design update:

      • Add new content-type filters at the top of the page

      • Recently Played is now the default view in your library

      • Music filter now makes it easier to find saved tracks and albums

    • Content pages design update: Redesign shows, episodes, artists, albums, tracks, clips and playlists pages

    • Episode summaries:

      • Add Summary button above show notes

      • Summaries and transcripts now come as a bundle

    • Playback improvements: Rebuilt the audio engine from the ground up

      • Tracks now load and play instantly when tapped

      • Faster skipping in-between collection of tracks

      • Replace scrollable player page with full-screen modals

    • Other bug fixes & improvements:

      • Rebuilt payment stats for more complete and reliable transaction records

      • Add new episode notification preferences in Settings

  • Phoenixd v0.6.0

    • Support simple close

    • Add support for linux arm64 target

    • Update Dockerfile - fix casing warnings

    • Support stateless offers with optional custom description and amount

    • Upgrade to lightning-kmp 1.10.2

  • BoltzExchange boltz-client v2.6.0 - Tiny

    • Allows lower swap limits for submarine swaps

      • Add support for a new minimal threshold (“MinimalBatched”) for batched swaps, allowing swaps below a certain amount to be handled differently.

  • Breez SDK

    • Nodeless v0.8.2

      • Faster Lightning payment reception

      • Critical fix to Bitcoin transaction fee calculation

    • Greenlight v0.7.1

      • Implement version 2 of Taproot swaps by unifying the swap execution interface under BTCReceiveSwap and extending support for taproot-specific logic

  • Lightning Loop

    • v0.31.1

      • Autoloop now defaults to a slow publication deadline (30 minutes after initiation) to reduce fees. To revert to the previous behavior, users can run loop setparams --fast, which causes swap HTLCs to be published immediately after initiation.

    • v0.31.0

      • Enhance the loop listswaps command by improving the ability to filter the response

  • lightning-kmp v1.10.0

    • Implement option_simple_close

    • Remove amount-based confirmation scaling

    • Bolt11 invoices: do not re-encode amounts

    • Add more force-close tests for HTLC settlement

    • Send normal failures for Bolt12 payments

    • Add test for Bolt11 features minimal encoding

    • Peer storage

    • Stateless offers

    • Use the offer description as default payer note

    • Add support for linux arm64 target

  • BlitzWallet v0.4.4-beta

    • eCash Improvements

      • Prevention of Duplicate eCash Payments: eCash transactions can no longer be paid twice

      • Fix Background eCash Invoice Handling: When a user creates an eCash quote but fails to pay before the quote expires, the app no longer attempts to claim it with an incorrect proof index during the next wallet load

    • Payment Experience

      • Bolt12 Payments from Liquid: Users can now send payments to BOLT12 invoices directly from their Liquid balance

      • Support for Blink QR Codes: Blink QR codes now open directly inside the Blitz native UI with LNURL-pay support

      • Lower Minimum for Lightning-to-Liquid Payments: The minimum receive amount for Lightning-to-Liquid swaps has been reduced to 100 sats

    • App Enhancements

      • Manual Sync via Swipe Gesture

      • Crash Reporting with User Control

      • Blitz Social Tracking: A new section in settings shows how many users have downloaded Blitz and tracks its growth over time

      • Half-modal Popups: Popups can now be dismissed

  • Nutshell v0.16.6-rc1

    • New Features

      • Blind Authentication

        • Limit mint access using Clear and Blind Authentication. Nutshell now supports NUT-21 and NUT-22, enabling the use of OAuth 2.0 identity providers like Keycloak (or any compatible provider)

        • NUT-22 introduces Blind Authentication, which enhances user privacy by anonymizing authentication within the set of registered users.

    • Improved Multi-Nut Payments

      • Multi-nut payments via LND are now more reliable

    • Additional Protocol Updates

      • SIG_ALL Multisig Flag: Users can now lock ecash to specific destinations (outputs)

      • Mint and Melt Quote Enhancements: The update to NUT-04/05 introduces new fields (amount, unit, request) to mint and melt quotes

      • ToS URL: Mints now have the option to enter a Terms of Service (ToS) URL in the mint info settings

    • Fixes and Improvements

      • Wallet Un-reservation: Nutshell wallet now un-reserves ecash after a failed Lightning payment more reliably

      • Improved Keyset Rotation: Enhanced keyset rotation process for mints

      • Pending Melt Quotes: Mints now check pending melt quotes in the background every hour

      • Balance Tracking for Keysets: Mints can now track balances for each keyset separately

  • Cashu-ts v2.5.0

    • Cashu-TS 2.5 is out, adding NUT-22 Blinded Authentication and plenty of DX improvements.

      • Replace Enums with Const Objects

      • Add getDecodedToken example in the README and an example of firebase API to receive cashu payments

      • Support for proof witness field in token serialization

      • Fix P2PK refund to reflect NUT-11 format

      • Add NUT-22 BlindedAuth

      • Melt: made blank output amount equal split length

      • Bringing back cashu-crypto-ts code into cashu-ts

      • Run format check on PR

      • Make sure to always stringify URL object for WebSockets

      • nut18: optional transport and add nut10 option

      • Add API-Extractor to project and CI

  • Minibits is now expanding to iOS TestFlight [Announcement]

  • Geyser launches Bitcoin Launchpad: A visibility platform for early-stage projects [Announcement]

    • Launchpad introduces a system requiring Bitcoin projects to gather 21 followers within 30 days to officially launch, addressing the issue that “projects don’t fail because they lack funds” but because “no one knew they existed.”

    • Each project receives a dedicated section for 30 days, with followers receiving email updates upon reaching the threshold of 21 followers; projects can alternatively launch manually for $21.

    • The platform aims to “separate signal from noise” by creating a small challenge that may trigger momentum, giving visibility to meaningful projects before they go live.

Nostr

Project spotlight

  • Nostr Follow List: A minimalistic Nostr application for creating, sharing, and discovering Nostr Follow Packs [Github] by callebtc

  • Relays.land: A customizable relay management tool for Nostr [Code repository] by fiatjaf

    • Relays.land is a platform that enables users to create and manage custom Nostr relays with specific content curation and moderation rules. It offers three types of relays: curated, programmable, and moderated.

  • (Pub)Caster: Effortlessly turn your npub into a podcast feed [Github] by dergigi

    • “(Pub)Castr is a service that automatically generates podcast feeds from Nostr profiles. It converts kind1 events containing audio (and video) file links into a valid Podcasting 2.0 feed.”

  • Camelus: A nostr client for Android and iOS (beta TestFlight) [Github] (WIP)

    • Features:

      • Nostr Protocol for Decentralized Data Storage: Ensures user data privacy and control

      • Clean Architecture: Uses Dart and Flutter

      • Dart_NDK Integration: Optimized for mobile battery

      • In-Box and Out-Box Messaging: Optimized for gossip and database performance

      • Open-Source Development: Community-driven project

      • Riverpod for State Management: Efficient and testable state management

  • nparrot-chat: Integrate any command line tool with Nostr relays-as-groups [Github]

    • Nostr Parrot Chat is a convenient CLI tool that facilitates messaging over Nostr relay chat rooms

    • Use cases:

      • Talk to your Goose AI agent via DMs from your phone by using any Nostr client compatible with NIP-17

      • Easily integrate almost any other command line tool with Nostr DMs

      • Send yourself notifications easily from any environment that can run shell commands

      • Use this as a test or troubleshooting tool for NIP-17 messages

  • Anchor Alerts: A notification and syncing server for flotilla.social [Github]

    • The tool bridges nostr to email, offering notifications without requiring users to install additional software.

  • Chronostr: A scheduling adjustment and RSVP tool working on the Nostr [Github]

  • Nostash: A nostr signing extension for Safari [Github]

    • This is a NIP-07 compatible extension for signing nostr events, forked from (the no longer supported project) nostore

  • Kinostr: A nostr client that renders kind 1 nostr notes and their attachments

    • Kinostr is a YouTube-like interface for Nostr videos using the #kinostr tag

  • Swae: A live streaming application built on the Nostr protocol, aiming to provide a censorship-resistant platform for content creators and viewers [Github] (WIP)

    • “Users are able to send bitcoin to streamers and other users over the lightning protocol.”

  • Nostroots: An initiative to seamlessly transition Trustroots, the platform for sharing, hosting, and community building, onto the nostr network [Github]

    • “Trustroots is a social network of travelers and hosts that offer couches. Founded in 2014, 112k+ members now.”

  • Sobrkey: A decentralized sobriety tracking and community support application built on Nostr [Github]

    • Features include: 12-step journey tracking, public community support, emergency resources, zap-based donations, and Decentralized identity.

  • Nostrly: A web-based service that allows users to register a verified Nostr address

    • Nostrly also provides various tools for Nostr and Cashu, including: NIP-09 Note Deleter, NIP-19 Decoder, and NIP-57 Web Zap

    • Cashu tools: Cache, Gather, NutLock, Witness, and Redeem

  • Nostream: A media-only Nostr firehose stream, unfiltered (A project by @jack)

Software Releases & Project Updates

  • 00:46:55 Nostr Messaging Layer Security (MLS) Update [Note]

    • Libraries released: nostr_mls_storage, nostr_mls_memory_storage, nostr_mls_sqlite_storage, and nostr_mls

    • White Noise refactor

    • Encrypted media with Blossom: Media in groups is encrypted using an MLS secret and uploaded to Blossom with a one-time use keypair

    • Damn mobile: beta version coming live on Zapstore in a few weeks

  • 00:48:42 Primal v2.2.13

    • Login with public key

    • Amber support

    • Blossom media uploads & settings

    • Push notifications for Google builds (not available in Github APKs)

    • Notifications revamp

    • Image gallery in article details

    • Muting words, hashtags & threads

    • New gallery rendering for media attachments in notes

    • “Share note as image” option in note context menu

    • Copy Url & Copy Image in media gallery screen

    • Copy to clipboard when tapping on bitcoin or lightning address in wallet

    • Topological sort for FeedPost on threads

    • Request Delete action for notes & articles

    • Simplified note context menu

  • 00:48:43 Damus v1.14 - TestFlight for Purple users

    • Introduce new one-click wallet setup, powered by Coinos

    • Revamp wallet experience with balance and transactions view for your NWC wallet

    • New notification setting to hide hellthreads

    • Add NIP-65 relay list support

    • Add Unicode 16 emoji reactions (only for iOS 18.4+)

    • Blurred images now show some more information

  • Damus Notedeck Beta Release [Announcement]

    • New in Notedeck Beta:

      • Dave nostr AI assistant app

      • GIFs

      • Fulltext note search

      • Zaps (NWC/ Wallet UI)

      • Introduce last note per pubkey feed (experimental)

      • Allow multiple media uploads per selection

      • Major Android improvements (still wip)

      • Add notedeck app sidebar

      • User Tagging

      • Note truncation

      • Local network note broadcast, broadcast notes to other notedeck notes while you’re offline

      • Mute list support (reading)

      • Relay list support

  • Coracle

    • v0.6.16

      • Add support for editing WOT feeds

      • Change default blossom servers

      • Add support for custom emojis

    • v0.6.15

      • Improve remote signing

      • Drop nip 96 support

      • Use user blossom servers

      • Avoid duplicate notes in feeds

    • v0.6.13

      • Add safe areas for phones

    • v0.6.12

      • Upgrade capacitor

      • Allow use of ws:// relays on android

    • v0.6.10

      • Use new version of network library

      • Re-work storage adapter to minimize storage and improve performance

      • Improve initial page load times

      • Upgrade welshman

      • Remove platform relay

      • Show PoW

      • Don’t fetch messages until decryption is enabled

  • Flotilla

    • v1.0.3

      • Add light theme

      • Use correct alerts server

      • Ignore relay errors for claims

      • Add custom emoji parsing and display

    • v1.0.0

      • Add alerts via Anchor

      • Allow use of cleartext relays on native builds

      • Detect blossom support on community relays

      • Use user blossom server list in settings

      • Improve thunk indicator

      • Update storage adapters

      • Switch to pnpm

  • ndk-cache-sqlite-wasm v0.2.0 - Introduces the Sqlite WASM cache adapter package (feat: add SQLite WASM cache adapter with support for decrypted and unpublished events, including schema updates and migration logic)

    • Implements the full NDKCacheAdapter interface, including:

      • Event caching (setEvent, getEvent, etc.)

      • Profile caching (fetchProfile, saveProfile, etc.)

      • Synchronous and asynchronous APIs

      • Relay status management

      • Decrypted event cache (getDecryptedEvent, addDecryptedEvent)

      • Unpublished event management (addUnpublishedEvent, getUnpublishedEvents, discardUnpublishedEvent)

    • Database schema and migration logic mirrors ndk-mobile’s implementation

    • Uses sql.js (WASM) for cross-platform SQLite support in browsers and JS environments

    • Database is persisted automatically to IndexedDB with debounced saves for performance

    • Example page included for browser testing and benchmarking

    • Documentation is symlinked into the main docs/cache directory

  • Amber

    • v3.4.1

      • Move from deprecated Autofill api

      • Move from deprecated ClipboardManager api

      • Move from encrypted shared preferences to DataStore and normal shared preferences

      • Add more event translations

      • Bigger qrcodes, increase brightness when showing the qrcode

      • Add a option to accept/reject a permission temporarily

      • Better connection handling when switching networks

    • v3.2.8

      • Use bunker response from quartz

      • Include zapstore in the new bunker and initial message

      • Add search to the activity screen

      • Show option to never close the app when using bunker url

      • Separate general prefs and account prefs keys

      • Add loading indicator when trying to fetch profile picture

  • 0xChat App v1.4.9

    • Implement updated NIP-29 group logic with support for group admin roles

    • Add support for Aegis URL scheme login on iOS

  • Kyoto

    • v0.11.0

      • Fetch the Network from the node builder

      • Configure the initial TCP connection timeout when trying new peers

      • Add BDK integration links to the README

      • Update resource usage and profiling in DETAILS.md

    • v0.10.0

      • Template issue for bugs, enhancement requests, releases

      • Mainnet, signet, testnet4 checkpoints

      • Testnet4 DNS seeds

      • Socks5 proxy connections supported

      • justfile improvements

  • Nostrmo v3.0.0

    • Add support to nesigner (Windows, Linux and MacOS)

    • Using ISar to recode local relay’s database

    • Upgrade flutter versions

    • Show comment event (kind: 1111)

    • Add Relay Group Naddr and Follow Set Naddr str decode

  • Citrine v0.8.0

    • Support for protected events

    • Support for auth

    • Option to disable listening to pokey broadcasts

    • Option to disable start on boot

    • Change how the last backup time is calculated

  • Keychat v1.31.13

    • browser: Save the status of the tab unless it is closed manually

    • browser: Remove btcnav.org from mini app

    • message: Automatically refresh the homepage when a new message is added

    • desktop: Support packaging exe for windows platform. Optimize cmd+shift line break operation

    • mls: Cache state for uploading mls key package

    • android: The minimum supported Android version is now 12 (API level 31)

  • Nowser v1.1.0

    • Add hardware signer (nesigner) support

    • Android Signer package name method change

    • Image and link add long press support

    • Incognito Mode

    • Add download support

    • Url https check

  • YakiHonne - iOS/Android/Web/Zap.Store

    • Web v4.6.0

      • Introducing Smart Widgets v2

      • New Tools Smart Widgets section in note creation for advanced content editing

      • Curations, videos, and polls are now Tools Smart Widgets, enabling quick creation and seamless embedding in notes

      • Zap advertisements added—top zappers can now appear below notes

      • Note translation button has been relocated next to the note options for easier access

      • Follower and following lists are now visible directly on the dashboard home page

    • Mobile v1.7.0

      • Introducing the fully upgraded smart widget with its expanded set of functionalities

      • A set of tools to enhance content editing

      • Curations, videos, and polls are now Tools Smart Widgets, enabling quick creation and seamless embedding in notes

      • Shortened URLs for a better user experience

      • Highest zappers in notes will be highlighted

      • Zapper list now includes zaps messages

      • Gossip model can be enabled and disabled

  • Yumyume v0.6.0 - Biryani with Pickled Onion & Raita

    • Optimized & Interactive Tag Cloud: The tag cloud is now fully visualized with tag density and colors.

    • Bookmark Cards Now Ordered by Publishing Time: Update the global feed to sort and display bookmarks based on their original publishing timestamp, rather than the last edit.

    • Saving Client Info: Yumyume now saves the client name (“Yumyume”) in the background when publishing a bookmark.

  • Samiz v0.0.4

    • Now Samiz will broadcast:

      • Notes of any Kind created up to 1 hour before the session started.

      • User Metadata created at any time

  • Shopstr v0.4.2

    • Add Blossom media support for image uploads with metadata stripping

    • Add a terms of service and privacy policy

    • Add pagination for product viewing

  • Nostur Update (TestFlight)

    • Add blossom media server support

    • Support multiple blossom servers as mirror

Boosts

  • 01:01:58 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @Rod Palmer (5000 sats) “PODCONF Disapproved ❌(due to Rijndael)”

    • @AVERAGE_GARY (1100 sats) “OpNext was great. Run your testnet4 CTV + CSFS client. [Code repository] Has Sv2 enabled branch too.” “dB near zero ⚡”

    • @pink money (500 sats) “🔥🔥🔥”

    • @user4 (500 sats) “🔥🔥🔥”

    • @Wartime (333 sats) “Mon a not 🤔🤣”

    • @btconboard (300 sats) “👍🏻⚡️🫡”

Tech Tip of the Day

  • 01:03:51 Cryptography 101: A free online cryptography course repository, by Alfred Menezes

    • Includes “videos, slides, exercises and solutions, and news items.” [Koob’s SN post]

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 353

      • BIP30 consensus failure vulnerability: Ruben Somsen posted to the Bitcoin-Dev mailing list about a theoretical consensus failure that could occur now that checkpoints have been removed from Bitcoin Core.

      • Avoiding BIP32 path reuse: Kevin Loaec posted to Delving Bitcoin to discuss options for preventing the same BIP32 wallet path from being used with different wallets, which could lead to a loss of privacy due to output linking and a theoretical loss of security.

    • 352

      • Comparison of cluster linearization techniques: Pieter Wuille posted to Delving Bitcoin about some of the fundamental tradeoffs between three different cluster linearization techniques.

      • Increasing or removing Bitcoin Core’s OP_RETURN size limit: in a thread on Bitcoin-Dev, several developers discussed changing or removing Bitcoin Core’s default limit for OP_RETURN data carrier outputs.

    • 351

      • Interactive aggregate signatures compatible with secp256k1: Jonas Nick, Tim Ruffing, Yannick Seurin posted to the Bitcoin-Dev mailing list to announce a paper they’ve written about creating 64-byte aggregate signatures compatible with the cryptographic primitives already used by Bitcoin.

      • Standardized backup for wallet descriptors: Salvatore Ingala posted to Delving Bitcoin a summary of various tradeoffs related to backing up wallet descriptors and a proposed scheme that should be useful for many different types of wallets, including those using complex scripts.

News & Noteworthy

Bitcoin

  • Elliptic’s new report shows cartels deposit cash into banks before converting to stablecoins, challenging the narrative that “unhosted wallets” are the primary problem [The Rage]

    • The report cautions lawmakers against relying on blockchain surveillance firm reports, noting these companies have “clear profit incentive to expand their services” into the non-custodial sector.

Lightning + L2+

  • Aqua Wallet to introduce Dolphin Card: A KYC-free VISA card for spending [Blog post]

    • Aqua Wallet’s upcoming Dolphin Card allows spending Bitcoin, Liquid Bitcoin, and Tether at VISA merchants without identity verification, with a monthly limit of $4,000.

    • Initially launching as a virtual card with physical version to follow, the Dolphin Card will be available in most countries except the U.S. and Canada.

Nostr

  • Bitcoin-focused news desk No Bullshit Bitcoin integrates zapthreads-based Nostr comments [Note]

    • “Comments you leave under the original (quoted) post below should appear on our site, and comments you leave on our site should be visible under the post on Nostr.”

  • Guide: Self-hosted NIP-05 as a Lightning Zap Address for Nostr, by Avren [Note]

Business & Finance

  • Bitcoin-native holding company Nakamoto merges with KindlyMD to build Bitcoin treasury [Bitcoin Magazine]

    • KindlyMD and Nakamoto Holdings announce $710 million merger deal with David Bailey becoming CEO of the combined entity while Tim Pickett continues managing healthcare operations.

  • Tether, SoftBank Group, and Jack Mallers launch Twenty One, a Bitcoin-native company, through a business combination with Cantor Equity Partners [Business Wire]

    • Twenty One Capital is launching with over 42,000 BTC in its treasury and plans to go public through a SPAC merger with Cantor Equity Partners.

  • Strike launches Strike Lending: Bitcoin-backed loans for individuals and businesses []

    • Strike introduces bitcoin-backed loans allowing eligible customers to borrow $75k to 2m for up to 12 months at 12% APR.

  • Bull Bitcoin introduces brand new platform for Canadian customer base, following its extension in Costa Rica, Europe, and Mexico [Blog post]

    • New features include instant e-transfers, transparent price spreads instead of fees, and enhanced Bitcoin transaction options including Lightning Network support, with automatic data deletion for inactive accounts.

    • Future developments include recurring buys over Lightning and Liquid networks, auto-buy/sell functions, Payjoin technology for privacy, and limit orders, all built on self-hosted infrastructure.

  • Relai brings Bitcoin-collateralized lending to the European market [Announcement]

    • The service requires qualified investors under Swiss FinSA regulations, with minimum financial assets of CHF 500,000 and initial deposit of CHF 100,000, offering loans with 12-month minimum terms and up to 40% LTV ratios.

  • Coinbase agrees to purchase Dubai-based Deribit for $2.9bn, paying 700mn in cash and the remainder in shares, marking the digital market’s largest ever acquisition [FT]

    • Deribit, the world’s largest cryptocurrency derivatives market, handled over $1tn in trading volumes last year as the industry prepares for anticipated demand from banks and asset managers.

  • Coinbase Asset Management launches the Coinbase Bitcoin Yield Fund (CBYF), aiming to generate 4-8% net returns in bitcoin annually [Press release]

    • Multiple investors including Abu Dhabi-based Aspen Digital have seeded the fund, which launched on May 1, 2025 with Aspen serving as initial distribution partner across UAE and Asia.

  • Lightspark announces partnership with Revolut to implement Bitcoin network payment infrastructure in the UK and select EEA countries, offering lower fees and faster transactions [Press release]

  • Ruya bank partners with Fuze to become the first Islamic bank globally to offer Shari’ah-compliant virtual asset investments [Bitcoin Magazine]

  • Meta explores stablecoin integration three years after Diem project collapse [Fortune]

    • Meta initiates talks with crypto infrastructure companies to potentially deploy stablecoins for cross-border payments to content creators

  • Spar now accepts Bitcoin payments at its Zug supermarket via LNURL, implemented by DFX Swiss through OpenCryptoPay solution that enables QR code transactions [Bitcoin News]

  • Citrea deploys Clementine Bridge on Bitcoin testnet using BitVM2 programming language to overcome the “bottleneck for using BTC in a programmable environment.” [CoinDesk]

  • Apple changes U.S. App Store guidelines to allow apps to link users to their websites for purchases after losing court battle against Epic Games [TechCrunch]

    • The ruling requires Apple to stop using “scare screens” and remove restrictive language guidelines, though the company states they will appeal the decision.s

Funding

  • Tether renews $100,000 grant to the BTCPay Server Foundation for the second consecutive year [Announcement]

  • Spiral renews grant to Dan Gould (@bitgould) for his work on the Payjoin Dev Kit, and to @joschisanbtc, for “simplifying federations, allowing anyone to run Fedimint guardians on laptops, Start9s, whatever”.

  • Btrust awards grant to Africa Free Routing to support five Bitcoin Lightning-focused developer bootcamps across Africa in 2025 [Press Release]

    • The bootcamps aim to onboard non-Bitcoin developers into the ecosystem, providing training, mentorship, and pathways to open-source contribution.

    • The initiative seeks to build local developer communities, increase participation in global Bitcoin projects, and expand technical capacity across the continent.

    • Participants will be funneled into long-term mentorship networks like Btrust Builders for continued growth.

Privacy

  • France bans mixers and privacy coins [Twitter post]

    • A new law adopted in France now considers mixers and privacy coins as an indicator of suspicious activity by default [Adopted Law proposal]

  • Jury orders NSO Group to pay WhatsApp $167 million in punitive damages for hacking 1,400 users in 2019 [TechCrunch]

    • Judge previously ruled NSO Group violated federal and California hacking laws, with researcher John Scott-Railton stating: “NSO makes many millions of dollars helping dictators hack people.”

Bitcoin Security Incidents

  • Elderly US citizen falls victim to 3,520 bitcoin social engineering theft [Coin Telegraph]

    • An elderly US investor loses $330 million worth of Bitcoin in a sophisticated social engineering attack, ranking as the fifth-largest crypto hack in history, as reported by ZachXBT

    • The attacker then laundered the 3,520 stolen bitcoin through over six exchanges using peel chain methods and swapped significant portions into Monero, which spiked its price by 45% and lead to estimated slippage losses reaching $66 million.

  • Five dollar wrench attacks: (Credit goes to Jameson Lopp’s physical bitcoin attacks repository)

    • Philippine National Police arrest three suspects for the kidnapping and murder of businessman and his driver [Global Nation]

      • The victims were lured to a house on March 29, 2025 and held captive for 10 days. The group demanded a $20m ransom, then killed their victim despite receiving a sum totalling $3m paid in cryptocurrency.

    • Pakistani Counter-Terrorism Department arrests four individuals in Karachi for conducting short-term kidnappings while impersonating various law enforcement offices [Ary News]

      • The suspects used fake government number plates on their car, abducted citizens to a remote area, and extracted ransoms including bitcoin secrets and cash from ATMs before releasing victims. The event took place on April 13, 2025.

    • Father of crypto firm boss rescued in French police raid [Le Monde]

      • French police free a kidnapped man during a weekend raid in Paris, arresting five suspects in their 20s. The victim’s finger was mutilated, with kidnappers demanding a €5-7 million ransom from his cryptocurrency-wealthy son. The event took place on May 1, 2025.

    • Three Florida teenagers kidnap Las Vegas business man at gunpoint, drive him to remote Arizona desert, and steal $4 million in cryptocurrency and other digital assets [8News Now]

      • The victim, who was the organizer of a cryptocurrency-related event in downtown Las Vegas, was forced to reveal the passwords of his financial accounts. The event took place in November 2024.

    • Montreal police arrest three men for kidnapping and stealing $15,000 in cryptocurrency from a Verdun businessman [CTV News]

      • The suspects allegedly tied up the victim, a man in his 30s who ran his own cryptocurrency business and tortured him for hours before obtaining transfer details and fleeing the scene. The event took place on August 15, 2024

Protocol

  • Bitcoin Core #31250: wallet: Disable creating and loading legacy wallets [Merged]

  • Bitcoin Core #31247: psbt: MuSig2 Fields [Merged] (Implements un/serialization of MuSig2 PSBT fields and prepares PSBT to be able to sign for MuSig2 inputs.)

  • BIPs #1835: BIP48: Add p2tr script type derivation [Merged]

  • BIPs #1555: BIP 321: URI Scheme (Replace BIP 21 with a new BIP containing information about more modern usage of it) [Merged]

  • BTCPay Server #6684: Add support for wallet policy descriptors (BIP388) [Merged]

  • Eclair #3064: Simplify channel keys management [Merged]

  • NIPs #1890: Adds optional nip60.signSecret() and kind 10019 filter tag [Open] (The PR clarifies and improves Nostr <-> Cashu interoperability)

Government & Political

  • Spain’s new banking regulations clarified: no pre-approval needed for cash withdrawals [Cryptoslate]

    • Spain’s Royal Decree 253/2025 requires financial institutions, not individuals, to report cash transactions over €3,000 monthly to tax authorities.

    • Financial institutions must now report all cash movements over €3,000 to tax authorities in monthly reports, offering the tax agency “granular, near‑real‑time data on every sizable cash movement and virtually every card transaction.”

  • European Union plans to ban anonymous crypto accounts and privacy-preserving coins by 2027 under new AML regulation [Coin Telegraph]

    • Credit institutions, financial institutions, and crypto asset service providers will be prohibited from maintaining any anonymous accounts or handling privacy-enhancing cryptocurrencies.

    • Customer due diligence will be mandatory for transactions above €1,000 as part of the EU’s expanded regulatory framework building on the Markets in Crypto-Assets Regulation.

  • German prosecutors confiscate Bitcoin, Ether, Litecoin, and Dash worth $38.2 million from privacy-focused crypto platform eXch, which operated without AML protocols [The Block] [Presse Portal]

    • Authorities claim approximately 1.9bn in crypto moved through eXch since 2014, with some funds originating from criminal sources, including part of 1.4 billion stolen from Bybit.

    • eXch operators, who announced shutdown on May 1, argue privacy is not a crime and that their “privacy-centered goals were being misinterpreted” by authorities. (See BR095 for added context on their planned shutdown after announcing a 50 BTC open-source fund to support privacy-enhancing projects: “eXch is shutting down operations and changing owners on May 1st, 2025 after learning they are the target of a transatlantic operation aiming to prosecute them for money laundering and terrorism.”)

  • France now allows crypto-backed Lombard credit [BFMTV]

    • France legalizes using cryptocurrencies as collateral for euro loans starting April 30, 2025, enabling investors to access liquidity without selling their digital assets.

  • U.S.: Florida lobbyist Brian Ballard faces Trump’s ire regarding the Truth Social post promoting a “Crypto Strategic Reserve” [Politico]

    • The Truth Social incident involved a Ballard employee at Mar-a-Lago persuading Trump to promote cryptocurrency, providing him with text to post, which promoted Ripple Labs, a Ballard client.

  • U.S.: Arizona Governor Katie Hobbs signs House Bill 2749 allowing the state to claim ownership of digital assets abandoned for three years and create a Bitcoin Reserve Fund [Coin Telegraph]

    • The new law follows Hobbs’ veto of a similar bill citing concerns over “untested assets,” while another pending bill would allow investment of up to 10% of state funds into Bitcoin [Coin Telegraph]

  • U.S.: Missouri House Bill 594 passes state House vote, proposing 100% income tax deduction for capital gains as the state tax code doesn’t distinguish between capital gains and income tax [Coin Telegraph]

  • Bhutan introduces its nation-wide digital currency tourism payment system in partnership with Binance Pay and DK Bank [Blog post]

    • Over 100 local merchants accept crypto payments for services from flights and visas to street market goods, with instant settlement in local currency.

  • Nigerian Government signs Investment and Securities Act 2025, bringing regulatory clarity to digital assets in Nigeria, recognizes Bitcoin as Security [Forbes]

    • The new law classifies all virtual assets as securities under SEC oversight, with penalties of ₦20 million ($12,430) and up to 10 years imprisonment for Ponzi schemes.

Prosecution

  • FinCEN told prosecutors Samourai Wallet developers likely didn’t need MSB license [The Rage]

    • Recent court filing reveals FinCEN informed SDNY prosecutors that Samourai Wallet “would not qualify as a ‘Money Services Business’ requiring a FinCEN license” six months before developers were charged.

    • Defense attorneys claim prosecutors “suppressed this information for over a year,” only disclosing it on April 1, 2025, after a specific Brady request for exculpatory evidence.

    • Update: SDNY prosecutors refuse to grant hearing requested by Samourai Wallet developers after FinCEN opinions suggesting non-custodial wallets might not need MSB licenses were withheld for nearly a year [The Rage]

      • Prosecutors claim the withheld FinCEN statements were merely “informal, individual opinions” and “not Brady material,” while maintaining the case focuses on alleged money laundering conduct.

  • Related: New Jersey District Court dismisses charges against Christopher James Scalon, citing the DOJ’s April 7 “Ending Regulation by Prosecution” memo that discourages prosecution where “ambiguity exists.” [The Rage]

    • Scanlon is a businessman who founded and operated Aurae Lifestyle and Club Swann, providing financial services to high-net-worth clients through various entities that allegedly functioned as an unlicensed money transmitting business between 2015 and 2019, resulting in criminal charges that have now been dismissed.

    • Indiana court previously dropped charges against AurumXchange operator Maximiliano Pilipis, ruling he couldn’t be held accountable for regulations that were ambiguous or non-existent at the time.

  • Texas District Court rules against Treasury’s attempt to retain power to re-list Tornado Cash on sanctions list after its removal last month [The Rage]

    • Court rejects Treasury’s argument that final ruling was unnecessary, noting they “do not suggest they will not sanction Tornado Cash again.”

    • Fifth Circuit previously determined Treasury overstepped authority by sanctioning immutable smart contract software, stating Treasury would need Congress to amend the IEEPA.

  • The DeFi Education Fund launches a petition urging Trump administration to end prosecution of software developers [Announcement]

    • “The SDNY is attempting to hold software developers criminally liable for how others use their code,” contradicting previous FinCEN guidance that developers of self-custodial protocols are not money transmitters.

    • The petition argues this prosecution “sets a precedent that potentially chills all crypto development in the United States” and threatens technological innovation.

Events

  • Kaduna Lightning Developer Bootcamp: A 4-day hands-on Bitcoin Lightning Developer Bootcamp

    • Organized by Africa Free Routing, in partnership with Btrust, Tether, and African Bitcoiners.

    • 14-17 May, 2025 in Kaduna, Nigeria

  • Bitcoin for AI Conference: One-day virtual conference exploring how Bitcoin meets AI

    • June 21, 2025

Reads

  • Here’s a list of our top recently published reads:

    • Removing Bitcoin’s Guardrails, by BitMEX Research [Blog post]

    • Relay policy drama, by Antoine Poinsot [Blog post]

    • The MEVil of Relay Policy, by Matt Corallo [Spiral]

    • When Prosecutors Ignore the Regulators, by Peter Van Valkenburgh [Coin Center]

    • Taplocks, Policy-Signer Wallets & the Anchor Era, by Murray Rudd [Blog post]

    • Decentralized Media Hosting via Blossom, by Miljan [Note]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR095 - OP_NEXT Recap, COLDCARD, Bitcoin Core, Ephemeral Dust, Ephemeral Anchors, Pay-to-Anchor outputs, Taplocks, Electrum, Cove Wallet, Mempool.space, Liana, ESP32.Review + MORE ft. Rob & Rijndael]]>https://substack.bitcoin.review/p/bitcoin-review-podcast-br095-op_nexthttps://substack.bitcoin.review/p/bitcoin-review-podcast-br095-op_nextWed, 23 Apr 2025 18:29:30 GMTI’m joined by guests Rob Hamilton & Rijndael to go through the list.

Listen on your favorite podcast app

Housekeeping

  • 00:01:09 OP_Next recap

Bitcoin

Software Releases & Project Updates

  • 00:15:18 Coldcard

    • Shared Improvements - Both Mk4 v5.4.2 and Q v1.3.2Q

      • New Feature: Multisig transactions are finalized when sufficiently signed. Allows use of PushTX with multisig wallets

      • New Feature: Signing artifacts re-export to various media. Now you have the option of exporting the signing products (transaction/PSBT) to different media than the original source. Incoming PSBT over QR can be signed and saved to SD card if desired.

      • New Feature: Multisig export files are signed now

      • Enhancement: NFC export usability upgrade: NFC keeps exporting until CANCEL/X is pressed

      • Enhancement: Add Bitcoin Safe option to Export Wallet

      • Enhancement: 10% performance improvement in USB upload speed for large files

      • (Q only) Enhancement: Always choose the biggest possible display size for QR

    • Two New Heavyweight Features

      • CCC: COLDCARD can now Co-sign like collaborative multisig HSMs, no centralized servers needed

      • KeyTeleport: Send secrets on a video call to other COLDCARD! Securely move seeds, secure notes/passwords, multisig PSBTs, even full backups (full clone), between two Q using QR or NFC

  • 00:42:53 Bitcoin Core v29.0

    • Notable changes

      • P2P and Network Changes

        • Support for UPnP was dropped

        • libnatpmp was replaced with a built-in implementation of PCP and NAT-PMP

        • When the -port configuration option is used, the default onion listening port will now be derived to be that port + 1 instead of being set to a fixed value

        • Upon receiving an orphan transaction, the node will attempt to download missing parents from all peers who announced the orphan

      • Mempool Policy and Mining Changes

        • Ephemeral dust is a new concept that allows a single dust output in a transaction, provided the transaction is zero fee

      • Updated RPCs

        • The RPC testmempoolaccept response now includes a reject-details field in some cases, similar to the complete error messages returned by sendrawtransaction

        • Duplicate blocks submitted with submitblock will now persist their block data even if it was previously pruned

        • getmininginfo now returns nBits and the current target in the target field. It also returns a next object which specifies the height, nBits, difficulty, and target for the next block

        • getblock and getblockheader now return the current target in the target field

        • getblockchaininfo and getchainstates now return nBits and the current target in the target field

        • the getblocktemplate RPC curtime (BIP22) and mintime (BIP23) fields now account for the timewarp fix proposed in BIP94 on all networks

      • New RPCs

        • getdescriptoractivity can be used to find all spend/receive activity relevant to a given set of descriptors within a set of specified blocks

      • Updated Settings

        • The maximum allowed value for the -dbcache configuration option has been dropped due to recent UTXO set growth

        • Starting with v28.0, the -mempoolfullrbf startup option was set to default to 1. With widespread adoption of this policy, users no longer benefit from disabling it, so the option has been removed, making full replace-by-fee the standard behavior

        • Setting -upnp will now log a warning and be interpreted as -natpmp. Consider using -natpmp directly instead

        • As a safety check, Bitcoin core will fail to start when -blockreservedweight init parameter value is lower than 2000 weight units. Bitcoin Core will also fail to start if the -blockmaxweight or -blockreservedweight init parameter exceeds consensus limit of 4,000,000 WU

      • Build System

        • The build system has been migrated from Autotools to CMake

  • 00:47:21 BDK v1.2.0

    • TxBuilder add_recipient function now accepts anything that implements Into<ScriptBuf>

    • The wallet considers a coinbase output eligible for selection if it will mature in the next block

    • Wallets persisted with a rusqlite::Connection are checked to be thread-safe

    • The bdk_chain dependency is updated to version 0.21.1, plus a number of internal cleanups

  • 00:48:12 Coinswap v0.1.1

    • Core Protocol & Performance Improvements

      • UTXO Management: A major source of latency due to frequent Core RPC calls have been removed by having custom in-memory UTXO indexes. These maps are also persisted in the disk, reducing wallet sync time.

      • Coin Selection: State of art coin-selection algorithms, similar to Bitcoin Core, is integrated, making various kind of tx creation more efficient.

      • Fidelity Management: Fidelity bond management tasks, like bond expiry checks, redemtion, recreation, is now automated in the maker servers. Reducing user responsibilities of managing Fidelity Bonds.

      • Taker Liveness: A new message WaitingFundingConfirmation have been introduced to mainatin swap connections between Takers and Makers to handle variable block confirmation delay

    • User Experience & Compatibility

      • Compatibility: The crate and the apps are now fully compatible with Mac

      • Tor: Tor operation is streamlined providing faster and more resilient tor connections. Tor addresses are now deterministically linked with the wallet seed, ensuring constant onion address across system reboots

      • UI/UX: Improved display of various user facing structures like, balances, utxos, offer data, fidelity bonds and overall improvements in system logs. Making the apps more fun to play with

      • API Design: Streamlined various transaction creation routines to use a single common API. Reducing technical debts and removing redundant code

      • Protocol Spec Documentation: Details how CoinSwap breaks the transaction graph and improves privacy through routed swaps and amount splitting. Includes diagrams for clarity

  • 00:48:56 Electrum Wallet

    • NIP47 plugin

      • Implements Nostr Wallet Connect (NIP47) plugin, which supports remote control of Electrum lightning wallet through Nostr protocol as a plugin with CLI and QT gui compatibility.

      • Users can set a 24-hour budget and connection expiry date when connecting Electrum as a funding source for clients like Amethyst, Alby, Bitbanana, and lnbits.

    • Userspace plugins

      • The next release of Electrum Wallet will make it possible to install plugins developed and distributed by third-parties.

  • 00:52:45 BTCPay Server v2.1.0

    • Add better MultiSig flow when all users are using BTCPay Server

    • Remove ZCash and Monero from core code

    • Disable cold wallet creation by default

    • Add support for RBF and improve UX for CPFP

    • Greenfield: Add refundBOLT11Expiration to Get/Update store endpoint

    • Greenfield: Add invitationLink and disabled properties to user APIs

  • 00:53:33 Nunchuk Android

    • v1.9.67

      • Option to disable key path spending in Taproot/MuSig2 multisig wallets

      • Fee estimates for key path spend versus script path spend

      • Option to export transaction history to CSV file

      • Option to create a Software key now and back up later

      • Fee settings

    • v1.9.66

      • New and improved encrypted group wallet

  • 00:54:04 Liana v10.0

    • This version does not introduce any breaking changes in the database schema

    • Two new features are implemented: Backup and Third party keys fetching during the install

    • Liana GUI

      • During the install process, the xpub of a key provider can be fetch from a Wizardsardine service by entering a token

      • This Xpub can be used as a “Safety Net”, a paid product where a third party keeps a recovery key for you in case you lose your access to your funds

      • We changed the default value of the “standard” recovery paths to ~1y, so the safety net can be quickly set with the maximum timelock without conflicting with an other recovery path

      • Due to rust-miniscript compiler changes, for the same keys setup the output descriptor may differ from one generated by a v9 Liana. Both descriptors are supported by Liana v9 and v10 versions

      • A new backup system for wallet configurations, including descriptors, has been introduced

      • Users can now back up their wallet configurations by downloading a file during the wallet creation process

      • They can also update their backup (for changes in labels, aliases, etc.) by downloading it from the Wallet settings

      • This backup file can be used to restore the wallet or keep it synchronized across different devices

      • This backup does not include hot keys (computer generated mnemonics)

      • A new “Export/Import” section will be available in the settings, consolidating all export and import options

      • This section will include the backup and restore wallet functions, as well as new features like “Export Labels” and “Export Descriptor.”

      • The export of labels adheres to the BIP329 standard, both in the wallet backup and the “Export Labels” function

      • Replace by fee action can now be executed on transactions without any related PSBT in the database

  • 00:54:51 The Mempool Open Source Project v3.2.0

    • Highlights:

      • Support for v3 transactions

      • Support for anchor outputs

      • New UTXO bubble chart on the address page

      • DATUM miner tags

      • Tags to identify runestone messages and inscriptions

      • Package broadcast

      • Stratum job data visualizations

      • Taproot multisig labels

      • Transaction & PSBT preview feature

      • Address poisoning detection

      • And more

  • Cove v0.3.0

    • Upgrade BIP329

    • Check for the next 30 addresses for txns even if not revealed

    • TAPSIGNER setup initial pin

    • TAPSIGNER import already initialized card

    • TAPSIGNER change PIN

    • TAPSIGNER create download backup

    • Readable card ident

    • Sign PSBT using TAPSIGNER

    • Watch for changes on unconfirmed txns

  • 00:57:01 BoltzExchange boltz-web-app v1.7.3

    • Include rescue key in backup

    • Add Portuguese translations

    • Improve UX for copying address/invoice on click

  • 00:57:16 RoboSats v0.7.6

    • For Users

      • Dispute statement now requires a contact method to be submitted

      • Coordinator rating over nostr (BETA)

      • Token input now clears up blank spaces

      • Add some messages to the trade workflow to answer the most common questions

    • For Coordinators

      • Add cancel_status param to the cancel order action

  • 00:57:21 Bitcoin Safe

    • v1.2.3

      • Expand QR SignMessage Compatibility: SignMessage now supports all QR-UR-compatible hardware signers, including SpecterDIY, KeyStone, Passport, and Jade (additional to previous supported Coldcard Q)

      • Wallet Import via QR: Add the ability to import wallet-export-files via QR code, ensuring compatibility with Keystone’s latest firmware

    • v1.2.2

      • Add Address poisoning detection and warning

      • Nostr sync&chat alias now also appears in share menu of the TX/PSBT

  • 00:57:58 Blockstream Green

    • Android v4.1.8

      • Add Language preference in App Settings

      • Enable Android data backup for disaster recovery

      • Allow setting custom Electrum gap limit with default server

    • iOS v4.1.8

      • Rename L-BTC to LBTC

      • Improve notifications translations

      • Persist wallet list across app reinstallation

      • Reduce login time

      • Improve background lightning payments

  • 00:58:08 Rust Payjoin v0.23.0

    • This release features a first-class persistence abstraction, wire protocol changes for RFC 9540 support, and better compliance with the BIP78 specification. It also pays back a whole bunch of tech debt including enhanced error handling, expanded functionality with new modules and additive features, and improved test infrastructure. There are breaking API and protocol changes as a result.

    • Changelog

      • Make features additive

      • Make receiver errors replyable to the sender

      • Introduce “directory” feature module

      • Accomodate updated BIP78 spec

      • Introduce experimental multiparty sender behind the “_multiparty” feature flag

      • Add support for RFC 9540

      • Add first-class persistence abstraction

      • Add many more tests, significantly improving test coverage

  • 01:01:15 Zaprite v2025.04.14

    • Added

      • Client Updates: Add new messaging in the browser to alert users when a new version of Zaprite is available

      • API: Add a new disablePaymentNotifs option to our API Order creation fields

    • Changed

      • New Organizations: Add the Organization Name field to the New Organization form to make it easier to identify Organizations after being created

  • 01:01:41 ESP Miner v2.6.1

    • New Features

      • Wi-Fi

        • SSID WiFi lookup

        • Expose Wifi RSSI to API endpoint

        • Init AxeOS AP mode

      • User Interface (UI)/Display

        • feat: add tooltip for pwm invert and flip screen by @WantClue (#709)

        • Add sorting switch to swarm page for hostname and ip

        • Show share reject reasons

        • Add asic failure status screen

      • Mining/Pool/Stratum

        • Keep old pool config synchronized until reboot

        • Add support for extranonce2_len<4

        • Improve pool fallback code

        • Update confusing connect to pool log message

        • Refactor Stratum code for Seamless Failover

      • Hardware/Power/Overclocking

        • Use url params to unlock overclock

        • Overclock url params

        • GammaTurbo support and HW abstraction

        • Create TPS546 VCORE alerts

        • Get combined current (power) for multi-phase TPS546

      • And more: API/Backend, Development/Build/Testing, Configuration/System, Documentation/Miscellaneous, and Fan Control.

  • 01:01:48 Krux Update

    • Krux achieves first air-gapped PGP signature using secp256r1 NIST P256 curve, which requires a coordinator for metadata support.

    • The developer chose secp256r1 for “size and efficiency for running on microcontrollers” after abandoning RSA due to processing-intensive steps.

  • 01:02:29 Iris Wallet Desktop v0.2.0

    • RLN Node Compatibility: The app now checks if the RLN node version is compatible at startup

    • Backup and Restore Improvements: Backup and restore now use a temporary folder, which gets deleted automatically after the process finishes

    • Error Reporting: Add an error dialog to report issues when unlocking the node

    • Data Directory Separation: Separate data storage paths for the application and the RLN node

    • Logs Cleanup: Remove unnecessary QProcess logs of the RLN node to reduce logs

    • GitHub Actions Update: Update GitHub Actions workflow to build the RLN node using a specific commit ID

  • 01:02:46 Bitcoin Core Config Generator Update

    • Now compatible with Bitcoin Core v29.0

  • 01:02:52 UTXOracle is Now live

Project spotlight

  • 01:04:14 SwiftSync: Smarter synchronization with hints [Discussion]

    • SwiftSync provides near-stateless, fully parallelizable validation of the Bitcoin blockchain using hints about unspent outputs (<100MB total), verifying validity through a hash aggregate that equals zero when successful.

    • Unlike traditional Bitcoin Core validation, SwiftSync eliminates database lookups, reduces memory usage, and enables parallel processing.

  • 01:04:43 PrivatePond: A Bitcoin Payjoin application to optimize transaction rails for services, such as deposits, withdrawals, and automated wallet rebalancing [Github]

    • Private Pond optimizes Bitcoin transactions by queuing withdrawals and processing them at fixed intervals, enabling batching while user deposits can fund withdrawals through Meta Payjoin, reducing hot wallet liquidity requirements.

  • 01:05:00 JoinMarket Fidelity Bond Simulator: A tool for JoinMarket makers to evaluate their competitive position in the market based on fidelity bonds [Github]

    • Features include simulating maker selection probability using real orderbook data, calculating bond values based on amount and lock time, and comparing different bond strategies.

  • 01:05:52 DahLIAS: Discrete Logarithm-Based Interactive Aggregate Signatures [Research paper]

    • DahLIAS allows multiple signers to produce a single constant-size signature that verifies all messages simultaneously.

    • The scheme features a two-round signing protocol with possible preprocessing and verification that is asymptotically twice as fast as batch verification of individual Schnorr signatures.

    • DahLIAS supports key tweaking for Bitcoin applications and is proven secure under the algebraic one-more discrete logarithm assumption in the random oracle model.

  • 01:06:00 Satoshi Escrow (scrow): A Bitcoin non-custodial peer-to-peer dispute resolution using only Nostr keys [Github]

    • Satoshi Escrow offers Bitcoin transactions through 2-of-2 multisig addresses where buyers and sellers lock BTC using only their Nostr keys (nsec/npub)

    • The system utilizes Pay-to-Taproot multisig technology and can be used offline on air-gapped computers

  • 01:06:12 Taplocks: Verifiable but Unspendable Tapleafs via Hashlock Mechanism

    • A recent proposal introduces Taplocks, a method to enforce unspendability of Taproot script paths containing OP_SUCCESS before opcode activation. The technique prevents premature spending while allowing smooth migration to new opcodes (e.g., CAT, CTV, or OP_WASM).

    • Key Mechanism:

      • Problem: Post-Taproot, OP_SUCCESS makes any script containing it immediately spendable, even before intended opcode activation.

      • Solution: A hashlock-like construct is applied over the script (not within it) using SHA-256 length extension.

    • The oracle pre-images a secret, which must be revealed to construct a valid spending script.

    • A ZKP (e.g., STARK) proves the script header contains only a data push and padding, ensuring no hidden malicious logic.

    • Benefits:

      • Eliminates manual UTXO migration post-activation.

      • Maintains security under the same trust assumptions as signing oracles.

    • Rijndael Explainer

    • Full technical details available on Github.

  • Censorship Resistance Threshold: A calculator estimating how many guerrilla miners are required to secure Bitcoin against censorship

    • The tool factors in existing guerrilla hashrate and calculates additional miners needed to reach the critical 51% threshold for censorship resistance.

  • 01:15:48 bitcoin.softforks.org: Easily compare various features, facts, and figures for the many soft fork proposals under consideration [Github]

    • The website serves as a research database educating the Bitcoin community about active soft fork proposals and helping evaluate them comparatively.

  • 01:15:52 CTV and CSFS Enabled Bitcoin Node: Mutiny Signet Docker Setup [Github]

    • “A Docker-based Bitcoin node configured with CheckTemplateVerify (CTV) and CheckSigFromStack (CSFS) capabilities enabled.”

    • “This node runs on a special signet (MutinyNet) that allows developers to test and build applications using these proposed Bitcoin protocol upgrades.”

  • 01:16:03 UTXOscope: A text-only BTC price heatmap built only from UTXOs, inspired by UTXOracle [Github]

    • UTXOscope analyzes newly created UTXOs to visualize Bitcoin price trends without relying on external exchanges or price feeds.

  • 01:16:13 Block Bitcoin Treasury: A visualization of Block’s Bitcoin treasury holdings [Github]

    • Block launches a bitcoin corporate holdings dashboard with BTC-to-USD real-time price quote API on GitHub, enabling companies to track bitcoin treasury assets.

  • 01:16:47 Waye: A website to discover tools, programs, and support systems designed to help open-source developers thrive. Waye empowers builders to stay clear-headed, motivated, and aligned for long-term impact [Github]

    • The OS Waye Foundation operates as a 501(c)(3) nonprofit providing tools, research, and frameworks to support open-source developers in the decentralized ecosystem.

  • 01:17:08 Sovereign Craft: A bitcoin-based Minecraft server offering an educational gaming experience

    • Sovereign Craft is a Minecraft server integrating Bitcoin as in-game currency that functions in the real world through custom wallets powered by LNBits

(Not) a Vulnerability Disclosure

  • 01:17:17 Pay-to-Anchor outputs now exploited for blockchain spam [Twitter post]

    • Pay-to-Anchor outputs in Bitcoin’s Lightning Network, designed to allow fee adjustments for channel closures, are being used to spam the blockchain with low-value transactions.

Vulnerability Disclosures

  • 01:18:10 CVE-2025-27840: New ESP32 vulnerability threatens Bitcoin security? [Daily CyberSecurity]

    • Researchers at Crypto Deep Tech discover a cryptographic vulnerability in ESP32 microcontrollers that could put of IoT devices and Bitcoin-related hardware at risk.

    • Six major flaws are identified, including invalid private key acceptance, weak random number generation, and signature forgery capabilities, with researchers demonstrating a successful attack recovering a private key from a wallet.

  • 01:20:49 Breaking ECDSA with two affinely related nonces [Research paper]

    • Researchers demonstrate a new vulnerability in ECDSA where private keys can be compromised when two nonces have an affine relationship, even if they are distinct and used for the same message.

    • The attack method requires only two signatures and uses algebraic techniques without needing lattice reduction or brute-force searches when the relationship between nonces is known.

    • Additional resource: Why Schnorr signatures should be preferred over ECDSA [Schnorr vs. ECDSA]

  • 01:21:02 Chinese SHOWJI phones contain pre-installed malware targeting cryptocurrency users [The Hacker News]

    • Cheap Chinese Android phones, particularly SHOWJI brand models, ship with pre-installed trojanized apps disguised as WhatsApp and Telegram that swap cryptocurrency wallet addresses during conversations.

    • The malware campaign has stolen approximately $1.6 million in cryptocurrency over two years, with attackers using about 30 domains and 60 command-and-control servers to manage the operation.

  • 01:21:44 X users discover hidden data access beyond official API [Security Express]

    • Users access hidden X data through browser developer tools by filtering network requests for “UserByScreenName” responses, revealing comprehensive datasets for public accounts.

    • The technique exposes sensitive metadata including NSFW flags, regional restrictions, and “protected” account status, plus access to direct messages including from blocked or deleted users.

Audience Questions

  • Thanks to everyone who sent in questions. Remember to send yours to questions@bitcoin.review.

    • 01:23:46 “How do we use open time stamps for transfer of assets using two party integrity between holders?” -@AVERAGE_GARY

    • 01:24:50 “Does Cove have testnet4?” -@AVERAGE_GARY

    • 01:25:15 “Can you explain like I’m 5 what opcodes are, how they are used on the network, and the level of optionality that applies to them?” -@anon

    • 01:26:49 “Please discuss this idea: Block-based TOTP for bitcoin wallet passphrase validation [Note]” -@anon

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 01:28:48 Tor Browser v14.5

    • Connection Assist now on Android

    • Add Belarusian, Bulgarian & Portuguese

    • Improve log readability

    • Better performance when quitting the app

  • 01:28:51 TailsOS

    • v6.14.2

      • Update Linux to 6.1.133, which fixes multiple security vulnerabilities that may lead to a privilege escalation or information leaks.

      • Update perl to 5.36.0-7+deb12u2, which fixes a heap-based buffer overflow vulnerability, which may result in denial of service, or potentially the execution of arbitrary code.

    • v6.14.1

      • Improve confinement technology used to protect files from possible security vulnerabilities in Tor Browser.

        • With Tails 6.14.1, you can safely access any folder in your Home folder or Persistent Storage from Tor Browser.

  • 01:28:53 NymVPN v2025.6 - Rhubarb release

    • Connection

      • Connection times have been reduced by registering Wireguard keys entry and exit gateways in parallel to improve NymVPN connection times

      • An always-on kill switch toggle has been added to settings so you can be sure unprotected traffic is blocked

      • NymVPN for Linux, macOS and Windows will launch without network connectivity to improve connection time by using available networks and caching the network environment between app run times

    • Improve in-app assistance

    • Improvements to existing features

      • Linux and Windows: Auto-start for NymVPN and nym-vpnd at device startup

      • Mixnet mode enhancements: New changes to ensure privacy and improve performance in Anonymous Mode (e.g., with fixes to Poisson delays, backpressure, SURBs)

  • 01:28:55 MapleAI [Update]

    • Maple AI chat product is now available as native apps for macOS and Linux users, offering end-to-end encryption, secure enclaves, and cross-device syncing.

Project spotlight

  • 01:28:59 Git With Me: Peer-to-peer, encrypted, ephemeral Git collaboration (git daemon with encryption) [Code repository]

    • Git withme provides a way for a single host to invite numerous peers with short, one-time secure codes. The peers connect directly via Dilated Magic Wormhole channels, allowing collaborators to git clone git://localhost/.

Lightning + L2+

Project spotlight

  • 01:29:17 Misty Breez: A hybrid Lightning and Liquid network wallet built with the Nodeless Breez SDK [Github]

    • The wallet supports multiple payment options including BOLT 11/12 invoices, LNURL-Pay, Lightning Addresses, BTC addresses, and offline payments via mobile notifications.

  • 01:29:25 Sovereign Tools: A comprehensive Bitcoin and Lightning Network wallet comparison tool built with React, Express, and TypeScript [Github]

    • The platform currently evaluates 18 Lightning Network wallets across 43 features including platform availability, invoice compatibility, payment routing, and privacy features.

  • 01:29:28 Silk Road on Lightning: A marketplace for legal items and services using Bitcoin on the Lightning Network

    • The platform requires no KYC for registration, withdrawals, or purchases.

    • Sellers receive all payments in Bitcoin through the Lightning Network, even when buyers pay in USD. The platform automatically converts USD payments to Bitcoin.

  • 01:29:37 Cashu Token Decoder: A web tool for parsing and editing Cashu tokens

Software Releases & Project Updates

  • CLN v25.02.1 - Onion Packet Filler Accreditation II

    • Several bug-fixes were addressed in this release, including:

      • wallet: we could miss our own returned outputs on mutual closes if our peer didn’t support option_shutdown_anysegwit

      • lightningd now properly handles duplicate HTLCs on closing and no longer spams the log

      • Unilateral closes now calculate fees with the correct HTLC timeout and no longer pay egregious fees

      • topology crash on invoice creation if a peer had a really high feerate

      • make cleans up the old clnrest directory prior to building and installing the new rust version of the plugin

  • LNbits v1.0.0 - Alan Bits

    • Key Highlights

      • LNbits now at v1.0.0: the software is stable, hardened, and production-ready

      • Vue 3 migration: a complete frontend overhaul for performance and long-term maintainability

      • WebSocket payments: faster and more efficient, replacing older SSE and long-polling methods

      • New lnbits.sh install script: simplifies setup and local deployment

      • Access Control Lists (ACL): token-based permissions for powerful role and scope control

      • Admin tools:

        • Admin payments overview

        • Toggle outgoing payments

        • View payments from deleted wallets

      • NWC (Nostr Wallet Connect) support

      • Login with Nostr or OAuth: expanding integration and authentication options

  • 01:29:48 Zeus

    • v0.10.1

      • NameDesc/bLIP-11 support: add receiver name to invoices

      • Locales: Hindi

      • UI: Add dynamic background/text colors to Android NFC modal

    • v0.11.0 - Rolling out to community sponsors and contributors

      • PR #2946 introduces support for Cashu

        • Add support for an optional Cashu ecash wallet for Embedded LND users

        • Add support for all backends to sweep Cashu tokens to self-custody

        • New Cashu Lightning addresses added alongside our existing Zaplocker address (switch between as you wish)

        • New ZEUS Pay+ service for premium features, incl. custom handles, web POS, early access, LSP discounts

        • Modal messages to prompt users to upgrade to self-custody

  • 01:29:49 LDK v0.1.2 - “Foolishly Edgy Cases”

    • API Updates

      • lightning-invoice is now re-exported as lightning::bolt11_invoice

    • Performance Improvements

      • rapid-gossip-sync graph parsing is substantially faster, resolving a regression in 0.1

      • NetworkGraph loading is now substantially faster and does fewer allocations, resulting in a 20% further improvement in rapid-gossip-sync loading when initializing from scratch

      • ChannelMonitors for closed channels are no longer always re-persisted immediately after startup, reducing on-startup I/O burden

  • LNDg v1.10.0

    • Improve performance with LND using an updated forwards query

    • AutoFees now uses aggregated pubkey metrics for those that have multiple channels with the same peer

    • New metrics page: Unprofitable/Stuck Channels

    • Automates inbound fee updates when using AutoFees (enable with AF-InboundFees)

    • Batch Open Warnings

    • P&L Chart updated with on-chain costs

    • Advanced settings added for those who would like their channel db size to be read remotely (default remains local)

  • Alby

    • Js-SDK v5.0.0

      • In this release, we introduce a new LN class which makes it even easier to get quickly started sending and receiving bitcoin payments. We also add a NWCWalletService class which allows wallet developers to add NWC support without having to implement the low-level NWC code of creating and signing events, relay connection, etc.

      • Features

        • feat: add NWC Wallet Service

        • feat: add simpler LNClient class

    • Hub v1.16.0 - Rop Gonggrijp

      • Features

        • Alby pro subscriptions

        • Add bitrefill to app store

        • New sidebar

        • App store submission: ZEUS

        • Add lightning messageboard to app store

        • Improve settings pages UI

        • Add healthcheck alert

        • Add update button to what’s new widget

        • Show channel duration on open channel pages

        • Add funding txid and amount to LDK channel closed event

        • Show date on lightning messageboard messages

    • Go v1.12.0

      • Wallet switcher to swap wallets during payments, withdrawals, and connections

      • Enhance number formatting for locales that use decimal commas

  • Ark v0.5.4 - New SubscribeForAddress API, Fixes and Optmiziations

    • SubmitRedeemTx: remove useless extra PSBT decode

    • Add SubscribeForAddress explorer API

    • hotfix: TapscriptsVtxoScript.Decode returns an error in case array is empty

    • hotfix: GetTaprootTree use bytes.Contains instead of bytes.Equal

    • hotfix: CLTV locktime decoding

    • [Server] Move db write ops to background

  • Ark Labs HQ wallet-sdk

    • v0.0.12

      • DefaultVtxo.Script add default exit timelock

    • v0.0.11

      • VtxoScript abstraction

      • Mark as side-effect-free to allow Tree Shaking

      • Add ArkNote class

      • Reveal tapscripts in virtual transactions

      • SubscribeForAddress RPC + service worker database

      • feat: optimize ESM and CommonJS dual package support

      • ServiceWorker: support concurrent calls

  • Fedimint

    • v0.7.0 - Going Full-Stack

      • Highlights

        • Initial recurring payment support through LNURL (to be extended to BOLT12)

        • Integrated guardian and setup UI to simplify deployment

        • Beta support for running fedimintd behind firewalls and NAT routers without opening ports and registering domains

        • Lower on-chain fees through better estimation

    • v0.6.2

      • Allow overwriting blockchain API supplied to clients

      • Add parse_invite_code function in fedimint-client-wasm

      • Expose additional backup metrics via prometheus

  • Breez SDK v0.8.0 - Nodeless

    • Add WASM support (Node.js and Web)

    • Lower the minimum payment amount for sending

    • Enable fee payments in USDT

  • BlitzWallet v0.4.3-beta

    • Ecash Improvements

      • Increased eCash Limits: Users can now customize their maximum receive and balance amounts for eCash transactions. Previously, eCash payments were restricted below the minimum Boltz swap amount of 1,000 sats. Now, users can define:

      • Expanded Manual Swap Options: The manual swap page now supports:

        • Liquid to eCash transfers

        • eCash to Lightning transfers

        • eCash to Liquid transfers

      • Store Payments with eCash: Users can now pay for items in supported stores using eCash.

      • Wallet Balance Visibility: The remove wallet function now displays the entire eCash balance when enabled.

    • Payment Experience

      • SMS Payment Update Messages: Users receive SMS updates on payment progress, improving transparency of background progress.

      • Direct Tip Payments: Employees who use an LNURL or Blitz contact name can now be sent tips directly from the app.

      • Improved App Access with LN Issues: If the Lightning Network (LN) connection fails and LN is enabled, users can still access the app instead of being locked out.

    • Performance Optimizations

      • Optimized Transaction Sorting: Transaction processing has been improved for better app performance.

      • Bulk Requests for Contact Address Updates: Instead of making multiple single requests, the app now processes contact address changes in bulk, reducing network usage by 10x.

  • CDK v0.9.0

    • Features

      • Added

        • Amountless invoices NUT PR

        • create_time, paid_time to mint and melt quotes PR

        • cdk-mint-rpc: Added get mint and melt quotes ttl PR

      • Changed

        • cashu: Move wallet mod to cdk-common

        • Export Mint DB Traits PR

        • Move Mint and Melt quote to cdk commit from cashu PR

  • 01:31:40 Minibits Wallet v0.2.2-beta.5

    • This is a new native Minibits release with huge amount of changes needed to adjust the project to the planned release on iOS devices. However, it still comes with useful features and fixes for Android as well, notably:

      • New feature to lock ecash to a receiver’s pubkey

      • Faster confirmations of ecash minting and payments thanks to websockets

      • Major upgrade of all libraries, switch to React native’s new architecture

      • Planned iOS release-related platform checks and changes for android

  • 01:31:42 Hydrus v0.2.0

    • Channels routing policies adjustments= Channels routing policies are adjusted based on the channel state (capacity, local balance) and the amount of satoshis forwarded in the last activity period (agent.intervals.routing_policies).

    • CLI commands: Agent instructions and scores queries now have their own command to execute them separately. To run all agent tasks (open/close/updates) use the agent run command.

    • Built-in tasks scheduling: Choose how often to open/close channels or update routing policies without having to use systemd timers or cron jobs.

    • New open heuristic: This release introduces a new open channel heuristic called channels.block_height.

Nostr

Project spotlight

  • 01:31:44 Atomic Signature Swaps over Nostr: A protocol for exchanging Schnorr signatures using Nostr events

    • The protocol supports applications like paid Nostr events, payment receipts, contract signing, asset exchanges, and credential access tokens through specific event kinds (455, 456, 457, and 30455).

    • The cryptographic mechanism allows two parties to swap signatures by having one party provide a public nonce and the other provide an adaptor signature, with safeguards needed for Taproot UTXOs and Cashu tokens.

  • 01:31:51 Lantern: A layered annotations noting tool and emphasizer of readables on nostr [Code repository

    • “Lantern is a fork of Hypothesis that publishes page notes, annotations and highlights to Nostr.”

    • “URLs are normalized and we follow NIP-84 for Highlights and NIP-22 for replies, annotations and page notes. NIP-65 relay lists are used for publishing the events in the common case and NIP-51 relay sets for custom relay groups of annotations.”

  • 01:31:59 Promenade: Provider of multisig for events on nostr and destroyer of encryption [Github]

  • Loudr: Reference client implementation that uses Atomic Signature Swaps over Nostr for sponsoring the publication of Nostr events [Github]

    • “A reference client that implements the Atomic Signature Swap NIP for sponsoring the publication of Nostr events in exchange for Cashu payments.”

  • 01:32:09 Noauth-enclaved: A safe Nostr nip46 signer to be deployed on AWS Nitro Enclave [Github]

    • Noauth-enclaved is a NIP46 signer deployed in AWS Nitro Enclaves, providing isolated compute environments where clients can verify code integrity cryptographically.

    • Users can verify instance attestations containing code hashes and builder/launcher identities, manage app permissions through encrypted Nostr events, and communicate with the service using end-to-end encryption via Nostr relays.

  • 01:32:27 GM Swap: Atomic exchange of GM notes using Schnorr adaptor signatures [Github]

    • “A proof of concept implementation of the Atomic Signature Swaps NIP. This project enables users to swap GM notes, ensuring that both parties’ signatures are exchanged simultaneously or not at all.”

  • Nostr Event Synchronizer: Syncs past events to your designated write and read relays based on NIP-65

    • The service synchronizes nostr events between relays using the outbox model, retrieving past events chronologically and republishing them only to relays where they’re missing.

  • Aegis: A simple and cross-platform Nostr signer that supports multiple connection methods [Github]

  • Morning Glory: A paid blossom server that only stores blobs for a day… just like the flower [Github]

  • Nostr4j: A high-performance Nostr library for the JVM, crosscompilable to javascript [Github]

  • Flotilla-Budabit: A fork of Flotilla which aims to provide a first class, git-centric community experience for developers [Github]

    • The platform offers eleven core features including repository browsing, branch views, issues tracking, patch threads, and real-time git chat for enhanced collaboration.

  • Zark: A tool to send sats to npub using Bark [Gitlab]

  • Nostr Game Engine: A game engine and framework for building games and applications integrated with the Nostr ecosystem [Github]

    • NGE is an open-source, royalty-free game engine designed for building games and applications integrated with the Nostr ecosystem

  • Bitcoin Calendar Bot: Archiving and relaying every Bitcoin milestone [Github]

    • Bitcoin Calendar Bot is an open source Go-based application that tracks and posts historical Bitcoin events daily to Nostr.

Software Releases & Project Updates

  • rust-nostr v0.41.0

    • Breaking changes

      • nostr: add optional relay URL arg to Tag::coordinate

      • nostr: update TagStandard::Label and EventBuilder::label

      • nostr: update custom field type in Metadata struct

      • pool: remove Error::Failed variant

      • pool: returns Output instead of an error if the message/event sending fails for all relays

      • pool: add reason field to AdmitStatus::Rejected variant

    • Changed

      • lmdb: enable POSIX semaphores for macOS and iOS targets

      • ndb: bump nostrdb to 0.6.1

      • pool: extend unit tests

      • pool: better handling of CLOSED message for REQs

      • relay-builder: send CLOSED if all possible events have been served

    • Added

      • nostr: add NIP-C0 (Code Snippets) support

      • nostr: add TagKind::u constructor

      • nostr: derive Copy for HttpMethod

      • nostr: add nip98::verify_auth_header

      • nostr: add push, pop, insert and extend methods to the Tag struct

      • nostr: add nip47::Notification

      • nostr: add MachineReadablePrefix::as_str method

      • nostr: derive Hash for EventBuilder and Metadata

      • pool: add Relay::ban method

      • pool: add AdmitPolicy::admit_connection method

      • keyring: add NostrKeyring

  • Primal iOS v2.1.49

    • Support for animated GIF uploads

    • Resolve issues with zap.stream URLs

    • Improve deep linking to threads

    • Fix rendering of mentioned events with unknown kinds

  • Nostur v1.20.0

    • Add support for Lists (kind 30000)

    • Show preview of feed from list

    • Turn list into feed tab with 1 tap

    • Subscribe toggle to keep updating the feed from original maintainer, or keep list as-is

    • Share List: Toggle to make list public

    • Lists tab on Profile view

    • ‘Add all contacts to feed/list’ post menu item

    • Discover tab now shows Lists shared by your follows

    • Enable manual ordering of custom feeds/tabs

    • New Top Zapped feed

    • New onboarding screens

    • New default color scheme/adjusted backgrounds

    • Lower delays and timeouts for fetching things

    • Improved hellthread handling

    • Support for comment on highlights (kind 9802)

    • Toggle to post to restricted/locked relay when starting post from single relay feed

    • Support relay auth for bunker/remote signer accounts

    • And more

  • Keychat App

    • v1.31.9 - Multi browser tabs

      • Multi browser tabs for desktop

      • Add pull_refresh to room list

      • Update style for browser home page

    • v1.31.2 - MLS Group && Macos dmg

      • Support desktop layout: Add DMG file for Mac OS

      • Desktop: Support pasting images and files into input fields

  • Nostr PHP v1.7.0

    • Add support for NIP-19 encoding and decoding bech32-encoded entities with identifiers and metadata.

    • Features

      • Implement NIP-19

      • Notes on naddr decoder (NIP-19)

      • Support all encodings, especially naddr

  • Citrine v0.7.3

    • Improve performance when exporting events

    • Improve memory usage when downloading your events

    • Improve query performance

  • Pokey v0.1.6

    • Now notifications include NIP-05 mentions

  • Nstart Update

    • Nstart is now multilingual: Currently available in English, Español, Italiano, Français, Deutsch and 日本語.

Boosts

  • 01:33:04 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @Rod Palmer Bugle News (10,000 sats) “PODCONF ✅”

    • @pink monkey (1,000 sats) “Whoa! 🔥👌💯👏”

    • @btconboard (300 sats) “Happy to discover this AI and coding podcast”

    • @jespada (100 sats) “Feeding the show to DVM rn, then asking o1 to write the spec then cursor = profit 🥉”

    • @AVERAGE_GARY (200 sats) “Does ecash enable blinded auditing for bitcoin books? 🤔” “First 30min is 🤌🤝🔥”

    • @larryoshi finkamoto (100 sats)

Tech Tips of the Day

  • Hide My Email (with Cloudflare): A browser extension to create unique, random email addresses that forward to your real inbox [Github]

    • Create up to 200 anonymous emails

    • Instantly creates new mailboxes

    • Works on any OS

  • Terms of Service; Didn’t Read, a website that helps users decipher complicated ToS, has just released an Android app for mobile users

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 349

      • SwiftSync speedup for initial block download: Sebastian Falbesoner posted to Delving Bitcoin a sample implementation and performance results for SwiftSync

    • 348

      • News

        • Educational and experimental-based secp256k1 implementation: Sebastian Falbesoner, Jonas Nick, and Tim Ruffing posted to the Bitcoin-Dev mailing list to announce a Python implementation of various functions related to the cryptography used in Bitcoin.

      • Changing consensus

        • Multiple discussions about quantum computer theft and resistance: several conversations examined how Bitcoiners could respond to quantum computers becoming powerful enough to allow stealing bitcoins.

        • Multiple discussions about a CTV+CSFS soft fork: several conversations examined various aspects of soft forking in the OP_CHECKTEMPLATEVERIFY (CTV) and OP_CHECKSIGFROMSTACK (CSFS) opcodes.

        • OP_CHECKCONTRACTVERIFY semantics: Salvatore Ingala posted to Delving Bitcoin to describe the semantics of the proposed OP_CHECKCONTRACTVERIFY (CCV) opcode, link to a first draft BIP, and link to an implementation draft for Bitcoin Core.

        • Draft BIP published for consensus cleanup: Antoine Poinsot posted to the Bitcoin-Dev mailing list a link to a draft BIP he’s written for the consensus cleanup soft fork proposal.

News & Noteworthy

Bitcoin

  • Bitcoin entropy puzzles: 68-bit challenge solved for 6.8 BTC [Twitter post]

    • The 68-bit puzzle was solved on April 7, 2025, by the same team that cracked the 67-bit puzzle in February, earning them 6.8 BTC.

Business & Finance

  • ACINQ resumes making its products available to customers in the United States, mentioning the “Ending Regulation By Prosecution” memo issued by the U.S. Deputy Attorney General [Announcement]

  • Bull Bitcoin launches in Mexico, allowing users to send pesos instantly to Mexican bank accounts using self-custodial BTC, LN, or Liquid wallets [Announcement]

  • Tether plans to implement OCEAN’s DATUM Gateway across global mining operations [Press release]

  • U.S.-based Bitcoin mining chip designer Auradine raises $153M in series C funding for Bitcoin and AI expansion [The Miner Mag]

  • Bakkt investors sue over revenue loss from non-renewed contracts [Coin Telegraph]

    • Investors file class-action lawsuit against Bakkt Holdings, alleging the crypto firm violated securities laws by failing to disclose its heavy dependence on Webull and Bank of America contracts.

  • BitGo and Voltage partner to scale Lightning Network for Bitcoin payments [Press release]

    • The partnership aims to bridge institutional security with Lightning infrastructure, allowing exchanges, neobanks, and fintech platforms to integrate instant Bitcoin payments.

  • Voltage announces Voltage Payments, a new API for bitcoin and stablecoin transactions [Announcement]

    • The service features flexible custody models, USD settlement options, and built-in compliance with SOC 2 Type II certification.

  • Bitcoin Keeper introduces Keeper Private, a premium self-custody service for high-net-worth individuals and organizations seeking long-term Bitcoin holdings guidance [Blog post] and Keeper Learn, a service offering a three-session educational program teaching Bitcoin fundamentals to beginners and teams.

  • Theya launches Bitcoin management solutions for businesses [Announcement]

    • The platform features flexible vault architecture supporting single-key or 2-of-3 multisig vaults for both cold storage and daily operations

  • Bitcoin on-ramp and custody service Magnolia completes Lightning Network implementation and will support it from launch, pending regulatory approval [Announcement]

Funding

  • OpenSats announces two new grant waves:

    • The Fourth Wave of Education Grants, supporting three projects that make Bitcoin education more accessible, practical, and useful: Librería de Satoshi, Crack the Orange, and FREE Madeira

    • The Eleventh Wave of Nostr Grants, supporting five projects focused on decentralized live streaming, off-grid connectivity, web-of-trust infrastructure, private messaging, and open tools for game development: Swae, HAMSTR, Vertex, Nostr Double Ratchet, and Nostr Game Engine

  • Brink announces supporting Bitcoin developer Sebastian Falbesoner (@theStack)’s transition to full-time open source work and that Eugene Siegel is joining Brink as an open source engineer for Bitcoin Core, bringing security experience from Lightning Network work and previous vulnerability disclosures.

  • Spiral announces @L0RINC as its newest grantee for his work on Bitcoin Core, “emphasizing performance benchmarking and optimizations, along with code quality enhancements, code reviews, block download time reductions, memory optimization, and code refactoring.”

  • Vinteum renews grant to now appointed BDK maintainer Leonardo Lima for his contributions to BDK and Fedimint [Announcement]

  • Einundzwanzig grants funding to Bitcoin Safe [Announcement]

    • Bitcoin Safe, created by former Specter developer Andreas Griffin, receives 1,000,000 satoshis funding to continue development of this open-source multisig wallet.

  • The Human Rights Foundation announces 1 billion satoshis in gifts from its Bitcoin Development Fund to support 20 projects worldwide: NetBlocks, TollGate, Vinteum, BTCPay Server, Africa Bitcoin Institute, Bitcoin Core Graphical User Interface (GUI), Rkrux, Elsat, Relay Wizard, Waye, Hashpool, Cashu KVAC, Brandon Black (Rearden), Tony Klausing’s Stable Channels, Bitsacco, The Core, Bitcoin Babies, East Asia Bitcoin Developer Apprenticeship Program, TalentLand 2025, Base58’s Bitcoin Live Action Role Play (LARP), BTCenEspañol, Bitcoin researcher Daniel Batten, and Bitcoin for Good.

  • Instant exchange eXch announces a 50 BTC open-source fund to support privacy-enhancing projects [Bitcoin Talk Announcement]

    • eXch is shutting down operations and changing owners on May 1st, 2025 after learning they are the target of a transatlantic operation aiming to prosecute them for money laundering and terrorism.

  • OpenCash Association offers a 2 million satoshi bounty for developing an open-source BTCPayServer plugin for Cashu payments

    • The plugin must include features to melt incoming tokens automatically to Lightning wallets and allow whitelisting of trusted mints to mitigate risks for merchants.

  • 256 Foundation announces 2025 open-source Bitcoin mining grant projects: Ember One hashboard, Hydra Pool, Libre Board, and Mujina Firmware, each led by specialized developers.

    • Grant cycles for the projects begin in April/May 2025 with end dates ranging from September to December, while a fifth project called Block Watcher is paused.

  • BDK Foundation adds AnchorWatch, CleanSpark, and Proton Foundation as new corporate members for 2025, joining founding members Spiral and OpenSats [Announcement]

    • Corporate membership dues fund open source developers who maintain BDK libraries and related FOSS projects supporting Bitcoin technology.

  • Bitcoin Legacy Project: A new funding initiative for Bitcoin ecosystem by Unchained [Blog post]

    • Financial commitments include $50,000 to the Bitcoin Policy Institute, $150,000 for a university endowment at University of Austin, and up to $250,000 in research grants through the Bitcoin Scholars program.

  • Project Eleven launches Q-Day Prize offering 1 BTC to the first team that breaks bitcoin’s elliptic curve cryptography using Shor’s algorithm on a quantum computer before April 2026 [Bitcoin Magazine]

Mining

  • Bitcoin Mining Centralization in 2025: A new publication by researcher B10c reveals that six pools control 95% of the network

    • Currently, Foundry (30%) and AntPool (19%) dominate Bitcoin mining, with the top four pools controlling 75% of the hashrate compared to a more decentralized era in 2017.

    • When accounting for “AntPool & friends” proxy pooling, the centralization becomes even more extreme, with six mining pools mining 96-99% of all blocks in 2025.

Privacy

  • Gmail introduces simplified E2EE for business customers [Google Blog post]

    • Gmail offers end-to-end encryption without complex S/MIME implementation, allowing users to send encrypted emails with just a few clicks regardless of recipient.

  • UK Court rejects secret hearing in Apple encryption challenge [Open Rights Group]

    • The Investigatory Powers Tribunal rejects the Home Office’s application for a secret hearing in Apple’s challenge against UK Government demands to break encryption.

  • European Commission unveils ProtectEU, a strategy aiming to establish Europol as “a truly operational police agency” for investigating cross-border threats [The Record]

    • The Commission plans to create roadmaps for lawful access to encrypted data while “safeguarding cybersecurity and fundamental rights” despite potential controversy and member states’ reluctance to surrender sovereignty.

Security

  • CISA renews MITRE’s Common Vulnerabilities and Exposures Program contract hours before expiration [NextGov]

    • The CVE Program, a 25-year global standard for cataloging cybersecurity vulnerabilities, faces uncertainty as a subset of the CVE Board plans to form an independent CVE Foundation.

    • CISA faces potential budget reductions amid political scrutiny. Homeland Security Secretary Noem aims to make CISA “much more effective, smaller, more nimble, to really fulfill their mission.”

  • The European Union Agency for Cybersecurity launch its own CVE database, the [European Union Vulnerability Database (EUVD)]

    • It serves as a centralized platform for the collection, management, and dissemination of information regarding vulnerabilities in information and communication technology products and services.

  • Android adds auto-reboot security feature after three days of inactivity [TechCrunch]

    • Google updates Android with new security feature that automatically reboots phones locked for three consecutive days, following Apple’s similar implementation last year.

Protocol

  • Bitcoin Core #31363: cluster mempool: introduce TxGraph [Merged]

  • Bitcoin Core #31278: wallet, rpc: deprecate settxfee and paytxfee [Merged]

  • Rust Bitcoin #4302: Add push_relative_lock_time() and deprecate push_sequence() [Merged]

  • LND #9669: Downgrade to legacy coop close for taproot channels [Merged]

  • LND #9620: chain: add testnet4 support [Merged]

  • LDK #3670: Handle receiving payments via Trampoline [Merged]

  • LDK #3593: [RFC] Implement a way to do BOLT 12 Proof of Payment [Merged]

  • Eclair #3045: Optional payment_secret in trampoline outer payload [Merged]

  • Eclair #2963: Use package relay for anchor force-close [Merged]

  • BOLTs #1242: Make payment_secret mandatory and ASSUMED [Merged]

  • NIPs #1881: Allow multi-user AUTH [Open]

  • NIPs #1875: Add Diff and Permalink kinds [Open]

  • NIPs #1873: Add guidelines tag to NIP-29 group metadata [Open]

Quantum

  • OpenSSL v3.5.0 introduces post-Quantum cryptography support [Cyber Security News]

    • OpenSSL v3.5.0 integrates three major post-quantum cryptography algorithms: ML-KEM, ML-DSA, and SLH-DSA

    • The update enhances TLS support with hybrid PQC Key Encapsulation Mechanism groups and adds server-side QUIC protocol support

    • Version 3.5.0 introduces new configuration options including no-tls-deprecated-ec and enable-fips-jitter, while changing default encryption from des-ede3-cbc to aes-256-cbc for some applications

Government & Political

  • Justice Department dismantles cryptocurrency enforcement team as part of Trump’s regulatory pullback [Fortune Crypto]

    • The DOJ disbands its National Cryptocurrency Enforcement Team (NCET), established in 2021 under Biden that prosecuted major crypto-related felonies including Tornado Cash and North Korean laundering operations.

    • Deputy Attorney General Todd Blanche calls for ending “regulation by prosecution,” but the memo contains numerous caveats that may still allow prosecution of developers if their services are deemed to facilitate criminal activity [The Rage]

  • Trump signs resolution to repeal IRS DeFi reporting requirements [Reuters]

    • President Trump signs H.J.Res.25, nullifying Biden-era IRS regulations that would have required non-custodial cryptocurrency service providers to file Form 1099 reports beginning in 2026.

  • Local authorities across China engage private companies to convert confiscated bitcoin into cash amid regulatory uncertainty [Reuters]

  • Panama City Council approves cryptocurrency payments for municipal services, including taxes, fees, and permits [Bitcoin Magazine]

Events

  • BTC Prague, Swan and GW University launch BTC in D.C., the Bitcoin conference in Washington D.C.

    • September 30 to October 1st, 2025 in Washington, D.C., U.S.

  • Chiang Mai approves Bitcoin Marathon and Festival, The World’s First Bitcoin Half Marathon

    • November 1-2, 2025 in Chiang Mai, Thailand

  • Bitcoin Designathon, a global online event organized by the Bitcoin Design Community to encourage designers and artists to collaboratively improve Bitcoin’s UX and accessibility through creative, open-source design projects. ​

    • May 4-18, 2025

Reads

  • Here’s a list of our top recently published reads:

    • A simple backup scheme for wallet accounts, by Salvatore Ingala [Delving Bitcoin]

    • Bitcoin Address Poisoning Attacks, by Jameson Lopp [Cypherpunk Cogitations]

    • A Brief History of Wallet Clustering, by @not_nothingmuch [The Scroll #3]

    • How Coinkite Defines Cypherpunk Bitcoin Security [Bitcoin Magazine]

    • Who pays for Bitcoin wallets?, by @Scoresby [Stacker News]

    • Three Staged Assassinations, by BitMEX Research [Blog post]

    • The Unwritten Rule, by Alekos Filini [Blog post]

    • DVMs were a mistake, by hzrd149 [Note]

    • Transacting with ecash while offline, by Gandlaf21 [Note]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR094 - COLDCARD KeyTeleport, Harbor, Ark, Cove, Zaprite, BTC Core, OMEMO, Knots, Vibe Coding, Trezor Safe 3 Attack Vector, Coinbase Phishing Campaign, Bitcoin Business Software + MORE ft. Rob & Paul]]>https://substack.bitcoin.review/p/br094-coldcard-keyteleport-harborhttps://substack.bitcoin.review/p/br094-coldcard-keyteleport-harborWed, 02 Apr 2025 18:15:38 GMTI’m joined by guests Rob Hamilton & Future Paul to go through the list.

Listen on your favorite podcast app

Housekeeping

  • 00:01:09 Nostr DVM Playground: Test out Nostr Data Vending Machines from DataMachine

    • Choose between Text Summarization, Text Generation, People Discovery, and People Search.

  • 00:26:33 Bitcoin Security Guide updated

  • 00:27:23 Looking for more beta testers for Cove, iOS Beta on TestFlight

  • 00:33:19 COLDCARD Key Teleport

    • Purpose: Send a small quantity of very secret data between two COLDCARD Q systems, with no risk of anything in the middle learning the secret.

    • Method: ECDH and AES-256-CTR plus an extra wrapping layer, transmitted over a mixture of NFC, passive websites, and QR/BBQr codes.

Urgent Vulnerability Disclosures

  • 00:29:04 “Designated seed phrase”: A new email phishing campaign is out, targets Coinbase users [Twitter post]

Bitcoin

Software Releases & Project Updates

  • 00:44:33 Bitcoin Core v29.0rc2 - Bitcoin Core 29.0 release candidate 2

    • Bitcoin Core 29.0rc2 is a release candidate for the next major version [Testing Guide]

  • 00:45:52 Fulcrum v1.12.0

    • Add support for UPnP

    • Add support for bitcoind’s ZMQ pubhashtx message

    • Improve Fulcrum’s mempool model efficiency by adding parent/child links for txns

    • Add support for Unix domain sockets in ZeroMQ notifications

    • Fix a rare and esoteric bug where Fulcrum would announce its TCP/SSL/WS/WSS port(s) to peers even if it was actually listening on a loopback interface for those ports

  • 00:46:06 Blue Wallet v7.1.5

    • Add market android widget

    • Allow app to run in Vision Pro

    • Allow quick tap to copy address- Bitcoin Keeper

    • Mobile v2.1.0

      • Add Emergency Key to vaults for recovery in emergency situations

      • Update the Server Key with Spending limits and security delays

      • Send batch transactions to multiple recipients at the same time

      • Purchase hardware wallets with discounts

      • Single Key support for Portal

      • Improve wallet migration flow on key changes

      • Significant improvements to wallets syncing

      • Multiple UI updates and performance improvements

    • Desktop v0.2.1

      • Support subscription purchases using Bitcoin, powered by BTCPay Server.

  • 00:46:27 Bitcoin Safe

    • v1.2.1

      • You can now assign names to participants in Sync&Chat

    • v1.2.0

      • Improve QR scanning performance in Linux, Mac, Windows

      • Enhance PSBT signing UI

      • Add message signing via USB and QR (Coldcard Q rocks)

      • Add Thai language support

      • Add Linux Gnome dark-mode

Interlude: OMEMO

Bitcoin (Cont.)

Software Releases & Project Updates

  • 00:53:28 Bitcoin Knots v28.1.knots20250305

    • P2P and Network Changes

      • Add support for Testnet4

      • UNIX domain sockets can now be used for proxy connections

      • Transactions having a feerate that is too low will be opportunistically paired with their child transactions and submitted as a package

    • Mempool Policy Changes

      • Topologically Restricted Until Confirmation (TRUC) parents are now allowed to be below the minimum relay feerate

      • Pay To Anchor (P2A) is a new standard witness output type for spending

      • Limited package RBF is now enabled, where the proposed conflicting package

    • GUI Changes

      • Add basic block visualizer to the Window menu

    • Signed Messages

      • Verifying BIP 137, BIP 322, and Electrum signed messages is now supported.

      • When signing messages for a Segwit or Taproot address, a BIP 322 signature will be produced

  • 00:53:59 BoltzExchange

    • boltz-backend v3.10.0 - Rescue mission

      • Support for rescue files that allow swaps to be refunded with only the refund keys

      • Nested fee premiums to allow referrals to add extra fees

      • Discount CT on Liquid mainnet

    • boltz-web-app v1.7.0

      • Swap recovery rescan

      • Download rescue key in settings

      • Adjust network fee when RIF is needed

      • Defer swap creation after backup is done

  • 00:54:01 Blockstream Green QT v2.0.22

    • Add option to request an email containing the user’s nLockTime transactions

  • 00:54:58 FullyNoded v0.1.0-beta

    • This update removes all functionality related to Lightning and Bitcoin Knots by commenting out the related code

    • The focus for the first proper release is going to be on Bitcoin Core and Join Market only

  • 00:55:11 BullBitcoin Mobile

    • v0.4.2

      • Using public/price endpoints for Bitcoin Price

    • v0.4.1

      • DiscountCT for liquid transactions

  • 00:55:19 RoboSats v0.7.5-alpha

    • For Users

      • When Javascript is disabled a box appears to help the user to enable it

      • Users will now be advised when they select a coordinator not offering swamps in order creation

    • For Coordinators

      • Now orders stay public even if there is a non-confirmed Taker, allowing multiple robots to try to take the order

  • 00:55:24 Bisq 2 v2.1.7

    • New features

      • Official Bisq mediators and moderators can now be identified by the badge next to their nickname

      • Add a splitpane to calibrate sizes between offerbook chat and offer list

    • Improvements

      • The Bisq Easy protocol has been enhanced to protect against triangular scams. Now, when the buyer does the Fiat transfer, trade ID must be set as “Reason for payment”.

      • Splash screen now shows the loading progress for each required step: Starting Tor, publishing onion service, connection to P2P network and, finally, data inventory request.

    • Improve Trade process, Message delivery, and Mediation (more details in release notes)

  • 00:55:26 Zaprite v2025-03-17

    • Global Tags: Add a Tags feature that allows merchants to add tags and categorize incoming Transactions for reporting

    • Invoices: Add a Total column to the Invoices table, which shows the calculated total amount due after discounts taxes

    • Recurring Invoices: Add a Biannual option to Recurring Invoice schedule options

    • API Orders: Add a new expiresAt field to the POST /order endpoint

    • API Orders: Add a new metadata field to the POST /order endpoint

  • 00:56:38 Bitcoin Jungle App v1.3.6

    • Includes the ability to add a backup recovery email to your account in case you lose access to your phone number

    • Adds beta support for Bolt Cards- a protocol enabling you to link a contactless card to your wallet that lets you pay without your phone

  • 00:57:22 SRI v1.3.0

    • This release migrates the old CI system based on Message Generator into the new SRI Integration Tests Framework.

    • Main changes (amongst many):

      • New integration test framework and tests

      • Enhanced APIs for role development

      • Core low-level crates now support no_std

  • 00:57:57 Stratum.work Update

    • New visual on stratum.work displays precise timing data for block template reception from pools, making it easier to spot similarities between pools

  • 00:58:46 Braiins OS

    • v25.03

      • Toolbox now supports DPS Boost–introduced in the Braiins OS 25.01 update.

      • Users can now detect Avalon miners, both via CLI and GUI. Additionally, you can perform actions such as pause, resume, reboot, and change pool config for these miners. Please note that this feature is available in beta testing.

      • CSV exports have been enhanced. The export functionality now allows for filtering, sorting, column visibility, and the order set in the GUI’s device list.

      • Extended Pool Username Variables now include , which represents the miner’s IP address with an “x” separator, instead of a dot.

    • v25.01

      • Full support for Antminer S21 Imm. and Antminer S21 XP Imm. with AML control board now available

      • Logs are now persistent across all control boards

      • DPS now has two modes—Normal and Boost. DPS Boost has been recently added

      • Customizable MIN/MAX fan speed ranges can now be set in the GUI and API

      • Fans on Braiins Mini Miners will now run quieter

  • 00:58:50 Coinselect

    • v1.3.1

      • Prevent crash in dustThreshold for addr() descriptors lacking miniscript

    • v1.3.0

      • Add support for single-key tr(KEY) and addr(TAPROOT_ADDRESS) descriptors

Project spotlight

  • Grid: An interactive tool designed to analyze and visualize Bitcoin mining data

    • Users can customize metrics and miner groupings to explore various aspects of mining pools and their activities. ​

    • For example, the tool allows analysis of specific miner groups such as “AntPool & friends,” which includes AntPool, BTC.com, Binance Pool, WhitePool, and SECPOOL.

  • CTV Playground: A native Android implementation and demonstration of Bitcoin’s proposed OP_CHECKTEMPLATEVERIFY (CTV) soft fork, including a CTV Vault implementation. [Github]

  • Bitcoin PSBTv2 Explorer: A quick and dirty PSBTv2 parser and converter [Github]

    • This tool aims to provide an updated version of the tremendously useful bip174.org compatible with modern PSBT features.

  • Fuzzamotto: Holistic Fuzzing for Bitcoin Protocol Implementations [Github]

    • Fuzzamoto framework enables coverage-guided fuzzing of Bitcoin full nodes through external interfaces like P2P and RPC, functioning as “Functional Fuzz Tests” rather than using in-process testing methods.

    • The system uses snapshot fuzzing with afl++’s Nyx mode for deterministic and performant testing of multiple node instances simultaneously, with future integration possibilities for other snapshot fuzzing tools.

  • Bitcoin Humanitarian Alliance: A global initiative leveraging Bitcoin to support freedom, financial inclusion, and humanitarian causes

    • The alliance aims to unite activists and humanitarian groups worldwide who use Bitcoin, educate nonprofits on integrating Bitcoin into their work, and host events to share strategies for financial freedom.

  • BetterStrike: Strike Tor Web Wallet [Gitlab]

    • Strike Wallet functions as a web-based Bitcoin wallet interface that uses Strike API and Tor technology to enable both Lightning and on-chain transactions.

  • Coinbase MPC: Coinbase open sources its MPC cryptography library [Announcement]

    • The library provides cryptographic protocols using secure multiparty computation, and is derived from Coinbase’s internal system but modified for general-purpose public use.

    • The library includes practical examples like HD-MPC, threshold EC-DKG for ECDSA-MPC, and ECDSA-MPC with threshold backup implementations.

  • Branta Core: A multi-platform app you to guard your clipboard on Mac, Linux and Windows [Docs]

  • Branta Guardrail: A tool to verify invoices and checkouts before sending Bitcoin or Lightning [Docs]

  • Satoshi Forex: A straightforward forex page listing the sat value of each unit of currency.

    • The website compares Bitcoin’s value to the world’s top 30 currencies in real-time, using data from CoinGecko and the IMF World Economic Outlook database (2024).

  • Antidote: London’s first Bitcoin startup incubator hub

    • Antidote is a startup studio and collaborative workspace for entrepreneurs, developers, investors, hackers and anybody building on or around bitcoin.

  • Satsify: A Chrome extension that converts Amazon product prices from USD to satoshis [Github]

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 01:18:13 Sideband v1.5.0

    • Added the ability to make and receive LXST voice calls

    • Add basic voice call UI

    • Add option to configure audio devices for LXST voice calls

    • Add option to block non-trusted callers

    • Add support for sharing any file type as attachment on Android

    • Add link stats to object details

    • Add a BME280 telemetry plugin example

    • Add button on Android to quickly go to full RNS interface status

    • Improve map initialisation time

  • Reticulum MeshChat v1.21.0

    • Migrated to using micron-parser from NPM

  • 01:18:23 Mullvad VPN

    • Release of DAITA v2 for all platforms [Blog post]

      • DAITA version 2 introduces reduced traffic overhead by more carefully inserting dummy packets, cutting their number by half while maintaining defense levels and improving connection speed.

      • The new dynamic configurations feature randomly assigns different rules to VPN connections, making two clients visiting the same webpage produce different data streams and helping resist targeted attacks.

    • Multihop feature now available on Android [Blog post]

      • Users can now route traffic through two servers instead of one in the Android app version 2025.1 and newer, allowing the selection of entry and exit servers in different jurisdictions

  • 01:18:33 NymVPN officially launches its privacy solution built on a Noise Generating Mixnet technology [Press release]

    • The system uses zero-knowledge proofs to prevent linking payment information to online activity, with no logging by design and censorship resistance features.

Vulnerability Disclosures

  • 01:18:42 Ledger Donjon conducts a security analysis of Trezor’s hardware wallets and reveals Trezor Safe 3 is susceptible to physical supply chain attacks [Security Audit]

    • Trezor Safe 3 and Safe 5 products incorporate Secure Elements (Infineon Optiga Trust M) that safeguard user PINs and secrets.

    • Donjon details the remaining security considerations:

      • Critical cryptographic operations still occur on the microcontroller, not the Secure Element, creating potential vulnerabilities if an attacker modifies the microcontroller’s firmware.

      • Ledger Donjon demonstrated they could bypass firmware verification measures to run modified code that could “lead to the remote recovery of all the user’s funds.”

      • The newer Trezor Safe 5 uses an STM32U5 microcontroller that offers improved security against fault injection attacks compared to the TRZ32F429 used in Safe 3.

  • nRootTag: Turning a Bluetooth device into an Apple AirTag without root privileges [Research paper]

    • Researchers discover “nRootTag” vulnerability allowing attackers to convert any Bluetooth device into an AirTag-like tracker without root privileges.

    • Attack exploits address confusion in Apple’s Find My network, using over 1.5 billion iPhones as unwitting tracking agents.

    • Attack requires malicious app installation, Bluetooth capability, and proximity to Apple devices participating in Find My network.

    • Apple released patches in December 2024 (iOS 18.2 and other system updates) to address this vulnerability.

  • Eavesdropping on black-box mobile devices via audio amplifier’s EMR [Research Paper]

    • Periscope is a proof-of-concept system demonstrating how electromagnetic radiations (EMR) from mobile devices’ audio amplifiers can be exploited to recover audio sounds.

    • Headphones connected to devices act as antennas that enhance EMR signals, making them measurable at distances up to 15m with a miniaturized prototype similar in size to hidden voice recorders.

    • The attack successfully recovers private audio with a word error rate as low as 7.44% across 11 mobile devices and 6 headphones, producing results intelligible to both human hearing and speech-to-text tools.

  • Microsoft discovers StilachiRAT, a sophisticated trojan targeting credentials and crypto wallet information [The Hacker News]

    • The malware targets at least 20 cryptocurrency wallet extensions in Chrome, including MetaMask and Coinbase Wallet, and can execute 10 different commands from its command-and-control server. [Microsoft Analysis]

  • Android apps are covertly tracking users through Bluetooth and WiFi [Cyber Insider]

    • Study reveals 86% of analyzed apps gather sensitive data, including device identifiers and WiFi scan results, often bypassing Android’s privacy controls.

  • Next.js discloses critical authentication bypass vulnerability (CVE-2025-29927) with CVSSv3 score of 9.1 in middleware layer, exploitable through an extra HTTP header [runZero Blog post]

    • Remote attackers can bypass security checks including authentication mechanisms by exploiting this vulnerability.

  • Clevo boot guard keys leak threatens system security [Security Express]

    • Binarly confirms discovery of leaked private Boot Guard keys in Clevo firmware packages. The keys were found in a publicly available BIOS update containing BootGuardKey.exe with private keys that could be used to bypass security measures.

    • Investigation identifies 15 affected firmware packages across 10 unique Clevo-manufactured devices, including several Gigabyte laptop models. The compromised keys remain in use on “actively supported products, thereby elevating the severity of the threat.”

  • Five dollars wrench attacks:

    • 41-year-old man assaulted and robbed of HK$318,000 in cash in Hong Kong after completing a cryptocurrency trade [The Standard]

      • The victim received the cash from a cryptocurrency trade and was heading to his home when the robbery occurred at around 11pm.

    • Turkish man carrying €5 million cash for cryptocurrency trading is attacked in Hong Kong by knife-wielding assailants [Dimsum Daily]

      • Victim fights off attackers, suffers 10-centimetre knife wound to forehead, but retains his money bag. Police arrests four men.

    • Four men and one woman arrested after the kidnapping of a cryptocurrency investor in Paris over a failed €10,000 cryptocurrency investment that collapsed [Le Parisien]

      • The 20-year-old victim was forced into a car trunk during what appeared to be a setup meeting with a 19-year-old woman. Kidnappers demanded €40,000.

    • South Korean prosecutors request 10-year sentence for a man who stabbed Haru Invest CEO in the neck during a court hearing in August 2024 [The Block]

      • The attacker, surnamed Kang, lost 100 BTC in Haru Invest, which allegedly defrauded around 16,000 investors of nearly $962 million after suspending operations in June 2023.

Interlude (Rob’s Corner)

Privacy & Other Related Bitcoin Projects (cont.)

Project spotlight

  • Voca: A privacy-focused Text-to-Speech (TTS) app for Android that respects system language settings and provides a clean, simple interface [Gitea]

    • Users can configure language through system TTS settings, with all processing done locally without data collection.

    • Voca is FOSS and operates on a value for value model [Npub]

  • Silkpad Computers: Privacy-focused refurbished computers, focuses on older Thinkpads models

    • Silkpad Computers offers refurbished devices emphasizing privacy and security through auditable firmware (IME disabled) and open-source software.

Lightning + L2+

Project spotlight

  • LN-spam-prevention: Fee-based protocols for preventing spam on the Bitcoin Lightning Network [Github]

    • The project introduces protocols to assign and collect fees for Lightning services, aiming to reduce network spam by charging for all significant costs incurred.

    • The collection system uses griefer-penalization where both parties lose comparable funds in griefing attempts, protecting users who select self-interested partners [Research paper]

  • Hydrus: Lightning automated liquidity management agent [Github]

    • Hydrus automatically opens and closes Lightning Network channels based on network graph analysis and performance metrics.

    • The system selects nodes using weighted heuristics including capacity, centrality, routing policies, and connectivity.

  • Alby Lite: A minimal Lightning address server powered by NWC [Github]

  • ngx_l402: An Nginx module that enables pay-per-request authentication using the L402 protocol [Github]

    • An L402 authentication module/plugin for Nginx that integrates seamlessly into your web server, enabling Lightning Network-based monetization for your REST APIs

    • It supports invoice generation through LND, LNURL, and NWC

  • LNVPS: A bitcoin powered VPS provider

    • LNVPS is a VPS provider based in Ireland that specializes in integrating Bitcoin’s Lightning Network for payments

  • Sig4Sats Script: Atomic exchange of Cashu payments for Nostr event signatures using Schnorr adaptor signatures [Github]

    • A simple script demonstrating how to atomically exchange Cashu payments for Nostr event signatures using Schnorr adaptor signatures.

  • nut-bridge: Bridging the gap between NIP-57 and NutZaps [Github]

    • “nut-bridge is bridging the gap between NIP-57 Zaps and NIP-61 NutZaps by providing a LNURL server that will receive payments via a Lightning Address and then turn them into a nut zap.”

Software Releases & Project Updates

  • 01:22:46 LDK announces Versioned Storage Service (VSS)

    • VSS provides server-side storage for non-custodial Lightning Network and Bitcoin wallets, which enables fund recovery after a device loss as well as future multi-device access.

    • The service ensures real-time synchronization of wallet states, and prevents loss of funds by securing every state change as it occurs rather than relying on periodic backups.

    • VSS is designed with privacy features including client-side encryption and can be self-hosted or cloud-deployed, with integration already available in LDK Node v0.4.x as alpha support.

  • Eclair v0.12.0

    • This release adds support for creating and managing Bolt 12 offers and a new channel closing protocol (option_simple_close) that supports RBF.

    • We also add support for storing small amounts of (encrypted) data for our peers (option_provide_storage).

  • Phoenixd v0.5.1

    • Use ubuntu for docker runtime image

    • Add parent_id link for first outgoing payment part

  • Breez SDK v0.7.2 - Nodeless

    • Add seed support to ConnectRequest

    • Improve realtime sync and restore

  • Alby

    • Go v1.11.0

      • Add support for NWC deep linking and NWA

      • BTC rates now refresh every 5 minutes for up-to-date pricing

      • Improve branding with Alby Go logos on success screens

      • Update wallet removal copy for better clarity

  • Ark v0.5.2 - Handle RBF transactions

    • Telemetry: Go runtime metrics

    • SDK: Detect rbf txs while listening for boarding utxos

  • Ark Labs HQ wallet-sdk

    • v0.0.9

      • VtxoScript abstraction

      • Mark as side-effect-free to allow Tree Shaking

      • Add ArkNote class

    • v0.0.8

      • Support Boarding

      • Cleaning types

      • Identity abstraction

      • Add getTransactionHistory()

      • Add ServiceWorkerWallet implementation

  • BitBanana v0.9.3

    • Significantly enhanced channel rebalancing interface

    • Nostr Wallet Connect support

    • Channel sorting

    • UTXO sorting

    • Exposed timeout setting for backend communication and lightning payments

  • BlitzWallet v0.4.2-beta

    • eCash Revamp: More Flexibility & Security

      • Deterministic Proofs: eCash proofs are now linked to your Blitz Wallet seed phrase

      • New SQL Storage System: Moved from encrypted database storage to a local SQL database

      • Cross-Wallet Portability: Upload and migrate eCash proofs between compatible wallets

      • Laying the Groundwork for Higher Limits: Preparing to increase the eCash storage limit beyond the current 5,000 sats cap

    • Manual Migration Required: Existing eCash proofs must be manually migrated via Settings > Experimental Features

    • Point-of-Sale Enhancements:

      • Customizable Currency Display: Toggle between sats or fiat, with proper regional formatting

      • Integrated Tipping System: Employees can now enter their name during PoS transactions, and business owners can track tips for proper distribution

  • CDK v0.8.0

    • Add redb feature to mintd in order to meet MSRV target

    • cdk-sqlite: In memory sqlite database

    • Add tos_url to MintInfo

    • cdk: Add tos_url setter to MintBuilder

    • Add optional “request” and “unit” fields to MeltQuoteBolt11Response NUT Change

    • Add optional “amount” and “unit” fields to MintQuoteBolt11Response NUT Change

    • Compile-time error when no lightning backend features are enabled

    • Add support for sqlcipher

    • Payment processor

    • Payment request builder

    • Sends should be initiated by calling Wallet::prepare_send

    • A SendOptions struct controls optional functionality for sends

    • Allow Amount splitting to target a fee rate amount

  • CashuBTC Update

    • Add the ability to use tap-to-pay with eCash, enables Bitcoin payments via NFC without internet or delay

    • The system supports payments from any mint and integrates with the Lightning Network

  • Cashu-ts

    • v2.4.1

      • Export OutputData

    • v2.4.0

      • Remove dleqValid from proof and expose verification api

      • Extract from- and to- raw request functions

      • Handle specific errors cases in request.ts

    • v2.3.0

      • Add method for automated batch restoration

      • NUT-18 is implemented, updating README.

      • NUT-15 MultiPath Melt Quotes

      • NUT-20 Signed Mint Payloads

  • Nutstash v2.0.4

    • Switch qr code lib to @paulmillr/qr

    • Feature: Offline tokens

Nostr

Project spotlight

  • GM.family: Send a ‘GM’ note to @fiatjaf by the press of a button

  • Nostringer: JavaScript library providing unlinkable ring signatures (SAG) for Nostr pubkeys [Github]

    • The library draws inspiration from Monero’s Ring Signatures using Spontaneous Anonymous Group signatures (SAG) and implements ring signatures using Ed25519 elliptic curve and Keccak hashing.

  • Igloo: Frostr keyset manager and remote signer [Github]

    • “Desktop-based key management and signing device. Options to import an existing nsec, or generate a new one. Allows you to manage and rotate shares, plus recover your nsec using shares. Can be used online for remote signing, or offline for key management only.”

  • Frost2x: Notes and other stuff signed by an extension, using the powers of FROST [Github]

    • Fork of the popular nos2x extension

    • Uses the Bifrost library for encryption and signing of events

    • Allows FROST-based signing for any website that supports NIP-07

  • Permafrost: Ephemeral relay and remote signing server for the FROSTR protocol [Github]

    • Server-based signing device and personal ephemeral relay

    • Includes a NIP-07 based web portal for managing your server

    • Options to run as a node service (using bun) or inside a docker environment

  • 23GMT: A specialized Nostr relay with time-based constraints

    • 23GMT is a specialized Nostr relay with some constraints:

      • Only accepts posts from 23:00 to 24:00 GMT

      • Deletes its database at 01:00 GMT

      • Only accepts events with kind 1 (text notes)

      • Only accepts events with a NIP-70 “-“ tag

  • Runstr: A motion tracking app built on top of Nostr [Github]

    • Runstr aims to offer an open source, privacy-focused alternative to platforms like Nike Run Club or Strava

    • Current features include Nostr login, run tracker, global running feed, and Wavlake music

  • EnterTheNostr: Matrix-themed Nostr note composer

    • Aside from the nostr extension sign up, it features a “Load Smith” function that creates anonymous, one-time identities for users to post without a signer extension

  • POWR: Proof Of Workout over Relays [NIP-101e: Workout Events]

    • POWR is a local-first, open-source fitness app for Android and iOS supercharged by Nostr [Announcement]

  • Nostr NIP Repository Extension: Opens the NIP repository in your browser [Github]

    • “This extension provides quick access to Nostr NIPs (Nostr Implementation Possibilities) documentation directly from Kunkun. It allows you to open Nostr-related repositories and browse specific NIPs with ease.”

  • Dezh DSR: A repository containing a set of Nostr relays designed to be used for specific purposes [Github]

    • Zapoli: A relay designed to used by NIP-82 clients

    • 210maxi: A relay that only accepts 210 character events, tuned for NIP-B1 feeds

    • Pages: A relay that only keeps profiles and follow lists. You can simply resolve any pubkey from it

    • Bunklay: A relay that only accept bunker related events

  • Notebin: NIP-95: Decentralized code snippets with Lightning tips [Github]

    • The proposal defines a new Nostr event kind specifically for code snippets, separate from regular text notes.

    • Code snippets include specialized metadata such as programming language, file extension, and other code-specific attributes.

  • Sats.gg: A Nostr client focused on live streaming [Github]

    • Sats.gg helps content creators monetize their work on platforms like Twitter, Ghost, Substack, Squarespace, and Nostr

    • The platform supports integration with LNURLPay and Lightning Address, facilitating seamless payment processes for users

  • Yumyume: A FOSS social bookmarking client built on the Nostr protocol, distributing bookmarks across multiple relays [Gitlab]

    • Yumyume supports self-hosting, and operates client-side but requires a local web server for full functionality.

  • Postr For Nostr: Share your WordPress Posts to Nostr with Postr For Nostr [Github]

    • This plugin provides the ability to postr content from WordPress to Nostr.

  • Flightless2: A terminal-based user interface client for Nostr direct messaging DM [Github]

  • Nostr Components: Take Nostr content beyond Nostr clients - embed it anywhere on the internet [Github]

    • Nostr Components makes it easy to embed Nostr profiles, posts, and follow buttons in any website.

  • Hello Nostr: A collection of Nostr educational resources

    • This site serves as a companion through the Nostr universe, helping users from downloading their first client to running relays and using self-custodial Lightning wallets.

  • Nostr MCP Server: A Model Context Protocol (MCP) server that provides Nostr capabilities to LLMs like Claude [Github]

    • The server supports both hex public keys and npub formats, and implements five tools for interacting with the Nostr network:​ getProfile, getKind1Notes, getReceivedZaps, getSentZaps, getAllZaps

  • Bookstr: Bookstr is a Goodreads or Storygraph alternative built on Nostr built with Lovable AI [Github]

Software Releases & Project Updates

  • rust-nostr v0.40.0

    • Add NIP-38 and NIP-62 support

    • Add nostr parser, to easily parse any text and extract nostr URIs, URLs and more

    • Extend Tags capabilities (i.e., add deduplication support)

    • Add admission policies, to selectively select which events to allow receiving and which to reject

    • Add Mac Catalyst support for Swift package

  • Coracle v0.6.9

    • Quote addressable events by address rather than nevent

    • Bump nostr-tools to fix nostrcheck uploads

    • Show error when DM fails to send

  • Nostur v1.19.0

    • Faster feed loading

    • Improve fullscreen image viewer

    • Prefetch images when swiping in gallery

    • Add blur hash metadata when posting images

    • Keep scroll position improvements

    • Show connecting thread lines in full width image mode

    • Multiple picture select for regular posts

    • Better m3u8 video stream detection

    • Show own npub in sidebar + copy

  • Nostr PHP v1.6.0

    • Allow verification of Event objects

    • Add NIP-04 and NIP-44 encryption

  • Yana v0.16.0

    • NWC alby go 1-click connection

    • Outbox relay set calculation progress

    • Upload media using blossom

    • Video player fullscreen

    • NIP-42 Relay Authentication

  • Gossip v0.14.0

    • Zappers and amounts are now shown

    • Reactions and who reacted are now shown

    • UI: Side panel contains less so it can be thinner. Bottom bar added.

    • UI: frame count and spinner (optional)

    • Relay UI: sorting by score puts important relays at the top.

    • Relay UI: add more filters so all the bits are covered

    • Image and video loading is much faster

    • Subject in draft (when replying) can be edited

    • DM feeds automatically update, and note order is fixed

    • Logging to stderr by default

    • Relay errors and fetch errors are now considered as warnings

  • Citrine v0.7.2

    • Add a button to delete events by kind

    • Change the delete all button color and separate it from the other buttons

    • Download events just with a npub

    • Change the relays when downloading events

  • 0xChat App Desktop v1.0.2

    • Supports NIP-104 MLS secret chat

    • Supports copying images from the clipboard

    • The desktop client will remain running after the window is closed.

  • nostr-relay-tray v2.0.0

    • Support one-click to expose the relay to the internet

    • Add ability to delete events based on specific conditions

    • Breaking Change: Improved event rules structure for better control

  • Pokey v0.1.5-alpha

    • Zap notifications now displays zapper’s profile

    • Pokey will skip notifications for events containing more than a configurable amount of tagger users (Hell Threads)

  • Nostr-zap v1.3.0

    • Introduce data-naddr property as alternative to data-note-id

  • Electrum 4.6 will feature built-in Nostr support with a custom aionostr library developed specifically for this purpose [Announcement]

    • Nostr integration aims to decentralize previously centralized services, enabling users to become liquidity providers for submarine swaps and replacing central servers for PSBT cosigning.

    • Developers are also currently working on a NWC plugin to further improve on connectivity options.

Boosts

  • 01:26:33 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @pink monkey (1,000 sats)

    • @Anonymous (1,000 sats)

    • @jespada (100 sats) “I need to sleep more often, please keep shipping”

    • @. (350 sats)

    • @Anonymous (350 sats)

    • @Anonymous (350 sats)

    • @btconboard (200 sats) “⚡️⚡️👍🏻👍🏻”

    • @AVERAGE_GARY (100 sats) “Roastr exists.” “ed25519?”

    • @alanStacksSats “Good tech content away from the usual price and macro talk alot of podcasts focus on.”

Tech Tip of the Day

  • No Ghibli Chrome Extension: A Chrome extension that helps you identify and filter out Studio Ghibli-related content from Twitter [Github]

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 347

      • LN upfront and hold fees using burnable outputs: John Law posted to Delving Bitcoin the summary of a paper he’s written about a protocol nodes can use to charge two additional types of fees for forwarding payments

      • Discussion of testnets 3 and 4: Sjors Provoost posted to the Bitcoin-Dev mailing list to ask whether anyone was still using testnet3 now that testnet4 has been available for about six months

      • Plan to relay certain taproot annexes: Peter Todd announced to the Bitcoin-Dev mailing list his plan to update his Bitcoin Core-based node, Libre Relay, to begin relaying transactions containing taproot annexes if they follow particular rules.

    • 346

      • Discussion of LND’s dynamic feerate adjustment system: Matt Morehouse posted to Delving Bitcoin a description of LND’s recently-rewritten sweeper system, which determines the feerates to use for onchain transactions. See #### Lightning…

    • 345

      • P2P traffic analysis: developer Virtu posted to Delving Bitcoin an analysis of the network traffic generated and received by his node in four different modes: initial block download (IBD), non-listening (outbound connections only), non-archival (pruned) listening, and archival listening.

      • Research into single-path LN pathfinding: Sindura Saraswathi posted to Delving Bitcoin about research she conducted with Christian Kümmerle about finding optimal paths between LN nodes for sending payments in a single part.

      • Probabilistic payments using different hash functions as an xor function: Robin Linus replied to the Delving Bitcoin thread about probabilistic payments.

News & Noteworthy

Bitcoin

  • CISA: Cross-Input Signature Aggregation research paper released

    • HRF sponsors research paper on Cross-Input Signature Aggregation, a Bitcoin protocol enhancement that combines multiple Schnorr signatures into a single, smaller signature.

    • CISA aims to reduce Bitcoin transaction sizes and storage requirements, lower transaction fees, and improve bandwidth efficiency.

Lightning + L2+

  • LND’s Deadline-Aware Budget Sweeper: A new approach to Lightning transaction fee management [Matt Morehouse]

    • LND v0.18.0 introduces a completely rewritten sweeper subsystem that dynamically adjusts transaction fees based on HTLC deadlines and fee budgets.

    • The new approach makes replacement cycling attacks uneconomical by allocating up to 50% of HTLC value for fees when necessary.

    • This deadline-aware strategy provides better security than existing methods while reducing reliance on potentially inaccurate fee estimators.

  • Second launches its Ark protocol implementation on signet, inviting developers to test it before mainnet release [Second Blog post]

    • The company provides signet faucet and test store to facilitate testing.

  • Exodus announces end of Lightning wallet support on May 30, 2025, after which users cannot access Lightning wallets or funds [Announcement]

    • Users must withdraw their entire LN balance before May 30, 2025 to avoid losing access to their funds.

Business & Finance

  • Chinese automobile financing platform Cango set to become Bitcoin mining proxy for Bitmain through Antalpha connection [The Miner Mag]

    • The connection between Antalpha, Antpool, Bitmain, and EWCL suggests Cango was positioned as a mining proxy for Bitmain from the beginning, explaining Cango’s recent purchase of 32 EH/s hashrate from Bitmain despite limited cash reserves.

  • Bitcoin financial firm NYDIG to acquire Crusoe’s bitcoin mining business [Blockspace]

    • NYDIG is negotiating to purchase Crusoe Energy’s 270 MW bitcoin mining portfolio across 20 sites, including 135 employees. The acquisition allows NYDIG to expand mining operations while leveraging potential synergies with parent company Stone Ridge Holding’s 10 GW natural gas assets.

    • Crusoe Energy is pivoting away from bitcoin mining to focus on AI infrastructure, including a 1.6 GW datacenter project in Texas.

  • LōD Technologies, an IoT-driven energy intelligence provider, now operates across all Bitfarms datacenters globally [Press release]

    • The platform enables Bitfarms to track electricity markets, respond to grid conditions, and optimize power costs while maximizing demand response revenue potential.

  • Bitcoin mining hardware manufacturer Canaan Inc. secures $200 million through a Series A-1 Preferred Shares financing [The Miner Mag]

    • The funding supports R&D, production expansion, and digital mining infrastructure in North America.

  • DLC Markets announces addition of options booking and settlement to their platform, automating margin calls, liquidation, and settlement processes [Blog post]

Funding

  • OpenSats

    • Announces the Tenth Wave of Bitcoin Grants, supporting six projects advancing the Bitcoin ecosystem:

      • First-time project grants for Bitcoin Safe, Stable Channels, and Waye.

      • And renewed project grants for Floresta, Krux, and Krux-Installer.

    • Reveals the recipients of the Tenth Wave of Nostr Grants, comprising of seven innovative projects that showcase the growing versatility of the nostr ecosystem:

      • The four first-time project grants in this wave are: Chachi, Zapstore, HyperNote, and Nostr Epoxy.

      • In addition, OpenSats has renewed project grants for: Futr, Npub.cash, and Notedeck.

    • Announces its support to OpenSats-like organizations, focusing on a specific domain, namely: 2140, OpenCash, Bitshala, Summer of Bitcoin, Bitcoin Dev Launchpad, and Foundation Formation Kit

  • Vinteum announces its fellowship program, a structured phase of onboarding new open-source contributors, selecting seven fellows which are starting a six-month journey:

    • Luis Schwab (BDK)

    • João Leal (Floresta)

    • Lucas Balieiro (PlebLottery and StratumV2)

    • QLRD (Krux and Floresta)

    • Erick Cestari (Rust-Bitcoin)

    • Moises Pompilio (LDK)

    • Lucad70 (Floresta)

  • Btrust awards Q1 2025 Starter Grants to Brandon Odiwuor, active Bitcoin Core contributor, and Itoro Ukpong, contributor to Bitcoinj and BDK-FFI.

  • Btrust Builders launches five structured learning tracks to train African developers in Bitcoin open-source development [Announcement]

    • The pathways include Mastering Bitcoin, Bitcoin Core CLI, Rust for Bitcoin, Programming for Bitcoin, and Start Your Career in BOSS.

Mining

  • Foundry mines 9 blocks in a row on March 29th, from block 889982 to 889990

  • Block 888989: First public-pool block mined by self-hosted user

    • A Bitcoin block with hash 00000000000000000000a517d87e63ea04c7ec3dd51d20926e82cca5466dccaf was successfully mined on a self-hosted public-pool.

  • DMND launches Stratum V2 mining pool [Blockspace]

    • DMND, backed by Trammell Venture Partners, opens applications for its Stratum V2 mining pool, offers miners a 0% fee for two months.

  • Bitdeer introduces the A2 Pro Bitcoin miner with 14.9 J/TH efficiency, improving upon the original A2’s 16.5 J/TH and matching Bitmain’s Antminer S21 Pro [Press release]

    • The A2 Pro comes in two versions: air-cooled (255-270TH/) and hydro-cooled (500-530TH/s), with Bitdeer projecting total production of 35 EH/s of SEALMINER units by October.

  • Auradine unveils the Teraflux AH3880, the first U.S.-engineered hydro-cooled Bitcoin miner, delivering up to 600 TH/s with 14.5 J/TH efficiency, marking the first U.S.-engineered hydro-cooled Bitcoin miner [The Miner Mag]

Privacy

  • GSMA introduces end-to-end encryption for cross-platform messaging [Cyber Insider]

    • GSMA announces RCS standard upgrade with end-to-end encryption using the Messaging Layer Security protocol, marking the first large-scale interoperable encryption system between different clients.

    • Apple confirms involvement, with spokesperson Shane Bauer stating: “End-to-end encryption is a powerful privacy and security technology that iMessage has supported since the beginning.”

  • U.S. Officials misuse Signal app for Yemen strike coordination, accidentally include journalist [Cyber Insider]

    • National security team members under Trump administration mistakenly add Atlantic editor Jeffrey Goldberg to a Signal group chat coordinating military strikes in Yemen.

    • Officials including VP Vance, Defense Secretary Hegseth, and Secretary of State Rubio exchange classified tactical information on commercial smartphones using an unauthorized platform.

  • Switzerland considers expanding its surveillance law to include VPNs, messaging apps, and social networks with over 5,000 users or $100 million turnover [TechRadar]

    • The amendment creates “three types of information and two types of monitoring” that would force privacy-focused companies to modify encryption and identification practices.

  • Mullvad VPN provides details on why its iOS app doesn’t enable Apple’s ‘includeAllNetworks’ flag despite its potential privacy benefits [Blog post]

    • The Swedish VPN provider discovers that enabling this feature causes critical system failures during app updates, resulting in complete network loss on iOS devices.

Protocol

  • Bitcoin Core #31407: guix: Notarize MacOS app bundle and codesign all MacOS and Windows binaries [Merged]

  • BIPs #1800: Consensus Cleanup BIP draft [Open]

  • BDK #1839: This PR allows the receiving structures (bdk_chain, bdk_wallet) to detect and evict incoming transactions that are double spent (cancelled). [Merged]

  • LND #9620: Adds testnet4 support to lnd [Merged]

  • LDK #3624: Support scalar tweak to rotate holder funding key during splicing [Merged]

  • LDK #3649: Add BOLT12 support to bLIP-51 / LSPS1 [Merged]

  • LDK #3608: Correct and update confirmation target constant definitions [Merged]

  • LND #9458: multi+server.go: add initial permissions for some peers [Merged]

  • BTCPayServer #6581: RBF and UX improvement to fee bumping [Merged]

  • Eclair #3044: Remove amount-based confirmation scaling [Merged]

  • Eclair #3026: Support p2tr bitcoin wallet [Merged]

  • BOLT #1233: Check for preimage before failing back missing HTLCs [Merged]

  • NIP #1822: Add B0 NIP for Blossom interaction [Open]

  • NIP #1826: A way for relays to be honest about their algos [Open]

Tutorial

  • Liana Simple Inheritance Taproot Miniscript Wallet with Krux [Guide]

    • This guide details how to set up a Taproot miniscript wallet using:

      • Krux: For key creation, backup, and transaction signing.

      • Liana Wallet: For creating a “Simple Inheritance” wallet that uses the keys generated on Krux.

  • Setting up a Strfry Nostr Relay as a TOR Hidden Service [0xtr’s Guide]

    • This guide will walk you through setting up your own Strfry Nostr relay on a Debian/Ubuntu server and making it accessible exclusively as a TOR hidden service.

Cryptography

  • GPU advancements in cryptographic brute force attacks [Research paper]

    • Researchers optimize implementations of KASUMI, SPECK, and TEA3 algorithms on GPUs, achieving 235.72, 236.72, and 234.71 keys tested per second on a single RTX 4090.

    • The KASUMI implementation shows 15x improvement over previous work, reducing requirements for breaking GPRS/GSM from 2400 RTX 3090 GPUs to just 142 RTX 4090 GPUs.

Government & Political

  • DeFi Education Fund publishes coalition letter asking Congress to correct DOJ’s interpretation of money transmission laws as applied to software developers [Announcement]

    • The letter challenges DOJ’s August 2023 legal theory that expands criminal liability to developers, which signatories believe contradicts FinCEN guidance and threatens the U.S. blockchain ecosystem.

    • Coalition maintains money transmitting businesses require “possessing & transmitting funds on behalf of others” and urges policymakers to “protect U.S. software developers from regulatory overreach.”

  • France rejects encryption backdoor mandate [EFF]

    • The rejected proposal would have implemented a “ghost participant model” allowing law enforcement to silently join encrypted chats, undermining private communication security.

  • The FAIR Act aims to protect bitcoin holders from civil asset forfeiture [Bitcoin Magazine]

    • The Fifth Amendment Integrity Restoration (FAIR) Act seeks to reform civil asset forfeiture laws, requiring clear and convincing evidence before the government can seize property, thereby offering stronger protections for Bitcoin holders. ​

  • U.S. Treasury removes Tornado Cash from sanctions list and issues warning to users [The Rage]

    • OFAC has officially lifted sanctions against Tornado Cash, removing it from the SDN List after the Fifth Circuit ruled the designation unlawful in November.

    • Update: Treasury files notice to prevent Texas district court from issuing final judgment on Tornado Cash sanctions reversal, attempting to retain power to list software on OFAC’s SDN list.

      • Despite removing Tornado Cash from sanctions list, Treasury seeks to avoid binding court order that would prevent it from sanctioning similar privacy software in future, signaling continued focus on cryptocurrency privacy services.

  • US government prosecutors allegedly withhold evidence showing Chainalysis incorrectly attributed 300 million to North Korea in the Roman Storm case where they claimed 1 billion was laundered through Tornado Cash [Twitter post]

    • The defense argues prosecutors violated the Brady rule by failing to disclose evidence that “undermines a core allegation” despite prosecutors claiming the material “stretch[ed] beyond recognition what constitutes Brady material.”

  • Chainalysis sued by bankruptcy debtors for facilitating fraud in Celsius network collapse [The Rage]

    • The lawsuit claims Chainalysis “knowingly and willfully fueled one of the biggest cons in cryptocurrency history” by validating inflated asset figures calculated using methodology designed by Celsius founder Alex Mashinsky.

  • Samourai Wallet developers attend fourth pre-trial hearing [Bitcoin Magazine]

    • The court establishes pre-trial motion schedule starting May 9, with prosecution responses due June 6.

    • Expert disclosures are scheduled for July 15 (prosecution) and August 8 (defense). The trial is officially scheduled to begin on November 3, 2025.

  • U.S. IRS sharing tax data with immigration agencies for deportation purposes [The Rage]

    • The IRS has agreed to share confidential tax records with ICE and DHS to help locate and deport immigrants who have removal orders.

    • This marks the second major increase in financial surveillance under the Trump administration, following Treasury’s lowering of reporting thresholds along the Mexican border from $10,000 to $200

  • The European Central Bank plans to finish the digital euro testing phase by October 2025 [CoinDesk]

    • ECB board members are actively campaigning with European Parliament, Council, and Commission stakeholders to advance the digital euro project.

Events

Reads

  • Here’s a list of our top recently published reads:

    • Cashu: Bitcoin freebanking, by Juraj Bednar [Blog post]

    • Wallet Clustering Basics, by Spiral [The Scroll #2]

    • Bitcoin’s Duplicate Transactions, by BitMEX Research [Blog post]

    • Nostr Security: Account Hacks, by Odell [Note]

    • Comprehensive Analysis and Proposed Solutions for Mitigating Sybil Attacks on Nostr, by PPQ Deep Research [Note]

    • The bitcoiner’s guide to physical security, by Jameson Lopp [Casa Blog post]

    • Bitcoin and the Rise of Cypherpunks: A Historical Timeline, by Craig [On Bitcoin]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR093 - ECDSA Key Extraction, ESP32 Security Concerns, COLDCARD, Cove Wallet, Krux, Nunchuk, Invalid Mining Jobs, Javascript Injection Attack, CTV Back on the table? + MORE ft. Rob & Vivek]]>https://substack.bitcoin.review/p/br093-ecdsa-key-extraction-esp32https://substack.bitcoin.review/p/br093-ecdsa-key-extraction-esp32Thu, 13 Mar 2025 19:05:24 GMTI’m joined by guests Rob Hamilton & Vivek to go through the list.

Listen on your favorite podcast app

Housekeeping

  • 00:01:18 Unleashed.chat rebrands to dataMachine and enables Nostr Wallet Connect.

Urgent Vulnerability Disclosures

  • 00:01:52 ECDSA private key extraction upon signing a malformed input in Elliptic library [Vulnerability disclosure]

    • The elliptic library versions up to 6.6.0 have a critical vulnerability allowing private key extraction when signing malformed inputs, such as strings or numbers.

    • This issue arises because the library, by design, accepts hex strings as input types, leading to potential nonce reuse during the signing process.

  • 00:09:12 ESP32 Security Concerns

    • CVE-2025-27840: Undocumented commands in ESP32 Bluetooth chip raise security concerns [Tarlogic Security’s disclosure]

      • Tarlogic Security researchers discover undocumented HCI commands in ESP32 microcontrollers, which are present in over one billion IoT devices worldwide. These proprietary commands allow memory access and modifications to the chip’s functionality.

      • Post-exploitation: The hidden commands require physical HCI access and high privileges on the controller, making remote exploitation via Bluetooth impossible.

      • Tarlogic introduces BluetoothUSB, a free tool designed to democratize Bluetooth security testing across operating systems, helping manufacturers and security experts conduct comprehensive device audits without expensive hardware requirements.

    • Undocumented commands found in Bluetooth chip used by a billion devices [Bleeping Computer]

    • [NVK Tweet] [esp32.fail]

      • ESP32 is an amazing platform, but not good for securing things, especially not securing #Bitcoin.

      • Here are a few known Secure Boot Bypass Methods, including both hardware (fault injection, EMFI) and software-based attacks with emojis!

      • Unpatched Bypasses (Active Threats)

        • CVE-2023-35818 – EMFI attack bypasses Secure Boot V3 on ESP32 rev 3.0/3.1, allowing unsigned code execution & plaintext flash readout.
          🔹 Not patchable in software, requires future silicon fix.
          📄 USENIX WOOT ’24 Paper
          📄 Espressif Security Advisory AR2023-005

        • AR2023-007 – Power analysis + voltage glitch on ESP32-C3 & ESP32-C6 extracts Flash Encryption Key & bypasses Secure Boot.
          🔹 No fix yet, Espressif confirmed future silicon will mitigate.
          📄 Espressif Security Advisory

      • Patched Bypasses (Fixed in Newer Hardware)

        • CVE-2020-13629 – EMFI attack on ESP32 (rev 0/1) bypasses Secure Boot & Flash Encryption. Attackers inject faults to force execution of unsigned code.
          🔹 Patched in ESP32 V3+ (ECO3).
          📄 Raelize Research Blog

        • CVE-2019-15894 – Voltage glitch skips Secure Boot digest check, allowing execution of unsigned firmware if Flash Encryption is off.
          🔹 Patched in ESP32 V3 (ECO3).
          📄 Espressif Security Advisory

        • CVE-2019-17391** – Fault injection allows reading Secure Boot & Flash Encryption keys from eFuses, permanently compromising security.
          🔹 Patched in ESP32 V3.
          📄 Espressif Security Advisory

  • 00:21:32 Coinos revokes NWC connection secrets due to security leak concerns [Announcement]

    • Users experiencing issues with Coinos zaps via NWC are advised to generate a new connection at Coinos settings and update their Nostr app.

Vivek’s Corner

  • 00:22:51 Invalid mining jobs by AntPool & friends during forks [b10c]

    • AntPool and associated pools (CloverPool, Ultimus, Rawpool, Poolin) published invalid mining jobs with excessive coinbase output values, indicating a bug in their coinbase creation code.

    • Invalid jobs were observed during block races, particularly on March 1, 2025, and in December 2024, suggesting a pattern of errors linked to these pools.

    • Historical data shows that invalid jobs often reused coinbase output values from previous blocks, hinting at a caching issue in the coinbase building process.

    • The behavior does not appear to be a selfish mining attempt but rather a result of technical glitches in job templates or coinbase code.

    • The consistent invalid job publication reinforces the idea that these pools are interconnected and potentially operated by the same entity, warranting the label “AntPool & friends.”

    • [Boerst Tweet]

  • Mempool Partitioning and Identifying Mining Nodes [crypt-iq]

    • The study aimed to identify influential mining nodes on the Bitcoin network to assess potential attack vectors, such as mempool partitioning and pinning attacks.

    • A list of approximately 5,700 listening p2p nodes was created, filtering out those that did not accept incoming connections or participated in transaction relay.

    • Using the Candidate Selection algorithm from the CoinScope paper, the researcher conducted 100 trials, finding that major miners like Foundry and AntPool accounted for a significant portion of mined conflicts.

    • The top 200 influential nodes represented about 40% of the network’s hashrate, while a refined list of influential nodes from individual mining pools improved the representation to 50%.

    • The high rate of unintentional mempool partitioning (91%) indicates that attackers could exploit this for effective partitioning attacks, suggesting further analysis and refinement of the influential node list is warranted.

  • BIP-119 (OP_CHECKTEMPLATEVERIFY) (no activation) #31989

Bitcoin

Software Releases & Project Updates

  • 00:37:44 COLDCARD

    • New COLDCARD Release: v5.4.1 (Mk4) and v1.3.1 (Q)

      • New (Message) Signing Features:

        • Sign message from secure note text, or password note

          • Sign message with key resulting from positive ownership check. Press (0) and enter or scan message text to be signed

          • Sign message with key selected from Address Explorer Custom Path menu. Press (2) and enter or scan message text to be signed

          • JSON message signing. Use JSON object to pass data to sign

      • Delta Mode Enhancements:

        • Hide Secure Notes & Passwords in Deltamode. Wipe seed if notes menu accessed

        • Hide Seed Vault in Deltamode. Wipe seed if Seed Vault menu accessed

        • Catch more DeltaMode cases in XOR submenus

      • Address Display Changes:

        • New address display format improves address verification on screen by splitting addresses into groups of 4 and showing with a space between them

        • Related: Added option to show/export full multisg addresses without censorship

      • Other Changes:

        • Both Mk4 and Q

          • Enhancement: Add ability to switch between BIP-32 xpub, and obsolete SLIP-132 format in Export XPUB

          • Enhancement: Use the fact that master seed cannot be used as ephemeral seed, to show message about successful master seed verification

          • Enhancement: Allow devs to override backup password

          • Enhancement: If derivation path is omitted during message signing, derivation path default is no longer root (m), instead it is based on requested address format (m/44h/0h/0h/0/0 for p2pkh, and m/84h/0h/0h/0/0 for p2wpkh)

        • Mk4 Specific Changes

          • Enhancement: Export single sig descriptor with simple QR.

        • Q Specific Changes

          • New Feature: Verify Signed RFC messages via BBQr

          • New Feature: Sign message from QR scan (format has to be JSON)

          • Enhancement: Sign/Verify Address in Sparrow via QR

          • Enhancement: Sign scanned Simple Text by pressing (0). Next screen query information about which key to use

          • Enhancement: Add option to “Sort By Title” in Secure Notes and Passwords

    • New COLDCARD EDGE Release: v6.3.5X (Mk4) and v6.3.5QX (Q) - Catch-Up Release

      • Update the startup warning which now reads: “This firmware version is qualified for use with wallets (such as AnchorWatch) that keep redundant key schemas for recovery independent of COLDCARD. We support the very latest Bitcoin innovations in the Edge Version.”

      • Catch up with latest releases

      • Qualified for use with miniscript wallets, such as AnchorWatch

      • Shared Changes - Both Mk4 and Q

        • Allow origin-less extended keys in multisig & miniscript descriptors

        • Static internal keys disallowed - all keys need to be ranged extended keys

  • 00:52:47 Sparrow Wallet v2.1.3

    • OneKey Pro and Classic 1S hardware wallet support

    • Update BIP329 wallet labels export to include additional fields

    • Make BIP329 wallet labels import and export scannable

    • Add Copy Payment Code item to the transaction diagram outputs context menu for BIP47 outputs

    • Add Show Transaction as QR button to signed transaction tabs when offline

    • Upgrade libusb to v1.0.27 on all platforms

    • Add specific handling for invalid Windows device drivers on Trezor devices

    • Handle scanning and pasting server URLs in the Electrum (x.x.x.x:n:t/s) format

    • Additionally check for Trezor model against internal name and improve exception handling on no match

  • 00:54:33 Lark v1.1.0

    • Add support for OneKey Pro and Classic 1S

    • Validate and sanitize multisig wallet names on Jade, BitBox02 and Ledger

    • Remove unnecessary public key field from BitBox02 pairing config

    • Add the Jade Plus to udev rules

    • Upgrade libusb to 1.0.27

    • Throw an error if trying to sign a Taproot input on legacy Ledger firmware

    • Additionally check for Trezor model against internal name and improve exception handling on no match

    • Support Coldcard P2TR address display and show correct address for script type on message sign

    • Add specific handling for invalid Windows device drivers on Trezor devices

  • 00:55:03 Krux v25.03.0

    • Taproot and WSH Miniscript support

      • Add an indented visualization of Miniscripts for improved readability

      • Implement Miniscripts policy and cosigner verification

      • Support custom derivations

      • Detect unspendable internal keys in Taproot

      • Include various UI and settings adjustments

    • Easter Eggs Reveal

      • Hints have been introduced to help users discover hidden features, such as:

        • Swiping sideways to change the keypad keyset

        • Switching between camera modes

        • Adjusting QR code brightness

        • Rearranged Keypad Keysets

        • Keypad keysets were organized to group similar keys and help with visibility

      • More Camera Modes

        • A zoomed camera mode is now available for all cameras

        • An anti-glare mode has been added for the GC0328 camera

      • More Intuitive Tamper Check

        • The Tamper Check Flash Hash is now displayed immediately after generating the Tamper Check code

      • Display Customization Options

        • Screen orientation can now be flipped on Yahboom and WonderMV devices

      • SD Card PSBT Signing Preserves All Fields

        • When signing PSBTs via SD card, all fields—including signatures from other keys—are preserved

        • This ensures a seamless signing process across multiple devices and locations, allowing a single PSBT file to be incrementally signed by different signers

      • Other Bug Fixes and Optimizations

        • New encrypted mnemonics now display a key strength score during confirmation

        • Address scanning for Blue Wallet has been updated to match its revised export format

        • A faster algorithm for double mnemonic calculation has been introduced

        • PSBT change detection has been made more restrictive

  • 00:56:37 Cove Wallet

    • v0.2.1

      • Add more plausible deniability to decooy PIN mode

        • Pretend to change PIN and trick PINs in the settings screen

      • Make it easier to click the “Change PIN” button in the settings screen

    • iOS Beta, is now available on TestFlight [Announcement]

      • It supports importing hardware wallets via NFC, file, and QR code.

      • Key features include creating and backing up hot wallets, sending Bitcoin via PSBTs, managing multiple wallets, and connecting to personal nodes. Users can also set Trick Pins for added security and lock wallets with Face ID or a PIN.

      • Upcoming updates will introduce CoinControl, TapSigner and SatsCard support, and UTXO locking/unlocking. An Android version is planned for release in a few months.

  • 00:59:09 Nunchuk Desktop v1.9.43 / Android v1.9.64

    • New and improved encrypted group wallet:

      • End-to-end encrypted group wallet and communication

      • Single-file recovery using wallet descriptors

      • Compatibility with hardware signing devices

      • Supports both standard multisig and Taproot multisig

      • Automatic message deletion for enhanced privacy

  • 01:00:32 BTCPayServer v2.0.7

    • Display fiat amount previews in Transaction Details page

    • Greenfield: Adding endpoint to set server email settings

  • 01:00:44 Bitcoin Keeper v2.0.2

    • Redesign manage subscription screen

    • Support External Key for Miniscript vaults

    • Support Specter DIY for Miniscript vaults

    • Improve ColdCard NFC integration

    • Improve import old wallets speed

  • 01:01:25 BlueWallet v7.1.0

    • Add support for importing minikeys (Casascius Coin, Satori Coin etc.)

  • 01:02:08 Bitcoin Safe

    • v1.1.0

      • Support for Jade Plus

      • Deb build

      • Xpub import from USB signers for different accounts

    • v1.0.7

      • Add languages: 🇲🇲 Burmese - မြန်မာ, 🇰🇷 Korean - 한국어

  • 01:03:15 Bitkey App v2025.1.1

    • Inheritance is here. You can now add a beneficiary of your Bitkey wallet in the app.

    • It allows users to designate beneficiaries for their Bitcoin without sharing PINs or seed phrases

  • 01:04:05 libwally-core v1.4.0

    • tx: Add caching to signature hash generation/PSBT signing making signing faster

    • tx: Add support for generating Elements taproot signature hashes and signing Elements taproot inputs

    • descriptor: Add support for “tr()/rawtr()” keyspend-only taproot descriptors

    • descriptor: Add support for parsing Elements-core compatible descriptors, including taproot

    • psbt: Add accessors for keypath/taproot related fields

    • pset: Add support for ELIP-101 genesis hash

    • psbt: Add support for serializing/parsing/combining signature-only PSBTs

    • script: Add support for generating Elements p2tr scripts

    • BIP85: Add support for deriving RSA keys via BIP85

    • base64/psbt: Add support for parsing from known length (non-NUL terminated) strings

    • build: Add Debian Bookworm docker build image

  • 01:06:00 Bisq2 v2.1.6

    • Security update: To enhance security for buyers, sellers must have sufficient reputation to secure a trade for the specified amount. See new formula.

    • New features:

      • The new Profile Card comes with many features. Find the user profile details, trade terms, reputation, offers created and the public messages posted by clicking on the profile icon or profile name anywhere in the app.

      • To improve on privacy, sensitive trade data will be automatically deleted after a certain period of time

    • Improvements: The create offer wizard has been consolidated into three steps to improve quickness and ease of use

  • 01:06:04 RoboSats v0.7.4-alpha

    • You can now see LNp2pBot orders on RoboSats mobile app

    • Order creation view now displays all available payment methods

    • Changed URLs to https://robosats.org and new onion (#Robosats’ previous clearnet and onion domains are no longer accessible as the original maintainer, @Reckless_Satoshi, has been unreachable for months [Note])

    • Libraries updates

  • 01:06:08 Boltz Exchange

    • boltz-client v2.4.0

      • With this release, boltz-client will start to use the highly anticipated Discount CT on the Liquid Network and introduces a new pro configuration option for using Boltz Pro fee rates

    • boltz-web-app v1.6.2

      • Transaction broadcasts via block explorer

      • Add tropykus and speed as integrations

    • boltz-backend v3.9.1

      • Add custom fees and limits based on referrals

      • Fixes for RSK swap

      • Fixes for handling CLN xpay payment failures

      • Lightning network information API

  • 01:06:10 Zaprite v2025-02-17

    • Copy Contact ID: Add an option to copy the Contact ID from the View Contact page

    • Improve the UI for Bank/Wire Transfer payment information on our Checkouts

    • Update the Delete Transaction modal to show more helpful messaging.

    • Adjust login/sign-up page to fallback and use a Recaptcha Puzzle when necessary

  • 01:06:13 Blockstream Explorer API Update

    • New features include a 99.9% SLA, transparent pricing, and an open beta with a free tier for developers.

    • Built on open-source Esplora, the API simplifies blockchain data access, supporting wallets, exchanges, and other applications.

  • 01:07:22 Mempal v1.5.2

    • Add welcome screen with quick tips

    • Add hashrate, difficulty, and adjustments to dashboard

    • Modify widget auto-refresh intervals

  • 01:07:29 Iris Wallet desktop v0.1.2 - First experimental release

    • Attached you can find 2 versions running on different bitcoin networks, testnet and a shared public regtest.

    • For the latter you can use our telegram bot to get some funds and play around.

  • 01:07:31 Utreexo

    • v0.4.0

      • Export detectOffset

    • v0.3.3

      • Export parent util functions

    • v0.3.2

      • Export childMany, leftChild, and rightChild

    • v0.3.1

      • Export detectRow

  • 01:07:34 ESP Miner v2.6.0b8

    • Show firmware updates on the display

    • Trim spaces from SSID

    • Add sorting switch to swarm page for hostname and ip

    • Show share reject reasons

    • Remove unit test workaround for qemu

    • Frequency transition

  • UTXOracle is now available again [Announcement]

    • UTXOracle is a tool that estimates Bitcoin’s daily price by analyzing on-chain transactions, avoiding reliance on exchange rates

    • The tool uses a method involving clusters of on-chain payments at round USD amounts to calculate the price, offering an alternative to exchange-based averages

  • Metamask announces “full bitcoin support” for Bitcoin within its wallet coming in Q3 2025 [Roadmap]

Project spotlight

  • 01:07:38 Reorg Calculator: A calculator to estimate the probability of an attacker reorganizing z blocks, considering their hash power and the time ratio (κ)

  • 01:07:51 Bitcoin Core Config Generator: A TUI for generating Bitcoin Core configuration [Github]

    • Provides an interactive terminal interface to generate bitcoin.conf files for Bitcoin Core.

    • Features include form-based configuration, real-time validation, and conditional field display.

  • 01:09:05 Bitcoin Core Snapshots: Fast-track your node setup with pre-synced blockchain data [Github]

    • The website offers verified Bitcoin blockchain snapshots at specific points, reducing initial sync time for new nodes

    • Snapshots are available for mainnet (pruned at block height 885,445), testnet4 (full at block height 71,808), and signet (full at block height 237,052)

  • 01:09:11 Boot Protocol: A decentralized protocol for bitcoin hashing nodes to share block rewards and reduce variance [Github]

    • The protocol aims to solve Bitcoin mining centralization by enabling miners to share block rewards without traditional pools. It reduces variance up to 16x compared to solo mining while maintaining decentralization.

    • The system operates through a “Winners List” of 15 addresses that have provided the highest difficulty hashes. Block rewards are split between these addresses and the block finder’s address.

  • 01:09:18 multisig-backup: Encrypt and inscribe your k-of-n multisig descriptor — recover with any k seeds [Github]

    • Sensitive data, such as master fingerprints and xpubs, is encrypted to prevent unauthorized decryption, requiring multiple seeds to recover the descriptor.

    • It utilizes Shamir’s Secret Sharing and ChaCha20 for encryption, and integrates with hardware wallets for the recovery process.

  • 01:10:04 regtest-in-a-pod

    • Companion to the Using Podman Containers for Regtest Bitcoin Development blog article.

    • Allows you to create a robust regtest environment which you can turn on and off at will using Podman. The final environment includes a lot of useful tools, namely:

      • A bitcoin core node and daemon (serving compact block filters)

      • bitcoin-cli enabled

      • An Electrum server

      • An Esplora server

      • A block explorer

      • Useful just commands for working with the daemon from your command line

  • 01:09:58 Wallet backup: A document standardizing Bitcoin wallet backup formats [Github]

    • The document proposes a JSON-based format to export wallet data, including accounts, descriptors, keys, labels, transactions, and PSBTs.

  • Explora: A visual tool to follow a chain of transactions [Github]

    • The tool utilizes APIs from mempool.space and ankr.com to retrieve transaction data

    • Users can input a transaction ID, view transaction details, and navigate through related inputs and outputs

  • Panopticon: A tool to monitor Bitcoin addresses privately [Github]

    • Users receive alerts from their own Electrum server, while notifications are sent locally, not through Google or Apple’s notification systems.

  • brute-samourai: A resumable samourai.txt backup file cracker, written in Go [Github]

    • A tool that enables brute-force attacks on Samourai Wallet backup files, based on Calin Culianu’s brute38

    • Users can specify character sets, passphrase lengths, patterns, or input files.

  • Genesis Key: A 256-bit private key designed for durable offline Bitcoin storage

    • The key ensures privacy by avoiding electronics and microchips, with entropy generated offline.

  • 21e15: A Micro-Seed kit to stamp seed phrases on a single stainless steel washer

    • The kit allows users to store up to 240 characters (120 per side) on a quarter-sized washer.

  • Cypherbox: A modular Bitcoin-Lightning application for self-custody [Github]

    • Cypherbox is a fork of BlueWallet v6.5.1, made to onboard newer users to advanced self-custody, supports integration with hardware wallets, and utilizes the Coinos.io API.

  • BitSpenda: Send bitcoin and receive mobile money instantly. No account. No KYC.

    • BitSpenda allows users to send Bitcoin, converting it into mobile money for recipients in Ghana, with plans for expansion.

  • Coinflip: A PoC exploring multiparty contracts on Ark

    • Real-time coordination is achieved through Nostr, while Ark handles validation and settlement.

  • Bitcoin Forking Guide: A guide aimed at achieving consensus before code changes

    • The guide outlines a six-phase process: Research and Development, Power User Exploration, Industry Evaluation, Investor Review, Finalization, and Activation.

Vulnerability Disclosures

  • 01:11:56 JavaScript injection attack: Safe{Wallet} confirms targeted TraderTraitor attack on Bybit resulting in $1.4 billion stolen [Bybit’s Audit report] [Safe{Wallet} Investigation update]

    • Forensic analysis confirms that the threat group TraderTraitor successfully compromised a Safe{Wallet} developer’s machine, extracted AWS session tokens from that machine in order to bypass multi-factor authentication.

    • It then enabled the attackers to target Bybit by spoofing their UI interface during transaction signing.

    • “As @adam3us suggests, #Web3 and #DeFi visibility is a general intrinsic problem of ALL Hardware Wallets, not of a specific vendor. A low power, air-gapped, small screen device will never be a good place to verify a complex Web3 or DeFi transaction.” [Tal Be’ery]

  • 01:15:05 Malicious PyPI package ‘set-utils’ steals Ethereum private keys by hooking wallet functions [The Hacker News]

    • The ‘set-utils’ package, mimicking popular Python utilities, targeted software wallet developers.

    • It intercepted Ethereum private keys during wallet creation and exfiltrated them through regular on-chain transactions.

  • Brain Wallet vulnerability?: A user withdraws 0.024 and 0.06 bitcoin from an exchange to a low-entropy or compromised address [Twitter post]

    • Bots snipped both transactions from the mempool and stole the funds within milliseconds, ensuing a Replace-By-Fee bidding war burning the entire amount in fees.

  • 01:16:57 OpenSSH vulnerabilities expose clients and servers to attacks [Qualys Security Advisory]

    • The Qualys Threat Research Unit has identified two OpenSSH vulnerabilities:

      • CVE-2025-26465: MitM attack against OpenSSH’s VerifyHostKeyDNS-enabled client: allows machine-in-the-middle attacks when the VerifyHostKeyDNS option is enabled, even without user interaction.

      • CVE-2025-26466: DoS attack against OpenSSH’s client and server: permits pre-authentication denial-of-service attacks, consuming system resources and potentially disrupting SSH services.

  • 01:17:05 USB side-channel attacks: A new privacy threat through hub congestion [CyberInsider]

    • Security researchers discover a novel USB side-channel attack that exploits hub congestion to monitor user activities without physical access or malware installation. The attack analyzes traffic patterns in shared USB bus architecture.

    • The keystroke recovery attack uses a rogue USB mouse to detect typing patterns, achieving 36.3% accuracy for password prediction within top 10 guesses. Website fingerprinting attacks reach 83.4% accuracy in identifying visited sites.

  • 01:17:37 Cellebrite: Critical Android security flaws exploited to target student activist in Serbia [TechCrunch]

    • Amnesty International discovers three zero-day vulnerabilities in Android’s Linux USB kernel, potentially affecting over a billion devices. Google has since fixed these flaws, which were used by Cellebrite’s forensic tools to unlock phones.

    • The vulnerabilities were uncovered during an investigation of a Serbian student activist’s phone, who was targeted by the Serbian Security Information Agency. The authorities used Cellebrite software to unlock the Samsung A32 phone without consent.

  • 01:17:49 Messengers vulnerabilities:

    • Meshtastic firmware vulnerability allows user impersonation [Disclosure]

      • A flaw was discovered in Meshtastic firmware versions up to 2.5.18, enabling attackers to send messages that appear as if sent by any user.

      • The vulnerability involved crafting MQTT messages misinterpreted as direct text messages. However, it did not bypass PKI but caused packets to be displayed as received via PKI when actually sent using the channel key.

    • EvilLoader: Android Telegram vulnerability enables malicious APK distribution through fake video files [Mobile Hacker]

      • It works by manipulating HTML files with MP4 extensions, causing Telegram to misidentify them as legitimate videos. When users attempt to play these files, they are prompted to install external applications that could contain malware.

    • Russian hackers exploit Signal’s device-linking feature for espionage [Google Threat Intelligence Group]

      • Attackers send phishing messages with spoofed QR codes, tricking victims into linking their Signal accounts to devices controlled by the hackers, enabling real-time message interception without full device compromise.

      • Google’s Threat Intelligence Group warns that these techniques may be used against other encrypted messaging services like WhatsApp and Telegram.

  • 01:17:56 GitVenom: A cryptocurrency theft campaign using fake GitHub projects [Secure List]

    • Threat actors have created hundreds of fake GitHub repositories, posing as legitimate projects like Instagram automation tools and Bitcoin wallet managers.

    • These repositories contain malicious code that deploys stealers and backdoors, to compromise users’ systems.

    • A clipboard hijacker within the malicious code replaces copied cryptocurrency wallet addresses with attacker-controlled ones.

  • 01:18:10 Stablecoin payment firm Infini loses $50M in exploit, developer deception suspected [Coin Telegraph]

    • The firm lost $50 million in USDC due to an exploit by a rogue developer who retained administrative privileges after project completion.

  • 01:18:18 Five dollar wrench attacks:

    • eNCA Report: Cryptocurrency is becoming a more common method for ransom demands in modern kidnappings

      • Crime expert Yusuf Abramjee reports a rise in kidnapping cases with many involving express kidnappings or ransom demands.

      • Kidnapping operations have become more sophisticated, with specialized teams handling different stages such as tracking, abduction, and ransom negotiations.

    • Streamer Amouranth, reports being attacked in a home invasion by armed intruders demanding cryptocurrency [Daily Star]

      • She says they pulled her from bed, pistol-whipped her, and forced her to log into her phone at gunpoint.

      • Amouranth previously revealed her $20 million bitcoin holdings to her audience.

    • In Vietnam, a Chinese man was successfully rescued from kidnappers by Ho Chi Minh City police [Tuoi Tre News]

      • The criminal group, consisting of three Chinese nationals and three Vietnamese accomplices, attempted to extort 600,000 USDT from their victim, who was held in a remote area.

    • Six men are accused of kidnapping and holding hostage a family and a nanny for five days, in October 2024, demanding $15 million in cryptocurrency. [Chicago Tribune]

      • The FBI arrested one suspect in January, while others are believed to have fled to China. Around $9 million of the ransom remains unaccounted for.

    • South Korean police arrest four individuals linked to the murder of a Chinese man in Jeju Island [Decrypt]

      • The victim had traveled to Jeju Island to conduct a private cryptocurrency transaction of about $52,500.

Audience Questions

  • Thanks to everyone who sent in questions. Remember to send yours to questions@bitcoin.review.

    • 01:20:00 Audience question for guests to comment on a flaw in Bitcoin Core regarding mining pools and their vulnerability against block withholding attacks, referring to this post -@anon

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • SimpleX

    • v6.3.0

      • Better groups:

        • Mention members and get notified when mentioned

        • Send private reports to moderators

        • Delete, block and change role for multiple members at once (Android and desktop only)

        • Faster sending messages and faster deletion

        • Better chat navigation

      • Organize chats into lists to keep track of what’s important:

        • Jump to found and forwarded messages

        • Better privacy and security

      • Private media file names:

        • Message expiration in chats

    • Privacy policy Update

      • Add content license in groups, and stated that NO LICENSE is granted to the server operators or ourselves

      • Add the conditions of access to preconfigured servers via modified 3rd party applications (The previous policy version prohibited it, unintentionally)

      • Clarify definitions:

        • “Aggregate statistics” explicitly excludes any stats that can be related to particular users

        • The content that can be removed changed from “identified illegal content” to “illegal content identified in publicly accessible resources”

  • Sideband v1.4.0

    • Add ability to export telemetry to MQTT brokers

    • Add MQTT renderers for all telemetry types

    • Add LXMF Propagation Node statistics sensor type to Telemeter

    • Add RNS Transport statistics sensor type to Telemeter

    • Add Connection Map sensor type to Telemeter

    • Add periodic cleaning of old telemetry data from the database

  • NomadNet v0.6.1

    • Add tabs to the announce stream

    • Improve LXMF propagation node list UI

    • Add acceptance rate stat to propagation node list entries

  • Rdsys v1.0 - First Rdsys table version

    • The Tor Project replaces BridgeDB with Rdsys for distributing bridges

      • moat: the type of the captcha bridge response is ‘moat-bridges’

      • bridgedb-metrics: use country if available

  • Mullvad partners with Obscura VPN and launches a “two-party VPN service that uses our WireGuard VPN servers as its exit hop”. [Announcement]

    • Obscura’s custom protocol, based on QUIC, mimics HTTP/3 to bypass firewalls and censorship.

  • Mynymbox launches email hosting service [Announcement]

    • Mynymbox introduces a privacy-oriented email hosting service supporting POP3, IMAP, SMTP, and webmail. Users can bring their own domain and are not restricted to a specific email client.

  • Kagi now offers Privacy Pass, a cryptographic protocol that ensures user authentication without tracking personal data or searches [Announcement]

    • The protocol adds an extra privacy layer by unlinking user searches from their identity.

Project spotlight

  • Rayhunter: Rust tool to detect cell site simulators on an orbic mobile hotspot [Github]

    • Rayhunter is an open-source tool that runs on affordable Orbic RC400L mobile hotspots to detect cell-site simulators used for mobile surveillance.

    • The tool monitors control traffic between mobile networks and hotspots, alerting users to suspicious activities through a simple color-coded interface and storing detailed logs for expert analysis.

  • RAVA: an Open Hardware True Random Number Generator based on Avalanche Noise [Github]

    • RAVA is an open-source True Random Number Generator offering high-quality entropy with independent random bit generation.

    • It features dual entropy cores, differential design, and full transparency with accessible hardware and software for customizability and integration.

  • PrivX: A secure, private pastebin alternative without JavaScript [Github]

    • It features AES-256 encryption, assigning unique keys to each paste, and employs a zero-knowledge architecture, preventing administrators from accessing stored data.

    • PrivX is a fork of IncognitoBin, and is also available on Tor Onion.

  • CypherHub: A verifiably secure dead drop for sharing Bitcoin addresses and other secrets [Description]

    • A tool for sharing Bitcoin addresses and confidential information without logging into accounts

    • Data encryption happens client-side in the browser, ensuring the server never receives unencrypted information. The recipient decrypts it using a shared password.

Nostr

Project spotlight

  • 01:22:32 24242.io

  • 01:22:49 nostr.media

  • 01:22:58 Frostr: Simple t-of-n remote signing and key rotation protocol for nostr, using the powers of FROST [Github]

    • FROSTR enables users to split their secret key into decentralized, distributable shares, enhancing security.

    • Users can sign messages using t-of-n signing devices; if one share is compromised, the secret key remains safe.

    • Shares can be discarded and replaced without changing the secret key or identity.

  • 01:23:33 nostr-double-ratchet: Implementing double ratchet encryption in nostr [Github]

    • The implementation includes features such as invite links for secure session key exchange, with installation available via npm or yarn. (The project is currently a work in progress)

  • 01:23:44 DVMCP: Bridging MCP servers to Nostr’s data vending machine ecosystem [Github]

    • DVMCP enables the integration of Model Context Protocol (MCP) servers with Nostr’s decentralized Data Vending Machine (DVM) ecosystem.

    • The project includes packages for bridge implementation, discovery service for MCP tools, and shared utilities across components.

  • 01:23:53 Samiz: BLE mesh for nostr notes when the internet is down [Github]

    • Samiz is a Bluetooth mesh system for sharing Nostr notes without internet, relying on local synchronization between devices.

    • The system works by creating a session where devices near each other can automatically share and store notes, even in remote areas or during internet outages.

  • 01:24:00 Welshman: A nostr toolkit focused on creating highly a configurable client system, extracted from the Coracle nostr client [Github]

    • “A series of independent libraries for managing every aspect of your Nostr application.”

  • 01:24:09 Norma: A Nostr Relay Management Panel [Github]

    • Norma (Nostr Relay Manager), is a nostr client based on NIP-86 (Relay Management API)

  • 01:24:20 Wallet Relay: High performance relay for enabling NWC & Cashu Wallets [Github]

    • “Wallet Relay is a specialized relay for wallet service providers to process NWC and Cashu Wallet events.”

  • 01:24:27 Nostr0: A web application that allows you to search and visualize Nostr events using npubs [Github]

  • 01:24:35 nAuth Protocol: decentralized two-party Authentication and secure document transmission [Github]

    • The nAuth protocol enables two parties to authenticate each other and securely share documents without third-party involvement

    • Designed for scenarios like patient-physician interactions, nAuth allows either party to initiate authentication, accommodating devices with limitations such as the absence of a camera.

  • 01:24:43 Hostr: Rental accommodation using purely peer-to-peer technologies such as Nostr [Github]

    • The projects implements several NIPs: NIP-01 for event creation and subscription, NIP-05 for mapping Nostr keys to DNS-based identifiers, and NIP-33 for creating and updating listings and bookings.

Software Releases & Project Updates

  • Primal

    • v2.1.9

      • Multi-account feature

      • Deep-linking

      • Articles pagination

      • Share photo/video via Primal app

      • Bigger previews for Github links

      • Legends contributions

      • nevent with relay hints when copy note id

      • nevent and nprofile when creating primal share links

      • nevent and nprofile in the note editor for mentioned notes and users

      • Ellipsis links in note content

    • v2.1.6

      • Improved feeds

      • Deep linking threads, articles, profiles

  • Coracle

    • v0.6.8

      • Correctly fetch and render NIP 22 comments

    • v0.6.7

      • Add note info to DMs

      • Make lnurl parsing more robust

    • v0.6.6

      • Show complete website/lnurl

      • Scan images for sensitive content

      • Make muting on feeds more strict

      • Apply muted words to nip05

    • v0.6.1

      • Use wasted space on mobile notes

      • Show PoW difficulty in settings

    • v0.6.0

      • Add support for tor/local relays

      • Use nstart for onboarding process

      • Show more details on reaction notifications

      • Improve mutes, add setting to completely hide muted people

      • Add kind 20 rendering support

      • Add pinned note support

      • Remove broadcasting of note parents

      • Add note scheduling via DVM

  • Flotilla

    • v0.2.12

      • Make error reporting and analytics optional

      • Replace long press with tap target

      • Add reply to chat on mobile

    • v0.2.11

      • Add in-app signup flow on ios

      • Add profile deletion

  • Iris Update

    • Deploy double ratchet messaging (See Iris software release)

  • Yakihonne

    • Web v4.4.0

      • Zap polls can now be added directly from the list or created instantly within notes and comments

      • Muting users is now more reliable

      • Users can download and export their NWC secret for wallets

      • Wallets and account credentials are automatically saved upon signup and logout

      • Faster login and signup when interacting with Yakihonne while logged out

    • Mobile v1.6.6

      • Ability to export your NWC wallets and your keys

      • Blink wallet is now available as one of the external wallets that can be used

      • Private messages drafts are now available

      • Notes stats optimised

      • Wallet management overall performance has been improved

  • nos.social

    • v1.2.1

      • Add Lists view and two ways to navigate to it

      • Add view for editing a list’s title and description

      • Add List detail view

      • Add view for managing users in a list

      • Add ability to delete lists

      • Add analytics for feed source selection and lists

      • Internal Changes:

        • Add function for creating a new list and a test verifying list editing

        • Localized strings on the feed filter drop-down view

        • Audit codebase for strict access control and mutability annotations

  • Keychat App

    • v1.27.2 - Amber Login

      • Support for logging in or importing accounts using amber app

      • Support for amber’s signMessage, signEvent, nip04, and nip44

      • Refactored routing for the room settings page

      • Browser support for sharing URLs to rooms

    • v1.26.8

      • Add a scan button to the Cashu page

      • Remove pubkeys from listening when disabling the chat identity

  • Amber

    • v3.2.5

      • Add scroll bars

    • v3.2.3

      • Add translation string for sign_message method

      • Add a log when encryption/decryption fails

    • v3.2.2

      • Allow to always reject permissions on the multi event screen

      • Allow copying the bunker uri after connected

      • Don’t try to url decode requests by native apps

  • Algo Relay

    • v0.2.0

      • User Dashboard:

        • Allows any npub to login to the relay

        • Ability to view the data used by the algorithm to generate a feed

        • Ability to customize the weights to curate your own feed

    • v0.1.5

      • Switch import back to 30 days

      • Default to kind 1 if empty filter

      • Sequential Migrations

      • Page Handlers: introduces a new pattern to define static pages and api endpoints with a mux router

  • 0xChat App v1.4.7-beta

    • Major Updates:

      • Private chat implementation changed to NIP-104 Nostr MLS (NIP-104 MLS is still in beta and should be used for testing purposes only.)

    • Other Updates:

      • NIP-17 and NIP-29 messages now support q tags

      • You can swipe left to reply on your own messages

      • Chat messages now support code block display

      • Copy images from the clipboard

  • Nostur v1.18.1

    • Floating mini video player

    • Videos:

      • Save to library

      • Copy video URL

      • Add bookmark

    • Improve video stream / chat view

    • Top zaps on live chat

    • Posting to Picture-first

    • Profile view:

      • Show interactions with you (conversations, reactions, zaps, reposts)

      • Show actual reactions instead of only Likes

    • Improve search + Bookmark search

    • Detect nsfw / content-warning in posts

    • ‘Show more’ to show reactions outside Web of Trust

    • ‘Show more’ to show zaps outside Web of Trust

    • Support .avif image format, .mp3, and .m4v video format

    • Improve zap verification for changed wallets

    • Improve outbox support

    • Show label on restricted posts

    • Low data mode: load media in app on tap instead of external browser

  • Nowser v1.0.0

    • Linux webview support

    • NIP46 encrypt and decrypt method change to NIP44

    • i18n support

    • Android signer try to get code by currentUser

    • URL input support direct search someting

    • Web URl input add suggestion

  • BitBanana

    • v0.9.1

      • Pick first hop on lightning payments (LND)

      • Rebalance channels (LND, use first and last hop in a self-payment)

      • Inspect LND and Core Lightning logs

      • Add search and verbosity filter to log view

    • v0.9.0

      • Add Coin Control support

      • “Send all” option

      • Support for custom BlockExplorers on Regtest nodes

      • Fixes for nodes with more than 500 outgoing lightning payments

      • Performance improvements for nodes with lots of payments

  • Kyoto v0.9.0

    • Introduce log level and optimize release builds to remove heap allocations for debug messages

    • Configure a custom DNS resolver

  • Mostro v0.13.2

    • Feat: Put the user’s reputation updated in the events

    • Feat: Do not allow a taker to take multiple orders at once

    • Shows relay list on relay list event job

    • Fix on some full privacy cases

    • Correct full privacy mode check when orders arrives

  • Grain v0.3.0

    • Nostr Login & Profile Page:

      • Introduce Nostr login to the front end, allowing users to authenticate using their Nostr key.

      • Future updates will add more front-end functionality, including event management, delete requests, relay configuration for operators, and a dashboard with relay statistics.

    • User Sync (Experimental):

      • New user sync functionality allows the relay to sync events for its users from their outboxes.

      • Add configurable sync options: define which event kinds to sync, define a limit of how many events to retrieve, and exclude non-whitelisted users from sync.

  • Nostrmo v2.9.6

    • This release mainly change remote signer (NIP-46) ‘s encrypt method from NIP-04 to NIP-44.

  • OpenLibrarian v0.1.7

    • Add Book reviews

    • NIP-07 Login

    • Extensive client-side rebuild

    • Add retries of get_default_pages on progress objects

  • GitPlaza: Nostr git stuff client for Desktop [Codeberg]

    • GitPlaza is a Desktop Nostr client specialized in handling git stuff

    • V0.1.0 - First release

      • Login via nsec

      • Show activity feed of people you follow

      • Create issues

      • Comment on issues

Lightning + L2+

Project spotlight

  • Chantools: Tools for managing LND and Lightning Network channels [Github]

    • Chantools is a collection of tools for managing LND and Lightning Network channels, especially in case of failures.

    • It provides recovery options for scenarios like node crashes, missing backups, or issues with unconfirmed channels.

  • Hashpool: An accountless mining pool that represents mining shares as ecash tokens [Github]

    • The system utilizes “eHash” tokens, which are ecash tokens backed by proof of work rather than bitcoin. These tokens mature over time and can be traded as mining futures, allowing miners to hedge risks and buyers to purchase bitcoin at discounted rates.

    • While Hashpool operates on a custodial basis through ecash mints, it offers perfect privacy through blind signatures. The platform enables small-scale miners to participate without KYC requirements and maintains no minimum withdrawal thresholds.

  • ZapGram: Bitcoin Lightning Wallet on Telegram [Github]

    • ZapGram integrates a Bitcoin Lightning wallet directly into Telegram, permits transactions within the messaging platform.

  • Quest for Sats: Geocaching with Bitcoin

    • Quest for Sats combines geocaching with Bitcoin, allow users to find hidden containers in their area and withdraw their earnings using a Lightning wallet.

Software Releases & Project Updates

  • CLN v25.02

    • Highlights for users:

      • Channel backup turns our peers into watchtowers by now allowing your node to generate penalty transactions

      • Blacklisted runes can now be restored via relist

      • xpay has many, many bugfixes, and is now almost seamlessly compatible when xpay-handle-pay is used

      • lightning-cli has neater help output, and doesn’t crash occasionally on xpay notifications

      • setconfig does more safety checks and uses a separate “config.setconfig” file for runtime changes

    • Highlights for the network:

      • Splicing: stricter checking for better interoperability with Eclair.

    • Highlights for developers:

      • clnrest is now a rust plugin

      • listpeerchannels now contains fieldstheir_max_htlc_value_in_flight and our_max_htlc_value_in_flight to better calculate channel limits

      • New notifications plugin_stopped and plugin_started

      • fetchinvoice now has BIP353 DNS payment instruction support

  • Lightning Terminal v0.14.1

    • This version of Lightning Terminal (LiT) ships the first update to the non-experimental version of Taproot Asset Channels

    • Breaking changes

      • Taproot Asset Channels: Taproot Asset channels are NOT backward compatible with any previous version of Lightning Terminal

      • Oracle RPC: The RPC protobuf definitions for the Price Oracle have changed. Asset exchange rates are now expressed as FixedPoint to achieve better precision

      • Configuration changes: The configuration value and command line flag now needs a value and is no longer a boolean. The value now controls whether the node’s universe database can be accessed over RPC and either read or written to or both.

      • litcli changes: The Taproot Asset Channel related sub commands of litcli ln no longer require a custom macaroon to be specified, they now work with the default lit.macaroon

  • Phoenix Wallet v2.5.0

    • (android) Improved scanner performances: The scanner should be able to read QR codes faster, and do so on a wider range of devices

    • Access to Tor now requires a third-party Tor Proxy VPN app (e.g. Orbot): With the Tor connection managed as a persistent VPN by a dedicated app, the connection is more stable, and background payments work much better.

    • (ios) Display the final wallet balance in the home screen: Pending on-chain funds are now displayed in an updated window in the Home screen ; it also shows the funds available in the final wallet.

    • (android) Removed legacy app: The old legacy app has now been removed. Along with other optimisations, this means the APK is now much smaller (16.5 MB instead of 72.5 MB).

    • Note that there has been a major database rework in this version, which is not visible to the user but impacted many files in the project.

  • Phoenixd v0.5.0

    • Major rework of the internal payments db

    • No more linux native build issues due to old toolchain, should build with no dependency on most recent distributions

    • Rolling log file

    • Fixed a memory leak in the TCP reconnection logic

    • New --seed-path configuration option

    • Ability to lookup outgoing payment by payment hash

  • Zeus v0.10.0-rc5

    • Renewable channels

    • NWC client support

    • Ability to create multiple Embedded LND ‘node in the phone’ wallets

    • Ability to delete Embedded LND wallets

    • Embedded LND: v0.18.5-beta

    • New share button (share ZEUS QR images)

    • Activity: highlight filter icon when filters active

    • Tools: Export Activity CSVs, Developer tools

    • Activity: filter by max amount, memo, and note

    • CLNRest: add payment timeout setting

    • Receive: add advanced settings toggle

    • ZEUS Pay: ability to delete addresses

  • Fedimint v0.6.0 - On-Chain for Everyone

    • The on-chain wallet is no longer considered “expert-only”

    • Other highlights since v0.5

      • Federation will now reject attempt to reuse ecash blind nonces, preventing possibility of loss of funds even in the event of client-side bugs and data corruption

      • Fedimint will now query (configurable) external sources for feerate information to improve real time fee estimation

      • On-chain feerate multiplier have been lowered, as it no longer needs to be as conservative

      • LN payment events are now tracked, allowing tracking profit and fees statistics

      • It’s now possible to customize LNv2 gateway fees

      • Client recovery has been optimized and should be faster and use less data

      • Core lightning gateway is no longer supported

      • Work has been started on Iroh networking integration

      • Fedimintd should use less memory now

  • Alby

    • Hub

      • v1.15.0 - Ian Goldberg

        • One-click connections for self-hosted hubs

        • Add pagination to tx list

        • Add peer and return_to query parameters to peer connection page

        • Show app creation time in connection summary

        • Show wallet pubkey on connection summary

        • Add app cleanup page

        • Add swap alert

        • Show total and reserved balance in spending balance tooltip

      • v1.14.2 - Mike Godwin

        • In this release we also add some cool new widgets to the home screen and many new apps to the app store. Alby Hub now has a healthcheck indicator, better fiat support, NIP-44 encryption, and a way for self-hosters to support Alby! We’ve also added basic swap functionality to the node page so you can more easily manage your liquidity without having to open new channels.

        • The Cashu backend was also updated - you can now recover stuck funds, and for new users you will have a recovery phrase which you can recover your funds in other wallets.

        • New features:

          • Add boltz.exchange swap out option

          • Add boltz swap in dialog

          • Use nip44 and versioning

          • PostgreSQL support

          • Enable multi-path payments in LND

          • Node page revamp for web and mobile

          • Display specific notes about counterparty above open channel buttons on increase incoming/outgoing flows

          • Show failure reason on transaction modal in transaction list

          • Add nostrcheck-server to Appstore

          • Add new apps to Hub’s Store (nostter, btcpay, coracle, lnbits)

          • Add new apps to appstore

          • Phoenixd subwallets

          • Add same counterparty alerts while opening channels

          • Currency switcher

    • Go v1.10.0

      • Support for PicknPay QRs

      • BTC Map to find places to spend sats

      • Improve Skeleton animations across the app

    • bitcoin-connect v3.7.0

      • Add alby hub

      • Add coinos connector

      • Add connection success screen

      • Add slide up animation on modal open in mobile

      • Add disconnect button while connecting a wallet

      • Add NWA & Alby Go

    • js-sdk

      • v4.1.0

        • Simplify NWA flow

        • Add sign message method to Alby OAuth Client

      • v4.0.0

        • In this release the NWC deeplink flow is improved to better support different kinds of http-accessible wallets

        • We also remove a dependency on an ESM event emitter package which was causing build errors in some projects

        • New features

          • New NWC deeplink flow to support other relays and wallet pubkeys

          • Add custom-timeout-values-for-requester-method

          • Custom EventEmitter classes

          • Add optional metadata field to get_info response

  • Ark Labs HQ wallet-sdk v0.0.7

    • export ArkAddress and VtxoTapscript

    • Make the lib compatible with webpack

    • Settle implementation

  • Ark v0.5.0 - Branch-only Signing Sessions and Connector Trees

    • New Features

      • Branch-only VTXO Tree Signing: Optimizes VTXO tree signing; drastically cuts down on the number of signatures you have to produce, making rounds quicker and less resource-intensive.

      • Connector trees: Another notable addition is the move from a linear connector chain to a tree structure.

    • Optimizations

      • Network compatibility and transaction costs

      • Round processing and client interaction

      • Scalability improvements

      • Client SDK API update

  • Taproots assets v0.5.1

    • Database Migrations: tapd v0.5.1 contains non-revertible database migrations.

    • Breaking changes

      • Downstream Projects: litd v0.14.x-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality

      • tapd v0.5.x changes

        • Oracle RPC: The RPC protobuf definitions for the Price Oracle have changed

        • Configuration changes: The configuration value and command line flag now needs a value and is no longer a boolean

  • lightning-kmp v1.9.0

    • RenameOfferIssuerId

    • Simplify outgoing payment state machine

    • Remove support for push_amount

    • Use shared input’s txOut in shouldSignFirst

    • Make the project multi-modules

    • Correctly set next_commitment_number during splice reconnect

    • Add require_confirmed_input to RBF messages

    • Add a succeededAt timestamp to payments

  • validating-lightning-signer v0.13.0 - Celestial Citadel

    • Added:

      • configure SimplePolicy values using vlsd2.toml

      • fuzz: basic fuzzing of the vls-core crate

      • developer flag for dev messages and fields

      • core: oid derivation for ldk channel id

      • protocol: implement sign_holder_htlc_tx for LDK / phase-2 code path

    • Changed:

      • core: Add new and oid methods to ChannelId and remove the oid/channel_id utility methods

      • LSS: split lightning-storage-server into library and lssd

  • SideSwap v1.7.0

    • New swaps API

    • Fee discount

    • Cross-wallet swaps

    • Peg-in/peg-out wallet balance

  • CDK v0.7.1

    • Mint builder add ability to set custom derivation paths

  • eNuts is no longer maintained [Note]

Boosts

  • 01:25:36 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @sean (3,000 sats) “Open sourced decentralized CIA? Sounds like y’all need to tap into the intellectual Silk Road 🚬”

    • @pink monkey (2,000 sats)

    • @Anonymous (2,000 sats)

    • @martinbarilik (750 sats) “Short AI intro 😁 right …”

    • @Momo Tahmasbi (100 sats) “Arkansas Traveler was a great song recommendation!”

    • @jespada (100 sats) “Zzzzap”

Tech Tips of the Day

  • Encoding data within emoji using unicode variation selectors [Paul Butler’s Blog post]

    • A demonstration on how to encode arbitrary data within a single emoji by utilizing Unicode variation selectors, which modify character presentation without visible changes.

    • By appending sequences of these selectors to a base character, data can be concealed within any Unicode character.

  • Bypassing hotspot restrictions for data [Article by Juraj Bednar]

    • Mobile carriers often detect tethering by monitoring Time to Live (TTL) values in data packets. Standard mobile devices send packets with TTL of 64, while tethered devices show TTL of 63.

    • The solution involves setting device TTL to 65, making tethered traffic appear as direct phone traffic with TTL 64.

  • WA-Tunnel: Tunneling Internet traffic over Whatsapp [Github]

    • WA-Tunnel allows TCP data tunneling via WhatsApp, useful for bypassing network restrictions such as limited carrier data.

    • The system works by sending network packages as WhatsApp messages, splitting large data into files or text to avoid message limits.

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 344

      • Disclosure of fixed LND vulnerability allowing theft: Matt Morehouse posted to Delving Bitcoin to announce the responsible disclosure of a vulnerability that affected LND versions before 0.18.

      • Discussion about Bitcoin Core’s priorities: several blog posts by Antoine Poinsot about the future of the Bitcoin Core project were linked in a thread on Delving Bitcoin

    • 343

      • Ignoring unsolicited transactions: Antoine Riard posted to Bitcoin-Dev two draft BIPs that would allow a node to signal that it will no longer accept tx messages that it had not requested using an inv message, called unsolicited transactions.

    • 342

      • Allowing mobile wallets to settle channels without extra UTXOs: Bastien Teinturier posted to Delving Bitcoin about an opt-in variation of v3 commitments for LN channels that would allow mobile wallets to settle channels using the funds within the channel for all cases where theft is possible.

      • Continued discussion about an LN quality of service flag: Joost Jager posted to Delving Bitcoin to continue discussion about adding a quality of service flag to the LN protocol to allow nodes to signal that one of their channels was highly available.

    • 341

      • Continued discussion about probabilistic payments: following Oleksandr Kurbatov’s post to Delving Bitcoin last week about emulating an OP_RAND opcode

      • Continued discussion about ephemeral anchor scripts for LN: Matt Morehouse replied to the thread about what ephemeral anchor script LN should use for future channels

      • Stats on orphan evictions: developer 0xB10C posted to Delving Bitcoin with statistics about the number of transactions evicted from the orphan pools for his nodes

      • Updated proposal for updated BIP process: Mark “Murch” Erhardt posted to the Bitcoin-Dev mailing list to announce that his draft BIP for a revised BIP process has been assigned the identifier BIP3 and is ready for additional review

News & Noteworthy

Bitcoin

  • The Satoshi Nakamoto Institute introduces The Reorg, a new podcast hosted by @Bitstein, exploring “the SNI archives to reexamine our ideas after years of accumulated proof-of-work.”

Business & Finance

  • Proton Wallet officially launches and is now accessible on iOS, Android, and web platforms, for all users [Announcement]

  • Custodial Lightning wallet service LifPay temporarily suspends operations to align with regulatory requirements [Announcement]

    • Users are advised to withdraw their bitcoin within 60 days by submitting a withdrawal request.

  • Orange Pill App introduces Lightning-enabled bitcoin wallet [Announcement]

    • The wallet aims to enhance community engagement through features like mass zapping, and plans to introduce geo-zapping, enabling users to send Bitcoin to others based on geographic locations.

  • Brazilian financial solutions company Transfero partners with Lightspark to add speed and cost efficiency to Bitcoin transactions using the Lightning Network [Press release]

  • Tropic Square introduces pre-production samples of TROPIC01, an open architecture RISC-V secure element [CNX Software’s Article]

    • TROPIC01 ensures tamper-proof hardware Root of Trust, enabling secure cryptographic key management and data storage in devices like hardware wallets and IoT products. [Product brief]

  • Fold introduces its Bitcoin Rewards Credit Card, offering cashback in bitcoin [Press release]

  • Canaan announces the Avalon Q, a home mining device with a hash rate of 90 TH/s. [Announcement]

Funding

  • OpenSats receives $250,000 donation from HRF’s Bitcoin Development Fund, directed at its Operations Budget [Announcement]

  • Vinteum announces its fifth grant to Pins for their work on LND [Blog post]

    • The donation has been divided for three non-profit organizations Brink, OpenSats, and the Human Rights Foundation

  • Blockstream opens its grant application portal for Bitcoin L2 projects, taking place on-site at the Lugano Research Hub [Portal]

  • Brink receives a $50,000 contribution to their open source Bitcoin development efforts from VanEck, and another $50,000 contribution from River

  • Bitwise donates $150,000 to support Bitcoin open-source developers [Announcement]

  • The University of Austin invests $5 million of its endowment in Bitcoin, partnering with Unchained for the initiative. [Announcement]

Mining

  • Bitaxe miner with 3.3Th of hashrate successfully mines a Bitcoin block, defying odds of 1 in 250,000,000 [Block 887212]

    • The device found a block with 719T difficulty, exceeding current difficulty levels, and has reportedly been operating for less than a month, generating approximately 350M shares.

  • Braiins reveals plans to open-source its BCB 100 control board [Announcement]

    • The release includes software (OpenWrt-based distribution, Linux support, and firmware source code) and hardware specifications (schematics, BOM, and CAD data), excluding the mining software.

    • All materials will be available under GPLv3 on the Braiins GitHub repository by the end of March.

Privacy

  • Bisq trade trends: An analysis of trading trends on the Bisq protocol in 2024

    • The number of trades on Bisq decreased in 2024, but USD volume per trade increased, indicating higher value per transaction.

    • Payment methods like Strike, Zelle, and Cash By Mail showed different trends in the volume and average value of trades in 2024.

    • Bisq’s surveillance discount was typically smaller than expected, with Cash By Mail offering the best rate and Strike the worst in 2024.

  • UK Government orders Apple to create backdoor for encrypted iCloud accounts [TechCrunch]

    • The UK Home Secretary’s office has issued a secret order under the Investigatory Powers Act of 2016, requiring Apple to provide access to user data protected by its Advanced Data Protection for iCloud.

    • In response, Apple has withdrawn support for Advanced Data Protection in the UK, and goes to court to fight UK’s demand.

  • Mozilla revises Firefox terms after user backlash over data usage [TechCrunch]

    • Mozilla has revised its Firefox Terms of Use, removing the explicit promise to “never sell personal data”, citing evolving legal definitions of data sales.

    • In response to feedback, Mozilla updates the terms to clarify that they do not claim ownership of user data and that data usage is limited to operating Firefox as described in the Privacy Notice.

  • Kraken’s 2024 Transparency Report: Kraken received 6,826 data requests from law enforcement and government agencies across 71 countries, marking a 38.6% increase from 2023

    • U.S. agencies accounted for 28.6% of these requests, with the FBI submitting 614. Kraken provided data for 57% of all requests, covering 10,369 accounts, primarily linked to clients in the U.S. (34.5%), the U.K. (8.8%), and Germany (8.5%).

  • X blocks Signal.me links, prompts error messages indicating potential harm or spam [Disruptionist]

    • The company cites security issues with the domain, threatening to user safety.

Protocol

  • Bitcoin Core #25832: tracing: network connection tracepoints [Merged]

    • “This adds five new tracepoints with documentation and tests for network connections”

  • Bitcoin Core #27432: contrib: add tool to convert compact-serialized UTXO set to SQLite database [Merged]

  • BIP #1712: BIP3: Updated BIP Process [Merged]

  • Rust Bitcoin #4114: Policy: Relax MIN_STANDARD_TX_NONWITNESS_SIZE to 65 [Merged]

  • Rust Payjoin #434: Multiparty Senders: NS1R [Merged]

  • LND #9491: Allow coop closing a channel with HTLCs on it via lncli [Merged]

  • LDK #3440: Support receiving async payments [Merged]

  • LDK #3575: PeerStorage: Add feature and store peer storage in ChannelManager [Merged]

  • Eclair #2989: Add router support for batched splices [Merged]

  • Eclair #2979: Check peer features before attempting wake-up [Merged]

  • BOLT #1228: Zero-fee commitments using v3 transactions [Draft]

  • NIP #1807: Add On-Chain Send/Receive to NWC #1807 [Open]

  • NIP #1777: NWC Deep Links: a standard for using deeplinks to communicate between a wallet and a nostr client [Open]

Government & Political

  • President Trump confirms the creation of a U.S. Strategic Crypto Reserve, including BTC, ETH, XRP, SOL, and ADA [Truth social post]

  • U.S. President brokers a prisoner swap, releasing BTC-e founder Alexander Vinnik [The Block]

    • Vinnik, co-founder of BTC-e, pleaded guilty to money laundering charges in the U.S. and France.

  • The U.S. SEC’s Division of Corporation Finance states that meme coins are akin to collectibles, not securities [Statement]

    • Consequently, transactions involving meme coins do not require registration with the SEC, leaving purchasers and holders unprotected by federal securities laws.

  • Bitcoin asset seizure and civil contempt order [Court order]

    • A U.S.federal judge holds Mr. Reynoso in civil contempt for violating a seizure warrant requiring him to transfer 119.65 BTC to a government-controlled wallet within 24 hours. Within hours of the warrant being served, Reynoso moved the bitcoin through multiple wallets, invalidating any claims of inability to access the funds. [Transaction]

    • The FBI discovered Ledger software on Reynoso’s laptop, and authorities confirmed his Bitcoin address through both the software interface and a text file in his Apple account.

  • U.S. Marshals Service struggles with managing seized cryptocurrencies [CoinDesk]

    • Previous reports and audits have criticized the agency’s inability to track forked assets and its reliance on insecure methods like unencrypted email for sharing bitcoin deposit addresses.

  • Nigeria’s release of Binance Executive Tigran Gambaryan linked to U.S. surveillance assistance deal [The Rage]

    • In October 2024, Nigeria released Binance executive Tigran Gambaryan, who had been detained since February 2024 on money laundering charges.

    • The same day, the U.S. and Nigeria announced a “Bilateral Liaison Group on Illicit Finance and Cryptocurrencies”, providing Nigeria with US “resources and expertise” in investigating cybercrimes.

  • Argentina’s President Javier Milei faces legal and political backlash over failed LIBRA memecoin launch [Reuters]

    • Milei denies any involvement, claiming he had no prior knowledge of the token’s issues and is now calling for an internal investigation.

  • CBP intensifies ASIC miner seizures, expands scope to MicroBT and Canaan units [Blockspace]

    • U.S. Customs and Border Protection (CBP) is seizing Bitcoin mining ASICs at ports of entry, including Bitmain, MicroBT, and Canaan units, at the request of the Federal Communications Commission.

Central Banking

  • The IMF requests El Salvador’s public sector to halt Bitcoin purchases as part of a $1.4 billion loan agreement [Atlas21] [Press release]

    • The IMF’s conditions include banning public sector Bitcoin accumulation and mining, restricting issuance of Bitcoin-linked tokenized debt, and revoking Bitcoin’s legal tender status.

  • The European Central Bank announced an expansion of the Eurosystem initiative for settling transactions using distributed ledger technology in central bank money [Press release]

    • The initiative will explore how DLT can settle transactions within the Eurosystem.

  • Heraclius: A Byzantine fault tolerant database system with potential for modern payments systems [Research paper]

    • Heraclius is a project by the U.S. Federal Reserve which attempts to replicate Bitcoin’s decentralized security while keeping control in central hands.

    • The Fed paper acknowledges Bitcoin as “the longest running electronic payment system that tolerates byzantine faults today”

Events

Reads

  • Here’s a list of our top recently published reads:

    • How Big Brother can attack Bitcoin without spending a dime, by Harsha Goli [Opinion]

    • Prosecuting Privacy: Examining Samourai Wallet, Money Transmitters, and the Criminalization of Innovation, by Spencer Peek [Research paper]

    • Atlas Mined, by Jon [Article]

    • The Logic of Spending Bitcoin, by Parker Lewis [Read]

    • What’s Driving Bitcoin Adoption in 2025?, by Sam Baker [River’s Research report]

    • Every App Needs Bitcoin, by Miljan [Note]

    • Why Keys Matter, by Holdbod [Note]

    • Bybit’s $1.4b breach started with stock invest malware [Crypto.news]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR092 - Nostr Wallet Connect, DeepSeek, AI Coding, Sparrow, Bitcoin Keeper, Maple AI, Calculating Tx Sizes + MORE ft. Future Paul]]>https://substack.bitcoin.review/p/br092-nostr-wallet-connect-deepseekhttps://substack.bitcoin.review/p/br092-nostr-wallet-connect-deepseekTue, 11 Feb 2025 16:28:18 GMTI’m joined by guest Future Paul to go through the list.

Listen on your favorite podcast app

Prelude to the list

  • 00:01:00 Conversation on AI and building with AI

Housekeeping

  • 00:22:02 New Coldcard Q tutorial by Loïc Morel on Plan B Network: Getting Started with COLDCARD Q

  • 00:22:10 We are still looking for bitcoin builders to come on the show!

  • 00:23:13 Unleashed.Chat Update - Deepseek R1 32B

    • Users can now access the DeepSeek R1 32B model on Unleashed.chat, all data remaining stored locally in the user’s browser.

    • Future updates aim to integrate it as a DVM, API, and enhance its ability to search Nostr and the web while improving speed.

  • 00:23:19 NWC and Olas/Primal

Urgent Vulnerability Disclosures

  • 00:37:17 Replacement Cycling Attacks on Bitcoin Miners Block Templates [Antoine Riard’s Disclosure]

    • A variant of replacement cycling attacks allows adversarial miners to censor transactions in block templates, manipulating the Bitcoin fee distribution. This attack, tested on Bitcoin Core 26.0 and 29.0, exploits mempool mechanisms to gain an economic advantage over honest miners.

    • The attack leverages non-UTXO transaction traffic and mempool policies like replace-by-fee to reorder transactions in block templates.

Bitcoin

Software Releases & Project Updates

  • 00:37:34 Sparrow Wallet

    • v2.1.2

      • Indicate historical rates support in Exchange Source drop-down on General Settings

      • Prefill the derivation to the default path for the chosen script type on watch only keystores

      • Add local network usage description in Info.plist for macOS 15

      • Support Coldcard P2TR address display over USB (Edge firmware only)

      • Set the script type selection import button as the default button after BIP39 wallet discovery returns empty

    • v2.1.0

      • Use Lark for USB hardware wallet communication (replaces HWI)

      • Store and send multisig wallet registrations on Ledger devices to avoid re-registration

      • Perform native pairing with the BitBox02 to avoid reliance on a previous external pairing configuration

      • Support Jade Plus over USB

      • Restore any adjusted table column widths and sort preferences on wallet load

      • Support loading PSBTv2 files

      • Skip labelled addresses when retrieving an unused address from the Receive tab, and the Send tab pay to wallet selection

      • Always select a new address when sending multiple payments to the same open wallet

      • Allow camera image mirroring to be changed from scanned image context menu and the application View menu

      • Only show CPFP rate if child fee increases effective fee rate

      • Add option to Bitcoin Core and Private Electrum server selection to scan a URL from a QR code

      • Allow server URLs to be pasted into the server settings Host fields

      • Enable Electrum RPC batching on mempool-electrs servers

      • Add blackie.c3-soft.com testnet4 Public Electrum servers

      • Add mempool.space exchange rate source

      • Retrieve fee rates from configured source on non-mainnet networks where available

      • Switch from paynym.is to paynym.rs and Tor equivalents

      • Update child wallet labels to available paynyms on displaying the Paynym dialog

      • Set transaction tab label to transaction label on opening transaction if available

      • Show input label in the input tooltip on the transaction diagram if present

      • Truncate labels in table columns to max persistable label length and notify the user via a tooltip

      • Disable broadcast progress bar if disconnected, and re-enable if connected again

      • Remove payjoin v1 verification step to check there is no previous UTXO information in the PSBT as per BIP78 change

      • Exclude Taproot wallets and Jade, Tapsigner and Satochip HWWs from requiring the non witness tx field in PSBTs

      • Improve socket address resolution handling when using a proxy

      • Improve keystore import panel spacing in Linux

      • Add Specter DIY multisig option to wallet import menu

      • Replace forward slash with underscore in file names when saving PSBTs

      • Improve Jade QR keystore import descriptions

      • And many more

  • 00:41:08 BDK v1.1.0

    • In this release of bdk_wallet v1.1.0 the tx builder is updated to use transaction version 2 by default, and support for wallets using testnet4 is now live.

    • This release also includes important updates to bdk_electrum which has a new MSRV of 1.75.0 to stay current with the latest security fixes, bdk_bitcoind_rpc introduces a new compact block filter module, as well as various bug fixes and improvements.

  • 00:41:35 Bitcoin Keeper

    • Mobile v2.0.1

      • Fresh new design across the app

      • Support Enhanced Vaults with Inheritance Key for BitBox02, Coldcard, Jade, and Ledger

      • In app concierge support system

      • Onboarding calls for Diamond Hands subscribers

      • Coldcard Q QR support

    • Desktop v0.2.0

      • Add support for Miniscript with Bitbox02, ColdCard, Jade, and Ledger

      • Add support for BitBox02 pairing code

  • 00:42:40 Wasabi Wallet v2.5.0

    • Fee rate estimations and exchange rate providers are now configurable

    • Quality of Life Features: address old bugs and feature requests

    • Backend and Coordinator packaged for Linux: The Debian package now includes two extra binaries: one for the backend (Wallet API) and one for the coordinator (Coinjoin API).

  • 00:42:43 Blockstream

  • 00:43:06 Electrs v0.10.9

    • Allow concurrent DB background operations for SSDs

    • Update bitcoin_slices to 0.10.0

  • Nunchuk Android v1.9.62

    • Support android 15

  • 00:43:44 Umbrel v1.4.0-beta.1

    • umbrelOS 1.4 Beta 1 introduces Files, a new file manager that turns your Umbrel into a full-blown home cloud, along with Korean language support and various bug fixes.

    • Create, upload, and organize files and documents.

    • Share folders over your local network, and easily add them as network drives on macOS, Windows, iOS, or Android.

    • Set up a shared folder as a Time Machine backup location on macOS

    • Preview all your photos, videos, PDFs, and audio files

    • Access app data folders

    • External (USB) storage support for Umbrel Home arriving in umbrelOS 1.4 Beta 2.

  • 00:44:29 Bisq v1.9.19

    • Produce exclusively low-R signatures from wallet keys

    • “Transfer Same Bank” & “Transfer Specific Banks” match case-insentitivity

    • Create payment method “Faster Payments System (SBP)” for Russian Ruble

    • New option in PhoneNumberValidator to enforce exact number of digits

    • Add 500+ string translations to Russian language file

    • Implement BitcoinCoreSeedListDiscovery method

    • getoffers (api): Return all offers by default

    • Add suddenwhipvapor mediator instance onion

    • Improve resync handling

    • Add missing snapshot creation in full DAO mode

  • 00:44:40 Bisq2 v2.1.5

    • A bug has been discovered in that release. Please do not install it and wait until a new version is available.

    • Security update: To enhance security for buyers, sellers must have sufficient reputation to secure a trade for the specified amount.

    • New features:

      • The new Profile Card comes with many features. Find the user profile details, trade terms, reputation, offers created and the public messages posted by clicking on the profile icon or profile name anywhere in the app.

      • To improve on privacy, sensitive trade data will be automatically deleted after a certain period of time

      • See trade details in the trade process window by clicking on the “Show details” button

  • 00:44:51 Zaprite v2025-02-03

    • Add: New BTCPay integration, allowing users to accept bitcoin and lightning payments alongside fiat using self-hosted infrastructure.

    • Update:

      • Transactions CSV: Add a new Customer Note column to our Transactions CSV export

      • Square ACH: Update Square ACH payment flow to adhere to new requirements from Square

    • Remove: Transaction Canceled: Temporarily disabled the Transaction Canceled notification emails until we can resolve their over-sensitivity.

  • 00:45:54 Mempal

    • v1.5.1

      • Disable APK dependency metadata

    • v1.5.0

      • Tapping the Mempal logo now opens a web browser to mempool.space or equivalent custom mempool server

      • Rework widget implementation to solve update issues

      • Customize proguard-rules file to shrink app size and increase overall performance

  • 00:46:04 Bitcoin Safe

    • v1.0.6

      • bitbox02: Added initial device setup option “restore from seed” without needing vendor software

      • Jade: Bugfix for unlocking a newly initialized device

      • Stricter tests for clean wallet shutdowns

    • v1.0.3

      • Add Tor support through proxy

  • BTC Map v0.9.2

    • Add merchant boosts

    • Add comments screen

    • Speed up element search within an area

    • Show user location marker

    • Show more info on deleted elements

    • Add Polish and Brazilian translation

    • Allow users to post merchant comments

  • 00:48:50 ESP Miner v2.6.0b2

    • Is SPIRAM Available?

    • Keep old pool config synchronized until reboot

    • Add support for extranonce2_len<4

    • SSID WiFi lookup

Project spotlight

  • 00:49:02 cbip32: A fast, secure, low-dependency C implementation of BIP32 [Github]

    • The library depends only on libsecp256k1 and libsodium, for minimal dependency.

    • Extensive testing includes cross-implementation fuzz testing against python-bip32 and verystable.

  • 00:49:15 StackStates: A map of the United States that shows legislation of official Bitcoin adoption [Github]

  • 00:49:21 Instamouse bitcoin: A full Bitcoin Core development environment accessible directly through a web browser

    • The environment includes pre-compiled Bitcoin Core software, with options to recompile if desired. Tools like Visual Studio Code and Qt Creator are pre-installed for development purposes.

    • The setup operates in regtest mode, with the Bitcoin configuration file located at ~/.bitcoin/bitcoin.conf. An autolaunch script is available and can be modified or deleted as needed.

  • 00:50:24 Iris Wallet Desktop: RGB on Lightning from a simple interface [Github]

    • The wallet enables users to manage RGB assets, including issuance, spending, and receiving, within a familiar wallet application.

    • Releases its first experimental release with the v0.1.0

  • 00:50:43 Explorer.timechainindex: An address and transaction explorer by Timechainindex, powered by Mempool.space API

    • Users can save the explorer’s webpages locally and run them from their own mempool instance by changing the “api_endpoint” to their local mempool directory.

  • 00:50:54 txTree: A tool to explore UTXO connections

    • txTree is a tool that visualizes Bitcoin transactions by fetching and displaying transaction data in a tree structure

  • 00:50:58 HurriCash: A multisig tool for collaborative bitcoin transactions [Github]

    • The platform guides users through an initial transaction to allocate necessary funds, followed by a coinjoin process to collectively fund the multisig wallet.

  • 00:51:29 The Bitcoin Trail: A community-driven bitcoin-themed game in development

    • The Bitcoin Trail began as a fun, stacking-themed game concept. Players can fund new features by zapping sats, including custom tombstones, news events, sound effects, new characters, and game mechanics.

    • The game aims to evolve dynamically, with features like in-game stops, custom graphics, and even original music—all dependent on user contributions.

  • 00:51:41 Bitcoin Laws: A dedicated platform that monitors legislative measures related to Bitcoin and digital assets across various jurisdictions.

  • 00:51:50 CoinMarketCrap: A website that provides bitcoin & shitcoins market cap rankings, and more. [Github]

Vulnerability Disclosures

  • 00:54:19 Researchers uncover two security flaws, FLOP and SLAP, in Apple’s A and M-series chips, enabling attackers to steal sensitive data through speculative execution attacks [ArsTechnica]

    • FLOP exploits the Load Value Predictor to access memory contents, while SLAP manipulates the Load Address Predictor to intercept JavaScript strings in Safari. Affected devices include iPhones (13–16 series), iPads, and Macs from 2021 onwards.

    • Researchers demonstrate that FLOP can steal saved credit card information from Square storefronts, while SLAP can recover email data from ProtonMail, Amazon purchase details, and Reddit comments. [Demo]

  • 00:54:33 Cybersecurity firm Kaspersky identifies “SparkCat” malware in both Google Play and Apple’s App Store targeting cryptocurrency owners [CyberInsider]

    • SparkCat employs OCR technology to extract sensitive information, including cryptocurrency wallet passwords from users’ photos. Infected apps request access to photo galleries under the guise of chat support features.

  • 00:54:40 A reported exploit is targeting users who access adult websites through their Phantom or Trust Wallet browser [Twitter post]

    • Users are advised to avoid viewing adult content using these wallet-integrated browsers to prevent potential security breaches and loss of funds.

  • 00:56:30 Lazarus Group deploys electron-based malware to steal cryptocurrency data [Security Online]

    • The Lazarus Group embeds malware into an open-source project, Uniswap Sniper Bot, to target cryptocurrency advanced users. This attack follows similar strategies where they exploited Python and Node.js repositories.

  • 00:56:36 Coinbase users lose millions to social engineering scams amid security failures [ZachXBT Analysis]

    • Coinbase users have lost over $65 million between December 2024 and January 2025 due to social engineering scams. These scams involve attackers spoofing Coinbase phone numbers and emails to trick victims into transferring funds.

  • 00:56:57 Singapore-based cryptocurrency exchange Phemex suffers $85 million hack, halts withdrawals [Security Week]

    • On January 23, 2025, the platform detected unusual activity in its hot wallets, leading to the theft of over $85 million in various cryptocurrencies.

    • Phemex is collaborating with third-party security firms and law enforcement agencies to investigate the breach and has announced plans to compensate affected users.

  • 00:57:56 Peer-to-peer cryptocurrency trading platform NoOnes suffers $8 million exploit due to Solana bridge vulnerability [CryptoSlate]

    • The breach involved multiple small transactions, each under $7,000, across various networks, then subsequently funneled through Tornado Cash.

  • Bug in Solana-based wallet Solflare exposes 4,800 email addresses onchain, links them to more than 6,700 distinct wallets [Note by Jameson Lopp]

    • A bug in Solflare’s transaction signing process caused users’ email profiles to be sent onchain during a ‘claim’ event. This issue specifically affected users who used Solflare with Ledger hardware wallets.

  • WhatsApp reports Paragon Solutions’ spyware targeting journalists and civil society members [Reuters]

    • WhatsApp detects hacking attempts on approximately 90 users, including journalists and civil society members, by Israeli spyware company Paragon Solutions.

    • Despite Paragon’s claims of ethical practices and selling only to stable democratic governments, WhatsApp’s findings raise concerns about the commercial spyware industry’s impact.

  • 00:58:40 Chinese AI startup Deepseek exposes over a million plaintext chat records, API keys, and internal logs due to unsecured ClickHouse databases. [Bleeping Computer]

    • Security firm Wiz discovers the vulnerability, noting that the publicly accessible databases allowed arbitrary SQL queries without authentication.

  • 00:58:16 Five dollars wrench attacks:

    • Russian national released after being cleared of involvement in kidnapping in Indonesia [News Farahas]

      • The incident was made public in early February 2025, more than a month after the kidnapping occurred, when a Ukrainian national and his driver were ambushed in Bali, Indonesia. Four masked attackers, armed with weapons, forced them into a villa and stole cryptocurrency worth approximately ~$220,000. Authorities are still searching for eight other suspects.

    • Criminal gang jailed for kidnapping and extorting cryptocurrency from victim [Police report]

      • On 2 December 2023, police discovered a kidnapped man in an Irlam flat. He had been assaulted, tied up, and forced to transfer cryptocurrency under duress.

      • The investigation revealed the gang had targeted the victim multiple times, using violence, threats, and even drugging him to obtain cryptocurrency. They had extorted over £100,000 before the final kidnapping.

    • Three individuals are charged with kidnapping and assault over a failed cryptocurrency investment in Accra, Ghana [Graphic Online]

      • The alleged assault occurred on December 19, 2024, when the victim was handcuffed, beaten, and electrocuted at one of the assaillant’s office for about 13 hours.

      • The attack followed claims that the victim held $600,000 linked to a misappropriated $1.6 million investment. Police intelligence intervened after a tip-off.

    • Criminals steal cryptocurrencies after invading family’s home in São Paulo, Brazil [Livecoins]

      • A group of criminals broke into a home in São Paulo, held a family hostage, and stole their cryptocurrencies. The attackers stayed in contact with a third accomplice by phone.

      • The stolen amount is estimated at $16,000, and the criminals also took the victims’ cell phones. The Civil Police have launched an investigation but have not yet identified any suspects, nor how the criminals discovered the family’s holdings.

    • A 30-year-old entrepreneur active in cryptocurrencies is kidnapped near Troyes, France during a staged client meeting [JDD]

      • Four individuals, including a fake client, hold him hostage and demand a €20,000 ransom.

    • Australian billionaire Tim Heath fights off kidnappers at his luxury apartment in Tallinn, Estonia [DailyMail]

      • The attackers, reportedly disguised as painters, had planned to abduct him and take him to a remote location. Heath, a cryptocurrency gambling entrepreneur, was targeted just before his new casino’s grand opening.

Audience Questions

  • 01:00:55 Why, when you sign a transaction on the COLDCARD, does it generate 2 files. A “signed” and a “final” transaction. What’s the difference between the 2?

  • 01:01:50 P1: What’s the maximum number of outputs there can be for a bitcoin transaction?

  • 01:03:43 P2: Is there any way to estimate what the size that a transaction will be depending on it’s number of outputs? For example is a 1 input, 3 output tx 33% bigger than a 1 input, 2 output tx? Is it a linear calculation, or a curve?

  • 01:04:13 Does using a passphrase offer any protection against a malicious hardware wallet? Or is it the same level as risk as just generating a regular seed?

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 01:06:10 Maple AI by OpenSecret, is an end-to-end encrypted chat tool that enables private conversations with a general-purpose AI assistant, is now publicly available [Github] [Technical primer]

  • 01:06:20 SimpleX v6.3.0-beta.2

    • Send mentions, mentions-only notification mode for groups

    • Support on-device message expiration per chat

    • Send reports to group moderators

    • Fast group deletion

    • To keep original filename private, use timestamp as video filename

    • Support connecting to SMP servers via port 443 (via Advanced network settings)

  • 01:11:00 TailsOS v6.12

    • Prevent an attacker from monitoring Tor circuits:

      • In Tails 6.11 or earlier, an attacker who has already taken control of an application in Tails could then exploit vulnerabilities in Onion Circuits and our Tor Browser wrapper that might lead to deanonymization.

    • Prevent an attacker from changing the Persistent Storage settings

  • 01:13:24 Reticulum MeshChat v1.20.0

    • Add ability to manage additional interface types and settings thanks to @RFnexus in #60

    • Add ability to double click lxmf.delivery nodes in network visualiser to launch conversation

    • Add ability to double click nomadnetwork.node nodes in network visualiser to launch page browser

    • Add ability to reload ports when adding or editing an interface

    • Add IFAC network name to interface info when enabled

  • NomadNet v0.6.0

    • Add ability to configure LXMF PN max_peers and static_peers

    • Update required RNS to 0.9.1 and LXMF to 0.6.1

  • Signal now allows users to transfer their message history and the last 45 days of media when linking a new Desktop or iPad device to their primary account [Announcement]

    • Signal bundles the user’s data into a compressed, encrypted archive, which is then sent to the new device through Signal’s servers.

  • 01:25:26 VPN provider Mullvad updates payment method options and adds Lightning payment as experimental beta feature with a 10% discount [Payment portal]

    • Previously, a third-party service was available to top-up Mullvad accounts, or purchase vouchers, using Lightning.

Project spotlight

  • Carbonio: A self-hosted digital workplace solution [Github]

    • It features modern tools for email management, calendar coordination, video meetings, and collaborative document editing, designed for scalability and security.

    • The platform supports mobile access and provides businesses with a secure alternative to hyperscale cloud providers while offering robust file management and privacy controls.

  • Privacy browser android: An open-source browser designed to minimize data sent to the internet and stored on devices [Code repository]

    • By default, it disables privacy-sensitive features like JavaScript and cookies, allowing users to enable them as needed per site.

    • Currently utilizing Android’s built-in WebView, future versions plan to adopt a forked version called Privacy WebView.

Lightning + L2+

Project spotlight

  • 01:26:17 Ark Wallet SDK: A TypeScript library for building Bitcoin wallets with support for both on-chain and off-chain transactions via Ark protocol. [Github]

    • The SDK offers JavaScript developers a secure, portable solution for implementing Bitcoin functionality without WebAssembly dependencies.

  • Vortex: A Raycast extension that lets you control you bitcoin lightning wallet directly from MacOS [Code repository]

    • The latest update introduces a Redeem command, allowing users to convert Cashu tokens into their Nostr Wallet Connect connected wallets.

    • Users can now withdraw satoshis from any LNURL-withdraw invoice into their connected wallets swiftly.

  • MNT: Cashu mint with admin dashboard [Github]

    • MNT introduces a new Cashu mint featuring an integrated admin dashboard.

    • The platform simplifies the management of ecash transactions by providing a user-friendly interface.

  • Paywally: A standalone web app with a lightning paywall powered by Cashu

    • The application fetches a 19-satoshi invoice from a specified Lightning Network address, creates a melt quote with this invoice, and upon payment, grants access to the protected content.

  • Mint Marketcap: A stats website that tries to guess how much money bitcoiners store on ecash mints [Github]

    • It queries each cashu mint for an invoice, extracts the public key, and retrieves associated data to approximate holdings.

Software Releases & Project Updates

  • Rust Lightning v0.1.1 - “Onchain Matters”

    • API Updates:

      • Re-Add a ChannelManager::send_payment_with_route

      • Add RawBolt11Invoice::{to,from}_raw

    • Security: 0.1.1 fixes a denial-of-service vulnerability allowing channel counterparties to cause force-closure of unrelated channels.

  • Zeus v0.9.5

    • Embedded LND: Seed: allow export of ypriv/zpriv (export to external wallets like Sparrow)

    • CLNRest: add ability to use all funds for channel open

    • Activity list: performance improvements

    • Lurker mode improvements

    • Improve display of memos and keysend messages

    • Allow return key for password login

    • Automatically include routing hints if node has only unannounced channels

    • Wallets list: better highlighting of active mode

    • Enhance on-chain receive workflow and address type selection

    • Migration to new storage system

  • Alby

    • Alby Go v1.9.0

      • Real-time push notifications of sent and received payments

      • Support to pay 0-amount invoices

      • Update LN address flow to avoid confusion

      • Increase button touch area in header for ease of use

    • Lightning-browser-extension v3.11.0 - Pleiades over Half Dome

      • Separate card for just importing nostr key

      • Add sinhalese to language switcher

      • Add tamil and russian language to locale switcher

      • Show pending and failed transactions for NWC

  • Aqua Wallet v0.2.7

    • New Features:

      • Select from different price feeds

      • Set a passcode

      • Toggle between the Bitcoin Price, Total Account Balance, and hide account balance on the header

      • Send and receive Liquid USDt on 4 new chains

      • Add a button to clear inputs in address entry fields

      • Add new Share Logs features in settings to help debug errors

    • Integrations:

      • Add Changelly for USDt swaps in the US and Thailand

      • Add BTC Direct to buy Bitcoin in Europe

      • Add Money Badger support for Lightning payments at Pick n Pay

  • CDK v0.7.0

    • Token::to_raw_bytes serializes generic token to raw bytes

    • Token::try_from for Vec<u8> constructs a generic token from raw bytes

    • TokenV4::to_raw_bytes() serializes a TokenV4 to raw bytes following the spec

    • Wallet::receive_raw which receives raw binary tokens

    • cdk-mint-rpc: Mint management gRPC client and server

    • cdk-common: cdk specific types and traits

    • cashu: Core types and functions defined in NUTs

  • Cashu-ts v2.2.0

    • Move to vite for bundling (updated target + typescript, added standalone builds)

    • Add custom output data for consumers to take control over the output data used for proof creation

    • Use sendOption type in function argument

  • Nutshell v0.16.5

    • This maintenance release contains various bug fixes for the mint and the wallet. Most notably, overpaid Lightning fees are now issued to the user at the next restart of the mint in cases where the mint has crashed or turned off while an outgoing Lightning payment was still pending.

      • Add restart policy for Redis Docker container

      • Issue NUT-08 overpaid Lightning fees for melt quote checks on startup

  • Clams Remote v2.6.0

    • Add TipModal component to settings screen

  • Plan B Network [January update]

    • Brand-new student dashboard

    • Add course conclusion pages

    • Expand resources section

    • Announce future search portal

    • Plan B Network launches Plan ₿ Labs - Lightning, a biweekly live session focusing on the Lightning Network’s developments and technical intricacies [Announcement]

Nostr

Project spotlight

  • Roz: A notary for nostr events [Github]

    • Roz is a proof-of-concept notary for nostr events, providing timestamp verification for event authenticity.

  • Vertex: A fast, reliable and open source Web of Trust DVM service based on the Personalized Pagerank algorithm [Github]

    • The service features a custom-designed data structure for rapid access to Pagerank and Personalized Pagerank within nostr, with all responses cryptographically signed by Vertex’s key.

  • Lockbox: A Nostr relay that accepts notes that should only be read by people you follow [Code repository]

    • Lockbox allows users to publish notes visible only to those they follow, using specific nostr protocols like NIP-70 and NIP-42

    • Notes can be shared from any client, but require the inclusion of a “-“ tag and support for authentication.

  • nostrdb-mcp: A Model Context Protocol server for nostrdb [Github]

    • nostrdb-mcp enables LLMs to interact with the nostrdb command-line tool for local queries. The server uses your Notedeck directory by default, allowing it to search your notes.

  • Freeflow: A TikTok clone in Flutter and Nostr [Github]

    • Users willing to post content can use zap.stream or olas to create shorts.

  • Pinja: A decentralized social media using the Nostr protocol

    • The platform offers features such as messaging, notifications, and search functionality.

  • BitVid: A decentralized platform where users can share videos and follow creators with privacy and freedom [Github]

    • The platform employs WebTorrent for peer-to-peer video streaming and Nostr for secure, password-free user authentication

  • Crawler: A nostr crawler that generates random walks used for computing monte-carlo pagerank and personalized pagerank [Github]

    • Vertex-lab’s crawler continuously scans the nostr network, focusing on follow lists (kind3s), to maintain an updated database.

Software Releases & Project Updates

  • rust-nostr v0.39.0

    • Add NIP96 support

    • Add NIP22 helpers

    • Adjust NIP01

    • Add try_connect and wait_for_connection methods for better connection handling

    • Add support for custom WebSocket clients (both in Rust, Python, Kotlin and Swift)

    • New JVM bindings

    • Huge reduction of UniFFI bindings binaries size

  • Primal v2.1.4

    • This update implemented the following:

      • Primal Wallet NWC

      • Primal Legend cards

      • Legends & Primal OG Leaderboards

      • Updated Legends Settings with leaderboard toggle and shoutout edits

      • Deep links for primal.net notes

      • Spotify and Tidal link previews

      • Embedded web player for YouTube, Spotify and Tidal

      • Rendering referenced note zaps

      • Support for kind20 referenced events in feeds

      • Showing top zaps in all note feeds (incl. thread screen)

      • Clikcable zap links in Reactions screen & Wallet TX details

  • Olas Update

    • Multiple images per post

    • Pause videos when switching away from the video feed

    • Add Instagram-like filters

    • Improve Nostr-native wallet

    • Improve NWC reliability

    • Add setting to toggle between displaying posts squared or full-length

  • Damus

    • v1.12 App Store release

      • Render Gif and video files while composing posts

      • Add profile info text in stretchable banner with follow button

      • Paste Gif image similar to jpeg and png files

    • Launch of the Alpha version of Notedeck for all users, Damus’ multiplatform Nostr client [Announcement]

  • Futr v0.2.0

    • Comment support with threaded discussions (NIP-10)

    • Repost and quote repost functionality (NIP-18)

    • Improve post rendering and content display

    • Event deletion support (NIP-09)

    • Persistent LMDB-based storage for all data

    • LRU caching system for improved performance

    • Optimize timeline storage and retrieval

    • Better subscription handling and event processing

    • Improve relay connection stability with websocket ping/pong

    • Better relay discovery through NIP-65 (Inbox & Outbox Model)

    • Optimize subscription management

    • Enhance relay authentication

    • Reference post display

    • Comment threading and counts

    • Better notification handling for post updates

    • Consolidate LMDB operations

    • Improve subscription lifecycle management

    • Enhance tag parsing and handling

    • Optimize event caching and invalidation

  • Flotilla

    • v0.2.7

      • Add calendar events

      • Make reply indicator nicer

      • Make share indicator nicer

      • Improve feed loading

    • v0.2.6

      • Add reply to long-press menu

      • Replace nsec.app signup with njump.me

      • Add new messages button in rooms

      • Add media server settings

      • Add build hash to about page

    • v0.2.5

      • Improve room and data loading

      • Drop support for legacy event kinds

      • Add support for back button navigation on android

      • Remove note to self page (still available via chat)

      • Improve chat conversation search

      • Change how reply UI works

  • Yakihonne

    • Web v4.3.0 / Mobile v1.6.4

      • Yakihonne wallet name customization for newly created wallets

      • Option to toggle between collapsed or expanded notes in the feed for a personalized experience

      • Notification preferences can now be managed directly from the settings page

      • Quick access to your profile with the newly added profile button

      • Native poll rendering and voting functionality within notes

  • Nak Update

    • Nak wallet: Implement NIP-60 token receiving, sending and swapping

    • Nak curl: Wrap the actual curl command and add a NIP-98 header to it, allowing APIs calls with Nostr authorization

    • Nak mcp: Allow AIs to search people on Nostr, publish notes, mention people, read notes with built-in outbox model

    • Nak outbox: List NIP-65 relays for a given pubkey

    • Add option to pipe multiline JSON into ‘nak event’ or ‘nak req’

  • Narr v0.3.3

    • Setup amd64 and arm64 docker image builds

    • Increase article fetching limit to 300.

  • Njump.me Update

    • Add support for kind:20 photos

  • Keycast Update

    • Docker now actually builds properly

    • Simplify own domain setup

    • Simplify config via a single .env file

    • Add config for “allowed pubkeys”

  • Citrine v0.7.1

    • Add the restore follows button back

    • Show notification when backing up database

    • Listen for pokey broadcasts

  • nos.social v1.1.1

    • Add Lists view and two ways to navigate to it

    • Add view for editing a list’s title and description

    • Add List detail view

    • Add view for managing users in a list

    • Add ability to delete lists

    • Add analytics for feed source selection and lists

  • Amber

    • v3.2.1

      • Add some details when signing a contact list

      • Refactor check for logged in account

      • After granting notification permissions show the notification

    • v3.2.0

      • Add profile picture in the incoming requests screen when using a large screen device

      • Add more event kinds translations

      • Add a log with the bunker request response

      • Use the relay from the request to send the response when no app is found

    • v3.1.9

      • Add missing logs for relay errors

      • Change listen for new connections button text and icons

  • Macadamia v0.2.1

    • This release is the first to be published to the App Store:

      • UI Improvements and project structure

      • Token V4 support, drop multi mint token redeem capability

      • Hide Mints instead of deleting

      • SwiftData thread safety & melt recoverability

      • Add Onboarding

  • KeyChat App v1.26.5

    • Add browser tab

    • Support nip07 to login websites

  • Fountain v1.1.14

    • Improve Nostr connect

    • Add ability to switch between NIP55 and nsec

    • Add the ability to seek while paused

  • Pokey v0.1.4-alpha

    • Features

      • Permanent and note notifications are now separated in 2 groups to be managed by Android settings

      • Number of connected relays now displays as part of the permanent notification

    • What’s Changed

      • Create a group for the service notification

      • Show connected relays

  • Haven

    • v1.0.5

      • Support for DB backup with Digital Ocean Spaces

    • v1.0.4

      • feat(lmdb): make LMDB map size configurable

      • NIP-40 and ReplaceableEvents

  • Algo Relay v0.1.4

    • Ranking any note type: support for NIP-20 & NIP-23

  • nos2x-fox v1.17.0

    • Unique unified prompt popup to avoid flooding windows

    • New kind description in prompt popup

  • Plebeian app launches the MVP of Plebeian.Market, its decentralized marketplace dedicated to goods and services tailored for the Bitcoin and Nostr communities [No BS Bitcoin]

    • After four years of development and multiple pivots, the Plebeian app has settled on NOSTR to demonstrate a proof of concept that is poised to disrupt traditional commerce.

Boosts

  • 01:26:35 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • @Anonymous (2,100 sats) “Second best bitcoin show!”

    • @Anonymous (2,100 sats) “Created Bip85 seed for friend. Exported xpub to his bluewallet for deposits, and he recorded seed phrase. After listening to pod I freaked… SUCCESS!!! Seed words were good, on hardware wallet.”

    • @AVERAGE_GARY (100 sats) “🤝🫶🫂🤌🫡👏🔥🥳🙇🏻‍♂️”

Tech Tips of the Day

  • Link cleaner: An open-source progressive web app for removing tracking parameters from URLs [Github]

    • It works offline, can bulk process multiple links and integrate with device share menus.

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 340

      • Channel force closure vulnerability in LDK

      • Zero-knowledge gossip for LN channel announcements

      • Discovery of previous research for finding optimal cluster linearization

      • Erlay update

      • Tradeoffs in LN ephemeral anchor scripts

      • Emulating OP_RAND

      • Discussion about lowering the minimum transaction relay feerate

    • 339

      • Vulnerability in LDK claim processing

      • Replacement cycling attacks with miner exploitation

      • Updated stats on compact block reconstruction

    • 338

      • Draft BIP for unspendable keys in descriptors

      • PSBTv2 integration testing

      • Correction about offchain DLCs

News & Noteworthy

Lightning + L2+

  • Tether announces the integration of USDT on bitcoin’s Lightning Network, utilizing the Taproot Assets protocol developed by Lightning Labs [Announcement]

    • With over 350 million users, Tether aims to enable instant, low-cost cross-border USDT transactions on Lightning.

    • Developers are encouraged to integrate USDT on Lightning by downloading the latest version of the litd suite, which combines necessary services into a single binary for an easy integration.

  • Core Lightning now offers bounties for open-source contributions on the CLN Build on L2 platform [Announcement]

    • Developers can browse issues, claim bounties, and contribute to CLN’s development.

Business & Finance

  • Blockstream launches Blockstream Asset Management and announces two Bitcoin-based investment funds: the Blockstream Income Fund and the Blockstream Alpha Fund, both set to open in Q1 2025. [Press release]

    • The Blockstream Income Fund aims to generate stable, predictable USD-based income by lending against Bitcoin collateral with conservative loan-to-value ratios.

    • The Blockstream Alpha Fund is designed to capitalize on Bitcoin’s ecosystem through diverse strategies, offering institutions and accredited investors exposure to Bitcoin’s growth potential.

  • Casa launches Casa Business, enabling companies to hold digital assets in a 3-key vault for self-custody [Blog post]

    • The platform offers team signing, allowing multiple key holders within a company to manage the treasury securely

  • Galoy launches Lana, a lending platform enabling banks to offer fiat loans secured by bitcoin collateral [Blog post]

    • Bitcoin-backed loans allow customers to access liquidity without selling assets, avoiding capital gains taxes.

  • European fintech company Bringin launches its debit card [Announcement]

    • The card integrates with Google Pay and Apple Pay via the Curve app, and enables tap-and-pay functionality at global merchants.

  • Trivago integrates with Travala, allowing users to book hotels using over 100 cryptocurrencies, including bitcoin [The Block]

  • Braiins Mining introduces Braiins Solo, a dedicated solo pool designed for miners who want to mine independently, to avoid diluting the hashrate of the original Braiins Mining pool.

  • Bitcoin financial services company River announces zero-fee status for U.S.-based open-source Bitcoin developers and non-profits funding such development [Announcement]

  • Rumble announces the development of Rumble Wallet, aiming to provide creators with a new way to transact using Bitcoin and Tether [CryptoSlate]

    • Rumble has also entered a cloud services agreement with the Government of El Salvador, providing cloud storage, computing, databases, load balancers, and Kubernetes integration.

  • FTX Recovery Trust to begin distributing funds to creditors in the convenience class (claims under $50,000) in February 2025 [Announcement]

  • Open House Group introduces bitcoin payments for property purchases in Japan [PR Newswire]

    • The company collaborates with Diamond Hands, Japan’s largest Lightning Network community, to explore applications in real estate.

    • Research areas include operating full nodes for businesses and utilizing the Lightning Network for IoT micropayments.

  • Digital Currency Group (DCG) launches Fortitude Mining, a wholly-owned subsidiary focusing on venture mining across various digital assets [Business Wire]

AI

  • Block introduces codename goose: An open-source, extensible AI agent that goes beyond code suggestions [Github]

    • Goose is compatible with a wide range of large language model providers, allowing users to choose and integrate their preferred model.

Funding

  • OpenSats announces the Ninth Wave of Bitcoin Grants, supporting four projects that enhance open-source innovation, privacy, and accessibility within the Bitcoin ecosystem: Kibo, El Tor, Nutstash, and rust-bitcoin.

  • The 256 Foundation raises a total of 3.146 BTC for open-source bitcoin mining during its Telehash fundraiser [Twitter post]

    • Supporters contributed hashrate to a self-hosted mining pool, which successfully solved block 881423 during the event.

  • Brink renews its financial support for all of its 8 Bitcoin Core engineers through 2025: @fanquake, @glozow, @hhebasto, @theStack, @dergoegge, @stphnvlstk, @fjahr and @marcofleon [Announcement]

  • HRF announces all 11 bounties of its Bitcoin Bounty Challenge have been claimed by developers [Announcement]

  • Spiral renews grant to Justin Moeller (@m1sterc001guy) for his work on Fedimint [Announcement]

  • Bitcoin association Einundzwanzig announces a 0.021 bitcoin donation to both Sparrow Wallet and Alby, and 0.1 bitcoin to the legal defense of the Samourai Wallet developers.

  • Breez secures $5 million to expand bitcoin payment integration [Blog post]

  • Taproot Wizards raises $30 million in a post-seed funding round to enhance OP_CAT [The Block]

Mining

  • Proto announces a long-term partnership with The 256 Foundation, donating 256,000 Intel BZM2 chips to support decentralized bitcoin mining initiatives [Announcement]

  • Braiins Mining open sources its BCB 100 bitcoin mining control board as a contribution to the open-source mining initiative led by the 256 Foundation [Announcement]

    • The BCB 100, designed for Bitmain S19 series and Mini Miner, is now available for public use and development.

  • Decentralization concerns grow as Bitcoin mining pools consolidate [Twitter post]

    • The Bitcoin mempool displays live centralized mining pools that share the same Stratum jobs, reflecting increased consolidation. These pools collectively account for over 35% of the total network hashrate.

    • Antpool leads the consolidation, while other major Chinese pools like F2Pool and ViaBTC—known to collaborate with Antpool—are not included in this count. This suggests that over 51% of the hashrate is controlled by a few entities.

  • Stolen identities lead to $1.9m bitcoin mining power theft in Malaysia [The Miner Mag]

    • Forty-five homeowners and business operators in Malaysia received power bills after tenants allegedly stole their identities to mine Bitcoin illegally.

Privacy

  • France bans crypto mixers to combat money laundering [Amendment N°COM-59]

    • The ban anticipates a similar European regulation effective from July 10, 2027. The French Senate’s legal commission adopted the amendment to address the alledgedly increasing use of mixers in laundering illicit funds.

  • DARPA to launch pre-crime anti-money laundering program [The Rage]

    • The Defense Advanced Research Projects Agency (DARPA) announces the Anticipatory and Adaptive Anti-Money Laundering (A3ML) program, aiming to develop algorithms that detect suspicious financial patterns to anticipate and prevent money laundering activities.

    • The objective of the program is to “eliminate global money laundering by replacing the current manual, reactive, and expensive analytic practices with agile, algorithmic methods”.

  • Swiss FinMa accused of overstepping authority in implementing new KYC rule [The Rage]

    • A leaked email reveals that Switzerland’s Financial Market Supervisory Authority (FINMA) instructed Self-Regulatory Organizations to enforce a monthly 1,000 CHF limit on no-KYC transactions for Virtual Asset Service Providers. Critics argue that FINMA overstepped its authority, as it is permitted to issue guidance but not direct instructions to SROs.

  • United Kingdom demands Apple to provide global backdoor access to encrypted data [The Washington Post]

    • The UK government has secretly ordered Apple to grant blanket access to users’ encrypted cloud backups under the Investigatory Powers Act. This unprecedented demand applies worldwide, forcing Apple to either compromise encryption or withdraw the service in the UK. Apple has refused to comment but is expected to challenge the order.

  • Digital rights group EFF urges dismissal of charges against Tornado Cash developer Roman Storm [CoinDesk]

    • The Electronic Frontier Foundation emphasizes that many privacy tools are dual-use, serving legitimate purposes but potentially misused by bad actors. They argue that holding developers liable for misuse of their open-source software threatens innovation and privacy rights.

  • Poland proposes changes to EU Chat Control, but concerns remain [Blog post]

    • Poland proposes making chat content searches voluntary instead of mandatory, aiming to protect encryption while still allowing surveillance.

    • The proposed ban on anonymous communication would require users to present an ID or facial verification to set up email or messaging accounts.

  • The EU’s Artificial Intelligence Act prohibits real-time remote biometric identification by law enforcement in public spaces, except under specific circumstances. [Reclaim The Net]

    • Exceptions include situations involving a present or foreseeable terrorist threat, allowing law enforcement to use such technology under certain conditions.

    • Critics argue that these exceptions effectively legalize biometric mass surveillance, as they provide legal avenues for its deployment.

  • The Reserve Bank of India teams up with fintech firms MobiKwik, Cred, and Yes Bank to pilot the digital rupee [Business Today]

    • The e₹ wallet app requires video verification and enforces daily limits of ₹50,000 ($577) and ₹10,000 ($115) per transaction. These platforms, with a combined user base of 180 million, will provide public access via the e₹ wallet app.

  • Google revises AI principles, removes pledge against weaponization [TechCrunch]

    • Google has updated its AI principles, removing previous commitments to avoid developing AI for weapons and surveillance. This change aligns Google with other tech companies like Meta and OpenAI, which permit certain military applications of their technologies.

Security

  • Tropic Square releases TROPIC01 RISC-V-based secure element samples for testing [Announcement]

    • TROPIC01 is an open and auditable secure element designed to safeguard hardware systems.

Protocol

  • Bitcoin Core #21590: Safegcd-based modular inverses in MuHash3072 [Merged]

  • Bitcoin Core #31397: p2p: track and use all potential peers for orphan resolution [Merged]

  • Bitcoin Core #31376: Miner: never create a template which exploits the timewarp bug [Merged]

  • LDK #3408: Add static invoice creation utils to ChannelManager [Merged]

  • BOLT #1110: Peer storage for nodes to distribute small encrypted blobs [Merged]

  • Eclair #2982: Add liquidity griefing protection for liquidity ads [Merged]

  • Eclair #2968: Send channel_announcement for splice transactions on public channels [Merged]

  • NIP #1713: Add NIP-4A Event Onion Routing [Open]

  • NIP #1718: NIP-101 - Decentralized Trust System for Nostr [Open]

  • NIP #1728: Re-write NIP 89 to accommodate relays/dvms [Open]

Government & Political

  • Czech President Petr Pavel signs a bill exempting Bitcoin and other digital assets from capital gains tax if held for more than three years [CoinDesk]

    • Individual transactions up to CZK 100,000 (approximately $4,136) per year will not need to be reported to tax authorities

  • Czech National Bank Governor plans to propose investing up to 5% of the bank’s €140 billion reserves in bitcoin [CoinDesk]

    • The governor emphasizes that diversifying assets with bitcoin is beneficial, stating that the cryptocurrency’s value is likely to rise independently of U.S. President Donald Trump’s backing.

    • European Central Bank President Christine Lagarde dismisses the proposal, asserting that bitcoin will not be part of central bank reserves due to concerns over its liquidity, safety, and security. [Reuters]

  • Tornado Cash developer Alexey Pertsev released from prison to prepare appeal [CoinDesk]

    • In May 2024, Pertsev was sentenced to 64 months in prison for money laundering.

  • U.S. government argues money isn’t property to justify seizure [Reason]

    • The U.S. Department of Justice contends that confiscating $50,000 from small business doesn’t violate property rights, asserting that “money is not necessarily ‘property’ for constitutional purposes.”

    • The DOJ’s argument includes three points: the government creates money, so individuals can’t own it; the government can tax money, indicating lack of ownership; and the Constitution permits government spending for the “general welfare.”

  • El Salvador amends Bitcoin law following IMF agreement [Reuters]

    • On January 29, 2025, El Salvador’s Congress approved a bill to amend the nation’s bitcoin law, aligning with a $1.4 billion loan agreement made with the IMF in December 2024.

  • U.S. President Trump establishes working group on digital assets [Press release]

    • The group aims to develop a federal regulatory framework for digital assets, including stablecoins, and will evaluate establishing a national digital asset reserve.

Events

  • Bitcoin Renaissance: A pioneering ​thought leadership summit that marks a new ​chapter in the evolution of the Bitcoin ​ecosystem.

    • February 27-28, 2025 in Denver, U.S

  • Bitcoin Ski Summit: The Bitcoin Ski Summit is an immersive, invite-only gathering in the heart of the Tetons.

    • March 5-9, 2025 in Teton Village, U.S

  • Opt Out Conf: A Bitcoin only conference about Philosophy, Freedom, Economy, Open Source, Privacy, Individual Sovereignty, Nostr, Layer 2 and more!

    • March 29, 2025 in Buenos Aires, Argentina

  • Swiss Bitcoin Conference: Bitcoin only conference in Kreuzlingen on Lake Constance

    • April 24-27, 2025 in Creuzlings, Switzerland

  • BitCare Forum: The Italian Bitcoin Conference

    • May 10, 2025 in Brescia, Italy

  • Budapest Bitcoin: The Bitcoin Conference with a bit of difference

    • August 8-9, 2025 in Budapest, Hungary

  • Learning Bitcoin: A Bitcoin Education Conference

    • August 16-17, 2025 in Vancouver, Canada

Reads

  • Here’s a list of our top recently published reads:

    • Bitcoin Payments: From Digital Gold to Everyday Currency, by Breez & 1A1z [Report]

    • Block Size Report, by Orange Surf [Mempool Research]

    • What is a nostr app anyway?, by hodlbod [Note]

    • Is It the Money or Is It the People?, by Don Olanrewaju [Mises Institute]

    • Everyone knows your location, by Tim Sh [Blog post]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR091 - AnchorWatch Trident Vault, Ledger Co-founder Kidnapped, Blue Wallet, M17, The Case for Multi-vendor Setups, Tails removes HWW Support + MORE ft. Craig & Rob]]>https://substack.bitcoin.review/p/br091-anchorwatch-trident-vault-ledgerhttps://substack.bitcoin.review/p/br091-anchorwatch-trident-vault-ledgerFri, 24 Jan 2025 19:36:29 GMTI’m joined by guests Craig Raw and Rob Hamilton to go through the list.

Listen on your favorite podcast app

Housekeeping

  • 00:01:11 Ross Ulbricht receives ‘a full and unconditional pardon’ from U.S President Donald Trump [Fundraiser]

  • 00:03:44 New Marketing Manager position open at Coinkite

  • 00:03:48 Exchanges BullBitcoin, River, Strike, Relai, CashApp, and Swan were added to BitcoinSecurity.guide

  • 00:04:15 Check out Olas Awesome new nostr app from Pablo

  • 00:04:48 Call for guests: If you are a maker, working on bitcoin projects, we would love to have you on the show. Reach out at producer@coinkite.com

Urgent Vulnerability Disclosures

  • 00:05:58 Ledger co-founder David Balland released after kidnapping [Bloomberg]

    • David Balland, co-founder of French crypto wallet startup Ledger SAS, was kidnapped from his home in central France on Tuesday, kidnappers demandning a substantial ransom in cryptocurrency.

    • Balland was freed on Wednesday night following a police operation and being rescued by the GIGN. He is currently receiving treatment from emergency services.

    • The kidnappers are said to have sent a finger as part of their request for money.

  • 00:12:28 AxeOS CSRF Vulnerability: Using CSRF Attack to update the Payout Address on BitAxe Bitcoin Miners [Snotra’s disclosure]

    • AxeOS, the firmware for Bitaxe Bitcoin miners, lacks authentication and CSRF protections in its web interface, enabling unauthorized users on the same network to alter settings, including the stratum user, which determines the Bitcoin address for payouts.

    • A proof-of-concept demonstrates that visiting a malicious website can change a Bitaxe’s settings without user consent, redirecting mining rewards to an attacker’s Bitcoin address.

    • The web server’s permissive CORS headers further exacerbate the vulnerability, possibly allowing attackers to change hardware settings or upload malicious firmware.

Bitcoin

Software Releases & Project Updates

  • 00:12:58 AnchorWatch launches U.S. service for bitcoin holders [Announcement]

    • AnchorWatch offers a bitcoin custody service with insurance from Lloyd’s of London, targeting U.S. customers holding between $250K and $100M in bitcoin.

      • Key features of AnchorWatch’s service:

      • Insured custody for bitcoin without requiring users to give up their keys

      • Lloyd’s of London Coverholder

      • Trident Vault provides protection through signing transactions while insured

      • Seamless transition to self-custody when policy ends

      • AnchorWatch aims to provide protection against various risks, including theft, loss of keys, and death.

  • Mint-005

    • Mint-005 is a 3 key joint custody vault that provides a way for a Principal to secure bitcoin with the help of an Agent.

    • It uses a negative control approach, where by default funds cannot be moved unless both the Principal and the Agent sign the transaction.

    • There are recovery mechanisms in place for situations where a party loses their keys or the agreement between the Principal and the Agent expires.

  • 00:47:28 Bitcoin Core v28.1

    • This release includes new features, various bug fixes and performance improvements, as well as updated translations.

    • P2P

      • When the -port configuration option is used, the default onion listening port will now be derived to be that port + 1 instead of being set to a fixed value (8334 on mainnet). This re-allows setups with multiple local nodes using different -port and not using -bind, which would lead to a startup failure in v28.0 due to a port collision.

      • #30568 addrman: change internal id counting to int64_t

    • Key: #31166 key: clear out secret data in DecodeExtKey

    • Build:

      • #31013 depends: For mingw cross compile use -gcc-posix to prevent library conflict

      • #31502 depends: Fix CXXFLAGS on NetBSD

    • Test:

      • #31016 test: add missing sync to feature_fee_estimation.py

      • #31448 fuzz: add cstdlib to FuzzedDataProvider

      • #31419 test: fix MIN macro redefinition

      • #31563 rpc: Extend scope of validation mutex in generateblock

    • Doc: #31007 doc: add testnet4 section header for config file

    • CI: #30961 ci: add LLVM_SYMBOLIZER_PATH to Valgrind fuzz job

    • Misc:

      • #31267 refactor: Drop deprecated space in operator""_mst

      • #31431 util: use explicit cast in MultiIntBitSet::Fill()

  • 00:48:10 Wasabi Wallet v2.4.0

    • Add support sending to Silent Payment addresses: receiving is a work in progress

    • Instead of TestNet 3, Wasabi now uses TestNet 4

    • Release Notes are now also available in the client

    • A donation button has been added on the main screen

  • 00:48:15 BDK v0.30.1 - DEPRECATED

    • The bdk library is now deprecated and replaced by bdk_wallet. All projects should migrate to bdk_wallet 1.0.0 or newer as soon as possible.

      • Update bdk 0.30.x README docs to deprecate the bdk library

  • 00:48:27 Nunchuk Android v1.9.59

    • Taproot multisig wallets

    • Revamp add key flow

    • Honey Badger Premier

  • 00:48:37 Specter Desktop v2.1.1

    • Add wallet export to Jade via QR

    • Expose internal node to localhost only

    • HWI upgrade to 2.4.x

    • Make Specter work with Bitcoin Core 28.0

    • Remove BLE code for Jade

  • 00:49:02 Bitcoin Keeper

    • v1.3.3

      • Redesign Electrum Server Management

      • Add Keystone remote signing support

      • PDF export for individual wallet configuration files

    • v1.3.2

      • Concierge: Introducing new technical support

      • Simplify collaborative wallet setup

      • Support alphanumeric PIN for Portal

  • 00:49:18 Blue Wallet v7.0.7

    • Import xpub as zpub/ypub if it was ever used

    • New wallet export screen

    • Display Lightning details in Invoice View

    • Add HKD fiat

    • Add loading indicator to Edit Vault row

    • Set preferred server from menu

    • Keyboard accessory on vault modal

    • Android menu icons

    • And many fixes

  • 00:50:32 BTC Pay Server v2.0.6

    • This release contains a security fix for merchants using refunds/pull payments On-Chain with automated payout processors

    • New features

      • SEO: Add ability to customize HTML meta tags and HTML lang attribute for crowdfund and PoS

      • Add the ability for merchants to manually transition a payout from the InProgress state to AwaitingPayment

  • 00:55:39 Liana v9.0 - It’s over 90.00k !

    • Breaking changes

      • Running Liana v9 on an existing installation will migrate its database. Once migrated the database won’t be compatible with previous versions of Liana.

      • The new Minimum Supported Rust Version of the GUI software is now 1.80

    • Liana daemon / library

      • The daemon feature was removed, we expect user to use their own process manager like systemd

      • Three new columns are added to the table transaction: the number of inputs, the number of outputs and if the transaction is a coinbase transaction

      • A new column is added to the coins table: is_from_self and a new field is_from_self is added to the coin entry of the list_coins command

    • Liana GUI

      • New button on the transactions panel allows user to do an export of their transactions to an external file using the CSV format

      • Bitcoind and electrum information in the settings panel can now be copied to clipboard

      • Coins that are change from transactions that user control are now part of the balance

      • Unconfirmed coins can now be selected by the automatic selection if the coins is from transaction which inputs are controlled by the wallet

  • 00:55:58 Blockstream

    • Green QT v2.0.17

      • Add graphical assets for Jade Plus

      • Support video promo on Linux

      • Show total spent amount in transaction details

  • 00:57:58 BoltzExchange

    • boltz-web-app v1.6.1

      • Safety check before calculating fees

      • Show when no lockup can be found for refund

      • Show routing fees

      • Pro build configuration

  • 00:58:00 Live Wallet v1.0.0

    • Transaction privacy analyzing

    • Transaction output labeling (KYC, do not spend)

  • 00:58:11 Kyoto

    • v0.8.0

      • Request the broadcast minimum fee rate from connected peers

    • v0.7.0

      • Request a block using the Client

      • Add broadcast_random convenience method on Client

      • Request a Range of block headers from Client

  • 00:58:19 ESP-Miner

    • v2.5.0

      • Critical fix: CSRF vulnerability patch

    • v2.4.5

      • Critical fix on devices without PSRAM module: Allow device to start without SPIRAM

    • v2.4.3

      • Enable PSRAM

      • Configure GPIO in Kconfig

  • 00:58:21 Bitcoin Safe v1.0.1

    • Add dark mode support

    • Add delete coin category (via right click context menu) additionally to the “drag to delete button” method

    • Fixes missing USB (HWI) support in Windows and Mac builds

  • 00:58:40 BTC Map

    • v0.9.1

      • Allow users to post merchant comments

      • Add special icon for debug builds

    • v0.9.0

      • Switch to vector maps

Project spotlight

  • 00:58:44 Bitaxe Touch: A new touch screen single ASIC chip Bitcoin solo miner [Announcement]

    • The Bitaxe Touch, developed by Open Source Miners United, is a touch screen Bitcoin miner featuring an 800×480 pixel LCD that displays real-time Bitcoin price, Mempool data, power usage, hashrate, and temperature.

    • It is powered by the Bitaxe 601 Gamma, and utilizes the BM1370 ASIC chip from the Bitmain S21 Pro, with a hash rate of up to 1.6 TH/s.

  • 00:58:51 Coinswap: Functioning, minimal-viable binaries and libraries to perform a trustless, p2p Maxwell-Belcher Coinswap Protocol [Github]

    • The project offers a minimal viable implementation of a trustless, peer-to-peer Maxwell-Belcher Coinswap protocol using HTLCs on Bitcoin.

    • It includes automated integration testing on Bitcoin Regtest and operates over Tor by default. The system supports multiple users (makers, taker, and directory server).

    • Coinswap releases its [v0.1.0](https://github.com/citadel-tech/coinswap/releases/tag/v0.1.0) - First Public Beta Release

      • Complete Protocol Specification:

        • The full Coinswap protocol has been formalized and documented in detail

        • Explore the Coinswap Protocol Specification to understand how it ensures decentralized, private, and censorship-resistant swaps

      • Functional Test Coverage:

        • A robust set of functional tests has been introduced to simulate swap scenarios and ensure protocol correctness

        • Dive into the tests and explore various swap situations: Functional Tests

      • Modular Protocol Design: All protocol components have been modularized for flexibility, extensibility, and easier integration into other Bitcoin applications

      • Command-Line Applications: Coinswap introduces three key command-line apps:

        • makerd: Run as a swap service provider and earn fees

        • maker-cli: Manage your maker server via a command-line interface

        • taker: Act as a client and perform swaps with multiple makers

  • 00:59:20 Scure: Audited & minimal library for creating, signing & decoding Bitcoin transactions [Github]

    • The library allows users to create, sign, and decode Bitcoin transactions, including support for classic and SegWit addresses.

    • Scure provides functionality for Schnorr & Taproot BIP340/BIP341, and BIP174 PSBT, with minimal dependencies.

  • 00:59:28 Bitcoin Is Data: A comprehensive Bitcoin metrics and visualizations platform launches two new sections related to UTXOs, Quantity of UTXOs and Balances of UTXOs, segmented by Bitcoin transaction types.

  • Bitcoin Fee Indicator: A system tray application that fetches and displays current Bitcoin transaction fee rates [Github]

    • It shows various fee rates, including fastest, half-hour, hourly, economy, and minimum, updating every 5 minutes.

  • Kernel-Node: An experimental bitcoin node written in Rust using the libbitcoinkernel library [Github]

    • Its primary function is to validate blocks but not to serve them to the network. The implementation highlights the limited initial API of the kernel library.

  • 00:59:43 Qoinstr: A GUI tool for rust-joinstr [Github]

    • Qoinstr is a work-in-progress graphical user interface designed to interact with the rust-joinstr library

  • First Rshiny: An interactive visualization tool used to explore Bitcoin’s dollar-cost averaging performance

  • 00:59:53 TollGate: A tool enabling WiFi routers to accept Bitcoin payments for internet access

    • TollGate allows users with a router and internet connection to operate as internet service providers by accepting Bitcoin payments for access.

  • Explore Mempool.space through two new lenses:

    • Mempoo.space, a Bitcoin Poo Explorer showing ordinals as poo emojis

    • Memepool.space, a Bitcoin Meme Explorer, showing memes in blocks

  • BitcoinFax: Send faxes worldwide with bitcoin payments over the Lightning Network

Vulnerability Disclosures

  • 01:01:27 Unique 0-click deanonymization attack targeting Cloudflare-backed apps, Signal and Discord users vulnerable [Disclosure]

    • A researcher discovers a 0-click attack leveraging Cloudflare caching to locate users within a 250-mile radius. This method uses the cf-ray HTTP header to identify the closest datacenter based on cached resource requests.

    • A tool called Cloudflare Teleport briefly exploited this before being patched

  • 01:02:00 UEFI secure boot vulnerability allows malicious bootkit deployment [The Hacker News]

    • ESET researchers discover CVE-2024-7344, a vulnerability enabling attackers to bypass UEFI Secure Boot, leading to potential deployment of malicious bootkits.

    • The flaw exists in a UEFI application signed by Microsoft’s third-party UEFI certificate, affecting multiple real-time system recovery software suites.

    • Exploitation allows execution of untrusted code during system boot, granting persistent access even on systems with Secure Boot enabled.

  • 01:02:23 Google Ad directs users to malicious homebrew clone [Twitter post]

    • A sponsored Google ad linked users to a fake Homebrew site with a cURL command distributing malware. The malicious site’s URL differed by just one letter from the official Homebrew site.

  • 01:03:01 Critical rsync vulnerability on Linux and Unix systems, affecting versions 3.2.7 to 3.4.0, necessitates urgent updates [Cyberciti]

    • A heap-based buffer overflow vulnerability, identified as CVE-2024-12084, is found in the rsync daemon due to improper handling of attacker-controlled checksum lengths. This flaw allows an attacker to write out of bounds in the sum2 buffer.

  • 01:03:31 January 2025 Patch Tuesday: 10 critical vulnerabilities and eight zero-days among 159 CVEs [Crowdstrike Blog post]

    • Three zero-day vulnerabilities in Windows Hyper-V NT Kernel Integration VSP are actively exploited, allowing attackers to gain SYSTEM privileges

    • Other zero-day vulnerabilities affect Microsoft Access, Windows App Package Installer, and Windows Themes, potentially leading to remote code execution or elevation of privileges.

  • 01:03:48 Unsecured tunneling protocols expose 4.2 million hosts, including VPNs and routers [The Hacker News]

    • Researchers identify security flaws in tunneling protocols, affecting 4.2 million hosts, including VPN servers and routers.

    • Affected protocols lack authentication and encryption, allowing attackers to inject malicious traffic and perform denial-of-service attacks.

  • 01:03:58 Apple’s CUPS printing system vulnerable to spoofing attacks [CyberInsider]

    • Security researcher Simone Margaritelli discloses a critical vulnerability in Apple’s Common UNIX Printing System (CUPS), highlighting its failure to verify TLS certificates. This flaw permits attackers on the same network to impersonate IPP-over-HTTPS (IPPS) printers, enabling them to intercept, modify, or redirect print jobs, potentially exposing sensitive data and compromising systems.

    • The vulnerability arises from CUPS’s integration with Apple’s Bonjour discovery service, which automatically trusts network printers without proper authentication.

  • 01:04:11 Security researcher Thomas Roth demonstrates code execution on Apple’s ACE3 USB-C controller, enabling firmware extraction [Forbes]

    • Apple acknowledges the attack’s complexity and does not perceive it as an immediate threat, opting not to address it currently.

  • 01:05:32 Five dollars wrench attacks:

    • A Canadian, volunteer moderator on a cryptocurrency forum, becomes the target of individuals who believe he possesses significant wealth in bitcoin [La Presse]

      • Suspects, including two minors, allegedly plan to kidnap and torture him to extract his passwords, assuming he holds millions in cryptocurrency

    • A 56-year-old man found tied up in car trunk after kidnapping in eastern France [France Bleu]

      • The victim, kidnapped on December 31, 2024, was found tied up in the trunk of a car intercepted by police, 600 kilometers from his home.

      • The kidnappers, armed and masked, reportedly demanded a ransom from the victim’s son, a cryptocurrency influencer based in Dubai, after holding the family hostage.

    • Pakistani trader kidnapped, forced to transfer $340,000 in cryptocurrency, seven arrested [Decrypt]

      • Seven individuals, including a Counter-Terrorism Department officer, were arrested for kidnapping crypto trader Mohammed Arsalan in December 2024. Arsalan was abducted and forced to transfer $340,000 from his Binance account. The criminals later released him after the ransom was paid.

    • Turkish man tied up and robbed of nearly $300,000 in cryptocurrency by three individuals in Pattaya, Thailand [Bangkok Post]

      • The assailants binded Erkol’s hands and ankles, leaving him to seek help from a condominium security guard

    • Korean bitcoin trader rescued after abduction in Batangas, Philippines [Philstar]

      • Taehwa Kim, a 40-year-old Korean bitcoin trader, is rescued in Batangas, after being kidnapped in Makati City.

      • Kim meets a prospective buyer for his car at his condominium. During a test drive, three men force him into another vehicle, blindfold and tie his hands, and detain him for three days.

    • Feds arrest a gang of 4 men accused of plotting to kidnap Miami jeweler for cryptocurrency [Local10]

      • The group used a Telegram group chat to plan the kidnapping of a Miami jeweler and theft of $2 million in cryptocurrency. Unbeknownst to them, an informant in their group chat alerted the FBI, leading to their arrest.

      • The suspects, armed with firearms, allegedly planned to kidnap the jeweler using a wired SUV provided by an undercover agent. The group intended to exchange watches for cryptocurrency as a ruse, then hold the victim for ransom.

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 01:07:17 Tails v6.11

    • Critical security fixes

      • Prevent an attacker from installing malicious software permanently

      • Prevent an attacker from monitoring online activity

      • Prevent an attacker from changing the Persistent Storage settings

    • New feature: Detection of partitioning errors

      • Sometimes, the partitions on a Tails USB stick get corrupted. This creates errors with the Persistent Storage or during upgrades.

      • Tails now warns about such partitioning errors earlier.

    • Changes and updates

      • Remove support for hardware wallets in Electrum. Trezor wallets stopped working in Debian 12 (Bookworm), and so in Tails 6.0 or later.

      • Add a link to the Tor Connection assistant from the menu of the Tor status icon on the desktop.

  • 01:09:52 Module_17, M17 modem board for 9600-baud capable radios [Github]

  • Reticulum MeshChat v1.19.0

    • Add setting to enable and disable transport mode

    • Add ability to cancel sending messages

    • Add button to open an LXMF address when no conversations are open

    • Add button to open a nomadnet url without having to click a random node first

    • Telemetry requests from Sideband no longer show up as empty messages

  • SideBand v1.3.0

    • Increased performance by updating included RNS and LXMF to latest versions

    • Add ability to cancel outgoing messages

    • Add ability to render messages formatted with markdown

    • Add ability to compose messages with markdown

    • Add ability to query peer telemetry from the map by right-clicking on the peer

    • Add auto-switching of message mode on attachment

    • Add indication if receiver rejects message

    • Add support for SX1280 bandwidth options to RNode configuration

    • Add ability to launch RNode flasher directly from utilities

  • NomadNet v0.5.7

    • Add sync transfer rate to PN list display

    • Update urwid API calls to handle deprecations

  • Mullvad VPN v2024.4

    • introduces split tunneling in version for macOS, allowing users to exclude specific apps from the VPN

    • Limitations include the inability to exclude Safari and other WebKit-based apps, performance overhead due to additional tunneling, and availability restricted to macOS 13 and above

Project spotlight

  • Peergos: A p2p, secure file storage, social network and application protocol [Github]

    • Peergos is an open-source platform that can be self-hosted and enables secure, peer-to-peer file storage and sharing without central nodes.

  • PrivacySpreadsheet: A privacy evaluation of messaging apps [Github]

  • cjdns: An encrypted IPv6 network using public-key cryptography for address allocation and a distributed hash table for routing [Github]

    • cjdns leverages a distributed hash table for routing, which enables scalable, near-zero-configuration networking.

  • Botan: An open-source cryptography library for C++ with extensive features including TLS, X.509, modern and post-quantum cryptography, plus TPM and RNG support [Github]

    • It provides APIs in C++, C, and Python, alongside other language bindings, and includes a command-line interface.

  • Sticktock: Share TikToks Safely. No Ads, No Spyware, No Phone App. [Github]

    • StickTock is an open-source tool allowing users to watch TikTok videos privately, without ads or tracking. [Onion]

Lightning + L2+

Project spotlight

  • Valet: A Bitcoin + Lightning wallet for Android [Github]

    • Valet is a non-custodial Lightning wallet designed to offer stable purchasing power for users through hosted channels.

    • Developed as a fork of the Simple Bitcoin Wallet, features include coin control, batching, and hardware wallet integration.

  • Eggstr: A platform that enables users to deploy and manage Bitcoin and Lightning applications with their own domain

    • It offers a variety of self-hosted apps, including LNBits, Alby Hub, Strfry (a Nostr relay), Nostr Address, and Blossom Server.

  • Rizful: A service offering instant disposable Lightning nodes

    • Rizful offers cloud-hosted, disposable Lightning nodes designed for fast, high-uptime performance, with instant inbound capacity.

  • Zeus2Koinly: A script to convert Zeus Wallet’s export format into Koinly’s import format [Github]

  • pWallet: A lightweight UI for Phoenix Server that can be set up and run entirely using Docker [Github]

  • LNBeats: A value-for-value music streaming app, using the Lightning Network

Software Releases & Project Updates

  • Rust Lightning v0.1 - “Human Readable Version Numbers”

    • API Updates

      • The lightning-liquidity crate has been moved into the rust-lightning git tree, enabling support for both sides of the LSPS channel open negotiation protocols

      • This release includes support for BIP 353 Human Readable Names resolution

      • On-chain state resolution now more aggressively batches claims into single transactions, reducing on-chain fee costs when resolving multiple HTLCs for a single channel force-closure

      • And many more

    • Performance Improvements

      • LDK now verifies channel_update gossip messages without holding a lock, allowing additional parallelism during gossip sync

      • LDK now checks if it already has certain gossip messages before verifying the message signatures, reducing CPU usage during gossip sync after the first startup

    • Node Compatibility: LDK now handles fields in the experimental range of BOLT 12 messages

    • Security: v0.1 fixes a funds-theft vulnerability when paying BOLT 12 offers as well as a funds-lockup denial-of-service issue for anchor channels.

  • Alby

    • Hub v1.13.0 - Eva Galperin

      • In this release we add some cool new apps to the app store, an auto-unlock feature for self-hosted hubs, extra information about pending closed channels, and some security improvements for isolated apps and budgeting.

        • Auto unlock for self-hosted hubs

        • ZapPlanner custom app

        • Add simple boost widget app

        • Add Clams to Hub’s Store

        • Include funding transaction in pending closing channel message

        • Add balance details for pending channel closures

    • JS SDK v3.9.0

      • Add nip 44 and versioning support

  • Mostro v0.13.0

    • This version dramatically improves privacy for users with keys management implementation: a way clients rotate keys for every trade adding another privacy layer to gift wrap previous implementation.

  • BitBanana v0.8.9

    • Add Payment Path view (LND)

    • Implement “Enable Offer” command for Core Lightning >=24.11

    • Allow offers without description (Core Lightning)

    • Add description and payer note for paid bolt12 offers in transaction history

    • Increase VPN start timeout to improve UX on slow internet connection

  • Nutshell v0.16.4

    • This release brings two new protocol spec updates to nutshell, NUT-19 and NUT-20. It also includes a new HTTP compression middleware.

      • Add MPP methods key to info endpoint

      • Add HTTP compression middleware

      • NUT-19: Cached Requests and Responses

      • NUT-20 (signatures on quotes) for mint and wallet side

      • Add period at the end of the phrase

      • Add NUT-19 example for caching responses

Nostr

Project spotlight

  • Nstart: A straight-forward nostr onboarding wizard [Github]

    • Nstart is a user-friendly onboarding tool for Nostr, offering key features like local backups and customizable contact suggestions.

    • It incorporates a multi-signer bunker to protect Nsec keys, allowing for easy recovery and access even in case of failure or theft.

  • Kanbanstr: A new nostr client for task management [Github]

    • Users can log in via nsec, npub, or NIP-07, create boards with customizable columns, and organize tasks using cards.

    • Current features include markdown support in cards, automatic mapping of cards to columns by status, and assigning tasks with “zap” tags to facilitate payment. Pending updates include programmatic functionalities and enabling direct zaps for task payments.

  • Noshtastic: A geo-specific virtual Nostr relay for Meshtastic [Github]

    • Noshtastic operates as a decentralized Nostr relay independent of the internet, using Meshtastic devices for communication.

    • It employs negentropy-based synchronization and region-specific geohash tagging to distribute messages locally without internet connectivity.

  • Alexandria: A Nostr knowledge base and long-form article reader [Github]

    • Alexandria is designed to display modular, long-form articles in a clean, distraction-free interface for focused reading.

    • It supports Nostr events, allowing users to interact with organized content in a structured format.

  • Nosotros: A nostr web client optimized for both mobile and desktop usability [Github]

    • Built using TypeScript, it includes testing support and a progressive web app design for smooth functionality.

  • Bostr: A nostr relay bouncer [Code repository]

    • Bostr is a minimalist HTTP server built with Go, designed to serve static files efficiently. It also acts as a nostr relay aggregator proxy, consolidating data from multiple relays.

    • Bostr2, is a bostr next generation project

  • Tides: A Nostr messenger browser extension for Chrome & Brave [Github]

    • Tides is a browser extension that provides secure, private messaging using the Nostr protocol. It supports real-time encryption, contact management, and media sharing.

    • Users can log in via NIP-07 extension, Chrome storage, or manual key input

  • CLN NWC: Nostr Wallet Connect plugin for CLN [Github]

    • Users can configure or manually start the plugin, create connections with budgets, list active connections, and revoke them as needed.

    • Payment requests are routed via Nostr relays.

  • Emojito: A platform based on the nostr application framework ngine to create personalized emoji sets

    • Nostr interactions: users can use personalized reactions, provided their client supports NIP-30

  • Nostr Llama 3.1 8B: A model built on Nostr notes from around 7,000 users

    • Fine-tuned using multiple datasets, including Evol-Instruct-Code and CodeFeedback-Filtered-Instruction.

    • With 8.03B parameters, this model is based on Meta’s Llama 3.1

  • Granary: A social web translator that fetches and converts data between platforms, formats, and protocols, including Nostr [Github]

    • It supports social networks, HTML, and JSON with microformats2, ActivityStreams 1 and 2 (including ActivityPub), Atom, RSS, and JSON Feed. It works as a Python library and REST API, supporting read and write operations for data interoperability.

Software Releases & Project Updates

  • Olas

    • v0.1.9

      • Web cleanup

    • v0.1.8

      • Reaction, comments, zaps, etc now showing up on the content view

    • v0.1.7

      • Add color style so text shows in dark mode

  • Notedeck Latest codebase changes

    • Add t tags for hashtags

    • Use HashSet, lowercase, and add emoji tests

    • Add test and format

    • Adjust context menu/grip circle sizes

    • Extract timing from AppSizeHandler to TimedSerializer

    • Introduce ZoomHandler

  • Amethyst

    • v0.94.3

      • Add iMeta tags to GIF urls to optimize GIF previews

      • Maintain note reaction visibility when scrolling

    • v0.94.1 - GIFs and Custom Emoji inputs

      • Add a : command to link custom emojis on new posts and chats. Similar to the @ for user search, just start typing to find your custom emojis.

      • Create your GIF and rection libraries on emojito.meme

    • v0.94.0 - Encrypted Media on DMs

      • Adds support for encrypted media uploads on NIP-17 DMs

      • Integrates with Pokey’s Broadcast receiver

      • Shows NIP-22 replies in the replies tab of the user profile

      • New upload screen for chats

      • Add support for multiple media uploads at the same time.

      • Add support to display PictureEvents with multiple images at the same time

      • Add QR code private key export dialog

      • Add new picture and video events to the user profile gallery

      • Add basic support for RelationshipStatus to Quartz

      • And much more

  • YakiHonne

    • Web - v4.2.3 - Add support for uploading multiple images or videos in notes, comments, and messages - Refine the search mechanism for better accuracy and performance

      • v4.2.2

        • Add language support for Spanish, Portuguese, Thai, Japanese, and Italian

        • Enable support for processing invoice payments in notes

    • Mobile v1.6.1

      • Add language support for Spanish, Portuguese, Thai, Japanese, and Italian

      • Add ability to multi-select and upload media

      • Introduce enhanced video player

      • Add media through your camera into notes

      • Enable support for processing invoice payments in notes

  • Flotilla

    • v0.2.3

      • Add NIP 56 reports for messages and threads

      • Add ToS and privacy policy

      • Add avatar fallback icons

      • Add mark as read to chats

      • Add send button to chat compose

      • Accommodate onion URLs

      • Improve loading and notifications

    • v0.2.1

      • Improve performance, as well as scrolling and loading

      • Improve NIP 29 compatibility

      • Refine notifications

      • Add join space CTA

  • Njump.me Latest codebase changes

    • Add support for kind:20 photos

  • 0xChat App

    • v1.4.6

      • Add reactions and mention notification button to chats

      • Long press the “Like” button on moments to select an emoji

    • v1.4.5

      • Add support for NIP46 login

      • Adapt UI for tablet devices

      • Introduce connection ping status

      • Implement search functionality for Moments

      • Set default relays for first login

      • Add default reaction emojis

  • Citrine v0.7.0

    • Update quartz dependency

    • Check if events are deleted

    • Recover service after crash

    • Add back button in the events screen

  • nos.social v1.1

    • Nos now publishes the hashtags it finds in your note when you post

    • Update the default relays that are added when you create an account

    • Add feed picker view (UI only)

    • Add feed source customizer drop-down view

    • Make feed source selector work

    • Add empty state for lists/relays drop-down

    • Add support for decrypting private tags in kind 30000 lists

    • Add pop-up tip for feed customization

    • Add remembering which feed source is selected

  • Nostur v1.17.0

    • Sync already seen/read across multiple devices

    • New 😂-feed

    • Support new Olas/picture format (viewing)

    • Support Frost/multi-sig login

    • Support for .heic image format in posts

    • Show extra autopilot relays used on Post Preview (default off)

    • Login with nip05 (read-only)

    • Undelete button for deleted posts

  • Nostrmo v2.9.5

    • Add Pc tray support

    • Add Pc notice support

    • Add support for some linux packages

    • Relay dtail page can jump to jumble.social

    • User can config their Client tag

    • Add note tail support

  • Nostrss v1.1.0

    • Optional cache: A default size can still be set with env values, however if no env value is provided and no cache size is defined for a feed, no limit will be set.

    • Dependencies updates: Note that this new version uses a version on tokio-cron-scheduler which changes the scheduler pattern to be used.

  • Zapstore

    • v0.2.2

      • Replace buggy WoT API-based service with Vertex DVM-based service (alpha)

    • v0.2.0

      • Sign in with NIP-55 (Amber)

      • Ability to zap via NWC and view zap receipts

  • Voyage v0.17.2

    • Force nip22 usage when reply has 6 or less characters

    • Use v2 replies by default for new installs

    • Don’t set grandparent p-tags

  • Strfry v1.0.4

    • New config: maxReqFilterSize. This allows REQs with many more filters

    • Default maxReqFilterSize was increased to 200

    • Reduce log spam by not dumping full invalid events

    • In sync and stream commands, provide the connected URL to write policy plugins

  • Nostrss v1.1.0

    • Dependencies updates: Note that this new version uses a version on tokio-cron-scheduler which changes the scheduler pattern to be used.

    • Optional cache: The feed cache is now optional. A default size can still be set with env values, however if no env value is provided and no cache size is defined for a feed, no limit will be set.

  • Amber

    • v3.1.8

      • Add button to clear cached data in settings

      • Fix multiple bunker requests not clearing when accepting or rejecting

    • v3.1.0

      • Move bunker and nostrconnect to its own files

      • Show relays after the app is connected

  • Algo Relay v0.1.3

    • Uselessly preallocate some slices

    • Dev refresh feeds

    • Saving the Social Graph

    • Purge Data Functionality

  • Wot Relay v0.1.16

    • Ignore follow list for people who follow spammers

  • Feeder v2.8.0

    • Add native Nostr NIP-23 feed support

Boosts

  • 01:12:29 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @Anonymous (3,333 sats) “I don’t know who this Rob guy is but congrats to him on the launch of his new fishing company!”

    • @manbyt (2,100 sats) “Itm!”

    • @agichoote (1,000 sats) “I see the new ep out and I don’t even need to see what else is out there”

    • @btconboard (300 sats) “The people using miniscript are people too despite their extra extra autism, NVK”

Tech Tip of the Day

  • ITOA: A web-based tool that converts images into ASCII art, with support for both monochrome and color output [Github]

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 337

      • Continued discussion about rewarding pool miners with tradeable ecash shares

      • Offchain DLCs: developer conduition posted to the DLC-dev mailing list about a contract protocol that allows an offchain spend of the funding transaction signed by both parties to create multiple DLCs

    • 336 - Investigating mining pool behavior before fixing a Bitcoin Core bug: Abubakar Sadiq Ismail posted to Delving Bitcoin about a bug discovered in 2021 by Antoine Riard that results in nodes reserving 2,000 vbytes in block templates for coinbase transactions rather than the intended 1,000 vbytes

      • Contract-level relative timelocks: Gregory Sanders posted to Delving Bitcoin about finding a solution for a complication he discovered about a year ago (see Newsletter #284) when creating a proof-of-concept implementation of LN-Symmetry

      • Multiparty LN-Symmetry variant with penalties for limiting published updates: Daniel Roberts posted to Delving Bitcoin about preventing a malicious channel counterparty from being able to delay channel settlement by deliberately broadcasting old states at a higher feerate than an honest counterparty is paying for confirmation of the final state

    • 335

      • News:

        • Deanonymization attacks against centralized coinjoin: Yuval Kogman posted to the Bitcoin-Dev mailing list details about several privacy-reducing vulnerabilities in the centralized coinjoin protocols used by current versions of the Wasabi and Ginger wallets, plus past versions of the Samourai, Sparrow, and Trezor Suite software wallets

        • Updated ChillDKG draft: Tim Ruffing and Jonas Nick posted to the Bitcoin-Dev mailing list a link to the current draft BIP for ChillDKG, which describes a distributed key generation protocol compatible with FROST scriptless threshold signatures for Bitcoin

      • Changing consensus:

        • CTV enhancement opcodes

        • Adjusting difficulty beyond 256 bits

        • Transitory soft forks for cleanup soft forks

        • Quantum computer upgrade path

        • Consensus cleanup timewarp grace period

News & Noteworthy

Bitcoin

  • Clavis: A new hardware wallet by Xellox Wallet

    • Clavis is designed for online and offline bitcoin storage. It features a capacitive fingerprint sensor, passcode protection, and is IP68 rated.

  • Judge dismisses man’s bid to recover 8,000 bitcoin from landfill [Ars Technica]

    • James Howells’ 11-year effort to retrieve a hard drive containing the private keys valued at approximately $765 million, ends as High Court Judge Keyser KC rules against him.

    • The judge cites environmental concerns and legal ownership, stating that excavating the landfill could release harmful substances.

Lightning

  • Zeus increases its LSP maximum channel lease duration from 6 to 12 months [Announcement]

Business & Finance

  • Block Inc fined $80 million for inadequate anti-money laundering controls in Cash App [Reuters]

  • BitMEX is fined an additional $100 million for Bank Secrecy Act violations between 2015 and 2020 [DOJ Press release]

    • Prosecutors sought a $417 million fine, arguing BitMEX hadn’t fully accepted responsibility, noting the company earned approximately $1.3 billion while ignoring U.S. regulations over five years.

  • Coinbase launches Onchain Reputation API and Bitcoin-backed loans

    • Coinbase introduces a public beta of the Onchain Reputation API, offering a reputation score for wallet addresses, ENS, and Basename IDs, ranging from -100 to +1000.

    • The company also announced Bitcoin-backed loans using its Base protocol, clarifying that the loans aren’t backed by Bitcoin nor based on its blockchain.

  • Unchained now supports passkey support for enhanced account security [Blog post]

  • River introduces ForceField, an extra layer of protection to secure Bitcoin against theft and scams [Announcement]

    • It features a 5-day delay on withdrawals, offering users time to respond to unauthorized access attempts.

  • Tether has filed a lawsuit against Swan Bitcoin in the High Court of England and Wales, alleging major violations of their commercial agreements related to their 2022 Bitcoin mining joint venture, 2040 Energy [Blockspace]

    • In September 2024, Swan sued former employees, accusing them of stealing proprietary information to establish Proton Management, which now oversees Bitcoin mining assets with Tether.

  • Bitcoin miner MARA deploys 16% of its BTC holdings (7,377 BTC, worth about $730 million) in short-term loans to third parties, aiming to generate a “modest single-digit yield” from these loans [The Miner Mag]

    • MARA surpassed its December hash rate target of 50 EH/s and increased its total BTC holdings to 44,893 BTC, including the loans.

  • Canaan launches Avalon Mini 3 (37.5 TH/s) and Nano 3S (6 TH/s) Bitcoin miners, respectively $899 and $249 [Blog post]

    • The Avalon Mini 3 doubles as a home heater, offering a sustainable, multi-purpose solution for home mining.

Tradfi

  • BlackRock introduces the iShares Bitcoin ETF in Canada, trading under the ticker IBIT [Business Wire]

Education

  • Applications for the Sovereign Engineering Cohort 4 (SEC-04) are now open [Registration]

    • SEC-04, titled ‘Building it Right’, will take place from March 3 to April 11, 2025.

  • The Bitcoin Students Network launches its Layer Zero program to empower students worldwide in building Bitcoin’s social layer and community [Forbes]

    • The program offers hands-on experience by connecting students with Bitcoin entrepreneurs.

Funding

  • OpenSats grants additional funding to three dedicated Bitcoin Core contributors: @L0rinc, @kevkevinpal, and @danielabrozzoni

  • BDK announces the pseudonymous John Galt as its newest grantee:

    • John will lead the efforts in partnerships, membership program and onboarding new members.

  • Vinteum awards its fourth grant to plebhash for contributions to Stratum V2 and decentralized Bitcoin mining

  • Finney Freedom Prize honors (blocks 210,000-420,000) Bitcoin pioneers Pieter Wuille and Gregory Maxwell for their contributions to Bitcoin usability, scalability, and privacy. [Announcement]

  • The BTC Pay Server Foundation receives a $25,000 grant in bitcoin from Unbank, a cash focused Bitcoin exchange [Bitcoin Magazine]

  • Alpen Labs announces raising $8.5M in a strategic round to support the development of Strata, a Bitcoin ZK rollup aimed at improving the Bitcoin ecosystem with self-custody, privacy, and interoperability.

  • Fold Inc. secures $30 million convertible note financing with ATW Partners backed by its bitcoin assets [FFNews]

  • JAN3 raises $5 million in a seed funding round for AQUA Wallet development [Blog post]

Mining

  • Fifteen transactions involving OFAC-sanctioned addresses were missing from blocks, prompting investigation into mining pool behavior [b10c Blog post]

    • F2Pool may be filtering sanctioned transactions, though other factors like transaction propagation or job publication may be responsible for some exclusions.

  • Hashrate Index publishes a list ranking the top bitcoin mining countries of 2025 [Blog post]

Privacy

  • Telegram provided U.S. authorities with data on 2,253 users in 2024, a significant increase in requests fulfilled [404 Media]

    • Between January and September, Telegram fulfilled 14 requests involving 108 users; the number surged in the final quarter.

    • Following Telegram CEO Pavel Durov’s arrest, the company updated its privacy policy to share user data with law enforcement when legally required.

  • GeoSpy, developed by Graylark Technologies, can pinpoint photo locations based on visual clues like soil, vegetation, and spatial relationships. [404 Media]

    • Initially available to the public, GeoSpy has now restricted access, offering its tool to law enforcement and government agencies.

    • Experts warn that the widespread use of GeoSpy could pose privacy risks, as it enables mass geolocation without traditional metadata.

  • The UN General Assembly adopts the United Nations Convention against Cybercrime, aimed at strengthening global cooperation to combat cybercrime and protect societies [UN News]

    • Critics, including human rights activists and tech companies, raised concerns over potential misuse by authoritarian governments

  • Apple agrees to a $95 million settlement following allegations that Siri recorded users without consent [CyberInsider]

    • Despite denying wrongdoing, Apple commits to deleting certain pre-October 2019 audio recordings and clarifying data collection practices

Cybercrime

  • Gang exploited Bitcoin glitch for £20m fraud, authorities recover full compensation [UK News]

    • An international crime gang exploited a flaw in an Australian cryptocurrency exchange in 2017, stealing over £20m.

    • The victim was compensated in full due to the rise in Bitcoin’s value, with excess funds distributed to authorities.

Protocol

  • Bitcoin Core #28121: Include verbose “reject-details” field in testmempoolaccept response [Merged]

  • BDK #1592: Introduce Architectural Decision Records (ADRs) to document major changes by detailing the problem, decision drivers, considered alternatives, advantages and disadvantages, and the final decision. [Merged]

  • BDK #1670: Introduce O(n) canonicalization algorithm: This PR introduces an O(n) algorithm to determine the canonical set of transactions in TxGraph [Merged]

  • LDK #3435: Authenticate blinded payment paths: introduces an authentication field to the blinded path payment context message, allowing the payer to include a Hash-based Message Authentication Code (HMAC) and a nonce [Merged]

  • LDK #3340: Batch on-chain claims more aggressively per channel: introduces batching of on-chain claim transactions with pinnable outputs, reducing block space usage and fees in force-closure scenarios [Merged]

  • Eclair #2936: Delay considering a channel closed when seeing an on-chain spend: introduces a 12 block delay [Merged]

  • Rust Bitcoin #3792: Add BIP324 V2 p2p network message support [Merged]

  • NIP #1695: NIP-60: clarify privkey is optional [Open]

  • NIP #1706: Introduce support for signing and encryption/decryption on hardware based Nostr Signing Devices over BLE [Open]

  • NIP #1696: nostr over reticulum: allows nostr clients/relays to communicate over Reticulum networks [Draft]

  • NIP #1674: Adds Open Graph “iMeta” tags: for clients to preview URLs without having to ping them [Open]

  • NIP #1681: NIP-88: DLC oracle announcement/attestation event kinds [Open]

Government & Political

  • At the World Economic Forum (WEF) Annual Meeting 2025, Spanish Prime Minister Pedro Sánchez calls for “an end to anonymity on social media” and for forcing “all these platforms to link every user account to an European Digital Identity Wallet.” [Reclaim The Net ]

  • U.S. court overturns sanctions on Tornado Cash mixer [The Block]

    • A U.S. District Court in the Western District of Texas orders the Office of Foreign Assets Control (OFAC) to remove Tornado Cash-related addresses from its Specially Designated Nationals and Blocked Persons (SDN) list.

    • The court rules that Tornado Cash’s immutable smart contracts are not “property” under the International Emergency Economic Powers Act (IEEPA), as they cannot be owned or controlled.

    • Despite the sanctions reversal, the U.S. Department of Justice states that this decision does not affect ongoing criminal proceedings against Tornado Cash developers, including Roman Storm.

  • Operators of Blender and Sinbad custodial bitcoin mixers arrested and charged with money laundering, facing over 25 years in prison if convicted [DOJ Press release]

    • The U.S. Department of Justice indicts three Russian nationals for operating unlicensed crypto mixers Blender.io and Sinbad.io

    • Blender.io operated from approximately 2018 to 2022, advertising a “No Logs Policy” and requiring no user registration.

  • Donald and Melania Trump launch the $TRUMP and $MELANIA meme coins ahead of inauguration [Coin Telegraph]

    • Both tokens are built on the Solana blockchain. For $TRUMP coin, an initial supply of 200 million coins is set, with plans to expand to 1 billion over three years.

    • The token’s website states that $TRUMP is “not intended to be, or the subject of” an investment opportunity or any type of security, and is “not political and has nothing to do with” Trump’s campaign, office, or government agency.

  • Trump-backed World Liberty Financial token extends sale [Coin Telegraph]

    • World Liberty Financial extended its token sale after raising $300 million, selling 20% of 100 billion WLFI tokens at 1.5 cents each. The extension added 5 billion tokens at 5 cents, aimed at raising an additional $250 million.

    • A tweet from WLFI announced significant strategic purchases “to commemorate the inauguration of Donald J. Trump as the 47th President of the United States,” including $47 million in ETH and wBTC, alongside smaller investments in cryptocurrencies.

  • The U.S. Department of Justice received court approval to liquidate 69,370 bitcoin following a four-year legal battle [Decrypt]

  • U.S. government recommends returning the 94,000 stolen bitcoin from 2016 Bitfinex hack to exchange as in-kind restitution [The Block]

    • This recommendation aligns with prior court filings where both defendants and Bitfinex’s parent company, iFinex, acknowledged the exchange as the sole victim of the 2016 hack.

  • U.S Internal Revenue Service (IRS) postpones bitcoin cost-basis reporting rules to 2026 [The Block]

    • The IRS delays new bitcoin tax reporting rules until January 1, 2026, granting brokers additional time to adapt to cost-basis regulations for centralized platforms.

  • Coin Center Fellow Michael Lewellen is suing the DOJ for criminalizing the creation of non-custodial software, like his Pharos protocol [Coin Center Blog post]

    • The DOJ argues that developers who enable money movement, like those behind Tornado Cash, must register as money transmitters, a position Lewellen contests as unconstitutional and anti-innovation.

  • Texas court orders Coinbase user to surrender access to his $124 million bitcoin holdings [Bloomberg]

    • Frank Ahlgren, was sentenced to two years for underreporting profits from $3.7 million in bitcoin sales.

    • Ahlgren must surrender access to his bitcoin holdings including private keys and passphrases, to settle a $1 million restitution, and disclose the location of 1,287 bitcoins moved via a mixing service in 2020.

  • A U.S federal appeals court overturned the FCC’s net neutrality rules, limiting its authority to regulate wireless and broadband services, citing the Loper Bright case. [Reuters]

    • The ruling prevents ISPs from throttling or blocking content, but allows state-level neutrality rules to remain in effect.

  • Burma’s military junta is tightening control over online spaces through a new cybersecurity law targeting digital platform providers [AP News]

    • The law mandates providers to store user data for three years and share it with the state on request, penalizing non-compliance.

    • VPN use is criminalized, with violators facing up to six months in prison and fines.

  • Iran’s central bank abruptly blocks payment gateways to cryptocurrency exchanges amid currency crisis [Twitter post]

    • This action follows previous measures, including freezing bank accounts of cryptocurrency exchanges and suspending payment processing services in November, due to concerns over speculation in the Tether market and money laundering risks.

  • Thai police seize 996 bitcoin mining devices [Bangkok Post]

    • Authorities raided JIT Co in Chon Buri, seizing 996 bitcoin miners, which were being run using modified power meters, stealing electricity.

  • Kazakhstan shut down 36 unauthorized crypto exchanges in 2024, seizing assets worth $112 million [Coin Telegraph]

    • Authorities are working on a digital currency, the digital tenge, and are collaborating with Visa and Mastercard to integrate it into global payment systems.

Events

  • Bitcoin Educators Unconference: Mi Primer Bitcoin fourth conference for educators, meetup organizers and community leaders

    • April 10, 2025 in Nashville, U.S

  • Bitcoin Is For Everyone: An immersive full-day Bitcoin Experience in Portland, OR

    • August 1st, 2025 in Portland, U.S

Reads

  • Here’s a list of our top recently published reads:

    • Privacy matters because it empowers us all, by Carissa Véliz [Essay]

    • A Spark of Defiance: A guide to Solo mining with a Bitaxe to a RasPi full node & a self-hosted Public Pool stratum server, by econoalchemist [The 256 Foundation]

    • How to run an economic node, by Scoresby [Guide]

    • Quantum Leap? Disentangling fact from fiction in bitcoin and quantum computing, by John [Ten31 Blog post]

    • Nostr is the world’s biggest bitcoin circular economy, by Frank Corva [Bitcoin Magazine]

    • A Day in the Life of a Prolific Voice Phishing Crew, by Krebs On Security [Blog post]

    • Buckets of blind signatures, by Cashu [Blog post]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR090 - COLDCARD, BullBitcoin, Tangem & Proton Vulnerabilities, Signatures Explained + MORE ft. Rob]]>https://substack.bitcoin.review/p/br090-coldcard-bullbitcoin-tangemhttps://substack.bitcoin.review/p/br090-coldcard-bullbitcoin-tangemFri, 03 Jan 2025 23:01:37 GMTI’m joined by guest Rob Hamilton to go through the list.

Listen on your favorite podcast app

Housekeeping

Urgent Vulnerability Disclosures

  • 00:18:57 New fake Ledger data breach emails try to steal crypto wallets [Bleeping Computer]

    • These emails falsely claim that a data breach has occurred, urging recipients to verify their recovery phrases through a provided link.

  • 00:20:51 Cryptocurrency hardware wallet Tangem ‘fixes’ app bug that saved user seed phrases in application logs, exposing private keys during support interactions [Coin Telegraph]

    • “What was the issue? When creating a wallet with a seed phrase, the private key was mistakenly logged in the application’s logs. These logs could later be accessed during interactions with our support team.” [Tangem’s Reddit comment]

    • Redditor, u/areklanga points out in a Reddit discussion on Tangem’s operations “So, user private keys remain in both user email history, Tangem email history, and perhaps in some Tangem ticket tracking system and are available for Tangen employees. Which makes all Tangem users compromized.”

  • 00:26:03 Irrevocable fees—stealing from LN using revoked commitment transactions [David Harding’s disclosure]

    • A critical vulnerability in all major Lightning Network implementations could allow miners to steal up to 98% of channel funds under certain conditions. Honest users performing normal operations also risk smaller fund losses due to similar flaws.

    • Eclair, LDK, and LND with default settings were vulnerable to an immediately exploitable version of the attack. Core Lightning users face risks with non-default configurations, especially when the --ignore-fee-limits setting is enabled.

    • Mitigations for the most critical flaws are implemented through updates: Eclair v0.10.0 (Feb 2024), LDK v0.0.123 (May 2024), and LND v0.18.3-beta (Sept 2024). Future protocol changes are required to eliminate all variations of the vulnerability.

  • 00:27:13 Security research company Zellic identified a vulnerability in Proton Wallet’s early preview version, affecting wallet and backup mnemonic security.

    • The issue stemmed from the use of Dart’s Random() class, which is not cryptographically secure. This weakness made it feasible for attackers to predict generated passwords, compromising user data.

Bitcoin

Software Releases & Project Updates

  • 00:28:29 Coldcard Edge v6.3.4

    • Shared Improvements - Both Mk4 and Q

      • Enhancement: Hide Secure Notes & Passwords in Deltamode. Wipe seed if notes menu accessed

      • Enhancement: Hide Seed Vault in Deltamode. Wipe seed if Seed Vault menu accessed

      • Bugfix: Do not allow to enable/disable Seed Vault feature when in temporary seed mode

      • Bugfix: Bless Firmware causes hanging progress bar

      • Bugfix: Prevent yikes in ownership search

      • Change: Do not allow to purge settings of current active tmp seed when deleting it from Seed Vault

    • Mk4 Specific Changes

      • All updates from 5.4.0

      • Enhancement: Export single sig descriptor with simple QR

    • Q Specific Changes

      • All updates from version 1.3.0Q

      • Bugfix: Properly re-draw status bar after Restore Master on COLDCARD without master seed

  • 00:33:00 BLOCKCLOCK v1.2.3

    • MINI only:

      • Add some “mime fun” on display page. Mr. Yellow makes an appearance.

      • Press either of the two middle buttons (not top/bottom) and the next value in your list will be shown immediately. MICRO already had this feature with bottom right button.

    • External IP address reported into the log file to aid network debug.

    • MAC address (wifi) is now shown on network page. Might be used for DHCP management on your LAN.

    • Carat symbol (^) added to the font.

    • Some values will be able to show OVER/UNDER without the bar between.

    • Improve local API display of numeric values, when using /api/show/number endpoint.

  • 00:33:36 BDK v1.0.0

    • Wallet::transactions should only return relevant transactions

    • Minor updates to fix new rustc 1.83.0 clippy warnings

  • 00:33:50 Nunchuk

    • Android

      • v1.9.57

        • Taproot multisig wallets: Nunchuk introduces Taproot multisig, reducing transaction fees and simplifying complex scripts, improving user experience and network performance.

      • v1.9.56

        • Add dark mode

        • Add biometric login support

    • Desktop v1.9.42

      • Implement advanced coin control

  • 00:34:19 BullBitcoin Mobile v0.4.0 - Payjo+n

    • Basic Payjoin Implementation:

      • Bull Bitcoin integrates Payjoin V2 into its mobile wallet, enabling serverless, asynchronous Bitcoin transactions. [Announcement]

      • Payjoin transactions no longer require constant internet connectivity or a full node. The receiver’s device can stay offline, resuming the session when reconnected.

  • 00:36:59 Bitcoin Keeper

    • Mobile v1.3.1

      • New Collaborative Wallet flow to make it easier to create a wallet with friends and family

      • Update the signing devices UI with a focus on easier collaboration and use

    • How to set up Bitcoin Keeper wallet with Tapsigners to create a mobile inheritance plan [Tutorial by BTC Sessions]

  • 00:37:21 Electrs v0.10.8

    • Separate blocks reading & index writing into scoped threads

    • Set HTTP Content-Type header for Prometheus response

    • Use ctrlc in place of signal-hook on Windows

    • Don’t deserialize transactions if not needed

    • Run CI only on master branch and PRs

    • Update dependencies (bitcoin, bitcoin_slices, crossbeam-channel, tempfile)

  • 00:39:20 BTCPayServer v2.0.5

    • Checkout: Add support link to footer

    • Pull Payment: Add “Copy Link” button to the action column

    • Greenfield: Remove authorization requirement for PoS data

    • Greenfield: Resolve store user’s image URL

  • 00:39:36 rust-payjoin v0.22.0

    • Payjoin V2 Sender now serializes reply_key so that it may resume after being persisted

      • Propagate uri Fragment parameter errors to their caller

      • Have Sender persist reply key so resumption listens where a previous send session left off

  • 00:39:45 Krux installer v0.0.20

    • First stable version of the entire code refactoring. Exisiting features:

      • Automatic check of latest official firmware

      • Optional selection of older firmware versions

      • Supported devices: M5stickV, Sipeed Amigo, Sipeed Bit, Sipeed Dock, Sipeed Cube, Yahboom, WonderMV

      • Flash official firmware with automatic integrity/authenticity verification

      • Flash beta firmware devices

      • Air-gap update devices with SDcard

      • Wipe devices

      • Support for Windows, MacOS Arm, MacOS Intel, Debian-like OS and Fedora

  • 00:39:55 Frostsnap v0.0.0-alpha.1

    • Basic wallet recovery:

      • Allows you to delete keys from the key list

      • Allows you to recover them by plugging in devices

  • 00:40:42 Bitcoin Safe 1.0.0rc1

    • New Features:

      • Full support for all major hardware signers Coldcard, Q, Bitbox02, Blockstream Jade, Trezor, Foundation Passport, Keystone, Ledger, Specter DIY

        • Full support for BBQr and UR

      • Balance Statement PDF Export

    • Improved Features:

      • Sync & Chat: Label Synchronization backup and Multi-party Multisig Collaboration can now be enabled in the last wallet setup wizard step

      • Transaction diagram navigation by clicking on inputs and outputs

  • 00:42:03 Blockstream Satellite v2.5.0

    • Add graphical user interface (GUI) application (blocksat-gui)

    • Add option to disable Linux media build backport on TBS driver installation

    • Update Telstar 11N Africa and Europe downlink frequencies

  • 00:42:28 Raspiblitz v1.11.4

    • AlbyHub feature release

    • Add AlbyHub to RaspiBlitz SSH menus

    • Improve mempool install script

  • 00:42:39 Ashigaru v1.1.0

    • Overhaul of Settings menu user interface

    • Add wallet accounts recovery information

    • Ability to automatically update over Tor the app’s functionality URLs (with PGP verification) to ensure continuous PayNym directory and Soroban network availability.

    • Display Tor direct download .onion URLs. URLs automatically updated over Tor (with PGP verification).

    • Display Ashigaru Tor website URL. URL automatically updated over Tor (with PGP verification).

    • Ability to hide balance by tapping on available balance

    • Consolidation and Wallet Sweep transaction alerts

  • 00:45:02 BoltzExchange

    • boltz-web-app v1.6.0

      • Add WalletConnect

      • Show error when QR scanning is not supported in browser

      • Help server claim Chain Swaps that receive on EVM

    • boltz-backend v3.9.0 - Swarm of Swaps

      • Add batch claim support for Chain Swaps

      • Add batch claiming on EVM based chains

    • BoltzExchange launched Boltz Pro, a non-custodial way to earn sats with swaps on Boltz [Announcement]

      • Boltz Pro offers dynamic fees that let users earn sats for swapping funds in specific directions when wallet imbalances arise.

  • 00:45:04 Mempal v1.4.0

    • New app icon

    • Tap to refresh any individual dashboard card

    • Save multiple custom mempool servers in settings

    • New settings option to change notification intervals from minutes to seconds

    • Fee distribution data will now fallback to mempool.space when using a custom mempool server

    • Widget data now defaults to mempool.space when using Tor

  • 00:45:11 Zaprite v2024-12-23

    • Orqestra: add new Orqestra.io integration to enable automated USD-to-BTC conversions

    • Merchant X: update Merchant X Checkouts to use an inline credit card form instead of a modal

    • Public API: update documentation to explain that Orders are not visible until paid

    • LNURL: enhance LNURL error reporting

  • 00:45:13 ESP-Miner v2.4.2

    • Add uptime to home screen

    • Change naming of stratum url to host

    • Change Stratum Fallback URL as well

    • Adds solohash getQuickLink()

    • Change Mining URL to Stratum Host on screen

Project spotlight

  • 00:45:18 Satoshi: A new wallet for Bitcoin, Lightning, and Liquid payments, that can be both custodial or self custodial [Announcement]

    • Satoshi Version 1.0 is now live in the App Store in 40 countries. 🎉

  • 00:45:28 Joinstr: An experimental rust implementation of joinstr [Github]

  • 00:45:33 miningpool-observer: The project compares block templates produced by a Bitcoin Core node to blocks produced by mining pools to provide insights [Github]

  • 00:46:51 Dojo Bay: A directory of available Dojo nodes, allowing users to select nodes based on reputation and location, both for Mainnet and Testnet.

  • 00:46:56 Nightly Bitcoin Core Tests: A tool to test and review development versions of Bitcoin Core [Github]

  • 00:47:04 Nigiri: A delicious docker box for special Bitcoin cookings [Github]

    • Nigiri offers a command-line interface that utilizes preconfigured Docker Compose setups to create a ready-to-use Bitcoin regtest environment.

    • The preconfigured package includes a Bitcoin Core node running in regtest mode, a backend and frontend explorer (Electrum) and Chopsticks a JSON HTTP proxy. You can extend the setup with: Ark, Elements/Liquid sidechain, and Lightning Network nodes.

  • 00:47:15 Run Litd: Notes and helper scripts for setting up and running a Litd node. [Github]

  • 00:47:28 bllsh: A bullish shell for a bitcoin lisp language [Github]

    • “Basic Bitcoin Lisp language (bll) is a proposed scripting language that could be added to Bitcoin in a soft fork. Formerly called BTC Lisp and conceptually based on Chia Lisp, it’s part of a set of tools that includes symbll (a miniscript-like compiler of higher-level Lisp to lower-level bll) and bllsh (a REPL for trying and debugging symbll and bll).” [Bitcoin Optech definition]

    • AJ Towns recently presented his work on Basic Bitcoin Lisp Language to Brink engineers [Presentation]

  • 00:48:05 Btceed: Bird’s-eye view of your bitcoin HD wallet [Github]

    • Btceed is a web application that provides a graphical overview of Bitcoin HD wallets using seed phrases.

  • 00:48:12 Zero Fee Playground: A site for trying out zero fee bitcoin transactions

    • The Zero Fee Playground provides a step-by-step demonstration for creating and testing paired transactions using Bitcoin version 28’s updated rules.

  • 00:49:17 P2PK Playground: A site for creating P2PK outputs in bitcoin i.e. paying someone’s raw public key

    • The guide includes step-by-step instructions for creating and spending P2PK outputs, highlighting tools for broadcasting transactions

  • 00:50:51 Bitcoin Testnet4 Faucet: A faucet for Bitcoin testnet4 coins, written in C# using ASP.Net Razor Pages and NBitcoin. [Github]

    • The faucet uses OAuth to authenticate users and does not store any personal information.

  • 00:50:58 Hashteroids: browser-based game combining elements of the classic Asteroid arcade gameplay with Bitcoin mining concepts

  • 00:51:07 My First Bitcoin launches Community Hub to support independent bitcoin educators with resources and tools [Announcement]

    • The platform features Wikis, forums, and a structured system for new educators, helping them connect and share resources globally.

Vulnerability Disclosures

  • 00:51:39 Oasis Security’s research team discovers a critical flaw in Microsoft’s Multi-Factor Authentication system, enabling attackers to bypass it and access user accounts, including Outlook, OneDrive, Teams, and Azure Cloud. [Public disclosure]

    • The vulnerability involves a lack of rate limiting for failed MFA attempts, permitting rapid session creation and code enumeration.

    • Attackers can exhaust all 1 million possible six-digit codes within approximately an hour, without user interaction or alerts.

  • 00:51:53 Five dollar wrench attacks: Fake uber driver steals over $223,000 in cryptocurrency from customers’ centralized exchange accounts [Fox10]

    • The driver allegedly deceived victims into handing over their phones by claiming his own device was malfunctioning or offering to assist with the Uber app.

    • Once in possession of the phones, he reportedly transferred funds from their Coinbase accounts.

  • 00:52:40 Two men fall victim to phishing scams, in May 2024, involving fraudulent Google security prompts [Krebs On Security]

    • An individual fell victim to a phishing scam, losing nearly $500,000 in cryptocurrency. Scammers tricked him into clicking a fraudulent Google account recovery prompt, providing them access to his Google account. They then retrieved his secret seed phrase stored in Google Photos.

    • Another individual lost 45 bitcoin after receiving a fake Google security alert and a call from someone claiming his account was compromised. The victim clicked “yes” on the fraudulent prompt and later provided his seed phrase on a phishing site, leading to the instant drainage of his wallet.

  • 00:55:28 Apache MINA’s CVE-2024-52046 flaw, rated CVSS 10.0, enables remote code execution through unsafe Java deserialization. [The Hacker News]

    • The vulnerability affects versions 2.0.X, 2.1.X, and 2.2.X, triggered by specific classes and unsafe data processing.

  • 00:55:37 WPA3 vulnerability: risks of downgrade attacks and social engineering [CyberNews]

    • Researchers reveal WPA3 vulnerabilities through a rogue access point and a downgrade attack to WPA2. This allows hackers to capture partial handshake data and potentially recover WiFi passwords.

  • 00:56:07 Hackers compromise 16 Chrome extensions, affecting over 600,000 users, by injecting malicious code to steal cookies and access tokens. [The Hacker News]

    • The attack begins with a breach of Cyberhaven’s extension on December 24, 2024, through a web-browser-based supply chain attack, exploiting an employee’s credentials to publish a malicious update. [Press release]

  • 00:56:54 Symlink exploit: A vulnerability in Apple’s FileProvider component, identified as CVE-2024-44131, allows unauthorized access to sensitive data by bypassing the Transparency, Consent, and Control (TCC) framework. [The Hacker News]

    • Exploiting this flaw, a malicious app can intercept user file operations in the Files app, redirecting them to attacker-controlled locations without user awareness.

Audience Questions

  • 00:57:22 Thanks to everyone who sent in questions. Remember to send yours to questions@bitcoin.review.

    • 00:57:32 Can you explain (like I own ETH), how signatures work for spending Bitcoin? Perhaps you can give a useful analogy for how signing can be done offline using your private key, but which doesn’t releal your private key to the network. In other words how do you PROVE to the network you can legitmately spend that bitcoin without revealing your private key? - anonymous

    • 01:01:04 When people say “there’s not enough UTXOs for everyone to have one”. How do you quantify that? What’s the number of UTXOs and what factors affect that number? (Such as blocksize?) - anon

    • 01:06:20 “I have a legacy address that starts with 1 wirh some BTC Should I be worried about CC?” -@Johnylabb

    • 01:07:16 “Don’t get it….why should anyone, except maybe millionaires, self custody? Even if u have a lot of BTC, if it’s from many small utxo then it’s worthless” -@Richard-ki4nkgm

    • 01:10:20 “If BTC must be essentially be held in custody, then why use BTC over gold? Distrust among large banks might encourage BTC over gold?” -@Richard-ki4nkgm

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • Reticulum MeshChat

    • v1.18.0

      • Add interface importing and exporting

      • Add dropdown menu on interfaces

      • Add button to export a single interface

    • v1.17.0

      • Add docker image

      • Add the ability to select a custom profile icon similar to Sideband’s Icon Appearance

      • Add the ability to select different levels of image compression when adding an image to a message

    • v1.16.0

      • Add new Ping tool under Tools -> Ping

    • v1.15.0

      • Add RNode web flasher to new tools section

      • Add SNR and hops away to LXMF announces list

      • Add new drop down menu to conversation viewer

      • Add the ability to ping destination from conversation viewer dropdown

      • Add LXMF user icons to the announce list and conversation viewer

      • Add signal metrics to conversation viewer

    • v1.14.0

      • Add dark mode

      • Add full micron format and field support thanks

      • Add setting to select Light Theme or Dark Theme

      • Add support for showing Sideband/LXMF user appearance icons in conversations list

  • SimpleX

    • v6.3.0-beta.0

      • Chat lists: organize and filter your chats

    • v6.2.2

      • Open files in default app (Android)

Project spotlight

  • Superbacked: A secret management platform used to back up and pass on sensitive data from one generation to the next, is now free and source-available [Announcement]

    • “Superbacked distributed backups are encrypted using Shamir Secret Sharing … before being encrypted (again) using Blockcrypt.” [Github]

  • The Ludlow Institute: an independent research and media organization dedicated to defending privacy, freedom, and individual autonomy in the digital age. [Announcement]

    • The institute aims to advance privacy and surveillance research, support privacy tools through advocacy and grants, and provide educational resources such as workshops and meetups.

Lightning + L2+

Project spotlight

  • Self-custodial wallet Klever Wallet integrates the Lightning Network using the Breez SDK. [Blog post]

    • Klever targets underserved areas like Nigeria, Brazil, India, and the Philippines with this integration.

  • Doppler: A tool for building out and managing bitcoind/lightning clusters for regtest or signet environments [Github]

  • LN OPR: A fast, scalable protocol for resolving Lightning payments [Github]

    • The Off-chain Payment Resolution (OPR) protocol enables Lightning payments to be resolved off-chain, even in worst-case situations.

    • It ensures faster resolution, typically within seconds, and improves scalability by avoiding additional blockchain data. [Research paper]

  • Magma AI: Intelligent channel management for Lightning Network [Announcement]

    • “By analyzing network data to recommend optimal channel configurations, Magma AI helps node operators improve routing performance and manage liquidity more efficiently.”

  • Lightstack (Full Phoenixd Stack): Automagic selfcustodial cloud Lightning stack [Github]

    • A self-custodial Lightning node that can be run on a VPS using this stack, accessed via your domain name. It includes an LNBits instance on your node and a phoenixd endpoint secured with SSL.

    • A multistack feature now allows multiple stacks to operate on the same VPS, served concurrently.

  • ZapPlanner: Schedule automatic recurring lightning payments

    • ZapPlanner is a tool enabling automated transfers within customizable intervals, using Nostr Wallet Connect.

  • CLN Backup: A CLN plugin that uploads the latest SCB to remote locations. [Github]

  • Hashpool: An accountless mining pool that represents mining shares as ecash tokens [Github]

    • “This project is a fork of the Stratum V2 Reference Implementation (SRI) that replaces traditional share accounting with an ecash mint.”

  • nutjar-ui: A project that helps integrate Lightning tips on websites using nostr and Cashu [Github]

    • It provides a web component that simplifies the process of adding donation functionality, allowing users to configure attributes like donation receiver details and minting options.

Software Releases & Project Updates

  • Core Lightning v24.11.1 - The lightning-dev Mailing List II

    • xpay compatibility improved significantly for xpay-handle-pay: the JSON return should be identical, and it handles maxfeepercent and exemptfee parameters.

    • xpay results in listpays will include destination and amount_msat fields.

    • xpay doesn’t spam the logs at INFO level any more

    • xpay now works through unannounced channels

  • Zeus v0.9.4-rc1

    • Embedded Node: LND v0.18.4-beta

    • Speed up transaction UX improvements

    • CLNRest: fix display of destination addresses on TXs

    • Display keysend messages in Activity and Payment views

    • Open Channel view: UI tabs for Connect Peer

    • LND: optimize payment path calls after payments

    • CLNRest: add ability to paste connection strings

    • Channels: restore sort by Close Height

    • Networking improvements

  • Ark v0.4.1 - Support absolute locktime (CLTV)

    • Patch release that adds supports for absolute locktimes encoded in the VTXO script with CLTV

  • Fedimint v0.5.0 - Christmas Edition

    • Highlights:

      • Add Tor support for client-federation connections

      • Stabilize v2 lightning module

      • Upgrade rust-bitcoin (and related ecosystem-crates) from 0.30 to 0.32

      • Improve CI to increase our agility while maintaining compatibility guarantees

  • Fedi App Update

    • Cashu Melting: Spend eCash between CashuBTC and Fedimint

    • Portable Nostr Keys: Fedi generates an nPub for you and you can take this nPub with you

  • Alby

    • Alby-go v1.8.1

      • Enhanced UI with popicons and new transaction icons

      • Verified ownership of Lightning addresses to avoid confusion

      • Support for nostr+walletconnect:// connection URLs

      • Show wallet name in payment confirmations and home screen

      • Simplified wallet renaming process

    • Alby-hub

      • v1.12.0 - Michael Froomkin

        • Pay 0-amount invoices

        • Migrate to VSS

        • Fire channel open and closure events in lnd

        • Improve Alby Account connection card

        • Add environment variable to customize LDK listening addresses

      • v1.11.2 - Suelette Dreyfus

        • Implement a large number of improvements to the privacy of app connections:

          • Relay connectivity

          • Backups

          • Open channel flows

          • Receive page

          • Isolated app connections

          • Transaction lists

  • BitBanana v0.8.8

    • Proper Android 14 support

    • Add Auto-Lock Timeout setting

    • Increase disconnect timeout after app moved to background to 5 min

    • Unlocking the app does no longer restart the connection

    • Migration Backup now includes app settings

    • Increase displayed lightning fee precision

    • Add explanation popup when enabling stealth mode

    • Add Tamil language

  • Loop v0.29.0-beta

    • Add support for persisting address loop in mode

Nostr

Project spotlight

  • PZP, a peer-to-peer protocol focused on enabling decentralized app development with lightweight storage requirements [Code repository]

    • Key features include public-key addressing, content deletion, multi-device identity support, and easy CRDT data structures like sets and dicts.

    • PZP differs from Nostr by using device-specific keys, sig-chains to track missing content, and being invite-only.

  • Narr: A self-hosted Nostr and RSS reader [Github]

    • “narr (not another rss reader) is a web-based RSS and Nostr long-form feed aggregator which can be used both as a desktop application and a personal self-hosted server.”

  • Noflux: A minimalist and opinionated feed reader based on Miniflux. [Github]

    • Noflux is a free and open-source Nostr and RSS feed reader optimized for readability, featuring fast navigation, no advertising or user tracking, and simple installation, while supporting Nostr NIP-23 feeds.

  • Keycast: Secure remote signing and permissions for teams using Nostr. [Github]

    • Keycast is an open-source platform designed for secure remote signing and key management for teams using Nostr. It enables collaborative management of keys, setting policies, and managing permissions.

  • Aegis Relay: A premium relay and blossom service that allows relay operators to earn income by providing relay services to the network. [Github]

  • Nostr Safebox: Your own private portable safebox on nostr [Github]

    • Nostr Safebox acts as a personal, portable safebox for securely storing private information like wallets and records while using the Nostr network.

    • It uses NIP-44 encrypted events to store its index and contents securely. Access is granted via a unique nsec key, which can be user-generated or provided by a custodial service.

  • nostr-nsec-seedphrase: A focused TypeScript library for Nostr key management and seedphrase functionality, with seamless integration with nostr-crypto-utils [Github]

    • This package is designed to convert between nsec keys and seed phrases, manage delegations, and support multiple key formats.

  • Noscrypt: A nostr specific cryptography library written in C [Github]

    • “A high-level C utility library built specifically for nostr cryptography operations such as those defined in NIP-01 and the new NIP-44 (NIP-04 coming soon).

    • Noscrypt simplifies key generation, note signing & verification, NIP-44 data encryption, NIP-44 private message encryption, and much more.”

  • Immortal: A nostr relay designed for scale [Github]

    • Immortal is a Nostr relay implementation written in Go, and designed for scalability and high performance. It is particularly suitable for large community or paid relays, rather than personal use.

  • LumiLumi: A lightweight web client for Nostr [Github]

    • LumiLumi is a web-based client for the Nostr protocol. It supports image and URL sharing, custom emojis, and various muting features.

    • To accommodate users with limited data, LumiLumi offers settings to disable images, icons, and Open Graph Protocol (OGP) data, reducing communication costs. It also includes features like NIP-05 verification, relay configuration, and reaction settings.

  • nostr-zap-view: View any nostr zaps from anywhere, supporting npub, nprofile, note, and nevent identifiers. [Github]

  • Spring boot starter: Write Nostr applications with the Spring boot kit [Github]

    • The project helps developers build Nostr applications, supports both custom relay software and client creation, and integrates with nostr-proto for core Nostr concepts.

  • Bouquet: A web tool to sync blobs between blossom servers. [Code repository]

  • CVS Importer: A Nostr Uploader. Publish events in bulk via CSV

  • Servus: A minimalist social media server [Github]

    • Servus is fully self-contained within one executable file: CMS, Personal Nostr relay, and Personal file server (Blossom & NIP-96).

  • Mostr: An immutable nested collaborative task manager, powered by nostr [Github]

  • Novia (NOstr VIdeo Archive): Manage video downloads on NOSTR [Github]

    • A service that connects video archive tools to NOSTR. It supports video downloading, metadata management, and publishing video events on NOSTR relays while enabling decentralized video management and sharing.

  • Meme Amigo: A companion app for Gifbuddy.lol, designed as a PWA for creating memes on the go. It allows users to easily add memes to notes on Nostr.

    • Meme templates stored on relays under NIP94, generate @nostr.build URLs for easy sharing, add emojis, paste images, and meme GIFs on the same page.

  • Awesome Nostr Bots: List of collected Bots on nostr [Github]

    • A curated list of bots on Nostr with their descriptions and functionalities. These bots bring automation, insights, and updates to the Nostr network.

  • Persian Nostr Book: A nostr book written in Persian [Github]

Software Releases & Project Updates

  • Rust Nostr v0.38.0

    • Add full NIP42 support for SDK and relay builder

    • Add negentropy support

    • Add read/write policy plugins for relay builder

    • Add NIP35 support

    • Improve logs, docs, and performance

  • Primal Android

    • v2.0.34

      • Highlights in Reads

      • USD currency support in Wallet

      • Biometric prompt when accessing private key

      • Blossom support when rendering images in feeds

      • Rendering quoted articles, highlights and notes in note editor

    • v2.0.28

      • Implemented:

        • Profile avatar and cover image viewer in profile details screen

        • Rendering highlights and generic events in feeds

        • Tap QR code to copy addresses on profile QR code viewer

        • Follow/unfollow approvals if contact list is not found

        • Onboarding follows customisation and zaps introductions

        • Premium badge on profile details screen

        • Support for primal legend avatars across the app

        • Primal premium check into profile editor

  • Damus Testflight v1.12

    • Render Gif and video files while composing posts

    • Add profile info text in stretchable banner with follow button

    • Paste Gif image similar to jpeg and png files

    • Improve UX around the label for searching words

    • Improve accessibility support on some elements

  • YakiHonne web Update

    • Resolve issues causing the article editor to appear malformed

    • Add support for both LTR and RTL languages in the article editor

    • Enhance the messaging box to support long text writing

    • Secure DMs (Nip44) can now be enabled globally via the messages and settings pages

  • Flotilla v0.2.0

    • Add NIP 29 compatibility

  • CDK v0.6.0

    • Changed:

      • cdk: Enforce quote_id to uuid type in mint

      • cdk: Refactor wallet mint connector

    • Added:

      • cdk: NUT19 Settings in NUT06 info

      • cdk: NUT17 Websocket support for wallet

      • cdk-axum: Redis cache backend

      • cdk-mints: Get mint settings from env vars

      • cdk-axum: HTTP compression support

  • Knox Update

    • Switch to NIP-44 encryption

  • Gossip v0.13.0

    • File Metadata support (NIP-92 / NIP-94)

    • Blossom support (BUD-01, BUD-02)

    • NIP-89 Support - Recommended Application Handlers

    • Search on relays (NIP-50): choose your search relays first

    • Followers and Followed: see who someone follows, and who follows them

    • Undo Send - for 10 seconds (or whatever you configure) you can undo sending

    • Thread replies now sorted by date, except author replies come first

    • Feeds no longer inject new events and scroll while you are trying to read.

    • Relays can now be tested to see whether they are fit for purpose

    • NIP-46 replies with NIP-44 encryption if the client used it

    • NIP-44 encryption now used for private contacts and private lists

  • Nostrudel v0.42.0

    • Add support for olas media posts and NIP-22 comments

    • Add tools menu under thread post

    • Add favorite DVM feeds

    • Add templates to event publisher

    • Update timelines to use applesauce

    • Add open and share button to stream view

    • Add “Proactively authenticate to relays” option to privacy settings, defaults to off

    • Support searching local relay

    • Add support for cashu v4 tokens

  • 0xChat App Desktop v1.0.0

    • The first desktop beta version supports macOS, Linux, and Windows

    • Future plans:

      • Support NIP-46 login

      • Optimize the UI & UX for the desktop version

      • Improve the performance of the desktop version

  • nos.social v1.0.4

    • Add feed picker view (UI only)

    • Add feed source customizer drop-down view

    • Add empty state for lists/relays drop-down

    • Add support for decrypting private tags in kind 30000 lists

    • Add remembering which feed source is selected

  • Citrine v0.6.0

    • Show notifications when importing, exporting, downloading events

    • Change database functions to be suspending functions

    • Update dependencies

  • Honeypot v0.1.0

    • Improve onboarding flow

  • Nowser v0.0.3

    • Add build-in relay for remote signer

    • Bookmarks support add to app index

    • Bookmarks support quick action for mobile

    • Bookmarks support add to desktop for android

    • Reject private zap decrypt request from amethyst

  • Haven v1.0.3

    • Add support for count events

    • Remove dynamic relay handler

    • Feature/blossom http range requests

  • Pokey v0.1.3

    • Add notifications center

    • Views rearrangement

  • Amber v3.0.3

    • Better pin entry screen

    • Add a close application config in the ui

    • Separate the service notification in a group

    • Always return a hex key for the get_public_key method

  • Openvibe v1.5.0

    • Multiple profiles: add multiple accounts from the same network (e.g., Mastodon or Bluesky) and organize them into sets like personal or work.

Boosts

  • 01:13:47 Thanks to everyone who streamed sats, and shoutout to our top boosters:

  • [🏆 TOP BOOSTER] @Ape Mithrandir (17,777 sats) “(Craig Raw)’s feature request for Broadcast Pool is much needed and we should get more eyes on it. [Feature request]”

  • @Ape Mithrandir (7,777 sats) “Epic rant at the end. Craig Raw always worth listening to.”

  • @shadowysuperbadger (1,000 sats) “Cool episode. Thanks for putting it together.”

    • @user40113771 (1,000 sats) “🙏”

    • @user40113771 (500 sats) “🔥🔥🙏🔥🔥”

    • @btconboard (300 sats) “SO MUCH WINNING 🫡🫡”

    • @Leurico8 (100 sats) “Fucking epic episode”

    • @Juan “May need to find a new sleep therapy solution as I made it thru this whole episode, on a night-flight. great rip guys, learned a lot. happy thanksgiving ;)”

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 334

      • 2024 Year-in-Review Special: The seventh annual Bitcoin Optech Year-in-Review special summarizes notable developments in Bitcoin during all of 2024

    • 333

      • Vulnerability allowing theft from LN channels with miner assistance: David Harding announced to Delving Bitcoin a vulnerability he had responsibly disclosed earlier in the year.

      • Deanonymization vulnerability affecting Wasabi and related software: a developer of GingerWallet disclosed a method a coinjoin coordinator could use to prevent users from gaining any privacy during a coinjoin.

      • Insights into channel depletion: René Pickhardt posted to Delving Bitcoin and participated, along with Christian Decker, in an Optech Deep Dive about his research into the mathematical foundations of payment channel networks (namely LN).

      • Poll of opinions about covenant proposals: /dev/fd0 posted to the Bitcoin-Dev mailing list a link to a public poll of developer opinions about selected covenant proposals.

      • Incentive-based pseudo-covenants: Jeremy Rubin posted to the Bitcoin-Dev mailing list a link to a paper he authored about oracle-assisted covenants.

      • Bitcoin Core developer meeting summaries: many Bitcoin Core developers met in person in October, and several notes from the meeting have now been published.

News & Noteworthy

Bitcoin

  • pqcBitcoin: A Post-Quantum Cryptography (PQC)-enhanced fork of Bitcoin [Github]

    • pqcBitcoin is a fork of Bitcoin Core that integrates post-quantum cryptography (PQC) algorithms, such as Kyber, FrodoKEM, and NTRU, to address potential future threats from quantum computing. The developers have proposed this feature to the Bitcoin community for review and consensus.

  • Timechainindex is shutting down on January 10, 2025 after one year of operation. [Announcement]

    • Timechainindex is a platform that tracks Bitcoin holdings across exchanges, funds, ETFs, and companies, offering real-time data and insights into Bitcoin’s market distribution.

Lightning + L2+

  • Diamond Hands, Japan-based Bitcoin community and organization, announces the closure of the DH Node, a Lightning node which has been operational since June 2021, citing challenges in maintaining large-scale routing operations [Announcement]

Nostr

Business & Finance

  • SeedHammer announces SeedHammer II: A smaller, lighter and more secure machine than the original off-the-shelf product, with an integrated controller. [Announcement]

  • Canadian broker Bull Bitcoin officially launches in Europe with a brand-new platform [Announcement]

  • Casa implements deepfake-resistant verification codes to enhance security for Premium, Enterprise, and Private clients [Blog post]

    • The system uses shared cryptographic keys to generate matching codes, protecting against impersonation during live support interactions.

  • Unchained improves its Connections feature, allowing collaborate on key security without revealing vault details, maintaining control over shared information. [Announcement]

  • Strike now enables USDT deposits and withdrawals for customers in 17+ countries. [Announcement]

  • Strike adopts Travel Rule regulation [Explainer]

    • The Travel Rule, established by the Financial Action Task Force (FATF), requires financial institutions to collect and share information about the originators and beneficiaries of financial transfers. In the EU, this is implemented through the Transfer of Funds Regulation (TFR).

    • For users in the EU or UK, sending or receiving Bitcoin via crypto-asset service providers will require sharing personal information such as name, address, and identification details.

  • Digital Currency Group divides Foundry’s mining business into two separate entities. Fortitude Mining will oversee Foundry’s former self-mining operations and physical infrastructure, while Foundry will retain its pool operations and other Bitcoin mining services [Blockspace]

Encryption

  • 01:16:45 NIST proposes to standardize wider variant of AES [Proposal]

    • NIST is considering a new version of Rijndael with 256-bit blocks, driven by the need for larger block sizes due to increased data processing demands.

Funding

  • 01:17:40 OpenSats announces its Ninth Wave of Nostr Grants, supporting five innovative projects that advance and strengthen the nostr ecosystem:

    • AlgoRelay

    • Pokey

    • Nostr Safebox

    • Persian NIPs

    • LumiLumi

  • 01:17:47 Spiral renews its grant to BTCPayServer [Announcement]

  • 01:17:49 The Human Rights Foundation donates 7 bitcoin to fund Bitcoin development and projects: [Bitcoin Magazine]

    • Stratum V2 Reference Implementation (SRI), Public Pool, Naiyoma, Daniela Brozzoni, Michael Haase, No Bullshit Bitcoin, Tando, YakiHonne, SeedSigner Multi-language Support, Vexl, Tomatech, Krux, Iris, African UX Bitcoin Bootcamp, Bitcoin History, Cashu-ts, Unify, The Financial Freedom Policy Coalition, Jon Atack and Brink.

  • 01:17:53 Btrust announces its Q4 2024 Btrust grant recipients: Abdullahi Yunus Ahmed, Enigbe Ochekliye, and Tobechi Chukwuleta

  • Chaincode Labs awards its inaugural Bitcoin Scholarship to 17-year-old Ishaana Misra, the youngest Bitcoin Core contributor. The scholarship covers one year of academic expenses and is renewable for her undergraduate education. [Bitcoin Magazine]

  • Relai secures $12 million in a Series A funding round led by Ego Death Capital, bringing its valuation to $72 million. [The Block]

  • Lava raises $10 million in a Series A funding round led by Khosla Ventures and Founders Fund. The Bitcoin lending platform plans to expand its offerings, including Bitcoin purchasing and payment services. [Forbes]

Mining

  • 01:18:12 GreenpeaceUSA’s ‘Change the Code’ campaign, aiming to modify Bitcoin’s energy-intensive proof-of-work system, likely shut down [Batcoinz’ blog post]

    • The campaign has been inactive since January 2024 and its former campaign director has since departed GreenpeaceUSA to join another organization.

  • Cango Inc., a Chinese automotive services firm listed on the NYSE, purchases 32 EH/s of Antminer ASICs from Bitmain for $256 million, securing approximately 4% of Bitcoin’s network hashrate. [Blockspace]

    • An additional 18 EH/s acquisition is under contract with Golden TechGen Limited, owned by former Bitmain CFO Max Hua, elevating Cango’s total hashrate to 50 EH/s, comparable to leading miners like Marathon Digital Holdings.

  • Foundry USA refunds overpaid Bitcoin transaction fee [Twitter post]

    • Foundry USA Pool mined block 875475 on December 19, which included a transaction with an 8.18 BTC overpaid fee, which was 91,127 times higher than necessary.

  • MicroBT introduces WhatsMiner M6XS++ series with a hashrate of 218 TH/s and 15.5 J/TH efficiency, including air-cooled, hydro-cooled, and immersion-cooled models [The Miner Mag]

  • Russia enacts six-year bitcoin mining ban to both individual and pool mining activities, across multiple regions [CoinDesk]

    • Partial restrictions will also affect three Siberian regions from November to March each year, aligning with high energy demands.

  • e4pool, an open source mining pool, is closing due to new mining regulations in Russia. [Announcement]

    • Reasons cited are that mining pools now must register in a special list of mining operators, and provide user data to the tax office.

Privacy

  • Byte Federal, a U.S.-based Bitcoin ATM operator, reports a data breach compromising personal information of approximately 58,000 customers [TechCrunch]

    • The breach, discovered on November 18, resulted from a vulnerability in third-party software, specifically a bug in the GitLab developer platform.

    • Exposed data includes names, birthdates, addresses, phone numbers, email addresses, government-issued IDs, social security numbers, transaction activity, and user photographs. [Notice of data breach]

  • Privacy and security focused open-source mobile operating system, DivestOS, announces the end of its mobile updates in December after 10 years. [Announcement]

  • NSO Group found liable for spyware attacks on WhatsApp users [Infosecurity Magazine]

    • A U.S. court ruled NSO Group liable for using zero-day exploits to deploy its Pegasus spyware on at least 1400 WhatsApp devices. The attack targeted journalists, activists, and government officials, violating both state and federal laws.

  • NoviSpy: Serbian authorities deploy NoviSpy spyware and Cellebrite forensic tools to surveil journalists and activists [Security Lab’s report]

    • NoviSpy captures personal data and can remotely activate microphones or cameras on targeted devices

    • Cellebrite is used to unlock phones, facilitating the installation of NoviSpy during police interviews

  • 01:18:29 Samourai Wallet pretrial hearing postponed to March 12, 2025, due to additional discovery batches, with the trial now set for November 3, 2025. [The Rage]

    • The U.S. government is reviewing data from 45 devices seized from developers, with over half of the total 17 TB of data already shared.

  • 01:19:59 Russian government directs ISPs to identify users accessing blocked content via VPNs [CyberInsider]

    • ISPs must implement Technical Means of Countering Threats (TSPU) to monitor user traffic and report in real-time.

Security

  • Cryptocurrency thefts rise in 2024, according to a Chainalysis’ report

    • In 2024, digital currency platform theft reached $2.2 billion, a ~21% increase from 2023. These attacks increased in both frequency and size, signaling a growing threat.

    • A shift in targets was observed in 2024, with centralized services becoming more vulnerable, particularly to private key exploits.

  • FBI, DC3, and Japan’s NPA alert the public to TraderTraitor, a North Korean cyber group responsible for a $308M cryptocurrency theft in May 2024. The group targeted Japan-based Bitcoin.DMM.com using sophisticated social engineering tactics. [FBI’s Press release]

Protocol

  • Bitcoin Core #31096: Package validation: accept packages of size 1. This change relaxes the RPC checks as enables the AcceptPackage flow to accept packages of a single transaction. [Merged]

  • Bitcoin Core #31112: Improve parallel script validation error debug logging [Merged]

  • Bitcoin Core #31175: rpc: Remove submitblock pre-checks [Merged]

  • BIPS #1535: BIP 348: OP_CHECKSIGFROMSTACK [Merged]

  • BTCPayServer #5743: Multisig/watchonly wallet transaction creation flow proof of concept [Merged]

  • LDK #3446: Support Trampoline flag in BOLT12 invoices [Merged]

  • BOLTs #1180: Include BIP 353 name info in invoice_requests. Update BOLT12 to allow optional inclusion of BIP353 human-readable Bitcoin payment instructions in invoice requests. [Merged]

  • NUT-20 – Signature on Mint Quote: an optional specification that locks a mint quote to a user-defined public key and requires a valid signature for minting. [Merged]

Government & Political

  • 01:20:14 Craig Wright is handed a one-year suspended sentence in the UK for contempt of court after violating an earlier ruling. The judge confirmed Wright continued his legal action against Bitcoin developers, despite a ban on such claims. [Reuters]

    • The court also ordered Wright to drop his $1.15 trillion lawsuit against Square and Bitcoin developers.

  • El Salvador agrees to scale back Bitcoin policies to secure $1.4 billion IMF loan [Bloomberg] [IMF Press release]

    • The government will make Bitcoin acceptance voluntary for the private sector and limit public sector involvement in Bitcoin-related activities.

    • The Chivo wallet will be gradually phased out, and taxes will be payable exclusively in U.S. dollars.

  • Russian companies embrace bitcoin in international payments to bypass sanctions, following legislative changes aimed at countering Western sanctions. [Reuters]

    • Finance Minister Anton Siluanov confirmed that cryptocurrencies, including bitcoin, are being used in foreign trade and are expected to expand in 2025.

  • EU-regulated exchange updates on digital currencies deposits and withdrawals exceeding €1,000 in value. [Stacker News post]

    • Starting December 30, 2024, deposits and withdrawals in select European countries will require additional verification, users must now verify their private wallets.

  • The European Securities and Markets Authority (ESMA) releases the final set of regulatory technical standards and guidelines, facilitating the full implementation of the Markets in Crypto Assets Regulation (MiCA). [Press release]

    • The regulation requires crypto service providers to obtain licenses, adhere to organizational standards, and implement robust governance measures to ensure consumer protection and market integrity.

  • Financial Accounting Standards Board (FASB) approves new standard requiring Bitcoin to be valued at fair value for fiscal years starting after December 15, 2024. [FASB Media Advisory]

    • This change aims to simplify accounting processes, reduce complexity, and provide more relevant information to investors about digital asset holdings, including Bitcoin. It mandates disclosures about significant holdings and changes during reporting periods.

  • The IRS finalizes two regulations affecting digital asset users and developers: a KYC dealer-broker rule for DeFi front-ends and IRS Safe Harbor Transitional Relief. [The Rage]

    • The KYC dealer-broker rule, effective by 2027, may require noncustodial services to implement KYC/AML measures.

    • Update: Industry groups, including the Blockchain Association and DeFi Education Fund, are suing the IRS over new KYC requirements for “DeFi front-end services”.

  • Early bitcoin investor receives a two-year prison sentence for underreporting capital gains on $3.7 million in bitcoin sales [Bitcoin Magazine]

    • He reportedly misled his accountant about purchase prices and concealed additional profits using mixers and cash exchanges. This case is noted as the first criminal tax evasion prosecution centered exclusively on cryptocurrency.

  • The Bank of Italy identifies platforms facilitating Bitcoin transactions without user identification as “crime-as-a-service,” citing the website kycnot.me, which lists P2P platforms operating without KYC checks. [Atlas21]

    • The institution highlights that money launderers exploit pseudonymity in cryptocurrency transactions to conceal illicit funds, using methods like mixers, tumblers, chain-hopping, and anonymous wallets to evade detection.

Events

Reads

  • Here’s a list of our top recently published reads:

    • Choosing a hash function for 2030 and beyond: SHA2 vs SHA3 vs BLAKE3, by Sylvain Kerkour [Blog post]

    • OpenSats’ 2024 Year in Review [Blog post]

    • Stone Ridge 2024 Investor Letter, by Ross Stevens [NYDIG]

    • The DOJ’s Dangerous New Legal Theory: Implications for Samourai Wallet and Bitcoin Self-Custody, by Bitcoin Policy Institute [Policy brief]

    • Can Nostr fix app distribution? by @franzap [Blog post]

    • P2QRH/QuBit chain growth rate calculations: An evaluation of the number of P2QRH transactions that can fit in a block under various attestation discount scenarios. [Analysis]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR089 - Lark, Security Tradeoffs Masterclass, Bitcoin Quantum Risks, WabiSabi Deanonymization, Core Txn Broadcast, Better Wallet Migration, Scaling Bitcoin, Bullish Sentiments + MORE ft. Craig & Rob]]>https://substack.bitcoin.review/p/br089-lark-security-tradeoffs-masterclasshttps://substack.bitcoin.review/p/br089-lark-security-tradeoffs-masterclassFri, 13 Dec 2024 22:04:09 GMTI’m joined by guests Craig Raw and Rob Hamilton to go through the list.

Listen on your favorite podcast app

Urgent Vulnerability Disclosures

  • 00:01:18 Full Disclosure: Transaction-Relay Throughput Overflow Attacks against Off-Chain Protocols [Antoine Riard’s post]

    • A new transaction-relay jamming attack targets off-chain protocols, exploiting throughput limits in full-node algorithms.

    • The “high-overflow” variant exploits the sender-side fee-rate sorting algorithm. The “low-overflow” variant targets receiver-side processing limits but remains untested.

  • 00:01:53 Vulnerability in WabiSabi coinjoin protocol exposes users to deanonymization risks [The Rage]

    • A flaw in the WabiSabi coinjoin protocol allows malicious coordinators to deanonymize users by correlating inputs and outputs.

    • The issue stems from malicious coordinators assigning unique maximum amount parameters, enabling tagging attacks to cluster wallets.

    • The vulnerability impacts Wasabi Wallet 2.2.1.0 and below, Ginger Wallet 2.0.13 and below, and BTCPay Server coinjoin plugin 1.0.101.0 and below. [GingerWallet’s Vulnerability Report]

Bitcoin

Software Releases & Project Updates

  • 00:19:59 Rust Payjoin v0.21.0

    • This release enables transaction cut-through by allowing the receiver to add an arbitrary number of inputs and outputs, and allowing mixed input script types in Payjoin V2.

    • Allow receiver to contribute multiple inputs and outputs

    • Make InputPair public to facilitate working with inputs in coin selection and input contributions

    • Enable receiver fee contributions in apply_fee, which now requires a max_feerate parameter

    • Allow mixed input scripts in Payjoin V2

    • Implement client end-to-end encryption using HPKE using bitcoin-hpke

  • 00:32:48 Lark: Command line application for the Lark USB Hardware Wallet library [Github]

    • “The Lark application is a command line app for interacting with USB hardware wallets in Bitcoin related functions. It uses the Lark Java library, which in turn is a port of the Python library HWI.”

    • “The Lark command line application is designed to be a drop-in replacement for HWI, with a subset of commands implemented.”

    • Lark initial release v1.0.0

      • The following hardware wallets (for all models) are supported: Coldcard, Trezor, Ledger (current and legacy Bitcoin apps), BitBox02, Jade, and Keepkey.

      • Across the following platforms: Linux x86_64 and aarch64, macOS x86_64 and aarch64, and Windows x86_64.

  • 01:12:40 Bitcoin Keeper

    • Mobile v1.3.0

      • Subscriptions: More features, reduced prices for all tiers.

      • Inheritance Planning: Inheritance Key now secured on the Bitcoin network using Miniscript. Convert any key into an Inheritance Key.

      • Attorney letters now include the Recovery Key and all added

      • Key Sharing: Share and sign keys remotely with any

      • Transactions: New history screen and support for sending unconfirmed

    • Desktop v0.1.4

      • Allow getting specific BIP44 accounts from a device

      • Add Taproot Key when getting device xPubs

  • 01:13:23 Blue Wallet v7.0.5

    • Add Offline import

    • Add CoinControl sorting

    • Add AMD Fiat

    • Add RSD Fiat

    • Add Market Price intent

    • Add Reset currency alert

    • Add Notification shortcuts

    • Add Remove all recipients

    • Add Clear clipboard on import

    • Add Dark/Tinted iOS icons

  • 01:13:33 Floresta v0.7.0

    • Async-std To Tokio: ends a major milestone of replacing async-std with tokio as the async runtime

    • florestad: expose assumeutreexo in lib mode

    • Feature: daemonize: On NIX environments, run florestad in the background as a daemon

    • Wire: handle block filters out-of-order

    • ssl init: Adds support for SSL to our Electrum Server

    • Adds fuzz to floresta using cargo fuzz with a few targets

    • Improve connection

    • Update getutxo: Now the gettxout rpc only returns UTXOS that are cached by the wallet

    • Improve CI caching

    • Add criterion benches and restructure testdata

    • Add test-features recipe to justfile

    • Add floresta-cli to Docker image

  • 01:13:44 Labelbase v2.2.3

    • UI: New, card based, label list view for small screens (mobile devices)

    • UI/UX: New, improved status and error messages

    • Rework Electrum background operations (UTXO lookup)

    • Add “Address Derivation” support for Testnet (tpub, upub, vpub)

    • Add Samourai Backup Import, allows you to import your samourai.txt

    • Add Donation page

  • 01:14:17 BDK v1.0.0-beta.6

    • Final “beta” test release before a final bdk_wallet 1.0.0 version.

    • Changes include small bug fixes and API improvements plus an improved algorithm for determining which transactions are in the current best “canonical” block chain.

    • The new canonicalization algorithm processes the transaction graph in linear time versus the prior quadratic time algorithm.

  • 01:14:26 FullyNoded v0.0.0.6

    • Quick Connect QR code url’s no longer contain real RPC credentials

    • Tweaks to JM config default fee settings to help increase chance of successful coinjoins (users can always add their own)

    • Obwatcher button added to Join Market so users can easily launch the order book to help trouble shoot failed coinjoins

    • Add auto refresh to Core Lightning

  • 01:14:43 BTCPay Server v2.0.4

    • Add QR Code with link to invitation email

    • Add rate providers for Norwegian exchanges

    • Greenfield: Improve store users API

  • 01:14:52 Zaprite

    • v2024.12.09

      • Add new View Contact page that displays Contact information and recent Invoices and Transactions

      • Add new View Recurring Invoice page that displays the Recurring Invoice Schedule summary and a list of Recent Invoices

      • Add new User Account Profile page, enabling Users to add avatars and display names

      • Add Coinos LNURL integration

      • Add LifPay LNURL integration

    • v2024.11.25

      • Add new View Invoice page which shows recent transactions and activity history

      • Add a ‘Discover’ carousel to the Home dashboard

  • 01:14:54 Peach v0.5.2

    • Dark Mode Build

    • Match paymentdata fix

    • Always share device id hash when using contact form

  • 01:14:55 Boltz boltz-web-app

    • v1.5.4

      • Switch to Blockstream Liquid explorer

    • v1.5.3

      • Improve HWW derivation path selection

    • v1.5.2

      • Submarine Swap preimage copy button

      • Add Chatwoot

      • Show when no browser wallet found

      • 0-amount chain swaps

  • 01:14:56 ESP-Miner v2.4.1

    • Add support for eusolo stats for ckpool

    • Add Noderunners pool to quick links

    • Add 205 config and remove self test flag

    • api: add stratum difficulty

    • Don’t abandon the first mining.notify

    • Swarm styles, refresh on load, more combined stats, more info in table

  • 01:14:58 Clams remote Update

    • Add support for BIP-353 usernames

  • 01:14:59 Mempal v1.3.0

    • Elapsed time since latest block displayed on dashboard and widgets

    • Number of blocks to clear mempool displayed on dashboard and widgets

    • Tor connection indicator now displays on dashboard when connected over Tor

    • Set specific block height alerts for notifications

    • Widget update frequency option in settings

    • Add tap to refresh widget feature and double tap to open Mempal app

  • 01:15:07 Kyoto v0.6.0

    • Pass FeeFilter to client

    • Add Signet and Bitcoin checkpoints

  • 01:15:20 LifPay

    • Introduces Reusable Payment QR Codes with fixed amounts, allowing users to create a QR code with a fixed amount that can be scanned and reused multiple times. [Stacker News]

Project spotlight

  • 01:16:09 Specter Shield Lite: Low Cost Secure Element Backed Security for DIY Bitcoin Hardware Wallet [Announcement] [Github fork]

  • 01:16:17 Covenants support: A dedicated covenants support page on the Bitcoin Wiki, listing developers’ current support positions.

  • 01:18:08 Kibo: An open source Bitcoin Core data extractor and visualizer [Github]

  • 01:18:20 Saving Satoshi: The world’s first interactive, practice-focused game to teach you bitcoin development.

    • “Saving Satoshi is a light-hearted, first point of contact for developers of all ages that want to learn how bitcoin works.” [Github]

  • 01:18:28 Fully Noded Server: A one click Bitcoin Core, Core Lightning and Join Market server to connect to Fully Noded apps. [Github]

  • 01:18:30 Timestamp: A platform that enables both accredited and non-accredited investors to invest in Bitcoin and open-source companies with low minimum investments.

  • 01:18:49 Satoshee: Winners’ club. Carefully curated gift cards, discounts, loyalty program.

    • Satoshee is platform offering gift cards, exclusive discounts, and Loyalty Programs, which support the creation and distribution of open-source media.

  • 01:19:06 hass-miner: Control and monitor your Bitcoin Miners from Home Assistant.

    • Great for Heat Reusage, Solar Mining or any usecase where you don’t need your miners running 24/7 or with a specific wattage.

    • Works great in coordination with ESPHome for Sensors (like temperature) and Grafana for Dashboards.

    • Support for: Antminers, Whatsminers, Avalonminers, Innosilicons, Goldshells, Auradine, BitAxe, IceRiver, Hammer, Braiins Firmware, Vnish Firmware, ePIC Firmware, HiveOS Firmware, LuxOS Firmware, Mara Firmware

  • 01:19:12 Entropy: A collection of open-source bitcoin workshops, projects, hackathons, and software, by D++.

  • 01:19:20 PlebDevs launches [PlebDev Starter Course], a free starter course aimed at complete beginners to learn basic coding or webdev skills, covering code editors, Git/Github, HTML, CSS, and JavaScript.

Vulnerability Disclosures

  • 01:19:29 Droidbot targets banking and crypto apps across Europe [Cleafy’s disclosure]

    • The malware impersonates apps like Google Chrome to steal credentials for 77 banking and cryptocurrency platforms across Europe, and uses Accessibility Services to log keystrokes, overlay fake login pages, and intercept SMS OTPs.

    • DroidBot employs MQTT, typically used in IoT, for stealthy data exfiltration. It encrypts and compresses data before transmission, complicating detection.

  • 01:19:36 DaMAgeCard: SD Express Card vulnerability exposes memory access risks in laptops and consoles [CyberInsider]

    • Positive Technologies researchers identified a vulnerability in SD Express cards, leveraging the Direct Memory Access (DMA) feature to bypass system protections. Modified cards can exploit gaps in securing the transition between SDIO and PCIe modes.

  • 01:19:47 Web3: Malicious versions of Solana’s web3.js npm library expose private keys [The Hacker News]

    • Researchers uncovered two malicious versions (1.95.6 and 1.95.7) of the popular @solana/web3.js npm library, which harvested private keys to drain crypto wallets.

    • The attack is believed to have stemmed from a phishing incident targeting the npm package maintainer, allowing the hacker to publish compromised versions.

  • Encrypted communications service ‘Matrix’, dismantled by international police operation [Europol]

    • A large-scale investigation, lead by French and Dutch authorities involved in a joint investigation, lead to the interception of 2.3 million messages in 33 languages over a monitoring period of three months, dismantling more than 40 servers.

  • Uganda confirms central bank hack, downplays extent of the loss of 62 billion shillings ($16.8 million) [Reuters]

    • The hacking group, ‘Waste’, based in Southeast Asia, transferred funds abroad, including to Japan. The central bank has recovered over half of the stolen amount.

Audience Questions

  • 01:24:05 How do NVK and the guests feel about Google’s Willow quantum chip? Is Bitcoin at risk?

  • 01:30:01 Can NVK and the guests comment on James OB’s recent Tweet? “Very simple scenario for you: Tomorrow gov announces that by EOW, all exchanges must move held bitcoins over to a one-way hardfork that adds “monetary policy tools” and OFAC compliance Can bitcoin support an exit for everyone who wants out? This is why scaling matters.” What are your general thoughts, and also how would a “one-way hardfork” work?

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • The Tor Project replaces its legacy BridgeDB system with Rdsys, a modular and adaptable bridge distribution system. [Blog post]

    • Rdsys supports flexible distribution channels, such as Telegram, enhancing user accessibility and bypassing restrictions without relying on outdated captchas.

    • Tor Browser v14.03

  • NomadNet v0.5.5

    • Add Checkbox and Radio Group fields to Micron

    • Fix invalid LXMF link handling in browser

  • Sideband

    • v1.2.0

      • Sideband now includes Liam Cottle’s RNode flasher in the internal repository

      • Updated message color scheme for better readability and theme consistency

      • Updated theme and user interface defaults for new installations

      • Added signal stats to the announce stream (if available from interface)

      • Added ability to render rich markup in messages

      • Added per-object live-tracking mode for telemetry-enabled peers

      • Added ability to add any number of interfaces via the Advanced RNS Configuration option

      • Added Utilities section

      • Added support for the repository server on desktop operating systems

    • v1.1.4

      • Add ability to add message attachments from sharing intent on Android

      • Add ability to add message attachments with drag-and-drop on desktop

      • Add user interface scaling option

      • Update RNS and LXMF to latest versions

  • Tails v6.10

    • Fix support for Trezor hardware wallets in Electrum

    • Disable saving telemetry data in Thunderbird

    • Update Tor Browser to 14.0.3. and Thunderbird from 115.16.0 to 128.4.3

Lightning + L2+

Project spotlight

  • PeerSwap: enables Lightning Network nodes to balance their channels by facilitating atomic swaps with direct peers [Github]

    • PeerSwap enhances decentralization of the Lightning Network by enabling all nodes to be their own swap provider. No centralized coordinator, no 3rd party rent collector, and lowest cost channel balancing means small nodes can better compete with large nodes.

  • Voltz Tip Bot: An easy-to-use Lightning Network Telegram Bot designed to facilitate tipping sats right within your Telegram groups [Announcement]

  • Liquid Horse: Liquid Sidechain Statistics. Provides statistics and analytics for the Liquid Network.

    • It tracks data such as block production, sidechain transactions, functionary uptime, and federation wallet balances. It also highlights the operational status of block signers and other technical metrics related to network performance

  • awesome-liquid-network: A curated list of Liquid Network resources, libraries, tools and applications

  • Macadamia: A native iOS client for cashu [Github]

    • Macadamia supports standard Cashu operations such as: Minting of tokens, sending and receiving, melting tokens, restoring your wallet balance using a 12 word mnemonic seed phrase backup.

      • v0.2.0: This version is a complete rewrite, segregating cashu logic to its own library and implementing a database model in SwiftData.

  • Strata Bridge: Alpen Labs is developing a bitcoin bridge to its Strata platform, enabling 1 BTC on Strata to match 1 BTC on bitcoin with minimal trust assumptions. [Announcement]

    • The Strata bridge is based on the BitVM2 paper by Robin Linus, incorporating optimizations and advanced research to improve efficiency and robustness.

Software Releases & Project Updates

  • Core Lightning v24.11 - The lightning-dev Mailing List

    • Highlights for Users:

      • xpay is a new, experimental plugin for payments. It’s rewritten from the ground up, on top of another plugin called askrene, which provides advanced routing advice for payments

      • Paying and receiving offers (bolt12 send and receive) are enabled by default

      • hsmtool generatehsm can now accept all the parameters on the command line

    • Highlights for Developers:

      • cln-grpc (our rust plugin to provide a GRPC interface) is enabled by default

      • There’s a new dev-splice command which lets you provide a splice script for describing complex moves

      • Improve tracing infrastructure

    • Highlights for the Network:

      • We gossip harder: we try to stay connected to 10 nodes

      • Connectd will connect faster on startup, maintaining up to 10 outgoing connection attempts in parallel

  • LND v0.18.4-beta.rc1

    • Minor release which ships the features required for building custom channels, alongside the usual bug fixes and stability improvements.

    • Features: The main channel state machine and database now allow for processing and storing custom Taproot script leaves, allowing the implementation of custom channel types in a series of changes.

    • Functional Enhancements:

      • A new protocol.simple-taproot-overlay-chans configuration item/CLI flag was added to turn on custom channel functionality.

      • Compatibility with bitcoind v28.0 was ensured by updating the version the CI pipeline is running against.

  • Eclair v0.11.0

    • This release adds official support for Bolt 12 offers and makes progress on liquidity management features (splicing, liquidity ads, on-the-fly funding). We also stop accepting channels that don’t support anchor outputs and update our dependency on Bitcoin Core.

    • Implement full support for Bolt 12 payments

    • Improve implementation of splicing, by relying on the now official quiescence feature and adding RBF support

    • Include an early prototype for liquidity ads

    • Update minimal version of Bitcoin Core (v27.2)

    • Incoming obsolete channels will be rejected

    • HTLC endorsement for channel jamming

    • On-the-fly funding: introduces implementation of proposed protocol to negotiate an on-the-fly liquidity purchase

  • Zeus v0.9.3

    • Improved channels UI: including reserves

    • Invoice Settings: Display requested amount on invoice

    • Embedded LND: Troubleshooting menu

    • Bitcoin denominated amounts: display with spaces

    • ZEUS Pay: UX improvements

  • Ark v0.4.0 - New address encoding, Notes and Market Hours

    • New Address Encoding: Instead of encoding user and server public keys, we now encode the VTXO output script (Taproot key) and server public key

    • Ark Notes: a feature designed for users who may not be online frequently

      • Clients can share a Nostr public key (profile) for each of their VTXOs

      • When users go offline, the Server will print notes worth their unspent swept VTXOs

      • Users can restore their off-chain balances when they come back online in the future

    • Market Hours:

      • Introduce specific periods during which the server will offer lower service fees for users joining rounds

      • Allow users to schedule their settlements at predetermined times in the future, potentially saving on fees

    • Server Improvements:

      • Connection of the internal Bitcoin wallet to bitcoind with ZMQ

      • Support for restoration of the internal Bitcoin wallet

      • Auto-unlock feature for the internal wallet

      • Increase testing surface for improved reliability

      • Consolidation of APIs

  • Alby

    • lightning-browser-extension v3.10.0 - Ice Clouds over a Red Planet

      • Version v3.10.0 introduces the Alby Hub Connector and a notification banner for upgrading shared wallets to Alby Hub. It also replaces “Citadel” with “Nirvati” and includes multiple translation updates.

    • Alby-go v1.7.2

      • LNURL-withdraw support

      • Improve currency selection

      • Boostagram info in transaction details

      • Delete contacts in address book

      • Enhance QR code readability

    • bitcoin-connect v3.6.3

      • Add currency selector UI

  • Breez SDK v0.6.5

    • Increase reliability for trampoline payments

  • Lightning Terminal v0.14.0-alpha.rc1

    • This first Release Candidate of Lightning Terminal (LiT) ships the first non-experimental version of Taproot Asset Channels

  • Taproot-assets v0.5.0-rc1

    • Database Migrations: tapd v0.5.0 contains non-revertible database migrations. After running tapd v0.5.0, these database migrations prevent downgrading tapd to a previous release. Create backups of tapd database state, before upgrading to tapd v0.5.0.

    • Breaking changes:

      • Downstream Projects - litd: litd v0.14.0-alpha enhancements require both channel peers to upgrade to a litd version >= v0.14.0-alpha to continue Lightning Channel functionality.

    • tapd v0.5.0 changes:

      • Oracle RPC: The RPC protobuf definitions for the Price Oracle have changed. Asset exchange rates are now expressed as FixedPoint to achieve better precision.

      • Configuration changes: The configuration value (universe.public-access) and command line flag (--universe.public-access) now needs a value and is no longer a boolean

  • Torq v2.1.0

    • Bitcoind wallet as a node type (Torq now has on-chain wallet support for CLN, LND and bitcoind)

    • Bitcoind existing on-chain address listing

    • Management of UTXO locking

    • Improve transaction output visualizations (and backend)

    • Improve transaction output linking to channels (funding/closing transactions)

    • LND: sweep transaction output linking to channels -Torq gRPC (BETA feature):

      • New call SubscribeBlockHeight

      • New call PayOnChain

      • New call DecodeInvoice

      • New call GetInvoiceStatus

  • Polar v3.1.0

    • This minor release is needed to support the latest released versions of litd v0.14.0-alpha.rc1 and tapd v0.5.0-alpha.rc1.

    • Features:

      • Add Description field when creating a new network

      • Add full support for decimal display for TAP assets

  • CLBOSS v0.14.1 - Hand at the Grindstone

    • Contrib Script Enhancements:

      • Add --lightning-dir option to the contrib scripts

      • Add Nix Support

    • Stack Unwinding Support:

      • Implement libunwind for stack unwinding

      • Replace the use of program_invocation_name with a custom global variable to store the program name, improving portability to systems like FreeBSD and other Unix-like systems.

    • Configurable Exception Backtrace Support:

      • Add the --disable-exception-backtrace option to configure

      • The Util::BacktraceException class now provides a no-op wrapper when exception backtraces are disabled via --disable-exception-backtrace

  • Minibits Wallet v0.1.10

    • This native update brings sole but important architectural change: all Nostr wallet (NWC) commands are now processed using Android’s foreground service.

  • Cashu-ts v2.0.0

    • NUT-05: description for invoice, integration test without bolt11 decode

    • DX: Enforce explicit type annotations on function parameters

    • NUT-18: Payment requests

    • Add pipeline to build RC from staging branch

    • Add fees and coin selection

    • Streamline blinding

    • Wallet: Remove bip39 dependency

    • Support for NUT-12

Nostr

Project spotlight

  • Myriad: A simple personal blossom server for your own files [Code repository]

  • Cherry Tree: Chunked files stored on blossom servers [Github]

    • “An experiment to see if its possible to re-create torrents on top of blossom servers and nostr” [Explanation]

  • Condenser: A nostr bot built using the mistral api which summarizes all notes from the news.utxo.one relay [Github]

    • “A script that fetches the last 6 hours of events from news.utxo.one and summarizes them using the Mistral API.”

  • Mostr: An immutable nested collaborative task manager, powered by nostr [Github]

  • Robosats Nostr Sync: Scrappers to publish to nostr orders from other platforms [Github]

    • The tool can display non-kyc exchange HodlHodl offers on Robosats’ client [Note]

  • nokakoi: Grid style live nostr client for Windows. [Github]

  • The Bullish Bulletin: An app powered by Nostr Wallet Connect to post all sorts of messages like job ads or announcements

    • Users can choose a note type, enter their message and pay via Bitcoin Connect to publish their post.

  • Vpnstr: A new VPN service with 53 locations and unlimited bandwidth, can be paid with Bitcoin on the Lightning Network

Software Releases & Project Updates

  • Rust Nostr v0.37.0

    • Add support to NIP17 relay list in SDK (when gossip option is enabled)

    • Add NIP22 and NIP73 support

    • Fix Swift Package

    • From this release all the rust features are be disabled by default (except std feature in nostr crate).

  • Primal

    • iOS v2.0.134

      • Improve onboarding

      • Profile screen improvements

      • Feed rendering improvements

      • App shell cosmetic improvements

    • Android v2.0.28

      • Implement:

        • Profile avatar and cover image viewer in profile details screen

        • Rendering highlights and generic events in feeds

        • Tap QR code to copy addresses on profile QR code viewer

        • Follow/unfollow approvals if contact list is not found

        • Onboarding follows customisation and zaps introductions

        • Premium badge on profile details screen

        • New avatars designs

        • Support for primal legend avatars across the app

        • Primal premium check into profile editor

    • Web v2.0.11

      • Profile screen improvements

      • Feed rendering improvements

  • Damus Notedeck Alpha is now available for Purple subscribers [Announcement]

    • Lightning fast: Built from the ground up with an ultra-fast database made exclusively for nostr, leveraging several state-of-the-art performance techniques not available on web clients

    • Custom feeds: Add timeline, hashtag, and notification columns of any nostr public key. Which means you can see the nostr landscape through other peoples’ eyes

    • Add account switching

  • Notedeck Update

    • Update user relay-list via polling

    • Add user mute list sync via polling

    • Skip muted content

    • debug: add crate features which enable egui DebugOptions

  • Amethyst

    • v0.93.1

      • Move to NIP-22 to reply to Interactive Stories

      • Add amount and personalization labels to the DVM feed

      • Improve performance of the Hex encoder

      • Improve the layout of the discovery feed items

      • Update Jackson, secp256k1, and AGP

    • v0.93.0 - Blossom, Olas, Around Me feeds and Interactive Stories

      • Add support for displaying NIP-63 Interactive Stories

      • Add support for Blossom media servers

      • Add support for Olas’ Image feeds

      • Add support for Around Me feed with posts that only show up in that location

      • And many more new features

  • Chronicle v0.3

    • Add workaround to stop saving duplicate events

  • Olas

    • iOS v0.1.5

      • Reposts

      • Zaps (via Nostr Wallet Connect for now)

      • Swipe-to-zap

      • Performance improvements

    • Android v0.1.5

      • NWC zaps

      • LN and Nutzaps via swipe-to-zap

      • Reposts

      • Performance optimizations

    • v0.1.4-1

      • Add reposts

      • Performance improvements

    • v0.1.4

      • Add bookmarks

  • Snort v0.3.0

    • Drop NIP-04 support for DM’s

    • Profile link QR selector (npub/nprofile)

    • Relay up time reporting (via nostr.watch NIP)

    • New note designer media attachment UI

    • Media browser via NIP-96 server list

    • NIP-89 support (App handlers for unknown events)

    • WoT filter for replies

    • Drop NIP-04 support for NIP-46 bunkers (NIP-44 only)

    • NIP-55 Amber signer support

  • YakiHonne Update

    • Mobile:

      • All-in-One Content Hub: Create notes, articles, videos, curations, and smart widgets all in one place

      • New Media Servers: Added support for NostrMedia.com (npub18jn…59kc), Nostr check, and more

      • Thread Timeline Enhancements: Smoother and clearer thread viewing

      • Nip 44 Gift Messages: Now enabled by default

      • App-Wide Improvements: Faster, smoother, better

    • Web:

      • Upgraded Note Editor: GIFs, emojis, and real-time previews to enhance your creativity

      • Enhanced Long-Form Content: A fresh design to make writing a joy

      • Custom Media Uploaders: Support for more media options and servers

      • Expanded Search: Find more notes, media, and users with ease

      • Browsing Suggestions: Discover new notes, media, users, and more

  • Nostrmo v2.9.4

    • Remove metadata cache when start and change wot reload method

    • Add support to sync user’s local events to relays

    • Add support to send long form

    • Add a json viewer to event json copy

    • Trace router query add tempRelays support

  • Keychat v1.22.2

    • Support Large Group Chat with OpenMLS Integration

    • New Bot Identity: Support Ecash Payments for ChatGPT-4o and ChatGPT-4o-mini Interaction, pay per message

    • Breaking change: Adopting nip17 to send signal hello message and use new signature scheme

  • 0xChat App

    • v1.4.4

      • Optimize the data storage performance of the Cashu wallet

      • Enable opening external images with 0xChat

      • Add support for customizing the Moment feature

      • Add support for the Persian language

    • v1.4.2

      • Add a text size adjustment setting

      • Add inbox/outbox relays setting

  • Voyage

    • v0.17.1

      • Don’t allow saving empty lists

      • Treat empty list pairs as deleted

    • v0.17.0

      • Features:

        • Create polls

        • Filter HomeFeed by roots, cross and polls

        • Show poll end time in post details

      • Improvements:

        • Force nip22 usage when replying with 5 or less characters

        • Set t tags when nip22-replying hashtags

        • Adjust scroll behaviour

  • Nos.social

    • v1.0.3

      • Add support for user setting and displaying pronouns

      • Add display of website URLs for user profiles

      • Update note header UI to make it more readable

  • Citrine

    • v0.5.8

      • Move database view to a new screen

      • Don’t send received events to the same connection that sent them

      • Performance improvements when deleting events

      • Check if there’s a newer version of the event before saving the event to the database

    • v0.5.6

      • Add a option to fetch your events from relays

      • Add a delete all button

      • Feed by kind

  • Pokey

    • v0.1.2

      • Implement Multi-account

    • v0.1.1

      • Notifications now display NIP05 pictures if available

      • Prepare the code for multi-account

      • New APKs available per Arch

  • Amber v3.0.0

    • New design (still a work in progress)

    • Open the permissions page with the correct account

    • Option to setup a custom pin for the app

    • Button to copy your public key

    • Better check for valid relays

    • Support for secret when using nostrconnect

  • Zapstore v0.1.7

    • Performance: Faster, background downloads

    • Feature: Full screen app images

    • Feature: Remember trusted signers

    • Feature: Show certificate mismatch before installing

  • SatShoot v0.2.0 [Github]

    • Cashu nip60 wallet and payment with nip61 nutzaps: multimint payments, mint exploration, manual and automatic backup and resync mechanisms

    • Rendering of nostr URI-s

Boosts

  • Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @forest (3,500 sats) “👊”

    • @tac_btc (1,000 sats) “Thank you”

    • @Hugh Janus (200 sats) “https://media.tenor.com/OdfwhhIoccAAAAAC/i-see-south-park.gif”

    • @edblock “Great Episode joined by guests Stephan Livera, Rijndael & Ben Carman about apps for Bitcoiners.”

Tech Tip of the Day

  • Surveillance Self-Defense: Tips, Tools and How-tos for Safer Online Communications, a project from the Electronic Frontier Foundation

    • A guide providing practical guides, tips and strategies to help individuals and organizations protect their privacy and security online.

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 332

      • Transaction censorship vulnerability: Antoine Riard posted to the Bitcoin-Dev mailing list about a method for preventing a node from broadcasting a transaction belonging to a connected wallet.

      • Continued discussion about consensus cleanup soft fork proposal: Antoine Poinsot posted to the existing Delving Bitcoin thread about the consensus cleanup soft fork proposal

    • 331

      • Lisp dialect for Bitcoin scripting: Anthony Towns made several posts about a continuation of his work on creating a Lisp dialect for Bitcoin that could be added to Bitcoin in a soft fork.

        • bll, symbll, bllsh

        • Implementing quantum-safe signatures in symbll versus GSR

        • Flexible coin earmarks

News & Noteworthy

Lightning + L2+

  • ZEUS Pay cuts lightning address fees and lowers minimum limit [Blog post]

    • ZEUS Pay announces zero fees for receivers, previously charged 2.5-10% depending on the payment amount. The minimum amount receivable has been reduced to 1 satoshi, previously set at 10 satoshis.

  • Non-Custodial Ecash: A Trust-Minimized Payment System by Luke Childs [Proposal]

    • The proposal details a protocol leveraging Spillman payment channels, allowing users to hold self-custodial credits redeemable for ecash tokens during transactions. Custodial risk would only exist during payment processing.

  • You can now buy a Vpnstr VPN with Cashu, making it the first VPN to accept ecash.

Business & Finance

  • Casa announces Praetorian by Casa, an offering for governements willing to secure their national bitcoin reserves with self-custody protocols, removing reliance on third-party custodians [Announcement]

  • Strike introduces Bill Pay for U.S. customers, allowing them to automate bill payments using either bitcoin or cash directly from their Strike accounts. [Blog post]

  • BitGo launches BitGo Retail, a retail platform offering trading, custody, staking, and wallets with institutional-grade security and regulatory compliance. [Business Wire]

  • Fold now allows primary account holders to add up to three authorized users, each with their own Fold card. [Blog post]

    • This feature enables families to collectively earn bitcoin rewards on eligible purchases under one account.

  • Rumble’s Board of Directors approves allocating up to $20 million of excess cash reserves to Bitcoin, supporting its expansion into cryptocurrency. [Press release]

    • The company will determine Bitcoin purchases based on market conditions and business needs, with the strategy subject to change at any time.

  • Swan customers are being charged up to $125 for a Fortress ‘Admin Fee’, after the company moved all Fortress Trust accounts to new services providers. [Announcement]

    • The company will cover up to $250 of purchase fees for impacted users in the first half of 2025.

  • DMM Bitcoin, a Japanese exchange, announces its closure following a 4503 BTC ($300 million) hack earlier this year. [Announcement]

    • The company agrees to transfer customer accounts and custodial assets to SBI by March 2025.

  • MARA acquires a 240 MW interconnection wind farm in Hansford County, Texas, featuring 114 MW operational wind capacity. The project plans to leverage sustainable resources for near-zero energy cost and enable broader renewable energy deployment [Press release]

Quantum

  • Google introduces Willow, a quantum chip with breakthroughs in reducing errors exponentially as more qubits are added. [Press release]

    • In benchmark tests, Willow solves computations in minutes that would take leading supercomputers over 10^25 years.

Funding

  • OpenSats renews grant to 9 projects advancing the ecosystem on various fronts: BTCPay Server, Stratum V2, Raspiblitz, LNbits, Vexl, Blixt, Krux, Bitaxe, and Labelbase.

  • Spiral announces two new grants to Bob McElrath, for his work on Braidpool, and Rachel Rybarczyk, core developer at Stratum v2 project.

  • Bitcoin Dev Kit Foundation announces grants to Wei Chen, newest BDK’s full-time Rust maintainer, Evan Lin, part-time Rust maintainer, and Nymius, a new project grantee contributing to Silent Payments and general project maintenance.

  • OCEAN Pool now allows miners to donate rewards directly to the P2PRights fund for Samourai Wallet’s legal defense. [Atlas21]

Mining

  • U.S. Customs and Border Protection is holding shipments of Bitmain’s Antminer S21 and T21 ASIC miners at ports, following a request from the Federal Communications Commission. [BlockSpace]

    • Seven U.S.-based bitcoin mining companies report delays of up to two months. Other ASIC manufacturers, such as MicroBT and Canaan, are not affected.

  • Bitmain introduces a new production line in the U.S. to improve response times and efficiency for North American customers. [Announcement]

  • The Public Utility Commission of Texas requires crypto mining facilities consuming over 75 MW to register with ERCOT, detailing their location, ownership, and power usage. [Texas Tribune]

  • Bitcoin mining pool issues rewards in ecash, without an account being required. Miners can then withdraw ecash to the Lightning Network or on-chain [Note]

Privacy

  • U.S. agencies, including the FBI and CISA, encourage Americans to adopt end-to-end encrypted messaging apps in response to ongoing cyber threats [ArsTechnica]

    • U.S. officials reveal an ongoing breach targeting global telecom systems, attributed to the Chinese hacking group “Salt Typhoon”, which has compromised at least 8 U.S. telecom providers, more than initially reported.

    • The attack, which began in spring 2024, exploited vulnerabilities in over 80 telecom companies, compromising sensitive data such as call metadata and private communications of political and government-linked individuals.

  • EU scrutiny on encrypted messaging: The High Level Group on Data Access highlights challenges law enforcement faces with “over-the-top” (OTT) messaging services like Signal, WhatsApp, and Telegram. [Heise]

    • They advocate “lawful access by design” to enable real-time access to encrypted communications while ensuring court oversight for serious crimes.

  • Coinbase advises users against using VPNs and ad blockers, citing that its risk models associate them with malicious activity. Product Director Scott Shapiro states these tools often raise security flags, even for legitimate users. [Twitter post]

Protocol

  • Libsecp256k1: Safegcd’s implementation formally verified by Blockstream Research [Bitcoin Magazine]

    • The safegcd modular inversion algorithm, implemented in libsecp256k1, was formally verified using the Coq proof assistant. This verification ensures its correct termination and accuracy in 256-bit inputs.

  • Bitcoin Core #30039: dbwrapper: Bump LevelDB max file size to 32 MiB to avoid system slowdown from high disk cache flush rate [Merged]

  • Bitcoin Core #31122: cluster mempool: Implement changeset interface for mempool [Merged]

    • Provides a changeset interface for the mempool, enabling a node to evaluate the impact of proposed changes on its state

  • Bitcoin Core #30708: rpc: add getdescriptoractivity [Merged]

    • The RPC command scanblocks helps retrieve blockhashes with relevant activity for specific descriptors.

  • Eclair #2935: Add force-close notification [Merged]

  • NIP #1551: Instagram feeds [Merged]

  • NUT-19 Cached responses: The NUT adds idempotency to key endpoints, enhancing the reliability of the Cashu protocol. [Merged]

Government & Political

  • Brazilian Congressman Eros Biondini introduces RESBit, a bill for a national bitcoin reserve, suggesting an allocation of up to 5% of Brazil’s $372 billion international reserves. [The Block]

    • The bill aims to diversify financial assets and strengthen Brazil’s resilience against currency fluctuations and geopolitical uncertainties.

  • El Salvador considers adjusting bitcoin policy to secure IMF loan [Financial Times]

    • A proposed legal change would allow merchants to choose whether to accept bitcoin. This adjustment is part of conditions set by the IMF for a $1.3 billion loan, alongside $2 billion from other international lenders.

  • Czech Republic removes capital gains tax on digital assets held for over 3 years, starting December 2024 [The Block]

  • Fifth Circuit overturns Tornado Cash sanctions, citing overreach by OFAC [The Rage]

    • The court rejected the government’s claim that Tornado Cash operates as a service, explaining that its smart contracts are lines of code, not human-driven services. It also clarified that Tornado Cash cannot control its immutable contracts, distinguishing them from mutable, user-controlled systems.

  • Damian Williams steps down as U.S. Attorney for the Southern District of New York after overseeing Samourai Wallet and Tornado Cash cases [Press release]

  • The Canton of Bern, in Switzerland, approves a feasibility study to explore Bitcoin mining’s potential within its energy framework. [Atlas21]

    • The study focuses on identifying surplus energy, collaborating with Swiss miners, and evaluating mining’s impact on grid stability.

  • Operation Choke Point 2.0: U.S. regulators’ actions against crypto activities revealed in FDIC letters [CoinDesk]

    • The FDIC’s “pause letters” dated back to March 2022, with officials advising banks to halt crypto services until further risk assessments were made.

  • Russia’s president signs a law recognizing digital currencies as property, enabling taxation of mining and transactions. [The Moscow Times]

    • Cryptocurrency mining and sales are exempt from VAT but subject to income tax at tiered rates. Corporate entities face a 25% tax starting next year.

    • A database of government-approved miners was launched in November. Another law permits the Central Bank to pilot cross-border cryptocurrency transactions.

  • Morocco’s central bank is adopting a draft law to regulate cryptocurrencies, which have been banned since 2017. [Reuters]

    • Bank Al Maghrib is also considering the development of a central bank digital currency (CBDC) to enhance financial inclusion.

  • Taiwan’s Financial Supervisory Commission (FSC) enforces stricter AML rules for digital assets service providers starting November 30, 2024. [The Block]

    • FSC officials emphasize fraud prevention and tighter oversight, including regulations on fiat custody, data security, complaint handling, and record-keeping.

Events

  • Plan ₿ Forum El Salvador

    • Central America’s premier Bitcoin conference, uniting global leaders, technologists, and entrepreneurs.

    • January 30-31, 2025 in San Salvador, El Salvador

  • Bitcoin Medellin

    • The first ever Bitcoin Medellin Conference

    • January 17-18, 2025 in Medellin, Colombia

Reads

  • Here’s a list of our top recently published reads:

    • Erosion of the Meaning of Custody, by Nicolas Dorier [Blog post]

    • Buckets of blind signatures, by Callebtc [Blog post]

    • Financial surveillance in the United States: How the Federal Government weaponized the Bank Secrecy Act to spy on Americans [Report]

    • Privacy in Public Part 3: Cash and Bitcoin, by BPI Fellows Andrew Bailey, Bradley Rettler, and Craig Warmke [Bitcoin Policy Institute]

    • Understanding Liability for Unlicensed Money Transmitting Businesses under § 1960, by Daniel Barabander, Amanda Tuminelli and Jake Chervinsky [Paper]

    • Hodlers: an apology, by the Financial Times [Article]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[Bitcoin Review Podcast BR088 - AnchorWatch, Bitkey, Krux, Primal, Proton Wallet, Kagi, Debifi, Namecheap $73M bitcoin revenue + MORE ft. Livera, Rijndael & Ben]]>https://substack.bitcoin.review/p/bitcoin-review-podcast-br088-anchorwatchhttps://substack.bitcoin.review/p/bitcoin-review-podcast-br088-anchorwatchWed, 27 Nov 2024 20:48:37 GMTI’m joined by guests Stephan Livera, Rijndael & Ben Carman to go through the list.

Listen on your favorite podcast app

Housekeeping

  • 00:05:29 Bitcoin Black Friday

  • 00:06:05 AnchorWatch gains Lloyd’s of London Coverholder status [Business Wire]

    • Starting December 2024, it will offer insured bitcoin custody solutions backed by Lloyd’s syndicates, allowing coverage of up to $100M per customer.

    • Its proprietary Trident Vault integrates advanced security features with 1-to-1 insured custody, addressing theft, fraud, and catastrophic risks for retail and institutional investors.

Urgent Vulnerability Disclosures

  • 00:10:25 Krux releases security fix for AES-CBC encryption flaw [Github]

    • Issue #477 revealed camera-captured entropy wasn’t properly utilized in AES-CBC encryption, reducing its intended security strength. This affected backups stored on flash drives, SD cards, and encrypted QR codes by users who switched from the default AES-ECB mode.

    • Affected users are recommended install the latest update to resolve the issue. After updating, they should recreate all backups to apply the corrected encryption and restore full security.

Bitcoin

Software Releases & Project Updates

News & Noteworthy

Business & Finance

  • Leading domain registrars Namecheap surpasses $73M in bitcoin revenue since its 2020 BTCPay integration [BTCPay Blog]

Bitcoin (Cont.)

Software Releases & Project Updates

  • 00:17:14 BDK v0.30.0

    • This release bumps the MSRV to 1.63.0 and updates the rusqlite dependency version to 0.31 to be aligned with the upcoming 1.0.0 release. These changes will prepare projects for migrating wallet data to the 1.0.0 version of BDK.

  • 00:17:38 BTCPay Server v2.0.3

    • “If you are using Boltcards, we advise you to update to this release.”

    • New features:

      • Greenfield: Histograms: Add Lightning data and API endpoints

      • Greenfield: Add image upload for app items

  • 00:19:53 Nunchuk Desktop v1.9.40 / Android v1.9.54

    • Support Coldcard as inheritance key

    • Option to Send all remaining for batch transactions

  • 00:20:20 Proton Wallet Update

    • Adds Replace-By-Fee (RBF), to speed up the confirmation speed of transactions

  • 00:23:58 Bitcoin Keeper

    • v1.2.20

      • Redesign transaction priority screen

      • Enable remote Key sharing and signing for Blockstream Jade and seed key

        • Improve transaction fee estimation

      • Add transaction details to view while signing external PSBTs

    • v1.2.19

      • Coldcard vault registration via NFC - Android bug fixed

  • 00:24:40 Nix Bitcoin v0.0.115

    • bitcoind: 27.1 -> 28.0

    • clboss: 0.13.3 -> 0.14.0

    • electrs: 0.10.5 -> 0.10.6

    • trustedcoin: 0.8.2 -> 2024-11-1

    • The lnd module’s ExecStartPost script is now extensible with custom scripts

  • 00:25:09 Krux v24.11.0

    • Tamper Check Flash Hash and Tamper Check Code (Experimental): the feature verifies the integrity of the device’s flash memory by generating a unique tamper indicator that relies on hash properties

    • Add Flash Map: an auxiliary tool that allows users to visualize the regions of the device’s memory that are empty

    • Add Japanese Translation

    • BIP85: Allow Export Base64 Passwords

    • Vulnerability Fix: Block Import of Python Modules from SD Card

    • Add Compatibility to Partial Text Mnemonic QR Codes

    • Add Multi-keypad Position Indicator

    • Add Computer simulator for WonderMV device

    • Krux Ethos: Guidelines have been created to assist with decision-making regarding the Krux project’s interactions

  • 00:26:49 RoboSats v0.7.3

    • Websockets now working on Android app: this enables instant chat and Nostr order book features

    • First external coordinator now available: you can now see @lnp2pBot orders on RoboSats UI

    • Better display coordinator info on the Create Order form

    • Charts now depend on selected currency

  • 00:26:57 Bitkey App v2024.73.0

    • Now see Coinbase offers alongside other partner exchanges when you sell bitcoin.

    • Bitkey introduces an inheritance feature, enabling users to designate a single beneficiary for simplified fund transfer after their passing. A 6-month waiting period safeguards against fraudulent or accidental claims. [Blog post]

      • Beneficiaries must set up a Bitkey wallet to receive funds, but cannot view the benefactor’s wallet details. Owners retain control over beneficiary changes.

  • 00:31:07 RewindBitcoin v1.1.3

    • Enhancements:

      • Emergency Addresses are now pre-filled by default, with contextual help provided

      • The app is now more resilient: it operates independently, even if backend services are unavailable or the backend goes offline

    • Robustness to Network Errors:

      • Automated and reasonable retries for network failures

      • Improved handling of Electrum node disconnections

      • Friendly, actionable error messages for poor connectivity

      • Optimized timeouts for better performance in weak network conditions

      • Avoids unnecessary network usage while the app is in the background and resumes seamlessly when restored to the foreground

  • 00:35:15 Umbrel v1.3.0

    • Swappable apps: You can now choose which Bitcoin node app you want to run: Bitcoin Node, Bitcoin Knots, or Libre Relay, and select your preferred Electrum server app: Electrs, Fulcrum, or ElectrumX.

    • Cloudflare DNS: Enable Cloudflare DNS for improved reliability, or disable it to inherit DNS settings from your router.

    • Add Factory Reset option

  • 00:35:32 ESP-Miner v2.4.0

    • Re-worked how we publish artifacts when releasing new builds

    • Use the same espressif/idf release for github and vscode

    • Add OLED Bitaxe logo screen

    • Add all in one factory file script

    • Replace default address with a prompt

    • Add info for check on update

  • 00:35:36 Boltz boltz-web-app v1.5.1

    • Disable EVM connect button for invalid pairs

    • Loading spinner when fetching signer balance

    • Add RSK to mainnet config

Project spotlight

  • 00:35:43 Wallet Dev Kit (WDK) by Tether: a multi asset cryptocurrency wallet library in JavaScript. [Documentation]

    • “An open-source, self-custodial toolkit for developers to create Bitcoin and USD₮ wallets for humans, AI and robots”

  • 00:35:51 ScriptLab: Uncomplicating Bitcoin Script: Learn and Code Scripts with blocks [Github]

    • Script Lab allows users to create Bitcoin scripts through an intuitive drag-and-drop interface or by generating basic scripts via chat

  • 00:36:04 Mempal: A Bitcoin mempool monitoring and notification app for Android. [Github]

    • “Mempal is a Bitcoin monitoring app that allows users to effortlessly track real-time fee rates and mempool depth for smarter transaction management.”

  • 00:36:44 Debifi: A Bitcoin-backed lending platform providing institutional-grade liquidity

    • Debifi App Update

      • Add support for Coldcard

      • Now available on the App Store

  • 00:37:41 Dart-bip85 package: A Flutter binding for the rust-bip85 which is an updated version of the original rust-bip85. [Repository]

  • 00:37:45 Descriptors Go: An experimental Go library to handle Bitcoin output descriptors, including miniscript and tapminiscript. [Github]

  • 00:37:47 tick-tock-tui: A TUI app to handle Bitcoin data provided by Mempool: fees, blocks and price converter. [Github]

  • 00:37:56 Awesome-bitcoin-guide: The Ultimate Bitcoin Guide: Secure, Private, and Informed Usage, by iAnonymous3000 [Github]

    • Comprehensive Bitcoin guide focusing on operational security, wallet management, privacy best practices, and risk mitigation

  • 00:38:30 BitAxe HAS Dashboard: A Home Assistant dashboard for BitAxe Miners [Github]

    • “This dashboard brings all your BitAxe miners and Satoshi Radio pool stats together in one clean, informative interface.”

  • 00:38:39 Radpool: Syndicated Mining Pool

    • Radpool introduces a syndicated design, using Mining Service Providers (MSPs) to decentralize bitcoin mining and reduce transaction censorship risks.

  • 00:38:43 Satadelica: A trippy Bitcoin price visualiser [Github]

    • Updates real-time Bitcoin metrics like price, block height and hashrate, and allow users to visualize market movements through ‘trippy’ graphics and tools.

Vulnerability Disclosures

  • 00:39:16 Nearest neighbor attack: exploiting nearby Wi-Fi for covert access [Volexity]

    • Russian APT GruesomeLarch’s novel Wi-Fi breach: The group leveraged nearby networks to infiltrate a Ukrainian-focused organization’s systems. Proximity was key in this “Nearest Neighbor Attack,” bypassing MFA-protected services by exploiting Wi-Fi credentials.

  • 00:39:27 New Ghost Tap attack exploits NFC mobile payments for fraud [Bleeping Computer]

    • The Ghost Tap attack exploits stolen credit card data and NFC technology to commit scalable financial fraud through global networks of money mules.

    • Attackers use banking malware and phishing to obtain payment credentials, relaying NFC card details remotely via servers.

  • 00:39:38 Leaked documents reveal Graykey, a phone unlocking tool, provides only partial access to iPhones running iOS 18 and 18.0.1, including the iPhone 12 through iPhone 16 series. [404Media]

    • Graykey’s capabilities with Android devices vary, with limited access on newer Pixel phones unless unlocked at least once, highlighting challenges due to the range of Android manufacturers.

  • 00:40:38 OverSecured researchers discover seven vulnerabilities in Android and Google Pixel devices, affecting millions of users worldwide.[Oversecured]

    • Vulnerabilities allow unprivileged apps to access geolocation and grant VPN bypass privileges, posing significant security risks. Other issues include arbitrary file theft via WebView, incorrect Bluetooth permission checks, and HTML injection vulnerabilities, all of which have been fixed by Google.

  • 00:41:03 Apple urgently patches vulnerabilities affecting macOS and iOS, including CVE-2024-44308 (arbitrary code execution) and CVE-2024-44309 (cross-site scripting). [Security Week]

    • The flaws involve JavaScriptCore and WebKit, primarily targeting Intel-based macOS devices. Apple advises immediate updates to macOS Sequoia 15.1.1 and iOS versions.

  • 00:41:32 Decades-old security flaws in Ubuntu’s Needrestart Package [The Hacker News]

    • Researchers discover local privilege escalation vulnerabilities in Ubuntu’s needrestart package, installed since version 21.04. Exploits allow attackers to gain root access via manipulated environment variables like PYTHONPATH and RUBYLIB.

  • 00:41:48 Chinese man arrested in Bangkok for operating, from a van, a 3km-range SMS blaster targeting populated areas, sending one million phishing messages per hour [Twitter post]

  • D-Link discontinues legacy routers over remote code execution flaw [Bleeping Computer]

    • D-Link urges users to replace DSR-150 and DSR-250 VPN routers due to an unfixed remote code execution vulnerability. The issue affects all hardware and firmware versions, with no patch planned.

  • 00:42:28 Five dollar wrench attack:

    • A gym trainer in Mira Road, Mumbai, was robbed of ~$56,000 by an eight-member gang during a USDT cryptocurrency deal. [LatestLy]

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 00:42:53 SimpleX

    • v6.2.0-beta.1

      • Flux - the second pre-configured operator in the app to improve metadata privacy

      • Improved chat navigation (Android/desktop apps):

        • Open chat on the first unread message

        • Jump to quoted messages anywhere in the conversation

    • v6.2.0-beta.0

      • Edge-to-edge interface with translucent toolbars*

      • Reachable UI in desktop apps - greatly reduces risks to send a message to a wrong chat accidentally

      • Conversation and settings toolbars moved to the bottom with reachable UI*

      • Don’t ask passcode/biometric to open your chat profiles (only required to add/delete)

      • Better stability of iOS notifications delivery

      • Android and desktop apps

  • 00:43:06 Signal

    • Introduces Call Links and enables users to share unique meeting URLs for quick access to calls without forming group chats. Admin controls and reusable links improve flexibility for recurring meetings.

Project spotlight

  • 00:43:28 DeFlock: An open-source crowdsourced project mapping Automated License Plate Readers (ALPRs) around the world

    • The project aims to raise public awareness about the widespread use of ALPRs, the privacy implications, and the extent of surveillance networks.

Lightning + L2+

Project spotlight

  • 00:43:56 Phoenix Server Lightning Wallet: An open-source wallet built on top of phoenixd [Github]

    • This project is a Lightning wallet interface built on top of Phoenixd server designed for Umbrel Server and Start9

    • It lets you easily manage your phoenixd transactions and leverage the power of Phoenixd for your Bitcoin Lightning wallet needs

  • 00:44:32 Cashu Brrr: Cashu ecash money printer [Github]

    • Print your own ecash notes using either ecash from the same mint or Lightning

  • 00:45:08 SING4SATS: Karaoke: A web client which allows users to request songs to be added to the queue, leveraging LNURL and Fedimod [Github]

Software Releases & Project Updates

  • 00:45:44 Primal v2.0.21

    • Updates:

      • New tab: READS

      • New tab: EXPLORE

      • Feed Marketplace

      • Advanced Search

    • Launch Primal Premium: obtain a Primal name and Nostr tools for power users for $7 per month.

  • 00:47:27 LND v0.18.4rc1

    • The main channel state machine and database now allow for processing and storing custom Taproot script leaves, allowing the implementation of custom channel types

    • A new protocol.simple-taproot-overlay-chans configuration item/CLI flag was added to turn on custom channel functionality

    • Compatibility with bitcoind v28.0 was ensured by updating the version the CI pipeline is running against

    • Performance Improvements: A new method AssertTxnsNotInMempool has been added to lntest package to allow batch exclusion check in itest

  • 00:48:05 Cashu Development Kit v0.5.0

    • This release included support with NUT-17 websockets for the mint as well as many bug fixes and improvements.

      • Add description to MintQuoteBolt11Request

      • Add description to mint_quote

      • Add amount and fee_paid to Melted

      • Add from_proofs on Melted

      • Add unit on PaymentResponse

      • Add description for mint quote

      • Add cache to some endpoints

      • Add Proofs trait

      • Wallet verifies keyset id when first fetching keys

      • NUT18 payment request support

      • Add Wallet::get_proofs_with

      • Mint NUT-17 Websocket support

  • 00:48:36 Phoenix Wallet v2.4.3

    • Redesigned the screen for sending payments: The contacts list and a free-form text input are now displayed first, instead of trying to open the scanner immediately. A button to read QR codes on images stored on disk has also been added.

    • Photos can now be attached to contacts (Android): You can also use an image from your device’s gallery. Photos are stored in the app private folder. Note that on iOS this feature was added in a previous version.

  • 00:48:47 Zeus

    • Wallet v0.9.3-beta1

      • Channel reserve display

      • Bitcoin denominated amounts: display with spaces

      • ZEUS Pay: UX improvements

    • Zeus Pay Update

      • All payments will incur no fee for the receiver (previously 2.5-10% depending on amount)

      • The minimum amount receivable has been lowered to 1 satoshi (previously 10 satoshis)

    • Zeus introduces Zeus White: White glove node management, point of sale, and integrated enterprise solutions for businesses [Announcement]

  • 00:49:56 Nutstash v2.0.1

    • New re-build

    • Multi-mint selection

    • Wallet Backup

    • New Ui

    • Integrated Nostr DM

    • Contact list

    • Zap contacts

  • 00:49:59 Nutshell v0.16.3

    • Mint:

      • bolt11 invoices with different units on the same mint now settle externally via the Lightning network

      • Turn on multipath payments (MPP) by default for LND and CLN

      • NUT-06: Signal alternative URLs to reach the mint from using .env var MINT_INFO_URLS

    • Wallet:

      • Store Lightning invoices in new melt and mint quote tables

      • Sort outputs by amount to mitigate transaction amount privacy leaks

  • 00:50:07 Fountain v1.1.8

    • Add and upvote tracks in the queue

    • Support the artist currently playing

    • Post in the live chat

    • Save tracks to your library

    • Listen to Fountain Radio on other apps

    • Artist Takeovers: Artists can now take control of the music and host a listening party or an AMA

    • Add prompt to share to Nostr after creating a clip

    • Add OPML file explorer

  • 00:50:10 Breez SDK v0.6.4 - Native (Greenlight Implementation)

    • Improve sync performance by moving to an incremental sync

    • Improve trampoline payments reliability and fix fees passed to the trampoline node

    • Add list_swaps API

    • Auto recover network connections after hibernation

    • Stability fixes for trampoline payments

  • Ride-The-Lightning v0.15.4

    • Improve authentication logic for clearer error handling and validation during login and password reset processes

    • Refine application settings handling to ensure stricter validation of access keys

  • 00:50:14 Lnp2pBot v0.11.1

    • Show the previous Status to DISPUTE in dispute message for solvers

    • Add MWK currency

    • Add community stats

  • 00:50:17 BoardWalk Update

    • Add support for Cashu payment requests

    • Add ability to request and send payments for specific amounts

    • All users now have a reusable ecash address to receive payments

    • Use dollars or bitcoin. Perfect for point of sale or tips

  • 00:50:19 Geyser November second release

    • Heroes Hall of Fame: a page that highlights the top projects and heroes driving Bitcoin adoption

    • Ambassadors: users can spread awareness of Bitcoin initiatives and earn recognition for their contributions

    • Hero Link: a unique link for users to share projects and earn points as ambassadors

    • Hero Card: a card displaying user rankings and impact across creator, contributor, and ambassador roles

    • Better Profile Stats: updated profiles now show detailed stats and rankings across all hero categories

  • 00:50:20 Aqua Wallet v0.2.5 - Make AQUA Great Again

    • Phase 1 of UI refresh with new AQUA logo and colors

    • Watch-Only Wallet export for Bitcoin and Liquid

    • Add UTXO filtering to prevent errors when sending back-to-back Lowball transactions

    • Add second guard to prevent double-pay issue with Boltz sends

  • 00:50:47 Clams Remote v2.5.0

    • Add BIP353 support

Nostr

Project spotlight

  • 00:50:52 NDK Mobile: A React Native/Expo implementation of NDK (Nostr Development Kit) that provides a complete toolkit for building Nostr applications on mobile platforms. [Github]

    • Features:

      • Multiple signer implementations (NIP-07, NIP-46, Private Key)

      • SQLite-based caching for offline support

      • Subscription management with automatic reconnection

      • React Native and Expo compatibility

      • React hooks for easy state management

      • NDK Mobile is the library behind Olas and the (upcoming) Honeypot wallet

  • 00:50:55 Olas: An Instagram-like client for iOS and Android [Announcement]

    • “Olas 0.1 provides a feed of videos (like those on flare/highlighter/zap.stream), picture events (kind:20, a new kind that no client had implemented yet) and the classical short notes with images attached we are all used to.” [TestFlight]

  • chachi.chat: A relay-based group chat client for the web [Gitea]

    • “NIP-29 allows creating groups that can be read by anyone or only authenticated users. These groups can be open to new members or require explicit approval from the group admins.” [Note]

  • 00:51:26 Knox: A command-line Nostr bunker built with Deno. [Gitlab]

    • “Knox is a new Nostr bunker CLI for running a NIP-46 remote signer and granting credentials to members of your team”

  • 00:51:32 Nostraut: Automate anything - on nostr

    • Nostraut is a platform designed to automate interactions on Nostr (schedule an event, receive notifications about events, and automatically react to events)

  • 00:51:35 ezdvm: Simple DVM python implementation [Github]

    • Easily run any python code behind a DVM on Nostr. Just pick a kind (for basic text-to-text use 5050) and put the code you want to run in the do_work() function. Then run the DVM.

  • 00:51:40 Futr: A cross-platform nostr client app written in haskell and qt5 [Github]

  • 00:51:45 Nosey: Nosey is a search app for nostr. Focus on supporting features similar to Twitter search directives. [Github]

  • 00:51:49 nos2x for Firefox: nostr signer extension for Firefox [Github]

    • A fork from nos2x by Fiatjaf, focused on Firefox and related browsers.

Software Releases & Project Updates

  • Damus

    • v1.11-10

      • Add Damus Share sheet action

      • Add new easy to use video controls for full screen video

      • Add Edit, Share, and Tap-gesture in Profile pic image viewer

      • Add Apple translation popovers for notes for iOS 17.4+ and macOS 14.4+

      • Allow multiple images to be uploaded at the same time

      • Add support for pasting images from the clipboard to the post composer

      • Add NDB search functionality to the universe view

    • New TestFlight available, with the following features:

      • Improved video controls

      • Stability improvements to video support

      • New image share options on the full screen carousel

      • Hashtag suggestions

  • YakiHonne Update

    • Mobile:

      • Adjust your home feed with what interests you the most

      • Home suggestion box can be enabled and disabled

      • Profile preview can be enabled and disabled

      • Replies can be previewed and highlighted directly

      • Articles, videos and curations can be quoted inside notes for more exposure

      • Add the ability to link connected wallet to your profile for zaps receiving

    • Web:

      • Connected threads: A refined notes thread makes following entire discussions more intuitive

      • Users can now personalize their home feed by selecting their top interests

      • Replies can now be previewed directly from the note card, without needing to open the full note

      • Wallets can now be linked to your account directly from the wallet page

      • Drafts for notes and replies are now saved, allowing easy edits later

      • The suggestions box on the home page can now be hidden

      • Articles, videos and curations can now be quoted and shared as notes

  • Flotilla v0.1.0

    • Remove nip05 login, use nostrconnect instead

    • Add types file

    • Add notification badges

    • Add checked store and set data

  • Pokey

    • v0.1.0

      • Add Mute thread button for notifications

    • v0.0.9

      • Notifications now display NIP05 names if available

  • Oxchat v1.4.1

    • Optimize video player UI with support for landscape mode

    • Add audio configuration in settings

    • Enable copying of ecash tokens from ecash messages

    • Support for media deletion

  • Zapstore v0.1.6

    • Performance: Background loading, remove deprecated

    • Allow sending system info and error report

    • Add Deeplink signer param support

  • Grain v0.2.0

    • Separate YAML Files for Blacklists and Whitelists: Moved the blacklist and whitelist configurations out of the main config.yml and into their own separate YAML files

    • Backup Relay Support: Introduced a new feature to configure a backup relay.

    • Support for Nostr Mutelists: Introduced the ability to consider one or multiple pubkeys’ nostr mutelists as blacklists

    • Configurable Time Constraints: Added new configurations to reject events based on their created_at timestamps

  • OpenLibrarian v0.1.3

    • Add second round of testing (up to 77% coverage)

    • Separate features & updates section

    • Add privacy policy

    • Include alternative secondary API for pulling book covers based on isbn

  • Nostr-PHP v1.5.1

    • Support for PHP 8.4

    • Add id property to Subscription class

    • Update example snippets

    • AllowDynamicProperty in Filter class

  • 00:52:00 GifBuddy Update

    • Add your own gifs with uploads

    • Load more gifs to find what you want

    • Faster gif loading

    • Less memory intensive on the server

Boosts

  • 00:52:30 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @Chris (5,000 sats) “Is there a technical limitation that prevents Coldcard Q from being able to type a note, and export it encrypted with a deterministic encryption key, so that it can only be decrypted on another Q with the same seed AND same passphrase? Thanks!”

    • @podconf (500 sats) “THIS PODCAST IS NONCOMPLIANT”

    • @btconboard (300 sats) “Liana is massively underrated”

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 330

      • Pluggable channel factories: ZmnSCPxj posted to Delving Bitcoin a proposal to make a small set of changes to the BOLT specification to allow existing LN software to manage LN-Penalty payment channels within a channel factory using a software plugin.

      • Signet activity report: Anthony Towns posted to Delving Bitcoin a summary of activity on the default signet related to proposed soft forks available through Bitcoin Inquisition.

      • Update to LNHANCE proposal: Moonsettler posted to Delving Bitcoin and also the Bitcoin-Dev mailing list a proposal for a new opcode, OP_PAIRCOMMIT, to be added to the LNHANCE soft fork proposal that includes OP_CHECKTEMPLATEVERIFY and OP_CHECKSIGFROMSTACK.

      • Covenants based on grinding rather than consensus changes: Ethan Heilman posted to the Bitcoin-Dev mailing list the summary of a paper he coauthored with Victor Kolobov, Avihu Levy, and Andrew Poelstra.

    • 329

      • MAD-based offchain payment resolution (OPR) protocol: John Law posted to Delving Bitcoin the description of a micropayment protocol that requires both participants to contribute funds to a bond that can be effectively destroyed at any time by either participant.

      • Papers about IP-layer censorship of LN payments: Charmaine Ndolo posted to Delving Bitcoin summaries of two recent papers about reducing the privacy of LN payments and potentially censoring them.

News & Noteworthy (cont.)

Bitcoin

  • 00:55:05 Chaincode Labs launches the 2025 edition of its BOSS (Bitcoin Open-Source Software) program, a free, three-month program focused on Bitcoin and Lightning open-source software development [Website]

    • The program runs from January to April 2025. Applications close on December 31, 2024.

Lightning + L2+

  • DLC Markets has transitioned from signet to mainnet, offering a secure, non-custodial Bitcoin derivatives platform. [Blog post]

    • Using Discreet Log Contracts and innovative features like Rust-based oracles and WebAssembly, it improves OTC trading efficiency.

  • Boltz integrates Rootstock swaps with the Lightning Network, enabling users to seamlessly move funds between the two networks. [Announcement]

Nostr

  • 00:55:49 Private and ad-free pay-per-query search engine Kagi HQ, joins Nostr [Note]

Business & Finance

  • 00:57:06 Block, Inc. announces Proto, a suite of bitcoin mining products and services aimed at decentralizing hardware supply and enhancing network resiliency [Press release]

    • Its focus spans ASIC chips, mining rigs, and developer tools for diverse applications like home mining and energy reuse.

  • 00:57:11 Casa introduces Casa Enterprise, a specialized product designed to help businesses securely manage their bitcoin treasuries through self-custody solutions. [Blog post]

  • 00:57:30 Swan Bitcoin sues former legal firm for conflict of interest in Tether case [The Mining Pod]

    • Swan Bitcoin files a lawsuit against its former legal firm, Gibson Dunn & Crutcher, alleging breach of fiduciary duty and attorney malpractice. Swan claims Gibson Dunn created a conflict of interest by representing Tether in a competing case.

Tradfi

  • 00:57:46 Revolut’s cryptocurrency exchange, Revolut X, expands to 30 European countries after successful UK launch. [Coin Desk]

  • 00:57:58 Private investment firm, Newmarket Capital, launches Battery Finance: Bitcoin-collateralized loan strategy. CEO explains bitcoin-backed private credit strategy on CNBC

Funding

  • 00:58:06 OpenSats announces:

    • Long-term support for m1sterc001guy for his continued contributions to the Bitcoin ecosystem.

    • Third wave of education grants, dedicated to advancing Bitcoin literacy and community development across the globe:

      • BTC Map

      • Yes Bitcoin Haiti

      • Entropy Bitcoin Education

      • Bitcoin 4all

    • Doubling down on Nostr, with additional grants to:

      • Damus

      • Gossip

      • nostr.build

      • nostr-sdk-ios

      • ngit & gitworkshop

      • nostr-relay (-nestjs, -tray)

      • Nostrocket

      • DVMDash

Mining

  • 00:58:12 Russia bans winter digital currency mining in Siberia, North Caucasus, and occupied Ukraine to address energy shortages [The Moscow Times]

    • The ban affects specific areas from December 1, 2024, to March 15, 2025, with annual restrictions in Siberia until 2031 and total bans in other regions.

Privacy

  • 00:58:40 U.S. Congress critiques Tornado Cash and urges for stricter regulations [The Rage]

    • Seven U.S. Congress members urge the Treasury to finalize regulations on cryptocurrency mixers like Tornado Cash, citing misuse for laundering, terrorism, and sanctions evasion.

  • 00:58:44 Chinese government employees with access to vast surveillance systems are profiting by selling citizen data to private brokers [Wired]

    • Brokers resell information ranging from phone numbers and bank details to encrypted passwords. Researchers reveal that even restrictions on accessing officials’ data are easily bypassed.

  • 00:59:20 Mullvad VPN cancels remaining PayPal subscriptions in order to reduce stored customers’ data and aligns with privacy-focused policy. [Announcement]

    • Users can still make one-time payments, including via PayPal, and will receive a notification from PayPal but retain unused account time.

Protocol

  • Bitcoin Core #30239: Introduces a standard for ephemeral dust outputs, enabling zero-fee transactions with dust outputs to be included in the mempool. [Merged]

  • Bitcoin Core #30930: Introduces a new peer services column in the netinfo command and an “outonly” filter to display only outgoing connections. [Merged]

  • Bitcoin Core #30592: Removes the option to disable full Replace-by-Fee (RBF) and revert to opt-in RBF [Merged]

  • Core Lightning #6980: introduces a splice command that supports either a JSON payload or a splice script. This command facilitates complex splicing actions and combines multiple channel operations into a single transaction. [Merged]

  • LDK #3283: Support paying directly to Human Readable Names using bLIP 32: introduces compatibility with BIP353 by enabling Bitcoin payments to use DNS-based human-readable addresses. [Merged]

  • NIP #1578: nip46: simple public key login using kind:10046 [Open]

  • NIP #1605: Kind-scoped follow: A way of following one or multiple kinds that are of interest [Open]

  • NIP #1587: Time-ordered event ids: Implementing temporal locality in primary keys, inspired by UUIDv7, increases the database efficiency by reducing memory usage and data rearrangement. [Draft]

Cryptography

  • 1:00:59 Two mathematicians discovered an elliptic curve of rank 29, breaking an 18-year-old record. This rank measures the complexity of rational points on the curve. [Quanta Magazine]

    • Their finding highlights unresolved debates in mathematics, including whether there is an upper limit to elliptic curve rank, which remains unproven.

Government & Political

  • Shanghai’s Songjiang People’s Court clarifies that personal ownership of bitcoin is legal in China under property laws, despite restrictions on commercial activities. [South China Morning Post]

  • Polish Presidential candidate Sławomir Mentzen commits to establishing a Strategic Bitcoin Reserve if elected in 2025. [Twitter post]

  • Pennsylvania is considering a bill, the Strategic Bitcoin Reserve Act, which would allow the state to invest up to 10% of its $7 billion treasury in Bitcoin. [Atlas21]

  • U.S. SEC Chair Gary Gensler announces his resignation, effective January 20, 2025, after serving since 2021. [Twitter post]

  • Five-year sentence for Bitfinex hacker Ilya Lichtenstein following $3.6 billion (120,000 units) bitcoin theft [Press release]

  • Federal agents raid Polymarket CEO’s home, seizing electronic devices. Polymarket is under DOJ scrutiny for allegedly allowing U.S. users to access its platform despite prior restrictions. [CoinDesk]

Events

  • 1:01:22 SATS’N’FACTS: Bitcoin Technical Unconference

    • First edition conference diving into Scalability, Mining, Payments, Infrastructure, and much more.

    • February 8—10, 2025 in Chiang Mai, Thailand

  • 1:01:26 Hackalajara: Guadalajara’s first bitcoin-focused hackathon

    • November 29-December 1, 2025 in Guadalajara, Mexico

  • 1:01:39 Bengaluru BITDEVS: BitDevs Summit

    • Day-long gathering of Bitcoin and open-source contributors showcasing their cutting-edge work in panels, demos, and talks.

    • November 30, 2024 in Bangalore, India

Reads

  • 1:01:46 Here’s a list of our top recently published reads:

    • High Risk, Low Reward, by Tony Giorgio [Blog post]

    • Boost Your Bitcoin Node Sync With UTXO Snapshots, by Jameson Lopp [Blog post]

    • Bitcoin Core’s Loss of Focus, by Jamesob [Twitter post]

    • Analysis of the Crypto Policy Landscape Following the Elections, by Coin Center [Blog post]

    • How decentralized is Bluesky really? by Christine Lemmer-Webber [Blog post]

    • Bitcoin Dev Project’s guide on how to sign a MuSig transaction [Guide]

    • Does Sovereign Default Risk Explain Cryptocurrency Adoption? International Evidence from Mobile Apps [Research paper]

    • Bitcoin Under Volatile Block Rewards: How Mempool Statistics Can Influence Bitcoin Mining [Research paper]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR087 - ColliderScript, BTCPay Server, OpenSecret, Matrix, Lottie player JS Attack, the Bullish Case for Vaults, LN Payment Censorship , EmailBTC, secp256k1-node vulnerability + MORE ft. Justin & Paul]]>https://substack.bitcoin.review/p/br087-colliderscript-btcpay-serverhttps://substack.bitcoin.review/p/br087-colliderscript-btcpay-serverWed, 13 Nov 2024 21:34:19 GMTI’m joined by guests Justin Moon & Future Paul & to go through the list.

Listen on your favorite podcast app

Quote of the Day

00:00:48 “Nobody knows anything.”

Housekeeping

Urgent Vulnerability Disclosures

  • 00:06:26 Critical severity: Private key extraction vulnerability in secp256k1-node affecting ECDH [Security advisory]

    • A vulnerability in the secp256k1-node library’s ECDH functionality allows private key extraction by exploiting specific crafted public keys, affecting versions 3.8.0 and earlier.

    • Attackers can retrieve private keys using low-order curve points through only 11 ECDH sessions.

  • 00:08:01 Medium severity: Disclosure of hindered block propagation due to stalling peers [Public disclosure]

    • Before Bitcoin Core v25.1, a vulnerability allows an attacker to delay block downloads by stalling peer nodes. The affected node waits up to 10 minutes before attempting another block download, leading to possible network degradation and mining delays.

Bitcoin

Software Releases & Project Updates

  • 00:08:40 Bitcoin Core v27.2

    • net: fix race condition in self-connect detection

    • init: change shutdown order of load block thread and scheduler

    • RPC: Fix cases of calls to FillPSBT errantly returning complete=true

    • psbt: Check non witness utxo outpoint early

    • test: fix constructor of msg_tx

    • ci: move ASan job to GitHub Actions from Cirrus CI

    • ci: remove unused bcc variable from workflow

  • 00:09:11 Electrs v0.10.7

    • Support testnet4

    • Enable LTO in release build

    • Don’t sync mempool when bitcoind mempool is not yet loaded

  • 00:10:22 BTC Pay Server

    • v2.0.2

      • Critical vulnerability disclosure for Nostr or Blink plugin users: Without it, an attacker with access to a pull payment could drain the Lightning wallet without limit.

    • v2.0.0

      • New feature:

        • Interface localization

        • New sidebar navigation

        • Improved onboarding flow

        • Improved branding options

        • Support pluginable rate providers

        • User: Add name and profile picture

        • Greenfield: Manage notifications

        • Greenfield: Add file endpoints and upload

  • 00:11:57 libsecp256k1 v0.6.0

    • Added:

      • New module musig implements the MuSig2 multisignature scheme according to the BIP 327 specification. See:

        • Header file include/secp256k1_musig.h which defines the new API

        • Document doc/musig.md for further notes on API usage

        • Usage example``examples/musig.c`

      • New CMake variable SECP256K1_APPEND_LDFLAGS for appending linker flags to the build command

    • Changed:

      • API functions now use a significantly more robust method to clear secrets from the stack before returning

      • Any type secp256k1_foo can now be forward-declared using typedef struct secp256k1_foosecp256k1_foo

      • Organized CMake build artifacts into dedicated directories to improve build output structure and Windows shared library compatibility

  • 00:14:18 Bitcoin Keeper

    • Mobile v1.2.18

      • Select Electrum servers during app setup

      • Add support for TwentyTwo’s Portal

      • USB option enabled for Coldcard and Jade via the desktop app

      • TAPSIGNER - Verify initial status and backups count

      • Receive screen now enables multiple addresses management and address labeling

      • Send experience overhauled

      • Major design updates to UTXO management and transaction details

    • Desktop v0.1.3

      • Support Trezor Safe 5 and Ledger Stax and Flex (updating HWI to 3.1.0)

      • Fix unlocking Jade on testnet

  • 00:14:56 Liana v8.0 - A Template Haven

    • Liana daemon/library: A new field last_poll_timestamp was added to the wallet table in order to track the last time the wallet was updated by the poller

    • Liana GUI:

      • The new Bitcoind 28.0 version is now downloaded by the GUI

      • Bitbox02 devices can now be part of a Taproot descriptor set-up if their firmware version is greater than or equal to 9.21.0

      • The install process now includes examples of setups with fixed templates and explanatory descriptions to guide the user

      • Hardware wallets with the app not open had a confusing warning message about outdated version

      • Button for the pagination of past transactions was sometimes missing because of a wrong calculation of the page size

      • Resend authentication token request did not work for already created account

  • 00:17:30 Bitcoin Safe

    • v1.0.0b3

      • Enable exporting of diagrams in SVG format for better quality and scalability

      • Add a portable exe for Windows

      • Users can now open file TX, PSBT, and wallet files directly via file associations

    • v1.0.0b2

      • Add German Language

      • Add GIF export for animated QR codes

      • Sync tab, which allows chat, synchronization and backup of labels, is now called SyncTalk

  • 00:20:08 RoboSats

    • v0.7.2

      • Improve recovery robot form

      • Fast generate robot -> fast generate order

      • Add Nostr order books

      • Add coordinator Alias to invoice description

    • v0.7.1

      • Multiple performance improvements

      • Better and faster web notifications

      • Add Android notification disable button

      • Remove Experimental and Satstralia coordinators

  • 00:21:10 Bitkey Firmware v1.0.91

    • Faster transaction signing: Hardware now signs transactions up to 5x faster

  • 00:21:20 Raspiblitz v1.11.3

    • Optimized to run on plain Debian 12 Linux for Proxmox/VM and x86 systems

    • Add Publicpool for solo mining

    • Add Telegraf for Grafana monitoring

    • Add Tailscale

    • Connect Zeus to CLN via CLNrest

  • 00:21:37 ESP-Miner v2.3.1b1

    • Re-work how we publish artifacts when releasing new builds

    • Use the same espressif/idf release for github and vscode

    • Add all in one factory file script

    • Replace default address with a prompt

  • 00:22:14 BoltzExchange

    • boltz-client v2.2.0 - Offer accepted

      • Add Bolt12 support for submarine swaps

      • Add support for amountless chain swaps

    • boltz-web-app v1.5.0

      • Add Bolt12 support for submarine swaps

      • Implement Discount CT

      • Fetch BIP-353 with DNSSEC prover

      • Validate invoices fetched for offers

      • Add Ledger and Trezor support

      • Hardware custom derivation paths

      • Loading indicator for wallet selection

      • Remember custom derivation paths for swaps

      • Show EVM lockup transactions

    • boltz-backend v3.8.0 - An offer you can’t refuse

      • Support for a new CLN hold invoice plugin rewritten from scratch with a focus on performance

      • Amounts for Chain Swap can be renegotiated in case they are over- or underpaid. Also, the creation of Chain Swaps without an amount

      • Paying BOLT 12 invoices in submarine swaps and an API endpoint for fetching invoices for offers

Project spotlight

  • 00:22:21 Frost: A flexible, round-optimized threshold signature library for BIP340 taproot [Github]

  • 00:23:12 ColliderScript: Covenants in Bitcoin via 160-bit hash collisions [Research paper]

    • The paper introduces a method for enforcing covenants on Bitcoin outputs using hash collisions in SHA-1 and RIPEMD-160, allowing covenants without Bitcoin protocol changes.

  • 00:27:44 GreatRSI: Great Restored Script Interpreter [Github]

    • The repository contains an experimental partial interpreter for the Great Script Restoration, a proposal aimed at re-enabling and refining Bitcoin script opcodes.

    • It also provides an implementation of the Winternitz One-Time Signature scheme (W-OTS) in Bitcoin Script, written in Bitcoin Script using the Great Script Restoration.

  • 00:28:16 Boltzmann TS monorepo: A Typescript library computing the entropy of Bitcoin transactions and the linkability of their inputs and outputs. [Github]

  • 00:28:55 Bitcoin hackerspace and community accelerator PlebLab, launches PlebDevs, a new Bitcoin developer education platform built on Lightning and Nostr. [Announcement]

  • 00:29:51 SatSale: A lightweight Bitcoin payment processor with the option of connecting to your own Bitcoin node or Lightning network node [Github]

    • Lightweight Bitcoin payment processor written in easily deployable Python.

  • 00:31:58 EmailBTC: Send Bitcoin to anyone that has an email address [Contract repository]

    • No wallet is needed to use the service, send Bitcoin to any email.

Vulnerability Disclosures

  • 00:33:21 XSS attack: Lottie player JS, a popular open-source npm package for web players, was compromised with a wallet drainer, impacting projects such as nostr client Primal and DeFi platform 1inch [Github issue]

    • “Blockchain threat monitoring platform Scam Sniffer reports that at least one victim allegedly lost $723,000 worth of Bitcoin (10 bitcoin) due to the LottieFiles supply chain compromise.” [Bleeping Computer]

  • 00:38:38 Hackers misuse emergency data requests to access user data [TechCrunch]

    • Hackers gain access to user data by exploiting emergency data requests using hacked law enforcement email accounts to bypass usual warrant requirements. They misuse legitimate communication channels to pose as police and request private information from tech companies.

  • 00:41:15 Tor relays targeted in IP spoofing campaign causing widespread disruptions [Blog post]

    • A recent IP spoofing attack targeted the Tor network, impersonating non-exit relay IPs to trigger abuse complaints and temporarily disrupt operations. Although no Tor users were affected, relay operators faced hosting issues due to unwarranted blocklists.

  • 00:41:22 Critical zero-click flaw exposes Synology storage devices to ransomware and data theft [Wired]

    • Security researchers reported that attackers could bypass authentication through Synology’s QuickConnect service, which lets users remotely access their devices. Even if not directly connected to the internet, many devices are still exploitable.

  • 00:42:03 Hidden Risk: North Korean hacker group BlueNoroff, deploy a new macOS malware campaign, targeting cryptocurrency firms. [Bleeping Computer]

    • The attacks use phishing emails disguised as crypto news to lure victims, and employs a persistence technique by modifying the “.zshenv” file, allowing it to evade macOS detection systems.

  • 00:44:45 Five dollar wrench attacks:

    • Targeted break-in: Bitcoin host and narrator Guy Swann reflects on the break-in which happened at the Lugano Plan B conference, where an intruder entered his hotel room, likely aiming to find valuables often associated with Bitcoiners [Twitter post]

    • A 23-year-old Ukrainian tourist visiting Phuket was ambushed in his friend’s hotel room by armed men. The attackers, threatening to break his fingers, demanded $500,000 in digital currency. [Bangkok Post]

      • The tourist transferred 250,000 USDT, after which the robbers left without harming him. He later reported the incident to authorities.

    • A Toronto cryptocurrency CEO, Dean Skurka, was kidnapped and held for ransom in a daylight incident. The kidnappers forced him into a vehicle downtown and demanded a $1 million ransom, which was later paid, leading to Skurka’s release. [CoinDesk]

    • A gunman fatally shoots Antônio Vinícius Lopes Gritzbach, a cryptocurrency businessman, and injures three others at São Paulo’s international airport. Police link the attack to the First Capital Command (PCC), a powerful Brazilian crime syndicate. [The Guardian]

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 00:52:50 Reticulum MeshChat v1.13.2

    • Add bandwidth and spreading factors for 2.4GHz SX1280 RNode interfaces

    • Add the ability to select Direct, Opportunistic or Propagated delivery methods before sending a message

  • 00:53:14 Matrix v2.0

    • Instant login, instant launch, and instant sync (aka Simplified Sliding Sync, MSC4186)

    • Next Generation Auth (aka Native OIDC, MSC3861)

    • Native Matrix Encrypted Multiparty VoIP/Video (aka MatrixRTC, MSC4143)

    • Invisible Encryption (MSC4153 & friends)

Lightning + L2+

Project spotlight

  • 00:54:52 Podcaster Boost Dashboard: Convert core-lightning’s listinvoices output to a podcasting 2.0 dashboard [Github]

    • “This is a simple Python script that converts core lightning’s listinvoices output into a podcasting 2.0 dashboard.”

  • 00:55:06 zPay.live: Monetise virtually any digital content with Lightning paywalls

    • A LN Paywall service that recently shifted its focus to the V4V model, and plans to implement the following features:

      • CrowdWall: When a target is reached, content unlocks for everyone

      • V4V Paywalls (Flexible price) : Buyers can choose their own price, & creators can set limits if they want

      • Blossom built-in storage & multiple file/folder upload option

  • 00:55:14 BullishNuts: A bullish Cashu PWA wallet [Github]

  • 00:55:19 Athenut: A privacy-preserving web search powered by Kagi and Cashu [Github]

    • The service includes an integrated Cashu wallet and offers a privacy-friendly pay-per-query web search engine using bitcoin through the Kagi API.

    • Payments are processed with locked ecash in the X-Cashu HTTP header, linking search and payment in one step.

  • 00:55:33 TinyPine: A simple LN and CASHU ecash POS system for merchants [Github]

Software Releases & Project Updates

  • 00:55:41 Fedimint

  • 00:56:34 Zeus v0.9.2-rc2

    • Activity: Export transaction history to spreadsheets

    • Improved BIP-353 and BOLT 12 support

      • Fix UI issues indicating BOLT 12 support

      • Fall back to BOLT 11 lightning address if not supported or not found

      • Support BIP-353 on-chain addresses

      • Support BOLT 12 offers encoded in BIP-21 URIs

    • Spooky theme

    • Settings: Payments: add ‘Slide to Pay’ threshold

    • Hardware wallet and external signer improvements

  • 00:58:19 Alby Go v1.7

    • LNURL-withdraw support

    • Improve currency selection

    • Boostagram info in transaction details

  • 00:58:28 Ride-The-Lightning v0.15.3

    • Add support to send payments for AMP invoices on LND

    • Add mempool information on on-chain Send Funds modal

    • Add Fee Rate Information on Send Funds Modal

  • 00:58:37 CLBOSS v0.14.1-rc2 - Hand at the Grindstone

    • Add --lightning-dir option to the contrib scripts

    • Add Nix Support: introduce contrib-shell.nix to facilitate running contrib scripts within Nix environments

  • 00:58:40 Nutshell v0.16.1

    • Add support for LND via gRPC for LndRPCWallet

    • NUT-15 Multinut payments for CLNRestWallet

    • Stability improvements

  • 00:59:00 Geyser November 2024 - Email Enhancement

    • Creators can now:

      • Choose between 9 different types

      • Link Posts to Rewards and Goals

      • Link posts to Goals

      • Send Posts by email

    • All Posts have been migrated to Markdown from Rich Text Editor

  • 00:59:24 Clams Remote v2.4.0

    • Add UI for BOLT12 Prism plugin

Nostr

Project spotlight

  • 00:59:36 SnapNostr: Create clean, customizable screenshots of Nostr posts for seamless sharing [Github]

    • “SnapNostr is an open-source web app designed for Nostr enthusiasts inspired by poet.so. It allows users to create visually appealing, customizable screenshots of Nostr posts. With a focus on simplicity and a clean user experience.”

  • 00:59:42 OpenLibrarian: A website for tracking and sharing a love of books [Github]

    • OpenLibrarian utilizes the Nostr protocol and allow users to bring their profile and connections, or leave to other applications on the network

  • 00:59:49 Jumble: Yet another nostr desktop client [Github]

    • Originally a feature of the nostr-relay-tray project, Jumble is now a standalone application with:

      • Relay-Based Browsing: Explore content directly through relays without following specific users

      • Relay-Friendly Design: Minimized and simplified requests ensure efficient communication with relays

      • Relay Groups: Easily manage and switch between relay groups

  • 00:59:54 Honeypot: A “multiple wallets, multiple currencies” project by PABLOF7z [Note]

  • 1:00:00 Mutestr: Live Nostr muted list monitor

    • “Monitor Nostr muted lists in real-time. Check who muted you, track mute list changes, and explore muting patterns across the Nostr network.”

  • 1:00:08 Nostr Gadgets: High-level utils for developing Nostr clients based on nostr-tools [Github]

  • 1:00:16 Mostro Tools: Typescript Mostro library for developing Mostro clients [Github]

Software Releases & Project Updates

  • NDK v2.10.5

    • Fix reconnection bug

  • Rust nostr v0.36.0

    • Reduced atomic operations and switched to async concurrency

    • Add NostrSigner trait, better methods and struct names

    • Add LocalRelay and allow to easily serve it as hidden onion service with the embedded tor client

    • Allow to keep track of negentropy sync progress, almost halved the weight of JavaScript SDK bindings

  • Primal Miljan’s Note

    • “Primal feeds are now available on Amethyst, Nostrudel, and any other Nostr client that supports DVM feeds. Yeah. We have a functional feed marketplace on Nostr.”

  • Lume

    • v24.11.8

      • Add Sync All via Negentropy to Settings

    • v24.11.7

      • Use NIP22 for comment

    • v24.11.5

      • Add DVM feeds

    • v24.11.4

      • Allow user enter custom relay for relayfeeds

    • v24.11.0

      • Support multi accounts

      • Add discover newsfeeds column

      • Add discover interests column

      • Add relay viewer column

  • Mostro v0.12.8 - b4os

    • Relays scheduled job publish only connected relays

    • Rabbit insipired unwrap removal

    • Implement request_id on mostro messages

    • Trick to avoid getting older events republished

    • Optional request id

    • Avoid sending unsolicited request-id

  • YakiHonne v2.0

    • Onboarding: add create a non-custodial wallet with Npub & Nsec, experience zapping, or browse as a guest

    • Home & Discover: “Discover” is designed for creators, focusing on rich formats like long-form content, videos, and curated works

    • Wallet: Simple setup with easy creation, direct YakiHonne node linking, and multi-wallet support

    • Dashboard: Manage all published and drafted content, check stats, and pick up right where you left off—all in one place

    • Notifications: Reactions, Reposts, Mentions, Zaps, Comments, and Follows now appear in clear, categorized cards

  • Haven v1.0.0

    • Allow gift wrapped messages in chat relay

    • Remove kind 4 support

    • Add support for configurable binding address

    • Add gcp bucket backup

    • Add delete to inbox relay

    • Blossom Support

  • Pokey

    • v0.0.6

      • Publish inbox relay lists

      • You get a notification when your inbox list is too big

      • Better relay authorization

    • v0.0.5

      • Zaps now display more info

      • Relay list manager

      • Configuration tab

      • Disable event device broadcast

    • v0.0.4

      • New follow notification

      • NIP-42 Auth to Relays

      • Broadcast your inbox events to other apps in your device

  • Oxchat v1.4.0

    • Enhance UX for a Telegram-like experience

    • Update message and calling sounds

    • Add support for CashuB tokens in Cashu wallet

    • Add support for input_fee_ppk in Cashu wallet

    • Add compatibility with Android 9

    • Enable support for kind 15 encrypted file messages

  • Kyoto v0.5.0

    • Client may fetch a Header at a particular height

    • Support for Testnet4 with new example

  • Citrine v0.5.5

    • Only store 1 replaceable event

    • Temporally remove the restore contacts feature

  • Nostr-PHP v1.5.0

    • Add NIP-42 support for client to relay authentication within the library

    • Set generic tags on filter for requestMessages + websocket client to relay improvements

  • Keychat v1.20.3

    • Set room relays

    • Change sentry to firebase

  • Fountain v1.1.6

    • New Audio APIs

    • New Performance Upgrades

    • Add Nested Navigation

  • Nak v0.7.9

    • Build arm binary for Raspberry Pi 32bit

Boosts

  • 1:08:57 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @Ape Mithrandir (2,112 sats) “Not long enough, was still awake at the end”

    • @btconboard (1,000 sats) “Great pod”

    • @VonPhoto (1,000 sats)

    • @AVERAGE_GARY (100 sats) “Red/green colorblind. Rekt from @NVK’s trading advice.”

Tech Tips of the Day

  • 1:10:45 LocalSend: An open-source cross-platform alternative to AirDrop [Github]

    • LocalSend enables secure communication between devices using a REST API and HTTPS encryption, and doesn’t require an internet connection or third-party servers.

  • 1:10:54 Disable 2G mobile connectivity for iPhone devices using Lockdown mode, helping protect against downgrade attacks from IMSI catchers or fake cell towers that exploit GSM vulnerabilities. [HaxRob’s Twitter thread]

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 328

      • Disclosure of a vulnerability affecting Bitcoin Core versions before 25.1: Antoine Poinsot announced to the Bitcoin-Dev mailing list the final vulnerability disclosure predating Bitcoin Core’s new disclosure policy.

    • 327

      • Timeout tree channel factories: ZmnSCPxj posted to Delving Bitcoin and discussed with Optech contributors a proposal for a new multi-layer channel factory design named SuperScalar.

      • Draft BIP for DLEQ proofs: Andrew Toth posted to the Bitcoin-Dev mailing list a draft BIP and a link to an implementation for generating and verifying proofs of discrete log equality (DLEQ) for the elliptic curve used by Bitcoin (secp256k1).

News & Noteworthy

Bitcoin

Lightning + L2+

  • 1:12:38 Charmaine Ndolo and Florian Tschorsch publish Payment Censorship in the Lightning Network Despite Encrypted Communication

    • The research identifies that a network-level adversary, like an autonomous system (AS), can censor payments in the Lightning Network. The attack would leverage network-level information, including TCP headers, to track and interfere specifically with LN payment messages.

    • The study demonstrates that an AS can detect and delay specific payment messages without affecting other LN operations, allowing plausible deniability.

  • 1:14:01 Blockstream opens its newest research center in Lugano, Switzerland, focusing on Liquid and Lightning network advancements [Note]

  • 1:14:05 CasaOS integrates Alby Hub, a self-custodial lightning wallet and lightning network node [Announcement]

Business & Finance

  • 1:14:46 Block refocuses on bitcoin mining equipment and Bitkey, reduces investments in Tidal and shutdowns TBD, Block’s decentralized Web5 project [CoinDesk] [Shareholder letter]

  • 1:15:49 Fold App introduces insured deposits [Press release]

    • The feature allow users to deposit and receive bitcoin into an “institution-grade cold storage custody”, insured up to $250M.

  • 1:16:33 Strike introduces Bitcoin auto-withdrawals [Announcement]

  • European Bitcoin store ShopinBit launches in Switzerland [Announcement]

  • 1:18:52 Ten31 launches Bitcoin Alpha, its new podcast

  • 1:19:13 CleanSpark finalized its acquisition of GRIID Infrastructure, a Bitcoin mining infrastructure provider, for $155 million [PR Newswire]

Nostr

  • 1:19:25 Nos.social is now live in Australia and New Zealand [Announcement]

    • “Complete with an updated onboarding workflow designed to help new users understand keys, find people to follow, and create their first post.”

Hyperbitconization

  • UK pension scheme incorporates bitcoin in asset allocation strategy [Press release]

    • Cartwright has advised a UK pension scheme to allocate 3% of its portfolio to bitcoin, a pioneering step for the industry

  • Detroit plans to become the largest U.S. city to accept Bitcoin and cryptocurrency for taxes and fees by mid-2025 [TFTC]

    • This initiative, supported by PayPal’s secure platform, aims to improve payment accessibility, especially for unbanked citizens. [Press release]

Funding

  • 1:19:32 OpenSats announces its Eighth Wave of Nostr Grants, directed at five projects:

    • Formstr

    • Groups

    • Coop

    • Nostrability

    • NIP-44 Libraries Audit

Mining

  • 1:20:23 Deutsche Telekom’s subsidiary, MMS, collaborates with Bankhaus Metzler to pilot “Digital Monetary Photosynthesis”, a Bitcoin mining initiative to manage surplus energy and stabilize Germany’s power grid. [Press release]

Privacy

  • 1:20:38 British activist and journalist Tommy Robinson, was sentenced to 18 months in prison after failing to unlock his phone for police under the Terrorism Act during a stop at the Channel Tunnel in July [Zero Hedge]

  • 1:20:47 Former TD Bank anti-money laundering employee, is indicted for unlawfully distributing customers’ personal identifying information on Telegram [Press release]

    • Evidence shows Sewell collected data from over 70 customers, including images of 255 checks, and advised accomplices on account-opening to deposit the checks, profiting from shared proceeds.

  • 1:21:02 Kenya to require incoming passengers to declare phone IMEI numbers from 2025 [Android Kenya]

    • Starting January 1, 2025, travelers entering Kenya must declare all mobile phone IMEI numbers via the F88 passenger form.

  • 1:21:09 Apple adds “inactivity timer” feature in iOS 18.1 that reboots iPhones after prolonged inactivity [404 Media]

    • Researchers confirm the feature shifts iPhones from “After First Unlock” to the more secure “Before First Unlock” state, where standard forensic tools struggle to extract data.

Protocol

  • 1:22:16 Ren Crypto Fish, Steve Lee and Lyn Alden publish Analyzing Bitcoin Consensus: Risks in Protocol Upgrades

    • The paper examines the evolution of Bitcoin’s consensus mechanisms and potential risks involved in future protocol upgrades from both economic and technical perspectives. It outlines historical trends, changes, and contentious periods in Bitcoin’s consensus development since 2009. [Github]

  • 1:25:30 BIPs #1676: Updates the status of BIP85 to final, as it is now widely deployed and has reached a point where breaking changes are no longer introduced. This decision follows the recent merging and subsequent reversion of a breaking change. [Merged]

  • 1:25:47 LDK #3207: Adds the ability to include invoice requests in the async payments’ onion message when paying static BOLT12 invoices as an always online sender. [Merged]

Government & Political

  • 1:26:05 U.S. Department of Justice charges AurumXchange operator with laundering funds linked to Silk Road [Coin Telegraph]

    • The DOJ accuses the former operator of AurumXchange, of laundering over $30 million, including funds from the Silk Road darknet marketplace. He allegedly failed to register with the U.S. Treasury and neglected AML requirements, processing transactions without proper oversight.

  • 1:26:12 Bitcoin Fog alledged operator, Roman Sterlingov, has been sentenced to 12.5 years in prison for money laundering conspiracy [DoJ Press release]

  • 1:26:34 Argentina’s central bank hosts a live Bitcoin mining art exhibit titled “Art, Artificial Intelligence, and the Future of the Economy” by Alberto Echegaray, becoming the first central bank to publicly mine bitcoin [Bitcoin News]

  • 1:26:50 BIS to leave cross-border payments platform Project mBridge Reuters

    • Project mBridge, launched in 2021 with central banks from China, Hong Kong, Thailand, and the UAE, was joined by Saudi Arabia in June. Despite reaching the “minimum viable product” stage, BIS General Manager Carstens emphasized that it is not yet ready to begin operations and will require many more years of development.

  • 1:26:56 Sovereignty concerns arise over digital euro as European Union and European Central Bank debate control [Politico]

    • The digital euro project has sparked tension between EU governments and the ECB over control and authority. Countries like France and Germany express concerns about ECB overreach, fearing that its control over digital wallet limits could threaten the banking sector’s stability.

Events

  • 1:27:22 Btc Hel: The first ever large scale bitcoin conference in the Nordics.

    • August 15-16, 2025 in Helsinki, Finland

Reads

  • 1:27:46 Here’s a list of our top recently published reads:

    • On Ossification by Jameson Lopp [Blog post]

    • Quantum Computing: Between Hope and Hype by Scott Aaronson [Blog]

    • Analyzing Bitcoin Consensus: Risks in Protocol Upgrades by Ren Crypto Fish, Steve Lee and Lyn Alden [Github]

    • Why I’m Betting Big on Nostr by Hivemind Ventures [Blog]

    • The case against edits by Fiatjaf [Note]

    • Digital Gold: Evaluating a Strategic Bitcoin Reserve for the United States by Bitcoin Policy Institute [Research paper]

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR086 - Electrum, Wasabi, Bitkey, Bitcoin Safe, Spark, Bitcoin Keeper, OP_CAT Privacy, FROST X nostr, btcd FindAndDelete bug + MORE ft. Rijndael & Ben]]>https://substack.bitcoin.review/p/br086-electrum-wasabi-bitkey-bitcoinhttps://substack.bitcoin.review/p/br086-electrum-wasabi-bitkey-bitcoinThu, 31 Oct 2024 21:07:59 GMTI’m joined by guests Rijndael & Ben Carman to go through the list.

Listen on your favorite podcast app

Housekeeping

Urgent Vulnerability Disclosures

  • 00:02:08 Disclosure of CVE-2024-38365: btcd FindAndDelete bug [Public disclosure]

    • “Btcd prior to version 0.24.2 4 does not correctly implement the consensus rules for legacy signature verification. The incompatible behavior can be triggered by a standard transaction, making it possible for anyone to fork off vulnerable btcd nodes at virtually no cost.”

  • 00:05:32 Disclosure of CVE-2024-35202: Remotely reachable assertion crash in Bitcoin Core <v25.0 [Public disclosure]

    • A high severity vulnerability in Bitcoin Core allowed attackers to remotely crash nodes by triggering an assertion in the blocktxn message handling logic.

    • Attackers could exploit the vulnerability without needing to trigger collisions, as they could simply include transactions not committed to in the block’s merkle root.

  • 00:06:54 Krux: A bug in Krux beta versions 24.10.beta6 to beta8 affects BIP85 password generation [Announcement]

    • Users should record and replace passwords created in these versions, as they may be incorrect

    • Version 24.10.beta9 contains a fix, and users are recommended to wait for the official release

  • 00:07:32 Nostr client Coracle has been unintentionally sending user session data to Bugsnag when reporting errors [Holdbod’s note]

    • An error reporting misconfiguration in Coracle has sent users’ session data, including private keys, to Bugsnag since December 5, 2023. Affected users include those who triggered an error while signed in with their private key.

    • A new Coracle version has been released, affected APKs have been deleted, all Bugsnag data has been erased and the Bugsnag project was deleted to ensure no further exposure.

Bitcoin

Software Releases & Project Updates

  • 00:11:00 Electrum

    • v4.5.7

      • General: new: add new historical exchange rate providers: Bitfinex and Bitstamp servers with weird TLS certs. As workaround, set pre-3.13 behaviour

      • Lightning: fix: send update_fee right away after channel_reestablish

      • Qt Desktop GUI: fix: show fee warnings also in the transaction dialog (c4fe2796)

    • v4.5.6

      • General:

        • new: add support for testnet4

        • changed: set stricter UNIX permissions for log files

      • QML GUI (Android):

        • new: show seed passphrase in WalletDetails

        • new: set max screen brightness when displaying QR codes

      • Hardware wallets:

        • ColdCard: export multisig wallet to coldcard over USB

        • Trezor: add support for new device “Safe 5”

        • Ledger: add support for new device “Flex”

      • CLI/RPC: changed: require wallet password for lnpay and similar commands

    • Electrum releases a reproducibly built version into the official F-Droid repository [Github]

    • How to dump your xpriv on Electrum: wallet.keystore.get_master_private_key('ur password')

  • 00:14:31 Nunchuk Android v1.9.53

    • Revamped Home screen and user onboarding experience

    • Allow users to clone a Decoy wallet from existing wallets

  • 00:14:46 Bitcoin Keeper

    • v1.2.17

      • TapSigner Experience Overhauled:

        • Download encrypted backups of your TapSigner

        • Change the card’s PIN

        • Unblock the card if rate-limited

      • Key/ Signer Improvements:

        • Associate contacts with signing keys

        • Better options for exporting and securing keys

      • Wallet Data Management:

        • Enhanced wallet import and export options

        • Improved file sharing across the app

    • v1.2.15

      • Use Canary Wallet even for the Recovery Key

      • Flexibility to only create vault and hide/ delete them for security reasons

  • 00:16:49 Bisq2 v2.1.2

    • Optimized reputation system:

      • Trade limits are now tied directly to the seller’s reputation score

      • Reputation earned through burning or bonding BSQ will now double over first year

      • Reputation requirements have been relaxed (eliminated) for trades up to 25 USD

      • The minimum required reputation score has been removed

    • Consolidated chat rooms: based on user feedback, chats have been streamlined into fewer areas

  • 00:16:58 Wasabi Wallet v2.3.0.0

    • Enhance Tor integration

    • Better BTC amount formatting

    • More insight on transactions

    • [Beta] Payment in coinjoin (RPC only)

    • Add Trezor Safe 5 & ColdCard Q support

  • 00:22:32 Fully Noded releases Fully Noded and Unify on the App Store

    • Fully Noded - Join Market is a dedicated Join Market client: connect over Tor, no private keys on device, full maker/taker/fidelity bond functionality, and more.

    • Unify - Payjoin Wallet is a Payjoin capable Bitcoin Core client: p2p over nostr and connect via Tor

  • 00:22:59 Krux-installer v0.0.20-beta - Major update

    • Now user can, after download and verify an official firmware, select between:

      • to flash;

      • or make an airgapped update:

        • user will be requested to insert a (or more) SDCard(s) on computer;

        • installer will recognize it (them);

        • user can select one of them;

        • both firmware.bin and firmware.bin.sig will be copied to sdcard;

        • after the copy, user will be requested to eject sdcard and insert it on device;

        • at same time, the firmware.bin’s computed hash will appear to compare with the computed hash on device

  • 00:23:14 BoltzExchange Client v2.1.10

    • Support creating swaps with lnurls and lnaddresses

  • 00:23:31 Utreexo v0.2.0

    • utils: simplify and export proofpositions

    • Revert “utils: simplify and export proofpositions”

    • utreexo: use slices from standard lib

    • utils: simplify and proof positions

  • 00:23:42 Bitcoin Safe v1.0.0b1 - BETA Version, Use with Caution

    • Easy Multisig-Wallet Setup:

      • Step-by-Step instructions for a secure MultiSig setup with PDF backup sheets

      • Test transactions ensure that all hardware signers are ready

      • Full support for Coldcard, Coldcard Q, Bitbox02, Blockstream Jade, and Specter DIY, supporting QR, USB, SD-card

    • Secure: Hardware signers only

      • All wallets require hardware signers/wallets for safe seed storage

      • Powered by BDK

    • Multi-Language

    • Simpler address labels by using categories

      • Automatic coin selection within categories

      • Transaction flow diagrams, visualizing inputs and outputs, click on inputs and output to trace the money flow

    • Sending for non-technical users

      • 1-click fee selection via mempool-blocks

      • Automatic merging of utxos when fees are low

    • Collaborative:

      • Label synchronization between different computers and encrypted cloud backup

      • Wallet chat and PSBTs sharing between different computers

  • 00:27:06 Joinstr App v0.1.1

    • Remove BIP 32 derivation paths from signed PSBT

    • Wallet selection in settings

    • Riseup VPN implementation

    • Support Testnet and Mainnet

  • 00:27:13 Bitkey App v2024.71.0

    • You can now select MoonPay in the Bitkey app to sell bitcoin

    • AUD or CAD are now available as display currencies

    • Transaction history and wallet descriptor now available for export

    • Currency display is now Appearance in the Settings menu

  • 00:28:30 Bitcoin Jungle Mobile v1.3.0

    • This update adds a new transaction statistics screen from settings allowing you to do some reporting on your own transaction history.

  • 00:28:47 Simple Bitcoin Wallet v2.6

    • Drop hardware wallet support

    • Drop built-in Tor support

    • Drop LNURL support

  • 00:29:26 DATUM Gateway v0.2-beta - Initial public release

    • OCEAN releases the DATUM Gateway source code, as well as the Linux binaries and a StartOS node runners package

  • 00:30:28 ESP-Miner v2.3.0

    • Allow connecting to open WiFi networks

    • Set default cpu freq to 240mhz

    • Add support for TPS546D24S as a drop in replacement for the TPS546D24A

    • Protect against negative frequency and voltage values

    • Add warnings for consecutive timeout responses (no rx) from the chip

    • Add overheat button and change loading service

  • 00:30:42 Braiins Toolbox v24.09

    • Add full support for Antminer S21 Pro with AML control board

    • Add BETA support for Antminer S21 XP with AML control board

    • Power estimations and power measuring has been made more accurate, and there now are more available underclocking targets

    • Implement DPS cycling prevention and mitigated unwanted tunings

  • 00:30:46 Blockstream Green iOS v4.0.36

    • Allow redeposit of expired utxos in liquid multisig accounts

    • QR mode for singlesig watch-only

    • Recovery phrase: improve QR view

  • 00:31:07 Defibi App v0.0.52

    • Coldcard MK4 Integration: Now you can store your escrow keys directly on the Coldcard MK4 hardware wallet

    • Explore Page: Find useful content right in the app

  • 00:31:45 Nirvati v0.1.0

    • Open-source: Nirvati adopts a copyleft license to ensure users retain rights over the software

    • Decentralization and data redundancy: Current solutions often concentrate data in one location, posing risks of loss; nirvati enables data distribution across multiple devices for better redundancy and failover options.

    • Security: Existing systems lack secure communication and app isolation, allowing potential security risks; nirvati enforces encrypted connections and isolates apps to improve data safety.

    • Remote access: Many self-hosting platforms restrict access to local networks; nirvati uses Tailscale to provide secure remote access without extra configurations.

    • Reversible updates: Conventional systems do not support app rollback options, locking users into new versions; nirvati includes app snapshots to enable simple update reversions.

    • Multi-user support: Standard systems limit safe multi-user functionality; nirvati introduces a permission-based account system for user isolation on shared servers.

  • 00:32:08 BTCmap-android v0.8.0

    • Show place comments

    • Hide ATMs by default

    • Show places offering delivery

  • 00:32:18 Kyoto v0.4.0

    • New HeaderCheckpoint constructor from height

    • shutdown, add_scripts, broadcast_transaction methods have blocking APIs

    • Add a TrustedPeer while the node is running

    • Add change the peer timeout while the node is running

  • 00:33:03 Bitcoin Dictionary v2.0

    • Add a ‘double title’ system, for terms that cannot be translated

    • Add .epub version

    • Add and remove definitions, bring the total number to 803 technical terms defined in both french and english

    • The glossary is also available on PlanB Network, in a different user interface

Project spotlight

  • 00:33:17 [2140.dev]: European non-profit organization dedicated to supporting Bitcoin research and development

    • Started by Bitcoin researcher and contributor @RubenSomsen and @josibake, the fund intends to provide a more stable career path to protocol veterans and aspiring contributors who want to work on Bitcoin full-time.

  • 00:34:24 Localhost Research: A Bitcoin-Focused Research Center in the Bay Area [Announcement]

  • 00:34:49 Rewind Bitcoin: Bitcoin wallet in beta that lets you reverse theft [Trailer]

    • Rewind’s Vaults lock funds, starting a countdown when unlocking to allow for response to unauthorized access

    • Users can assign a trusted individual to assist in emergencies, helping to secure funds under certain situations

  • 00:35:30 bitcoinutils.dev: Utility resource website offering various Bitcoin-related cryptographic and encoding tools by Vojtěch Strnad

  • 00:35:46 Standalone Bitcoin Consensus Engine: A standalone binary exposing the historical bitcoin consensus engine [Github]

    • This repository contains the historical bitcoin consensus Engine exposed in an experimental standalone binary, i.e bitcoin-chainstate. This is a fork of the libbitcoinkernel project from its 27.0 release tag.

  • 00:35:54 Fabric: a trustless, distributed DNS resolver for Bitcoin Spaces [Github]

    • Fabric enables spaces to publish Bitcoin-signed zone files on a permissionless DHT without storing anything on-chain. Currently default to Testnet4

  • 00:36:06 l402_middleware: A middleware library for rust that provides handler functions to accept microtransactions before serving ad-free content or any paid APIs [Github]

  • 00:36:19 NodeWatch: a CLI dashboard for monitoring your Bitcoin fullnode, providing essential information such as node status, transaction fee estimate, bitcoin price, and more [Github]

  • 00:36:32 Bitcoind Quick: A dockerized bitcoin core container for quickly spinning up a (pruned) node with zmq support for running public-pool [Github]

  • 00:36:44 Chorly: reward your kids with sats for completing chores, create a custom chore list for your kids and set up automatic payouts

  • 00:36:53 Satoffee: Bitcoin coffee machines

    • Satoffee sells coffee machines that accept Bitcoin payments, allowing users to purchase coffee with Bitcoin through the Lightning Network. The company offers ready-made machines and DIY kits for customization.

  • 00:37:00 Koinvote: Endorse your candidate with Bitcoin

    • Koinvote is a weighted voting platform using Bitcoin Signature technology

  • 00:37:14 Bitcoin Prediction Market: Place bets by sending lightning payments and receive winnings to you lightning address.

  • 00:37:24 LiquiSabi: Coinjoin explorer: Monitor and publish WabiSabi’s coordinators advertised on Nostr [Github]

    • LiquiSabi tracks coinjoin transactions and allows you to filter them by the coordinator that staged it.

  • 00:37:34 Coin Demo: A interactive visual introduction into how mining works

Vulnerability Disclosures

  • 00:37:42 GoldenJackal’s specialized toolsets for targeting air-gapped systems in espionage campaigns [We Live Security]

    • ESET research uncovers two toolsets from GoldenJackal, an APT group, targeting air-gapped systems in Europe and South Asia since 2019. The toolsets include GoldenHowl and GoldenRobo, enabling system infiltration, data collection, and exfiltration through customized malware.

    • ESET’s findings highlight GoldenJackal’s expertise in breaching highly secure networks, demonstrating their capability to infiltrate isolated systems that lack internet connections.

  • 00:38:03 Radiant Capital hack exploits multisig approval process and hardware wallet compromise [Analysis]

    • On October 16, 2024, Radiant Capital suffered a security breach totaling $50 million, targeting three trusted, geographically distributed developers through sophisticated malware that intercepted hardware wallet transactions, enabling unauthorized transfer actions like transferOwnership.

    • Attackers leveraged the Safe{Wallet} (Gnosis Safe) interface and normal transaction resubmission behavior to gather signatures without arousing suspicion, while front-end and simulation tools displayed standard transaction data. [Post Mortem]

  • 00:38:25 Locate X: U.S. law enforcement tool enables warrantless smartphone tracking [404 Media]

    • The tool, by Babel Street, is available to both government contractors and private investigators, while its lack of usage restrictions poses concerns about unchecked surveillance and data exploitation.

    • Privacy advocates show that this type of surveillance can identify people based on unique identifiers like mobile advertising IDs, breaching presumed privacy safeguards.

  • 00:38:38 Hackers target Android users with Qualcomm zero-day vulnerability [TechCrunch]

    • A zero-day vulnerability was found to affect about 64 different Qualcomm chipsets has been exploited by hackers to target Android users

  • 00:39:03 Research, conducted by Jonas Hofmann and Kien Tuong Truong with the Applied Cryptography Group at ETH Zurich, discovers flaws in five end-to-end encrypted cloud services [Research paper]

    • “End-to-End Encrypted Cloud Storage in the Wild: A Broken Ecosystem” is an analysis of five E2EE providers—Sync, pCloud, Icedrive, Seafile, and Tresorit—reveals severe cryptographic vulnerabilities.

  • 00:39:20 Security analysis reveals weaknesses in WeChat’s mmtls encryption protocol [CitizenLab]

    • The report highlights the continued use of “business-layer encryption” from earlier WeChat versions, despite MMTLS adoption. This legacy encryption adds vulnerabilities due to inconsistencies and lacks essential features like forward secrecy, raising security concerns given WeChat’s wide user base.

  • 00:39:34 Imprompter: a tool tricking LLM agents into improper tool use demonstrates the risks of AI chatbot exploitation by hidden malicious prompts [Research paper]

    • Security researchers reveal that hackers can trick AI chatbots into disclosing user data by embedding hidden commands in gibberish-like prompts. Attackers exploit the chatbots’ response systems to send sensitive information back to servers controlled by hackers.

  • 00:39:46 Tails v6.8.1 releases an emergency release to fix a critical security vulnerability in Tor Browser.

    • “Update Tor Browser to 13.5.7, which fixes MFSA 2024-51, a major use-after-free vulnerability. Using this vulnerability, an attacker could take control of Tor Browser, but probably not deanonymize you in Tails.”

  • 00:39:56 A critical “use-after-free” vulnerability (CVE-2024-9680) in Firefox 131.0.2’s animation timeline allows attackers to execute arbitrary code and take complete control of a machine. Mozilla reports this issue is being exploited in the wild [Mozilla Security Advisory]

Privacy & Other Related Bitcoin Projects

Software Releases & Project Updates

  • 00:40:38 SimpleX v6.1

    • Improve calls

    • Improve iOS notifications

    • Improve user experience

      • Add new conversation layout and customizable messages

      • Add switch between user profiles

      • Increase speed: deletion, moderation and forwarding of messages

    • New security audit: SimpleX announces cryptographic design review by Trail of Bits

  • 00:40:41 SideBand v1.1.1

    • Add support for RNode device types that were added in the latest RNS release

    • Update RNS to version 0.8.2

    • Update LXMF to version 0.5.5

  • 00:40:48 Reticulum MeshChat v1.13.1

    • Add support for high quality audio messages using opus codec

    • Add message attachment sizes to message info dialog

    • Update suggested interface to new domain name

    • Update to RNS v0.8.4

    • Update to LXMF v0.5.6

  • 00:40:52 Tor Browser v14.0

    • Add new circuit for Android

    • Extend support for legacy platforms

Project spotlight

  • 00:40:56 Pubky Core: An open protocol for per-public-key backends for censorship resistant web applications [Github]

    • It enables public-key-based authentication and third-party authorization without relying on central databases, combining elements of decentralized technology with familiar web standards.

    • PKDNS: A decentralized, censorship-resistant DNS built on Pubky’s identity layer [Github]

      • “A DNS server providing self-sovereign and censorship-resistant domain names. It resolves records hosted on the Mainline DHT, the biggest DHT on the planet with ~15M nodes that services torrents since 15 years.”

    • Pubky Notes: Note taking app using pubky protocol [Github]

      • “Since the data is stored via the Pubky protocol, your notes are not locked into a single app or service—they’re portable and reusable”

  • awesome-pubky: A curated list of awesome Pubky resources, libraries, tools and applications [Github]

  • Awesome Privacy: List of free, open source and privacy respecting services and alternatives to privative services [Github]

Lightning + L2+

Project spotlight

  • 00:42:00 Blockstream launches Simplicity on Liquid testnet and introduces Simfony, a high-level language for writing Bitcoin smart contracts [Blog post]

    • Simplicity aims to provide a more secure and flexible environment for developers compared to Bitcoin Script.

    • Simfony is a Rust-like high-level language that compiles down to Simplicity bytecode. Work in progress. [Github]

  • 00:42:09 Spark: A trust-minimized solution designed to scale Bitcoin and extend the Lightning Network

    • Lightspark announces new Bitcoin L2 and upgrades its Universal Money Address (UMA) standard with the release of UMA Extend, UMA Auth and UMA Request. [Announcement]

  • 00:44:39 Blockbuster: Seamless content monetization with the Lightning Network

    • “Blockbuster is a media server that allows creators to upload and sell their videos, ebooks, and other content from any application that implements the L402 protocol.”

    • “The objective is to be able to share a unique link (L402 URI) that can be consumed across platforms like Nostr, Twitter, or Farcaster.”

Software Releases & Project Updates

  • 00:44:45 Core Lightning v24.08.2 - Steel Backed-up Channels

    • pay: Now remembers and updates channel hints across payments

    • pay: Discarding an overly long or expensive route does not blacklist channels anymore

    • grpc: Channel type anchors/even was added to the grpc bindings

    • Improve pathfinding speed for large nodes

  • 00:44:54 LDK Node v0.4.0

    • Add support for multiple chain sources

    • Add support for sourcing chain and fee estimation data from a Bitcoin Core RPC backed

    • Add initial experimental support for an encrypted VSS remote storage backend

    • Add support for setting the NodeAlias in public node announcements

    • Add support for generating and paying unified QR codes

    • Add support for quantity and payer_note fields when sending or receiving BOLT12 payments

    • Add support for setting additional parameters when sending BOLT11 payments

  • 00:44:58 Phoenix

    • Phoenixd

      • v0.4.2

        • Support fee bumping for on-chain transactions

        • Add a CSV export

      • v0.4.0

        • Support for new on-the-fly funding

        • Use the distribution plugin for all platforms

    • Phoenix Wallet transitions to new open protocol for Phoenix LSP: The new protocol builds on the Lightning BOLT standard and includes features like dual funding and splicing.

  • 00:45:01 Zeus v0.9.1

    • LND: BOLT 11 blinded paths

    • LND: spend full UTXOs

    • LND: Inbound routing fees

    • [Experimental] Rescans for external wallets

    • Simplified open channel UX

    • Linked contacts showing in Channel view

    • LNDHub: dismiss custodial warning

    • POS: add option to default to Keypad view

    • View on-chain address list

  • 00:45:06 Breez SDK Core (Greenlight) v0.6.2

    • Greenlight signer fix for de-sync

    • Use invoice destination for trampoline

  • 00:45:12 Alby

    • lightning-browser-extension v3.9.2 - Messier 24: Sagittarius Star Cloud

      • feat: setup your keys -> setup master key in default view cards

      • Onboarding for node_required accounts

      • Translations update from Hosted Weblate

    • Go v1.6 - Security (protect wallet with biometrics, face unlock, PIN, etc) - Link handling support (Lightning links, BIP21) - Improve LNURL handling (fixed amount LNURLs, LUD9 lnurl successActions)

  • 00:45:15 CashuMe now supports restoring ecash from a seed phrase [Announcement]

  • 00:46:11 Microbolt v2.0

    • Add new firewall: awall

    • Add new reverse proxy: caddy

    • Add new expl btc: mempool

    • Add new section: nostr

    • Remove fail2ban, applied firewall level mechanism

    • Bitcoin*: no more patches, except for ordinals

    • Microbolt cloud: automatic deployment of microbolt through ansible

  • 00:46:18 Geyser October 2024

    • Private messages: Contributors can now drop a private comment to the creator when funding a project or buying a reward

    • Creator can request buyer Npub: Creators can now request specific information from reward buyers such as their npubs, or reward specifications

    • Creator reward confirmation message: Creators can now tie each reward with a success message. This allows them to automate giving access to certain digital content or spaces

    • Multiple rewards and project images: Creators can now properly showcase their rewards by adding multiple images to them. And project banners can also have multiple images.

    • Add login with email

    • Rebrand Geyser bot to @GeyserSpirit

    • Launch announcement banner

    • Increase creator fees to 5% in the coming 2 weeks for lightning addresses, node-runners will remain on a value-for-value plan

  • 00:47:08 LN Markets

    • Add option to Cash In from trade margin

  • 00:47:14 Zaprite introduces Sandbox Environments [Blog post]

    • Users can now simulate both bitcoin and fiat transactions to test their custom API integrations

Nostr

Project spotlight

  • 00:47:20 Pokey: Nostr “Pull Notifications” on Android [Github)

    • Receive live notifications for your nostr events and allow other apps to receive and interact with them.

  • 00:47:25 White Noise

    • JeffG shares his progress made on implementing MLS messaging on Nostr [Note]

  • 00:47:41 Nostrastic: Bridge to publish Nostr posts and send/receive DMs over LoRa using Meshtastic [Github]

  • 00:49:14 AlgoRelay: An algorithm relay for nostr [Github]

    • “AlgoRelay is the first nostr native relay capable of serving personalized, algorithmic feeds without the use of external or proprietary APIs or DVMs.”

  • 00:49:22 ppe-relay: A paid relay that charges on per-event basics. [Github]

  • 00:49:27 Search Relay: A NIP-50 search relay [Github]

    • Full text search relay using Elasticsearch as backend

  • 00:49:31 Flotilla: A nostr relay-based communities PWA modeled after discord by Coracle [Github]

    • “A discord-like nostr client based on the idea of “relays as groups”. WIP.”

  • nostr-editor: A full text editor + note parser for Nostr based on Tiptap / ProseMirror [Github]

    • nostr-editor is a collection of Tiptap extensions designed to enhance the user experience when creating and editing nostr notes. It also provides tools for parsing existing notes into a structured content schema.

  • Zapchat: A Nostr App Design [Project description]

    • Nostr-specific UX/UI for conversations and monetization around any content type, using interoperable communities [Design system]

  • 00:51:40 nosweet.net: Share or clone any tweet on nostr with a url and without any permission or integration needed [Github]

  • 00:51:54 Docstr: A simple document management system on Nostr

    • Docstr allow users to create and delegate documents, only publicly for now.

  • 00:52:13 Translator: A new nostr service, offering automated translation of notes, videos and memes [Note]

  • 00:52:18 rx-nostr: A library based on RxJS, which allows Nostr applications to easily communicate with relays [Github]

Software Releases & Project Updates

  • Damus New TestFlight version

    • Multiple image uploads

    • Seamless scroll

    • Improve text and profile search

    • New side menu

    • Less sensitive thread view notes when scrolling

  • Amethyst

    • v0.92.4

      • Makes Amethyst a share target for texts, images and videos

      • Changes the new post screen to use the non-disappearing version of the scaffold

      • Correctly maps the write status of the outbox relays

    • v0.92.2

      • Moves the API with amber from signature to result

      • Ad new fields on vision prescriptions

      • Prioritise search results that start with the search term

      • Add some test cases for video compressions

      • Add Unknown media type test

      • Use “use” blocks to close resources automatically

      • Faster logout processing without closing the account switcher dialog.

      • Add animation to notification chart

      • Add animation to FABs

      • Add animation to zap and reaction popups

      • Support for login with hex key when using amber

    • A user shared having successfully used the ‘journalist’s mode’, temporarly logging into Amethyst using an ncryptsec on a NFC tag

  • Coracle

    • v0.4.15 - Security Release

      • In past versions of Coracle, user session objects were inadvertently sent to my error reporting platform

        • Hack in accommodation of algorithmic relay feeds

          • Downgrade typescript to save my sanity

          • Show links/images as blocks when at the end of a paragraph

          • Implement new profile page and summary designs

          • Stop sending user to bugsnag

    • v0.4.13

      • Add support for nip05 urls

      • Re-work notification rendering and loading

      • Use Intl api for list formatting (zmjohnson)

      • Update nostr signer version to support app icon url

  • Iris publishes new Iris version source code [Github]

  • Lume v4.3.0

    • Add support for multiple follow sets (NIP-51)

    • Add support for multiple interest sets (NIP-51)

    • Add support for event deletion (NIP-09)

    • Automatically restore window state when reopen app

    • Prioritize query from local database instead of relay

    • Improve search performance, overal performance and stability

  • nos.social v1.0.0

    • Add relay.mostr.pub to the default relay list

    • Add a tip to Discover to prompt first-time users to go to their Feed

    • Add a tip to the Feed to welcome first-time users and explain how the Feed works

    • Add a tag to published contact lists to help us detect the source of lost contact lists

    • Update the onboarding screens with a new design

    • Add new authors and categories to the Discover tab

    • Nos now hides the notes from blocked users when viewing their profile page

  • Nostrmo v2.9.3

    • Add NIP-55 content-resolver support

    • Add cache relay support

    • Live’s Naddr address link to zap.stream

    • Change filed name for NIP-55’s meger

    • Change Group’s sync time

    • Add user change to use the login page

    • Add support for pick multi file for editor

  • Mostro v0.12.7

    • When taking an order, check the status first and then the quantity

    • Update README.md to have instructions for Mac

    • Tonic-lnd

    • Add Cross.toml for protoc compiler inside docker sandbox

  • Blossom introduces Onion-routing for event publishing [Announcement]

    • This technique hides both the sender’s identity and IP address, even from the relay used for publishing.

    • “The sender can include small ecash tokens inside each onion layer to pay for the routing.” -@Pablof7z

  • Citrine v0.5.2

    • Support for tor proxy when restoring contact list

    • Support for auto backup every 24 hours

    • Check if port is in use

  • Voyage

    • v0.16.0

      • Render nip88 polls

      • Vote on nip88 polls

    • v0.15.0

      • Support nip22 comments

      • Always use nip22 when replying to nip22 comment

      • Optionally force nip22 usage

      • Show client, full date time and unix timestamp in post details

      • Create generic repost when cross-posting nip22 comment

      • Show hint when nip22 comment parent is not supported

  • Chronicle v0.2.1

    • Upgrade dgraph-io/badger

  • YakiHonne iOS/Android v1.4.1

    • Outbox model support

    • A complete new core with enhanced features that ensures a better performance and lightning speed while browsing

    • Notes media has been enhanced

    • Notes threads are now efficiently displayed

    • Accounts switching enhancements

    • Private messaging optimization

  • Zapstore v0.1.4

    • Curated app sets

    • Load more releases (show all)

    • Better app cards and version/install state

    • Performance: Complete rework of internals, preloading, caching, background work

  • Nostream v2.1.0

    • Add dark theme support for static html files

  • strfry v1.0.2

    • New config param: relay.info.nips which allows you to override the NIPs that are claimed to be supported

    • New connectionTimeout parameter in router config

  • Nostr-PHP

    • v2.0.0-alpha1

      • Add valtzu/guzzle-websocket-middleware to execute async concurrent websocket requests with the Http/Guzzle client

    • v1.4.2

      • phpdoc + examples

      • Remove build dir phpdoc.nostr-php.dev from repo

      • Some improvements in the Filter class to handle multiple authors

  • BitBanana v0.8.7

    • More flexible fiat currency setup

  • Fountain v1.1.5

    • Simpler Library Architecture: makes offline playback more reliable and reduce system resource requirements, reduces mobile data and memory usage, and fixes long-standing playback issues

    • Pay BOLT-11 Invoices: withdraw funds by generating a lightning invoice using any app that supports lightning payments

    • Add artist Pages: From any Track or Album page you can now tap through to the Artist page to see all tracks

Boosts

  • 00:52:39 Thanks to everyone who streamed sats, and shoutout to our top boosters:

    • [🏆 TOP BOOSTER] @Ape Mithrandir (7,777 sats) “Listening to end if you count 30 minutes of sleep listening at the end 😅”

    • @tdub (5,000 sats) “Proof of Listrning (PoL): Here’s how to make a classic grilled cheese sandwich (…)”

    • @btconboard (1,111 sats) “More miniscript please. I am not Rob.”

    • @AVERAGE_GARY (1,000 sats) “SatsLink revival?!?! But I already used my preorder money for a second Q. 😵‍💫”

    • @VonPhoto (500 sats)

    • @BrightSats (121 sats) “Keep an eye on your wife flash attack vectors!”

00:54:14 Tech Tip of the Day

  • 00:54:16 DeArrow: an open source browser extension for crowdsourcing better titles and thumbnails on YouTube [Github] (Recommended by fiatjaf)

    • “The goal is to make titles accurate and reduce sensationalism. No more arrows, ridiculous faces, and no more clickbait.”

  • 00:54:26 Eartho: The open-source, privacy-focused alternative to Google sign-in [Github]

    • Eartho allows developers to integrate authentication without relying on third-party data collection services.

Bitcoin Optech Newsletter

  • Highlights from recent Bitcoin Optech Newsletters

    • 326

      • Updates to the version 1.75 channel announcements proposal: Elle Mouton posted to Delving Bitcoin a description of several proposed changes to the new channel announcements protocol that will support advertising simple taproot channels

      • Draft BIP for sending silent payments with PSBTs: Andrew Toth posted to the Bitcoin-Dev mailing list a draft BIP for allowing wallets and signing devices to use PSBTs to coordinate the creation of a silent payment.

    • 325

      • LN Summit 2024 notes: Olaoluwa Osuntokun posted to Delving Bitcoin a summary of his notes (with additional commentary) from a recent LN developer conference.

    • 324

      • Disclosure of vulnerabilities affecting Bitcoin Core versions before 25.0: Niklas Gögge posted to the Bitcoin-Dev mailing list links to the announcements of three vulnerabilities affecting versions of Bitcoin Core that have been past their end of life since at least April 2024.

      • CVE-2024-38365 btcd consensus failure: as announced in last week’s newsletter, Antoine Poinsot and Niklas Gögge disclosed a consensus failure vulnerability affecting the btcd full node.

      • Guide for wallets employing Bitcoin Core 28.0: As mentioned in last week’s newsletter, the newly released version 28.0 of Bitcoin Core contains several new features for the P2P network, including one parent one child (1P1C) package relay, topologically restricted until confirmation (TRUC) transaction relay, package RBF and sibling eviction, and a standard pay-to-anchor (P2A) output script type

News & Noteworthy

Bitcoin

  • Guide for Wallets Employing Bitcoin Core 28.0 Policies: A guide to address Bitcoin Core v28.0 updates for wallet developers, detailing new P2P and mempool policies that aid in handling various transactions, including coinjoins, Lightning Network, and Ark transactions.

  • Bitcoin live dashboard TimechainStats, has added an Arcade game section on its website

  • LNhance, a soft fork proposal for Bitcoin, has launched a new website

Lightning + L2+

  • Lightning Network + introduces Group Channel Opens [Announcement]

    • Group Channel Opens on LN+ enables up to 5 Lightning Network channels to open through a single bitcoin transaction, reducing costs and block space usage by approximately 52–62% depending on group size.

  • @Roasbeef publishes his Notes & Summary of the LN Summit 2024 in Tokyo, Japan

  • CashuBTC launches its new website: cashu.space

Business & Finance

  • 00:58:48 River now offers 3.8% interest on cash with bitcoin payouts [Announcement]

    • Users can withdraw cash at any time, with funds FDIC-insured up to $250,000. The service has no hidden fees or minimum deposit requirements.

  • Mt. Gox announced an extension to its repayment deadline for creditors to October 31, 2025 [CoinDesk]

    • This decision aims to give creditors additional time to navigate complex administrative requirements that have hindered the timely return of funds

  • Dutch bitcoin-only exchange BL3P will shut down by December 20, 2024, citing new regulations, including MiCA, as a driver for the decision. [Press release]

    • Following closure, remaining funds and trading history will transition to users’ Bitonic accounts, which will adopt some BL3P features.

  • Bitkey announces new partner: users of the Bitkey App can now sell, buy or transfer bitcoin using MoonPay [Announcement]

  • Decentralized exchange platform HoldHold discontinues support for most cryptocurrencies as payment methods, keeps supporting stablecoins and Bitcoin second-layer solutions [Announcement]

Tradfi

  • U.S. SEC approves NYSE options trading on spot Bitcoin ETFs [Watcher Guru]

Art

  • 00:59:46 Bitcoin illustrator NoGood releases The art of NoGood – a self-published art book showcasing five years of bitcoin themed illustration [Geyser page]

Funding

  • 00:59:58 Bitcoin and Freedom Technologies Research firm 1a1z releases report covering how Bitcoin Core development is funded

    • Part 1 covers the organizations that raise and distribute funds to core devs

  • 1:00:06 OpenSats announces:

    • Eighth Wave of Bitcoin Grants, the four projects of this funding wave are:

      • Citadel-Tech

      • Lampo

      • Cashu Nutshell

      • PickhardtPayments Plugin

    • Long-term support for Greenart7c3, creator and lead developer of Citrine and Amber, for his ongoing contributions to the nostr ecosystem.

  • 1:00:13 Spiral announces grant renewals to:

  • Bitcoin development fund Brink receives a $250,000 contribution to their funding efforts from The Draper Foundation [Announcement]

  • Donor-advised fund, UI Charitable (University Impact), makes first Bitcoin grant to support Bitcoin education [Press release]

    • The scholarship fund, directed to Base58, a nonprofit promoting bitcoin engineering education, targets software engineers learning bitcoin fundamentals

  • OKX announces a grant to the 2140 Foundation [Press release]

  • Germany’s Sovereign Tech Fund boosts open-source development with $25 million across 60 open-source projects [Blog release]

  • Non-profit organization Btrust launches new website

  • Donations to the Tor Project will be matched, by Power Up Privacy, dollar-for-dollar up to $300,000 through the end of 2024 [Announcement]

  • Blockstream secures $210 million in convertible note financing, led by Fulgur Ventures, to advance Bitcoin integration into global finance. [Press release]

Mining

  • Bitmain introduces the Antminer S21+ series, featuring two models: the S21+ Hyd and the S21+ [Press release]

    • The S21+ Hyd model delivers a hashrate of 319 TH/s at 15 J/TH, while the S21+ provides 216 TH/s at 16.5 J/TH

Privacy

  • A New York court dismisses YieldNodes’ defamation suit against Chainalysis, citing Anti-SLAPP laws protecting public speech. [The Rage]

    • Judge Lyle Frank states that statements made in Chainalysis’ Reactor subscription service, are within public interest, akin to private Facebook group discussions.

  • 1:00:51 SimpleX publishes Wired’s Attack on Privacy, a critical response to Wired’s article on neo-Nazis moving to SimpleX Chat following Telegram privacy policy changes

  • Encrypted chat app Session relocates to Switzerland following Australian police visit [404 Media]

    • After Australian Federal Police visited a Session employee regarding the app and a specific user, Session’s leadership decided to relocate to Switzerland under the newly formed Session Technology Foundation (STF) [Announcement]

  • A recent amendment to Norway’s Financial Contracts Act mandates businesses to accept cash if they offer other payment options at physical sales premises, if the amount is below ~$1800 [Announcement]

  • VPN provider Mullvad introduces Shadowsocks obfuscation for WireGuard [Blog post]

    • Shadowsocks obfuscates data, making it harder for firewalls to block

  • Transak, a cryptocurrency onramp API platform used by companies such as Binance US, Coinbase, Ledger and Bitpay, was hit by a data breach in October 2024, leaking the KYC information of ~57,000 users [CoinDesk]

  • Fidelity data breach exposes personal data of 77,000 customers, accessing social Security numbers, driver’s licenses, and names over a two-day period between August 17 and August 19, 2024 [CNET]

  • The Internet Archive, a nonprofit organization that maintains digital archives of the internet, has suffered a data breach affecting 31 million accounts [ZDNet]

    • DDoS attack: the incident was caused by an unauthorized third-party accessing a database backup from June 2020.

Protocol

  • 1:01:09 Libsecp256k1 #1479: Add module “musig” that implements MuSig2 multi-signatures (BIP 327) [Merged]

  • Bitcoin Core #30955: implements two new methods to the Mining interface, compatible with Stratum V2 requirements [Merged]

  • Rust Bitcoin #3450: Add version three variant to transaction version. Topologically restricted transactions are now considered standard as of Bitcoin 28.0. [Merged]

  • Eclair #2927: Enforce recommended feerate for on-the-fly funding [Merged]

  • Eclair #2922: Remove support for splicing without quiescence [Merged]

  • NIP-60 and NIP-61 are the first Cashu NIPs to have been made into the Nostr specifications [Merged]

    • NIP-60 describes portable Cashu wallets that live inside nostr relays

    • NIP-61 describes nutzaps, a new, instant way to zap users and events by posting ecash locked to their public key

Government & Political

  • Two senior researchers at the European Central Bank publish The distributional consequences of Bitcoin, a paper detailing the redistributive impact of a rising Bitcoin market

    • The paper claims that while early adopters benefit, rising Bitcoin prices generate wealth at the expense of non-holders and late investors

  • The Minneapolis Fed publishes a research paper and argues that Bitcoin disrupts a government’s ability to maintain a unique, permanent primary deficit by introducing multiple economic equilibria, solvable through Bitcoin prohibition or taxation.

  • Craig Wright has filed a £911 billion lawsuit against Bitcoin Core developers in the UK High Court [Forbes]

    • His argument centers on the claim that modifications by Bitcoin Core, such as SegWit and Taproot, deviate from Bitcoin’s original design, which he says was meant to be a decentralized cash system, not a store of value.

  • FinCEN’s recent alert underscores that Hezbollah primarily relies on bulk cash transfers and smuggling for financing, rather than cryptocurrencies [FinCEN’s notice]

  • The FBI arrested an individual for allegedly hacking the SEC’s account on X in January 2024. The suspect reportedly gained access to the account using a SIM swap attack, announced the launch of a fake Bitcoin ETF and profited from it. [Forbes]

  • Nigerian government drops charges against Binance Executive Tigran Gambaryan [Reuters]

  • The Danish Minister of Taxation proposes a bill to tax unrealized capital gains on cryptocurrencies. [Announcement]

  • Italy raises bitcoin capital gains tax from 26% to 42% in its 2025 budget [Reuters]

Bitcoin (cont.)

Events

  • Three events have announced the dates of their 2025 editions:

Reads

  • Here’s a list of our top recently published reads:

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR085: Nostr Rising 08 - Nostr Funding ft. Lyn Alden, Max & Odell]]>https://substack.bitcoin.review/p/br085-nostr-rising-08-nostr-fundinghttps://substack.bitcoin.review/p/br085-nostr-rising-08-nostr-fundingWed, 30 Oct 2024 18:28:34 GMTI’m joined by guests Lyn Alden, Max & Odell to discuss nostr funding.

Listen on your favorite podcast app

Chapters

  • (00:00:00) Introduction to Nostr funding concepts

  • (00:01:04) Importance of decentralized funding in tech

  • (00:02:07) Discussion on Nostr’s scalability and funding potential

  • (00:06:17) Analysis of community-driven funding models

  • (00:12:01) Benefits of open-source funding approaches

  • (00:18:02) Comparison of Nostr’s funding capabilities with traditional platforms

  • (00:19:00) Potential challenges for funding in decentralized systems

  • (00:28:32) Exploration of funding solutions using Bitcoin

  • (00:33:17) Incentives for developers in the Nostr ecosystem

  • (00:41:34) Role of privacy in funding models

  • (00:46:22) Future of funding mechanisms in Nostr

  • (00:49:01) Community engagement and its impact on funding success

  • (00:53:33) Scalability of Nostr vs. traditional funding platforms

  • (00:54:14) Announcement of a bounty related to Nostr funding

  • (00:54:26) Optimism about the future of funding in the Nostr community

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR084: Nostr Rising 07 - Long Form Content ft. DK & Miljan]]>https://substack.bitcoin.review/p/br084-nostr-rising-07-long-form-contenthttps://substack.bitcoin.review/p/br084-nostr-rising-07-long-form-contentMon, 28 Oct 2024 18:51:50 GMTI’m joined by guests DK & Miljan to discuss long form content.

Listen on your favorite podcast app

Chapters

  • (00:00:00) Introduction to long form content on Nostr

  • (00:03:15) Challenges of content distribution on Nostr

  • (00:06:42) Nostr as a decentralized platform for creators

  • (00:11:20) The role of relays in content storage and competition

  • (00:15:47) Building user-centric tools for long-form content

  • (00:19:33) Balancing short-form and long-form content on Nostr

  • (00:22:58) Algorithmic feeds and user-controlled algorithms

  • (00:28:40) Primal’s focus on algorithm marketplace development

  • (00:34:15) Human-curated algorithms and user-selected feeds

  • (00:39:48) Ethical advertising and user choice in ads

  • (00:43:22) Importance of competition in relays, clients, and algorithms

  • (00:46:58) Creating customizable algorithms for users

  • (00:48:09) Potential for ethical, non-intrusive advertising

  • (00:50:26) Nostr as a global town square for nuanced discourse

  • (00:51:34) Learning from torrents: the importance of better UX

  • (00:52:24) Closing thoughts on Nostr’s future and appeal to creators

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR083: Nostr Rising 06 - Zap the Planet and Nostr Money ft. Calle, Pablo & Miljan]]>https://substack.bitcoin.review/p/br083-nostr-rising-06-zap-the-planethttps://substack.bitcoin.review/p/br083-nostr-rising-06-zap-the-planetFri, 25 Oct 2024 13:08:18 GMTI’m joined by guests Calle, Pablo & Miljan to discuss zaps and nostr money.

Listen on your favorite podcast app

Chapters

  • (00:00:00) Introduction

  • (00:05:12) Building a permissionless public square on Nostr

  • (00:12:25) Challenges in decentralized social media and privacy

  • (00:18:43) Cashu protocol integration with Nostr

  • (00:22:50) Role of ecash in relays and wallets

  • (00:28:16) Nostr as an open social graph for applications

  • (00:31:42) Innovation in digital payments and Zaps on Nostr

  • (00:35:14) Open-source culture and project monetization

  • (00:39:23) Bitcoin integration in social media platforms

  • (00:42:38) Scaling challenges and user adoption

  • (00:47:06) Nostr’s impact on new market designs

  • (00:48:25) Future of Zaps in expanding Bitcoin user base

  • (00:49:24) Social feedback and micro-transactions

  • (00:50:20) Infinite innovation potential with Nostr and Zaps

  • (00:51:57) Nostr’s role in enhancing app social features

  • (00:54:29) Regulatory challenges and JavaScript as a platform

  • (00:55:12) Closing thoughts

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR082: Nostr Rising 05 - Podcasting 2.0 ft. Kieran, Odell, Hodlbod & Oscar Merry]]>https://substack.bitcoin.review/p/br082-nostr-rising-05-podcastinghttps://substack.bitcoin.review/p/br082-nostr-rising-05-podcastingWed, 23 Oct 2024 17:55:53 GMTI’m joined by guests Kieran, Odell, Hodlbod & Oscar Merry to discuss podcasting 2.0.

Listen on your favorite podcast app

Chapters

  • (00:00:00) – Introduction and overview of the discussion on Nostr and podcasting.

  • (00:01:10) – Importance of Nostr in decentralization and censorship resistance.

  • (00:10:30) – Integrating Bitcoin and Lightning Payments with Nostr.

  • (00:19:12) – Value-for-value model and podcast monetization using Nostr.

  • (00:26:50) – Challenges of onboarding new users and improving user experience on Nostr.

  • (00:35:15) – The future of podcasting with Nostr and potential for listener engagement.

  • (00:41:20) – The potential for creating decentralized, censorship-resistant content.

  • (00:48:30) – Vision for integrating games with Nostr and Lightning Payments.

  • (00:59:18) – Opportunities in gaming and Nostr’s role in gaming’s future.

  • (01:00:19) – The importance of owning your social graph on Nostr.

  • (01:01:10) – Discussing podcasting analytics and user platforms.

  • (01:02:27) – The need for more apps and users in the Nostr ecosystem.

  • (01:03:25) – Audience breakdown by platform, including Spotify, Fountain, and Overcast.

  • (01:04:06) – Issues with Spotify’s closed analytics and data control.

  • (01:05:17) – Simplifying Nostr onboarding and improving the user experience.

  • (01:06:41) – Challenges of niche adoption and the importance of positive feedback loops.

  • (01:07:42) – Nostr’s future growth driven by censorship on other platforms.

  • (01:08:09) – Optimism for Nostr’s long-term success despite short-term challenges.

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR081: Nostr Rising 04 - DMs and Groupchats ft. Fiatjaf, Hodlbod & Jeff G]]>https://substack.bitcoin.review/p/br081-nostr-rising-04-dms-and-groupchatshttps://substack.bitcoin.review/p/br081-nostr-rising-04-dms-and-groupchatsMon, 21 Oct 2024 13:29:57 GMTI’m joined by guests Fiatjaf, Hodlbod & Jeff G to discuss DMs and groupchats.

Listen on your favorite podcast app

Chapters

  • (00:00) - Introduction to the discussion

  • (02:32) - Overview of MLS Messaging Layer Security and its role in group chats.

  • (10:03) - Addressing spam and impersonation in group communications.

  • (14:16) - Managing group keys and group membership.

  • (21:10) - Security concerns and potential vulnerabilities.

  • (26:58) - Relays and group management.

  • (30:50) - Importance of secure client implementations.

  • (35:25) - Handling bad actors in group chats.

  • (43:15) - Integration of payments in group chat dynamics pay-to-post model.

  • (50:25) - Exploring broadcast model for private groups.

  • (55:16) - Proof of concept for a secure group chat client.

  • (59:27) - Conclusion and final thoughts

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR080: Nostr Rising 03 - Relays & Scaling ft. Fiatjaf, Mike Dilger & Pablo]]>https://substack.bitcoin.review/p/br080-nostr-rising-03-relays-andhttps://substack.bitcoin.review/p/br080-nostr-rising-03-relays-andFri, 18 Oct 2024 13:27:27 GMTI’m joined by guests Fiatjaf, Mike Dilger & Pablo to discuss relays and scaling nostr.

Listen on your favorite podcast app

Chapters

  • (00:00) – Introduction to Nostr protocol and event signing

  • (02:15) – Relay management and costs in Nostr ecosystem

  • (05:30) – Scaling concerns and misconceptions about relay overload

  • (09:11) – Importance of public key identity management

  • (12:18) – Challenges in moderation and decentralized governance

  • (15:40) – Defining the roles of clients and relays

  • (20:19) – Lightning integration for payments in Nostr

  • (25:00) – Need for better developer tools for relay management

  • (29:45) – Cross-platform interoperability between Nostr and Mastodon

  • (35:20) – Censorship on Mastodon and the Fediverse

  • (40:05) – Scalability and reliability improvements during user influxes

  • (44:10) – The idea of creating more experimental and niche relays

  • (47:25) – Vision for integrating specialized relay functionality into clients

  • (49:31) – Concept of Yahoo Pipes for Nostr relays data aggregation tools

  • (50:09) – DVMs and the evolution of decentralized systems

  • (51:00) – Closing remarks

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR079: Nostr Rising 02 - Communities ft. Rabble, Alex Gleason, Hodlbod & Pablo]]>https://substack.bitcoin.review/p/br079-nostr-rising-02-communitieshttps://substack.bitcoin.review/p/br079-nostr-rising-02-communitiesWed, 16 Oct 2024 14:31:43 GMTI’m joined by guests Rabble, Hodlbod, Alex Gleason & Pablo to discuss nostr communities.

Listen on your favorite podcast app

Discussion Topics

  • 00:00:00 – Introduction to Nostr and its evolving landscape

  • 00:01:35 – Comparison between TCP/IP and Nostr as flexible protocols

  • 00:05:45 – Nostr’s decentralized development and innovation without permission

  • 00:12:20 – User experience challenges in decentralized systems

  • 00:18:10 – Importance of experimentation and building tools for Nostr

  • 00:21:55 – Differences between digital and physical communities

  • 00:25:10 – Discussion on the long tail of communities in Nostr

  • 00:29:00 – How Nostr helps niche groups and the growth of communities

  • 00:32:50 – Balancing decentralization and user experience

  • 00:38:10 – Ham radio community’s adoption of Nostr

  • 00:42:55 – Importance of building discoverable and easy-to-join communities

  • 00:47:30 – Nostr as an open, super-app platform similar to early Facebook

  • 00:52:00 – Final thoughts on Nostr’s role in fostering decentralized communities

  • 00:57:55 – Nostr’s network effect and social graph integration

  • 01:00:04 – Future potential and excitement about Nostr communities expanding

  • 01:01:28 – Nostr’s organic growth and fostering more community engagement

  • 01:02:07 – Closing remarks and thanks to the guests

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]><![CDATA[BR078: Nostr Rising 01 - Permissionless Algos ft. JB55, Hodlbod & Miljan]]>https://substack.bitcoin.review/p/br078-nostr-rising-01-permissionlesshttps://substack.bitcoin.review/p/br078-nostr-rising-01-permissionlessMon, 14 Oct 2024 20:30:38 GMTI’m joined by guests JB55, Hodlbod & Miljan to discuss Permissionless Algos in the first episode of Nostr Rising.

Listen on your favorite podcast app

Discussion Topics

  • 00:00:00 – Introduction to decentralized algorithms and Nostr’s open network

  • 00:01:01 – Users’ control over algorithms and content feeds

  • 00:03:01 – Challenges of building permissionless systems without tracking users

  • 00:05:01 – Feed marketplace concept and its impact on content discovery

  • 00:08:01 – Importance of user feedback in developing decentralized platforms

  • 00:12:01 – AI agents and bots assisting with content curation

  • 00:15:01 – The value of human-created content versus bot-generated content

  • 00:17:31 – AI’s role in building decentralized apps on Nostr

  • 00:20:01 – Future of algorithms and personalized content on decentralized networks

  • 00:24:01 – Curation and community-driven feeds as an alternative to centralized platforms

  • 00:28:01 – Nostr’s potential to disrupt big tech and centralized institutions

  • 00:30:01 – Open network and emergent properties of user-driven content

  • 00:33:01 – Role of lists and curated social clusters in enhancing user experience

  • 00:36:01 – Encouragement for users and developers to participate in Nostr

  • 00:40:01 – Final thoughts: the power of decentralized networks and AI collaboration

  • 00:42:31 – Closing remarks and a call to action for Nostr’s growth and adoption

Episode submission ideas

  • We’re looking for ideas for interesting panel conversations. To send Bitcoin related questions, just go to bitcoin.review and follow the contact links at the bottom of the page.

Get in touch with the pod

]]>