Nostr notes by btc_insider__

In this week’s update by @npub1jeq…nmal, we feature the ...

2026-10-26T15:15:27Z

In this week’s update by tuma (npub1jeq…nmal), we feature the current work to add support for splicing and dual-funding to taproot channels in the BOLTs specifications.

We also cover several news from the Bitcoin ecosystem. Fabian Jahr is teaming with Payjoin to integrate that protocol with Cross-Input Signature Aggregation (CISA), Core developer l0rinc is working to remove AssumeUTXO , Wavelength is now available on Mainnet, and more.

quoting
naddr1qv…s007

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature the current work to add support for splicing and dual-funding to taproot channels in the BOLTs specifications.

We also cover several news from the Bitcoin ecosystem. Fabian Jahr is teaming with Payjoin to integrate that protocol with Cross-Input Signature Aggregation (CISA), Core developer l0rinc is working to remove AssumeUTXO , Wavelength is now available on Mainnet, and more.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

Lightning developers are working to add support for splicing and dual-funding transactions in taproot channels

During the monthly meeting, on Monday 19th, Lightning developers discussed the ongoing effort to add support for splicing and dual-funding transaction in taproot channels. The work is currently reviewable in PR1324 in the BOLTs repository.

Taproot Lightning channels were introduced last May as a way to improve privacy, security, and flexibility of the system. In particular, the new taproot channels use MuSig2 key aggregation to combine two keys into one, with the multisig output becoming a single P2TR key, and tapscript trees capabilities.

The new update to the specifications aims to add nonces in various messages of the peer protocol to allow creating musig2 partial signatures during dual-funding and splicing. It also allows to omit the prevtx field when using taproot, since that field had to be included to prevent transaction malleability when using pre-segwit inputs.

A BIPs Update

In the last days there was some movement in the BIP repository. Specifically, one new BIP has been published by BIP maintainer Murchandamus.

Published BIPs

A list of recently published BIPs

BIP139: Wallet Metadata Backup Format

Published On: October 24th, 2026

Layer: Applications

BIP139 specifies a standard way to store various type of metadata, such as account descriptors, keys, labels, PSBTs, and more, allowing compatibility between different wallet implementations, simpler wallet migration, and easier recovery processes.

Other News from the Bitcoin World

AssumeUTXO Removal: Bitcoin Core develoepr l0rinc announced a draft proposal to remove the AssumeUTXO feature from the Bitcoin reference implementation. This comes after in-person discussions during the Core Dev meeting.

AssumeUTXO allows a new user bootstrapping a node to import the UTXO set from an external source to start transacting right away, while the classic Initial Block Download (IBD) starts in the background.

According to l0rinc, this feature adds several layers of complexity around the codebase, making porposed changes difficult to implement. Moreover, the feature does not seem to be widely used by noderunners.

L0rinc’s provided a reference implementation of what the removal of AssumeUTXO would look like in PR36598. However, he stated that discussion on whether to remove the feature is still ongoing between maintainers.

Payjoin + CISA = PISA: Fabian Jahr announced PISA, a new integration between Payjoin and CISA.

Jahr shared a video explaining how PISA could increase privacy on-chain — breaking the common ownership heuristic used in chain analysis —, while at the same time saving in fees.

To send a payment, both Alice and Bob can provide an input, as in a classical Payjoin transaction. Once Alice gets back the transaction with Bob’s input and signatures, she can leverage CISA so as to aggregate their signatures into one single signature.

To make it work, Jahr modified Bitcoin Core to include BIP460, the soft work that would bring CISA to Bitcoin. Thus, the provided test implementation is available only on regtest.

Bitcoin Design <> AI: The Bitcoin Design Community — supported by Spiral — is launching a research initiative to understand how the Bitcoin Design Guide should evolve so that it can be easily leveraged by AI agent.

The Bitcoin Designer Community is specifically looking for builders of Bitcoin and Lightning wallet to understand how AI is used in their workflows, if the Guide is ready for the AI-driven development age, and which could be the areas where it could be improved.

Wavelength on Mainnet: Lightning Labs announced that Wavelength — their implementation of the Ark protocol — was finally available on mainnet. Wavelength was announced in July, promising fast integration of Bitcoin payments in any application.

Bitcoin-backed Dollars on Cashu: Ducat — a Bitcoin-native credit and stablecoin protocol — announced that they had launched a Bitcoin-backed dollar stablecoin built on top of the Cashu protocol. Ducat’s mint would allow users to deposit their UNIT stablecoin and receive newly minted ecash tokens.

More from BTC++ Insider Edition

News Hour

BTC++ News Hour: Check out our Friday livestream, where Matthew Vuk and I discuss the most interesting news of the week from the Bitcoin developer ecosystem. This time, we hosted Brandon Black — known in cyberspace as reardencode — to talk about rbitcoin, a Bitcoin full-node implementation in Rust.

Videos

Aleksei Moskvin — BTC++ Insider Interviews: Alksei Moskving of [[alloc]init] talks to the Insider about the Shielded Bitcoin metaprotocol: private transfers on Bitcoin L1, encrypted notes, and wallet recovery from a seed phrase.

Alex Bragin — BTC++ Insider Interviews: Alex Bragin — CTO at Jan3 — talks to the Insider about his commitment to Liquid, finally coming to resolution as peg-out functionality is restored.

Michael from Boltz — BTC++ Insider Interviews: Michael — Former CTO at Boltz — talks to the Insider about why he shut down the swap service, how AI changed the risk equation, and why he’s still optimistic about the future of software.

Jussi Tiira — BTC++ Insider Interviews: Jussi Tiira of the Finnish Bitcoin Association talks to the insider about his quest to educate Finnish MPs about Bitcoin.

Rene Pickhardt — BTC++ Insider Interviews: Lightning researcher Rene Pickhardt talks to the Insider about Lightning’s scaling limits, on-chain bottlenecks and the case for multiparty channels.

Articles

We’re reimplementing private broadcast - This Week in Bitcoin Core #63

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Seoul this November 5-6 to talk about privacy in Bitcoin!

In this week’s update by @npub1jeq…nmal,we feature current ...

2026-10-19T14:05:57Z

In this week’s update by tuma (npub1jeq…nmal),we feature current effort to add support for recurring payments with BOLT12 in LDK.

We also cover the announcement of two new offchain protocols on Bitcoin, namely Zark by Lx DEV, a statechain with a blinded co-signer and zero-knowledge proofs, and LayerTree by Lightning Labs, a non-custodial scaling solution which allows multiple users to share a Bitcoin UTXO.

quoting
naddr1qv…vtc5

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature current effort to add support for recurring payments with BOLT12 in LDK.

We also cover the announcement of two new offchain protocols on Bitcoin, namely Zark by Lx DEV, a statechain with a blinded co-signer and zero-knowledge proofs, and LayerTree by Lightning Labs, a non-custodial scaling solution which allows multiple users to share a Bitcoin UTXO.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

LDK contributors are working on adding support for BOLT12 recurrence in the Lightning Implementation.

During the biweekly call, on Monday 12th, LDK contributors discussed the latest updates to the Lightning implementation. One of the most interesting things devs are working on right now is adding support BOLT12 recurrence in LDK Node.

Developer Shashwat Vangani is currently working on PR1119 in LDK Node, which builds on the previous work done in rust-lightning — which introduced protocol primitives, message handling, and payment flow.

This PR introduces the management whole recurrent payment workflow to LDK Node, such as persistence of recurrent payment state, updates, scheduling, and APIs for applications to manage recurrence.

A BIPs Update

There was no newsworthy update in the last days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

Other News from the Bitcoin World

Zark: Lx Dev announced a new protocol for private, offchain Bitcoin transfers called Zark. The protocol is based on the statechain paradigm and leverages zero-knowledge proofs to improve users’ privacy.

The protocol’s coordination relies on a co-signer. This entity is blinded, which means that it signs a UTXO transfer without getting to know the specific details about the transfer itself. Users need to trust the co-signer to delete the keyshares belonging to a previous owner.

Users can prove their ability to spend, receive, and withdraw coins using zero-knowledge proof. This means that inside the protocol the amount of leaked information about previous owners — such as payout addresses — is highly reduced, improving privacy.

Lx Dev published an extensive overview of Zark, which dives into how the protocol works and which are the trade-offs to be taken into account.

LayerTree: Lightning Labs announced LayerTree, a new non-custodial scaling solution on Bitcoin, which allows multiple users to share a Bitcoin UTXO.

Ownership is recorded offchain into a Merkle-sum tree in which each leaf represent a user’s balance, and Each node of the tree holds a hash of its children, up to the root. The shared UTXO commits to the root of this tree.

The protocol cannot work on Bitcoin as it is today. According to Lightning Labs CTO Olaoluwa Osuntokun, LayerTree needs covenant to work. Interestingly enough, no specific opcode is needed, but the protocol could work with any of the proposals already drafted.

Lightning Labs published a full website, which allows users to interactively understand how the protocol works.

Post-quantum Shielded CSV: Jonas Nick reported that a research group from Imperial College had published a paper introducing a post-quantum version of ShieldedCSV, called Compact ShieldedCSV. Unlike ShieldedCSV — where the nullifier carries a signature — Compact’s nullifiers carry no signature, only something called a “degriefer”.

More from BTC++ Insider Edition

News Hour

BTC++ News Hour: Check out our Friday livestream, where Matthew Vuk and I discuss the most interesting news of the week from the Bitcoin developer ecosystem. This time, we hosted our first guest, Lx Dev CEO Janusz, to talk about Zark.

Videos

Pim Keer — BTC++ Insider Interviews: Pim Kerr, PhD Researcher at the Security and Privacy Group of TU Wien, talks to the Insider about the work his research group is doing to formalize and prove the security of the Ark protocol.

Pietro Valese — BTC++ Insider Interviews: Pietro Valese, Lab Manager at BitPolito, talks to the Insider about what BitPolito is and what it is doing to connect students and the Bitcoin industry.

TheMhv — BTC++ Insider Interviews: TheMhv, Vinteum fellow and Cashu contributor talks to the insider about his work on the Cashu Development Kit (CDK), new NUTs, and the importance of meeting the people you work with in real life.

Articles

The prefill was already there - This Week in Bitcoin Core #62

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Seoul this November 5-6 to talk about privacy in Bitcoin!

In this week’s update by @npub1jeq…nmal, we feature the ...

2026-10-12T14:12:43Z

In this week’s update by tuma (npub1jeq…nmal), we feature the latest news from Marmot (marmotprotocol (npub1mar…r6m9)) — with the team working on bringing multi-device to the protocol — and the implementation of efficient animated QR codes in Cashu (Cashu (npub17fz…9yxv)).

We also cover the effort by Robin Linus to make taproot annexes standard in Bitcoin Core, an attack to Second that resulted in 0.75 bitcoin stolen, and the latest patch release for Core-lightning.

quoting
naddr1qv…xhdh

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature the latest news from Marmot — with the team working on bringing multi-device to the protocol — and the implementation of efficient animated QR codes in Cashu.

We also cover the effort by Robin Linus to make taproot annexes standard in Bitcoin Core, an attack to Second that resulted in 0.75 bitcoin stolen, and the latest patch release for Core-lightning.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

Marmot protocol specifications are now stable and the team if focusing on the next features, such as multi-device.

During the monthly community call, on Tuesday 6th, Marmot developers discussed the latest improvements in the protocol for secure, private messaging and in the White Noise application and gave an update on the next steps.

Marmot specifications are quite stable now and the Marmot Development Kit (MDK) is nearly on par with them. The team solved a bug that did not allow a group to have more than 50 users and is currently working on making media upload faster and more efficient and focusing on how to make Marmot itself more private.

Devs are now focusing on one of the most requested, multi-device — i.e. the possibility to have the same chats, with the same messages, on multiple devices. This is one of the most complex features to work on, given the decentralized nature of the protocol. The team is currently gathering ideas on that and is working toward a draft specification.

Cashu developers are implementing efficient animated QR codes thanks to a discussion at the bitcoin++ conference in Berlin.

During the weekly call, on Wednesday 7th, CDK developers discussed PR2646 which aims to add binary fountain token transport, a way to make animated QR codes more efficient.

This new feature comes from a discussion between Cashu developer Egge and Fedimint contributor Joschisan during the Berlin bitcoin++ conference. Joschisan had previously implemented custom, efficient fountain QR codes in Fedimint.

The feature is also being implemented in cashu-ts — the TypeScript implementation of the Cashu protocol — and an upgrade to the NUT-16 specification is currently under discussion. Moreover, Egge published the nut-fountain repository which includes a TypeScript implementation and a playground to test the new feature in the browser.

A BIPs Update

There was no newsworthy update in the last days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

Other News from the Bitcoin World

Making taproot annex standard: Robin Linus — BitVM creator and developer working on Shielded CSV (now Glass Coins) — decided to open a pull request to make taproot annexes standard in Bitcoin Core.

A taproot annex is an optional field in the witness structure of taproot inputs that can be used to store additional data. This field still hasn’t a clear use-case and was reserved for future updates.

Glass Coins need to post data to the main chain, as a requirement to prevent double-spending in the client-side validated protocol. Linus’ idea would be to leverage the annex for that specific purpose. However, Bitcoin Core does not relay annexes by default. Linus’ PR aims to change that, allowing Bitcoin Core nodes to relay them.

As Rearden pointed out, however, two implementations already relay the annex by default, namely LibreRelay and rbitcoin.

Bark Hacked: Second revealed that the company had been hacked on Monday 5th. An attacker exploited a bug in the Ark Server’s boarding flow and managed to steal 0.75 bitcoin of Second’s own liquidity. No users’ funds were stolen.

The attacker was able to exploit a bug that allowed him to board the Ark Server using only his own signature. Usually, the process requires a co-signature from the Server itself. Thus, the attacker was able to exit the ark protocol with the funds, while at the same time spending his VTXOs through Second’s Lightning gateway.

No funds from Second’s users were stolen, thanks the design of the Ark protocol. In fact, users’ VTXOs sit on a pre-signed exit path that no one else — server included — can spend.

An interesting thing about this attack was that the liquidity used to perform it was linked to the hack that hit Blink couple of weeks ago.

Upgrade Core-lightning: The Core-lightning team released a new patch version, v26.06.9, that fixes a vulnerability that could lead to a loss of funds. The team suggested an immediate upgrade for node operators running version v26.06.8 and lower.

More from BTC++ Insider Edition

News Hour

BTC++ News Hour: Check out our Friday livestream, where Matthew Vuk and I discuss the most interesting news of the week from the Bitcoin developer ecosystem.

Articles

The comma is the limit - This Week in Bitcoin Core #61

Bitcoin++ — Payments Edition Livestream

Day 1: Check out the livestream for the first day of the Berlin event!

Day 2: Check out the livestream for the second day of the Berlin event!

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Seoul this November 5-6 to talk about privacy in Bitcoin!

In this week update by @npub1jeq…nmal we feature the most ...

2026-10-05T14:06:56Z

In this week update by tuma (npub1jeq…nmal) we feature the most interesting things happened during Bitcoin++ Payment Edition in Berlin. During the three-days conference, developers met to discuss how to make Bitcoin payments better for everyone.

We also cover some interesting news from the Bitcoin ecosystem. Notably, we discuss Peter Todd joining MARA Foundation, an interesting deep dive by Vinteum, and Blink Wallet’s post-mortem on the recent attack to their users.

quoting
naddr1qv…63d3

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week update we feature the most interesting things happened during Bitcoin++ Payment Edition in Berlin. During the three-days conference, developers met to discuss how to make Bitcoin payments better for everyone.

We also cover some interesting news from the Bitcoin ecosystem. Notably, we discuss Peter Todd joining MARA Foundation, an interesting deep dive by Vinteum, and Blink Wallet’s post-mortem on the recent attack to their users.

Highlights from Bitcoin++ — Payments Edition

I spent last week at Bitcoin++ Payments Edition in Berlin. The first day of talks will be live-streamed starting from Thursday, October 8th, at 5PM UTC.

Day 1

Rene Pickhardt kicked-off the Berlin conference by talking about his experience in working on Lightning.

Calle gave a talk describing how they are working towards federaing Cashu ecash, so as not to rely on a single mint.

Erik Cativo, the designer behind several Cashu applications, talked about how they built the Numo point-of-sale app by working closely with the merchant using it.

Steven Roose, CEO at Second, described how Bark — their implementation of the Ark protocol — can make self-custodial Bitcoin payments easier.

Allen Farrington came back to Berlin for a sequel talk on the fiat payment stack. This time, he talked about how the different layers of Bitcoin can improve payment technology.

Day 2

Aleksei Moskvin and Markus Schofnegger, researchers at [[alloc]init], talked about Shielded Bitcoin, the new metaprotocol that promises ZCash-style private Bitcoin payments on-chain with no consensus change needed.

Setor, the developer behind BilndBit, talked about how is product is trying to balance UX and privacy for silent payments.

Elias Rohrer gave a talk about Loupe, the AI-assisted security scanning suite used in several projects across the Bitcoin ecosystem.

Jesse Shrader examined the technologies and opportunities behind cross-currency payments on Bitcoin using Lightning.

Niftynei moderated a panel with Calle, Joschisan, Michael, and Elias, where the devs discussed their different experiences with LLMs and tried to understand if Bitcoin can survive the current AI onslaught.

Day 3

Stutxo gave a talk on how to make Bitcoin magical internet money again, thanks to the ongoing effort of several projects.

Pim Keer presented a protocol for accountable Chaumian ecash, which protects users from token overissuance while maintaining unlinkability.

Jungly described the P2Poolv2 Share Chain, a way to make miner payouts non-custodial.

Ilya Evdokimov presented Zerosats, an experiment that aims to make Bitcoin transactions private while keeping the base chain maximally transparent.

Lightrider talked about his 7-years long experience in accepting Bitcoin as a payment method.

Niftynei moderated the final panel with Liam Eagen, George, Matthew Vuk, and Markus Schofnegger, exploring which should be the future Bitcoin stack for payments.

A BIPs Update

There was no newsworthy update in the last days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

Other News from the Bitcoin World

Peter Todd <> MARA Foundation: MARA Foundation recently announced that Peter Todd had joined them as Lead Maintainer of Slipstream, a private mempool service that allows direct submission of transactions to MARA’s mining pool. Todd’s involvement with Slipstream is mainly due to the use of the service as a proving ground for different proposals in the Bitcoin R&D space.

Vinteum’s Deep Dive on Privacy: Vinteum — the organization behind open-source Bitcoin development in Brasil — published an interesting deep dive on how chain analysis work, with the aim to understand how private are Bitcoin transactions.

Blink Wallet Attack Post-mortem: Blink recently published the post-mortem for the attack that affected their wallet and that resulted in 6.61 bitcoin stolen from their users. It seems that the attacker leveraged a flaw in their admin tools to gain access to 35 accounts. All affected users were made whole, and the company put a bounty as high as 50% of the recovered funds.

More from BTC++ Insider Edition

Articles

v32.0 is around the corner - This Week in Bitcoin Core #60

Shielded Bitcoin & PIPEs: 12 Questions & Answers

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Seoul this November 5-6 to talk about privacy in Bitcoin!

In this week’s update by Tuma (@npub1jeq…nmal) we feature ...

2026-09-28T14:11:00Z

In this week’s update by Tuma (tuma (npub1jeq…nmal)) we feature some new NUT specifications currently being discussed for improving the Cashu protocol (Cashu (npub17fz…9yxv)).

We also cover Shielded Bitcoin, a new protocol by [[alloc]init] to provide private bitcoin transactions, the new plugin by Second (second (npub1ake…pfwt)) for simplifying accepting Bitcoin through BTCPayServer (btcpayserver (npub155m…dcvg)), Ben Carman’s work to include Lightning in the x402 specifications, and the latest maintenance release for Core-Lightning.

quoting
naddr1qv…c82d

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature some new NUT specifications currently being discussed for improving the Cashu protocol.

We also cover Shielded Bitcoin, a new protocol by [[alloc]init] to provide private bitcoin transactions, the new plugin by Second for simplifying accepting Bitcoin through BTCPayServer, Ben Carman’s work to include Lightning in the x402 specifications, and the latest maintenance release for Core-Lightning.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

The Cashu ecosystem is working on implementing new features and proposing new NUT specifications.

During the monthly community calls, on Thursday 24th, Cashu developers discussed the latest news from the ecosystem. In particular, they presented new additions to the NUT specifications.

PR433 introduces compact state filter, a concept similar to compact block filters (BIP158) available on Bitcoin. This new feature aims to increase the privacy of the protocol by allowing a wallet to retrieve the information about the state of a token locally, without providing the mint with all the token identifiers. Instead, the mint would provide the wallet with filters containing the state of a token.

PR450 adds an optional NUT that allows a mint to publish a bid and an ask price on its own liquidity. Since there are several payment methods available for minting and melting — LN, on-chain, Bark —, this NUT would allow the mint to set different prices on the liquidity available on different payment methods, thus attracting liquidity where needed the most.

A BIPs Update

In the last days there was some movement in the BIP repository. Specifically, one new BIP has been published by BIP maintainer Murchandamus.

Published BIPs

A list of recently published BIPs

BIP138: Compact encryption scheme for non-seed wallet data

Published On: Sep 21st, 2026

Layer: Applications

BIP138 specifies a compact encryption scheme for output descriptors, wallet policies, labels, and wallet backup metadata to allow users to store sensible information on untrusted media. The encryption key is derived from the public keys in the descriptor, allowing any keyholder to decrypt the data without additional secrets.

Other News from the Bitcoin World

Shielded Bitcoin: [[alloc]init] presented a new metaprotocol to make Bitcoin transactions more private, called Shielded Bitcoin. The proposal — presented in a dedicated paper by Clara Shikhelman, Misha Komarov, and Aleksei Moskvin — does not require neither changes to the Bitcoin consensus, nor operators or trusted third parties.

A Shielded Bitcoin transaction is a blob of data included in an on-chain transaction through an OP_RETURN or other data-carrying fields. The transaction validation is demanded to an external node, called Indexer, which has also the task to update the state of an output.

Shielded Bitcoin uses a specific type of output, called note, which plays a similar role as a Bitcoin UTXO. However, while UTXOs are deleted from the set once they are consumed, notes are spent by posting a proof and nullifier. To check whether a note has been spent or not, a user checks if its nullifier has already been used or not.

For what concerns the peg, the protocol uses Bitcoin PIPEs v2. This is a witness encryption method that can be used to reproduce covenant semantics without changes to Bitcoin consensus. Basically, instead of locking a certain output behind a spending condition, it allows a user to specify those conditions on the key needed to move those funds, adding prerequisites on whether a valid signature can be produced or not.

Bark <> BTCPayServer: Second — the company behind the Ark implementation Bark — announced that their plugin for BTCPayServer was available for use in production.

Historically, BTCPayServer has relied on Lightning to allow merchants to accept Bitcoin payments. That meant taking on all the difficulties of running a full Lightning node, such as channel management, liquidity, and maintenance.

The new Bark plugin allows merchants to accept Bitcoin without all of that. Users will now be able to run their self-hosted BTCPayServer instance without running a Lightning node behind and to accept self-custodial, instant Bitcoin payment in a simpler way.

Lightning <> x402: LDK maintainer Ben Carman announced that Lightning had been officially included in the x402 specifications.

x402 is an open standard for native internat payments built on top of HTTP. It is currency-agnostic, which mean that it can support any payment rail, such as Bitcoin, stablecoins, and fiat. It is supported by some of the biggest corporations in the world, such as Amazon, Amex, Google, Mastercard, but also by come big companies in the wider crypto industry, such as Ripple, Coinbase, Solana.

Given the companies involved, it is not surprising that Bitcoin had not been added yet to the x402 standard. Ben Carman was able to close this gap, pushing for the inclusion of Lightining in the specifications.

CLN Release: The Core-lightning team announced the release of a new maintenance version of the Lightning node software, v26.06.8. This version includes several fixes for bugs and vulnerabilities that were responsibly disclosed in the last weeks. Contrary to the previous version, no embargo was put on this release, making the source code available from the beginning. However, the team noted that some tests were withheld from publication to prevent attackers from reverse-engineering the vulnerabilities.

More from BTC++ Insider Edition

Articles

Silent Payments finally made some noise - This Week in Bitcoin Core #59

Videos

Russel O’Connor — BTC++ Insider Interviews | Part 1: Russel O’Connor talks to the Insider about his current work in formal verification of mathematics and software.

Russel O’Connor — BTC++ Insider Interviews | Part 2: Russel O’Connor lks to the Insider about SafeGDC, the new algorithm for modular inverse and how Bitcoin devs like Greg Maxwell, Pieter Wuille, and Peter Dettman implemented it in libsecp256k1 and how it was formally verified.

Russel O’Connor — BTC++ Insider Interviews | Part 3: Russel O’Connor talks to the Insider about libsecp256k1, and the initial choices Satoshi made on the cryptography of Bitcoin.

Russel O’Connor — BTC++ Insider Interviews | Part 4: Russel O’Connor talks to the Insider about why he chose to work on modular inverse and what he would like to work on next.

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

In this week’s update by @npub1jeq…nmal, we feature the ...

2026-09-21T14:12:20Z

In this week’s update by tuma (npub1jeq…nmal), we feature the latest releases for the Stratum V2 protocol. Maintainers focused mainly on hardening, refactoring and bug fixing, while also introducing support for BIP323.

We also cover several news from the developer ecosystem. Notably, we discuss a first working proof-of-concept for a post-quantum Lightning implementation, a new scaling protocol to bring self-custody to a huge number of users, and other interesting news.

quoting
naddr1qv…dft6

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature the latest releases for the Stratum V2 protocol. Maintainers focused mainly on hardening, refactoring and bug fixing, while also introducing support for BIP323.

We also cover several news from the developer ecosystem. Notably, we discuss a first working proof-of-concept for a post-quantum Lightning implementation, a new scaling protocol to bring self-custody to a huge number of users, and other interesting news.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

The Stratum V2 published new releases for the Stratum protocol, the applications, and the new UI.

During the weekly call, on Tuesday 15th, Stratum V2 developers announced that the new versions for the Stratum V2 libraries were ready to be published. The releases were published on Thursday 17th.

v.1.12.0 is the new release for the protocol libraries. Developers focused on hardening and refactoring several parts of the protocol, introducing several breaking changes. Moreover, this release introduces BIP323, which reserves 24 bits in the nVersion field as extra nonce space for miners.

Releases for sv2-apps and sv2-ui were also published. sv2-apps v0.8.0 hardens the applications by fixing several issues found by Loupe — the AI-assisted vulnerability scanner by Spiral —, improves the translation proxy (tProxy) and the Job Declaration Client (JDC), and adds supports for BIP323. sv2-ui v0.7.0 mainly addresses vulnerabilities found by Loupe.

A BIPs Update

In the last days there was some movement in the BIP repository. Specifically, one new BIP has been published by BIP maintainer Murchandamus.

Published BIPs

A list of recently published BIPs

BIP461: Deterministic ECDSA Signatures

Published On: Sep 16th, 2026

Layer: Applications

BIP461 defines how to obtain deterministic ECDSA signatures. A signature is now encoded using the Distinguish Encoding Rule (DER), which results in two numbers r and s , treated as big-endian signed integers. Due to the sign, in case a r number has its most significant bit set to 1 , hence treated as negative, a null byte is added to keep it positive. BIP461 describes how to do low r grinding of an ECDSA signature, to avoid adding an additional byte to it. The described process is deterministic, following RFC6979.

Other News from the Bitcoin World

Quantum Lightning: Ahmet Kurt, a researcher from East Texas A&M University, posted to Delving Bitcoin to present a first proof-of-concept for a quantum-secure implementation of the Lightning Network, called PQLN.

Kurt published a paper, which presents a hybrid post-quantum extension of Lightning that protects all the different layers composing it — gossip, onion routing, invoice, peer services — with the lattice-based standards ML-DSA and ML-KEM. The proposed changes don’t need any modification to the consensus layer of Bitcoin, since they are LN-specific.

As the author specifies, the huge cost for PQLN is bandwidth. A PQLN node on regtest needs to download 10 times and needs to store around 9 times more data than a legacy node. On the other hand, computation seems not to be the bottleneck, since the most expensive operation — ML-DSA signing — only takes 0.33ms.

A fork of rust-lightning that implements the new post-quantum approach is already available on GitHub.

Depot: John Law posted to Delving Bitcoin a proposal for a new scaling protocol whose goal is to provide self-custodial Bitcoin to a large number of users. This new protocol is called Depot.

The proposal builds upon three principles: it has a small, on-chain footprint, it allows user to participate even if they don’t have enough bitcoin to put a transaction on-chain, and it avoids creating more off-chain transactions than can be put on-chain before theft occurs.

An operator funds one Taproot output that can be used to create probabilistic off-chain Lightning channels for a high number of users. Each user buys channels though a LN payment, which can be used to make payments.

The security of the protocol depends on expiry management, expected values, and penalties that make griefing economically irrational. To be viable, the proposal would require new opcodes, such as OP_CTV and OP_CSFS.

Swaptopia: Grubles, researcher at Second, launched Swaptopia, a new swap service to move funds between on-chain and Lightning. Swaptopia is built upon Bark — Second’s Ark implementation —, it’s self-custodial, and runs completely in the browser.

To move funds from on-chain to Lightning, this service boards the Ark Server and send a Lightning payment for the specified amount. On the other hand, to move from Lightning to on-chain the service receives the payment and offboards the Ark Server, moving funds on-chain.

CLN Security Advisory: The Core-lightning team provided a security advisory, suggesting operators running their nodes with experimental features enabled to switch-off that feature immediately. The advisory comes after reports from users of a possible loss of funds, and an investigation is currently ongoing.

More from BTC++ Insider Edition

News Hour

BTC++ News Hour: Check out our Friday livestream, where we discuss the most interesting news of the week from the Bitcoin developer ecosystem.

Articles

The GUI doesn’t speak RPC - This Week in Bitcoin Core #58

Videos

Rob Hamilton — BTC++ Insider Interviews: “CEO of Bitcoin” Rob Hamilton gives a shoutout to instagibbs and explains how BIP-448 TEMPLATEHASH would benefit AnchorWatch

Naiyoma — BTC++ Insider Interviews | Part 1: Developer Naiyoma tells us about Private Broadcast, which she reviewed in Bitcoin Core. It sends transactions over short-lived Tor or I2P connections to hide the origin IP.

Naiyoma — BTC++ Insider Interviews | Part 2: Developer Naiyoma tells us how fingerprinting attacks can link a Bitcoin node’s clearnet and Tor identities, weakening privacy.

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

In this week’s update by @npub1jeq…nmal, we feature the ...

2026-09-14T14:12:28Z

In this week’s update by tuma (npub1jeq…nmal), we feature the latest release, v3.1.0, of the bindings library for BDK (bitcoindevkit (npub13dk…gnvc)), exposing the latest development to several programming languages.

We also cover the publication of BIP332, defining a new, opt-in P2P message, a a new BIP that has been assigned a number, BIP394, which defines a new output script descriptor, called rawtr() .

We finally discuss some other news from the Bitcoin developer ecosystem. In particular, we talk about a bug in the legacy gateway module in Fedimint (fedimint (npub1su3…cngd)), a blog post from Second (second (npub1ake…pfwt)) on how to board an Ark using Payjoin, and a research by BlueWallet CTO on the security of non-custodial wallets on the App Store.

quoting
naddr1qv…kk30

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature the latest release, v3.1.0, of the bindings library for BDK, exposing the latest development to several programming languages.

*We also cover the publication of BIP332, defining a new, opt-in P2P message, a a new BIP that has been assigned a number, BIP394, which defines a new output script descriptor, called rawtr() .*

We finally discuss some other news from the Bitcoin developer ecosystem. In particular, we talk about a bug in the legacy gateway module in Fedimint, a blog post from Second on how to board an Ark using Payjoin, and a research from BlueWallet CTO on the security of non-custodial wallets on the App Store.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

The BDK team released the latest version of their bindings, v3.1.0, bringing the whole library to several programming languages

During their weekly call, on Tuesday 8th, BDK contributors discussed the release of bdk-ffi v3.1.0, the library that allows to expose the Rust codebase to several other programming languages, such as Dart, Swift, Kotlin, Python, and react-native.

This release upgrades UniFFI — the bindings generator — to v0.31.2 and brings the bindings up-to-date with the latest release of the BDK Wallet libraries, exposing several new methods, such as those to choose the coin selection algorithm, wallet signers, APIs to load wallet parameters, and more.

bdk-dart — the library exposing BDK to Dart — has been upgraded to use the latests bdk-ffi library, and a new release candidate, v1.0.0-rc.4 has been published. This update brings the Dart bindings closer to a first stable release.

A BIPs Update

In the last days there was some movement in the BIP repository. Specifically, one new BIP has been published and one has been assigned a number by BIP maintainer Murchandamus.

Published BIPs

A list of recently published BIPs

BIP332: Stale Tip Relay

Published On: Sep 9th, 2026

Layer: Peer Services

BIP 332 defines a new, opt-in P2P message called staletip whose goal is to announce recent stale chain tips to peers. The message contains the block height at which a stale branch diverges (the fork point), a vector containing the block headers belonging to the stale branch, and a flag signaling willingness to serve that block data. This may be useful for monitoring the network health, since increases in the stale block rate may expose validation or relay bottlenecks, network partitions, or selfish mining behavior.

Numbered BIPs

A list of BIPs that recently got assigned a number

BIP394: rawtr() Output Script Descriptors

Assigned On: Sep 9th, 2026

Layer: Applications

PR2251 introduces BIP394, which defines a new output script descriptor, called rawtr() . The descriptor — that has been available in Bitcoin Core since v24.0 but was never specified in a BIP — can be used to express a P2TR output directly by its output key. The key is used as the taproot output key without applying the BIP341 tweak. This is useful, for example, when the internal structure isn’t known, or the script tree hasn’t been revealed by the owner.

Other News from the Bitcoin World

Fedimint Bug: The Fedimint team announced that they had found a bug in the legacy gateway module, the one responsible for integrating the federated ecash ecosystem with the Lightning Network.

The team released v0.12.1 to fix the issue and contacted all the reachable gateway operators to invite them to update their modules as soon as possible.

The issue only affects legacy gateway modules, those running the so-called LNv1, while those that had previously upgraded to LNv2 or those running an LDK backend can run safely. The team also point out that users’ funds, federations, and ecash are not affected by the bug.

Boarding an Ark with Payjoin: Second, the company behind Bark, posted a thread explaining how to board and Ark using Payjoin, a feature that has been available for some time now. The same flow is also available to enter a Cashu mint. Second also provided a full write-up on the topic.

App Store Research: BlueWallet CTO @overtorment pubished a report on the security of non-custodial wallets on the App Store.

The research focused on finding traces of weak entropy and private key exfiltration by decompiling and analyzing code from different wallets.

@overtorment was able to decompile 494 wallets, 45 of which raised red flags. He identified 23 apps with critical vulnerabilites and 22 with high-severity one. The complete list can be found at the end of the report.

Bitcoin++ Insider Edition — News Hour: On Friday, the Insider team held its first News Hour, a livestream where we discussed the most important news of the week, interesting articles, and the latest insides from the developer ecosystem. This will become a weekly appointment, so don’t forget to tune in on Friday @ 5p UTC!

More from BTC++ Insider Edition

Articles

Egge Wants You to Pay with Bitcoin

How cache optimization, not broken crypto, caused inflation on Liquid

temudandelion - This Week in Bitcoin Core #57

Videos

Connor Aherne - BTC++ Insider Interviews

Antoine Poinsot - BTC++ Insider Interviews

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

Insider Edition talks to Egge (@npub1mhc…c226), a prolific ...

2026-09-09T14:11:21Z

Insider Edition talks to Egge (egge (npub1mhc…c226)), a prolific Cashu (Cashu (npub17fz…9yxv)) developer about how he's accelerating paying with bitcoin.

quoting
naddr1qv…jmht

Egge is one of the lead developers in the Cashu ecosystem. Former maintainer of cashu-ts, the TypeScript implementation of the protocol, he is now building Coco, a library that aims to make integrating Cashu as easy as possible.

We reached out to talk with him about bitcoin-based payments, which will be the main topic at the next Bitcoin++ conference in Berlin.

Hi Egge! Tell us a bit about yourself and what you are working on! What are you going to talk about in Berlin?

I’m an open-source developer working mostly on Bitcoin payments and Cashu. My goal is to make Bitcoin payments accessible to anyone, enabling a more sovereign world.

A lot of my current work revolves around Coco, a TypeScript framework for building applications on top of Cashu. Cashu already provides really powerful payment rails, but there is still a lot of complexity involved in implementing a full wallet or payment system correctly. Coco tries to abstract a large part of that complexity while still giving developers control over how their application works.

In Berlin I’ll be doing a workshop showing how easy it can be to integrate Bitcoin payments into products using Cashu and Coco. I want developers to leave with the feeling that adding Bitcoin payments to an app or ecommerce product doesn’t have to be a massive undertaking anymore.

The topic of Bitcoin++ Berlin is payments. Where do you stand on the Bitcoin monetary-scale? Is Bitcoin more a Store of Value (savings) or a Medium of Exchange (payments)?

Both are incredibly important, but personally I care even more about Bitcoin as a medium of exchange.

Bitcoin being a global, accessible, fair and equal form of money is what makes it so powerful. The store-of-value aspect is obviously important for building sustainable wealth, but the freedom to transact freely is even more fundamental to me.

If I had to choose between a world where Bitcoin becomes the dominant savings asset but everyone continues paying through fiat systems, and a world where hundreds of millions of people actually transact using Bitcoin-native payment rails, I would choose the latter.

That said, I think the distinction is mostly theoretical. I find it hard to imagine Bitcoin being adopted globally as a payment system without also establishing itself as a major global monetary asset and taking market share from other stores of value.

Currently, we can see both a lack of merchants accepting bitcoin and users spending it. Do you think it is more an economical problem — i.e. bitcoin exchange rate is continuously rising and people do not want to spend it — or a UX one — it is difficult to use and accept bitcoin?

I think it is a combination of several things.

There are already very orange-pilled merchants who would like to accept Bitcoin, but the additional integration work, accounting, tax considerations and general operational complexity make it unattractive.

On the user side there are similar problems. People have to figure out how to convert fiat into Bitcoin, which wallet to use, which provider to trust, how custody works, what payment method they need and so on. Even terminology like addresses, invoices, payment requests, sats, Bitcoin, Lightning and ecash can become intimidating very quickly.

And then you have the classic chicken-and-egg problem. Merchants are more willing to do the work of adding Bitcoin if it lowers their fees or brings them additional customers. Users are more willing to learn how to pay with Bitcoin if they can actually use it in many places.

I don’t really buy the argument that people will not spend Bitcoin because it appreciates. People need to consume regardless of what currency they save in.

“Spend and replace” is a completely valid strategy: spend Bitcoin and use the fiat you would otherwise have spent to replace the Bitcoin. You can take that even further and simply get paid in Bitcoin.

I think the HODL movement has sometimes created this idea that spending Bitcoin is inherently bad. I disagree with that.

How do we make sure that Bitcoin is actually used as a payment method? How do we convince more merchants to accept it and more people to spend it?

A big part of it is simply making the experience dramatically better.

We need Bitcoin payment systems that can compete with PayPal and Visa on UX. A normal person should not need to understand payment rails, liquidity management or protocol details just to pay for something.

I think we will increasingly see wallets and merchant applications dynamically choose between different payment mechanisms behind the scenes. BIP321 is already moving in this direction by allowing payment requests to contain several possible payment methods.

We experimented with this in Numo, a mobile Cashu point-of-sale application. A merchant can present a single payment-request QR code and accept both Lightning and Cashu bearer payments. The merchant does not need to present different buttons or explain different protocols to the customer.

There are situations where understanding the underlying technology is absolutely critical. Cold storage is the obvious example: if you are protecting your life savings, you need to understand what you are doing.

But spending-money applications are different. We should be comfortable hiding complexity there.

At the same time, I do think we should actively explain why spending Bitcoin matters. Bitcoin does not become a widely used monetary system simply by everyone holding it forever.

You are one of the leading voices in the Cashu ecosystem. Do you think Cashu is the best attempt at making Bitcoin everyday money? What are the strongest advantages in using Cashu as money compared to other layers? What are its disadvantages?

I don’t think there is an absolute best solution. Every payment system has trade-offs.

What I think Cashu does exceptionally well is UX. Representing money as a digital bearer asset enables interactions that feel much closer to physical cash.

You can make offline payments. You can literally put money into a message or an email. You can drop money into a digital tip jar. The receiver does not necessarily have to be online at the exact moment the payment is created.

Cashu can also interact with the wider Bitcoin ecosystem, so it does not need to exist as an isolated payment network.

Another major advantage is what it can do for developers. Cashu encapsulates an enormous amount of payment complexity, and the developer tooling has become very good. With libraries like CDK and Coco, and increasingly capable AI development tools, building a functional Cashu wallet can genuinely become an afternoon project.

That accessibility is important to me. If we want thousands of applications experimenting with Bitcoin payments, developers need primitives they can actually build with.

The most obvious trade-off is custody. A Cashu mint is a custodian, and you have to trust it with the Bitcoin represented by the ecash it issues.

But Cashu is not supposed to be a vault. I think of it much more like the cash you carry in your pocket. Long-term savings belong in proper Bitcoin self-custody.

One useful property of Cashu is that the custodial risk can also be distributed across multiple independent mints. Instead of putting all your spending balance with one custodian, you can hold ecash from several.

There are also interesting approaches for reducing trust further. Federations are one option, although they introduce their own complexity. TEEs are another promising approach for reducing how much trust needs to be placed in the operator. There are a lot of experiments happening here, and I think we will learn over the next few years which models work best.

Another challenge is simply domain knowledge. Cashu makes many things technically easier, but users can still be confronted with Bitcoin terminology and then additional concepts such as ecash, tokens and mints.

That is ultimately a UX problem for us to solve. Users should not need to become protocol experts in order to spend money.

Other than Cashu, what are you most excited to see at Bitcoin++ Berlin?

Definitely the hackathon.

It is always incredibly fun seeing what people come up with when you put a lot of smart Bitcoin developers in one place and give them permission to experiment.

Some genuinely novel ideas and projects come out of these hackathons, including things nobody would have predicted beforehand. That experimentation is one of my favorite parts of Bitcoin++.

We’d like to thank Egge for his availability for this interview. Would you like to attend Egge’s workshop and see what devs are working on? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

In this week’s update by @npub1jeq…nmal we feature the latest ...

2026-09-07T14:12:33Z

In this week’s update by tuma (npub1jeq…nmal) we feature the latest releases in the ecash ecosystem, Fedimint (fedimint (npub1su3…cngd)) v0.12.0 and Cashu Dev Kit (Cashu (npub17fz…9yxv)) v0.18.0.

We also cover the recent hack to the Liquid Network. Attackers, who stated to be whitehats, were able to stole 3998 bitcoin with a peg-out transaction leveraging a bug in the validation logic.

quoting
naddr1qv…jeek

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature the latest releases in the ecash ecosystem, Fedimint v0.12.0 and Cashu Dev Kit (CDK) v0.18.0.

We also cover the recent hack to the Liquid Network. Attackers, who stated to be whitehats, were able to stole 3998 bitcoin with a peg-out transaction leveraging a bug in the transaction validation logic.

We finally cover some other news, such as an implementation of multisig in Bitcoin Core GUI and a proposal to use silent payments in the coinbase transaction to pay miners for their hashrate.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

Fedimint release v0.12.0 is out with new v2 modules, support for Iroh v1.0, and more.

During the weekly call, on Monday 31st, Fedimint developers discussed the release of Fedimint v0.12.0, called “Second Nature”.

The name of the release is linked to the fact that all the new v2 modules — lnv2, mintv2, and walletv2 — are now the default, with the older versions now labeled as “legacy”. Moreover, the latest version supports Iroh v1.0, the first stable release for the p2p networking stack.

v0.12.0 also improves the overall reliability of the system, reduces latency in Lightning payments, and allows recovery with no downtime and no blocking or stalling. Developers also released UniFFI bindings for Kotlin and Swift.

Cashu Dev Kit (CDK) release v0.18.0 is out, bringing the implementation up-to-date with the latest protocol changes.

During the weekly call, on Wednesday 2nd, CDK developers announced that they had just released the new version of the Cashu implementation, v0.18.0.

One of the most important changes is related to the mint configuration and settings. Previously, the mint configuration could be overridden by local settings and environment variables. v0.18.0 stores the authoritative settings in the primary mint database. The team provided a migration guide for mint operators.

The release also adds support for animated QR codes (NUT-16), signature-based authentication for mint quote redemption (NUT-20), BOLT12 offers descriptions (NUT-25), and deterministic nonces for DLEQ for offline ecash (NUT-12).

A BIPs Update

There was no newsworthy update in the last few days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

Other News from the Bitcoin World

Liquid Hacked: On Sunday 6th, news got around that the Liquid Network, Blockstream’s sidechain, had been hacked by whitehats. The attackers stole 3998 bitcoin from the Liquid bridge.

Hackers contacted Blockstream directly onchain using an OP_RETURN. The discussion went back and forth, with the attackers asking the company to fix the bug before returning the funds. Developers Sjors shared a gist reporting all the discussion between hackers and Blockstream.

The bug seems to be connected to confidential transactions (CT), one of the feature available on the Liquid network that allows a user to hide the amount and the type of asset being sent by default. Since CTs do not show the amount being spent, two types of proofs are needed to verify that a transaction is valid: a balance proof and a range proof. The former checks that the amounts of L-BTC in input and in output are the same. The latter, checks that an hidden output falls within a positive amount.

Calle provided a possible explanation of what happened. Basically, since the range proof is particularly expensive to compute, Liquid nodes can cache a successful proof in memory, stored by assigning a label called cache key. Attackers were able to build two transactions with colliding cache keys. The first one was a valid transaction, checked by nodes and stored. The second one, on the other hand, was an invalid transaction, effectively creating L-BTC out of thin air. However, having the same cache key, nodes did not perform all checks and made it pass as valid.

The situation is still evolving. Check out BTC++ Insider Edition X account for the latest updates

Silent Payments in Coinbase Transactions: Developer average_gary wrote a post on Delving Bitcoin explaining his idea to use silent payments to allow miners to get paid to different addresses for the provided hashrate without revealing an xpub.

The proposal would require a dedicated BIP since it is not currently possible to use the silent payments protocol defined in BIP352 as it is. The author is looking for feedback on the idea before moving on to a formal draft.

Multisig in Bitcoin Core GUI: Developer sdbtc announced that he was able to integrate multisig in the Bitcoin Core GUI by using Claude. He is now reviewing the code created by the LLM and polishing the implementation with the objective of opening a real PR in the repository.

Reads from BTC++ Insider Edition

BitPolito: How Italy’s Largest Bitcoin Student Org Is Passing the Reins to the Next Generation

Don’t start a node in the past - This Week in Bitcoin Core #56

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

Francesco Pelle, after an incredible 2 years at the helm, talks ...

2026-09-02T14:14:46Z

Francesco Pelle, after an incredible 2 years at the helm, talks to Insider about his time leading BitPolito and his work ushering in the student org’s next chapter.

quoting
naddr1qv…gjey

Chances are if you’re in the Italian Bitcoin community, or perhaps even those outside of it, you’ve heard of the most popular Italian students club: Politecnico of Turin’s BitPolito. Or maybe you’ve seen their logo, a pixelated blue cow, somewhere at a Bitcoin conference.

BitPolito was founded in 2018 by three students of the Politecnico di Torino: Giorgio Rasetto, Salvatore Scorsone, and Gabriele Vernetti. Inspired by their shared passion for the world’s most popular cryptocurrency, the three students united to bring a Italy’s first Bitcoin focused student’s club to life. Their objective: to bridge the gap between the academic world and the Bitcoin industry, helping members develop skills and create value for Bitcoin, by creating an educational environment focused on R&D in computer science and mathematics, holding classes for students, and organizing events in Turin and around Italy.

No price noise, just educational signal.

According to the latest annual report (2025/2026), BitPolito has more 55 active members. Historically, around 220 members have been active in the student’s organization, and there are now more than 30 former students actually working in the Bitcoin industry. For example, Gabriele Vernetti, one of the founders — known in cyberspace as GitGab19 —, is now one of the main maintainers of the Stratum V2 project.

The association is always present to the biggest Bitcoin events around the world. Other than talks at several Bitcoin++ events, in 2024/2025 the BitPolito guys could be found at the Plan B Forum in Lugano, BTC Prague, Baltic Honeybadger, and BTCHEL, and the Barcelona Cypher Conference.

In Italy, their impact can be also felt outside of the Politecnico. They organize events all over Italy — more than 70 according to the latest report —, they take part in the Italian-only conferences, such as the BitCare Forum in Breascia, and provide education to anyone willing to learn. With their “Bitcoin al Liceo” program, BitPolito is bringing Bitcoin and the Cypherpunk culture to high school students around Turin, while “BitGeneration” brings together the best educators in the Italian ecosystem to provide everyone with a full understanding of Bitcoin directly at the Politecnico.

BitPolito has also been invited to participate in an event organized by the Camera dei Deputati — one of the Italian parliamentary chambers — to present their view on what Bitcoin is and why it is important for a better future.

Franscesco Pelle has been BitPolito’s president since July 2024. After two years successfully leading the club, he is now stepping down, leaving the role to a member of the next generation. Francesco recently completed his academic journey in Management Engineering, and is graduating from the Politecnico. While his passion for Bitcoin and the BitPolito is as strong as ever, he is ready to move forward to his new chapter of life: “My main interests are entrepreneurship and product management. I currently work as a product manager at a startup, and I want to continue developing my skills in this field”, he says.

> “There is no single moment that I would describe as the most important one. Serving as president of BitPolito has been one of the most rewarding experiences of my journey so far. It was both a privilege and a responsibility to be part of a group of people united by values that I consider fundamental, starting with freedom and the other principles at the heart of Bitcoin.”

Giorgio Rasetto, one of the founders, and the rest of BitPolito’s OGs personally chose Francesco as the new president in 2024, when Giorgio himself completed his academic journey and decided to focus on his Bitcoin career. “They selected the person they believe is best suited to ensure continuity in the team’s activities, responsibilities, and leadership,” Francesco says, pointing out that he “had also demonstrated a strong commitment to BitPolito and its mission.” This seems to have reassured the founders they were entrusting someone who genuinely cared about what they were building.

Being the first president outside of the circle of the original founders, continuity has been one of the most important focuses of Francesco’s term. How do you make sure that the ethos, the values, and the ideas that led to BitPolito will remain intact, even after the founders are gone? “My main goal was to ensure BitPolito’s continuity and allow the work built over the previous years to continue. Today, the team includes highly motivated people who genuinely care about the project.”

One of the best ways to ensure continuity is through education. New members are not always operational until they have absorbed what Bitcoin is really about. Moreover, the structural organization has been made so that new members can easily integrate with the ongoing activities and the association in general.

“The president is responsible for providing leadership and maintaining an overall view of the team’s activities. The president does not hold exclusive decision-making power: they are part of a board where decisions and responsibilities are shared with the heads of the team’s internal divisions.”

The role of the presidency in BitPolito is a high-profile one. Other than giving a common direction to the organization and making sure that all the important initiative are completed on time, the president is responsible for managing institutional relationships with companies, projects, and, most importantly, with the Politecnico itself. During his term, Francesco was able to secure “significantly more financial support from Politecnico di Torino than in the past,” — something he is proud of — so that the members could continue attending events and travelling across Europe, promote both BitPolito and the Politecnico, and strengthen the relationships they had built over the years.

Francesco is proud of everything he has done during his presidency. He is proud of how BitPolito has impacted the Italian Bitcoin scene and how their events have allowed many people to get a closer look to Bitcoin and get fascinated by the ideas behind it. “Discovering Bitcoin can have a profound impact on someone’s life, and I believe that BitPolito has helped create that change for many people in Italy over time,” he says. Most importantly, though, he is proud of having been able to remain true to himself while “creating an environment where people could feel at home, take an active role, and freely bring forward their own initiatives.”

“I do not have any real regrets. There are certainly things I would have liked to do better or spend more time on, but they do not change how I feel about the overall experience. I am satisfied with what I did, and I am confident that the team will continue in the best possible way under its new leadership.”

Some things remain undone, like creating a more clearly defined and robust structure for the team’s internal processes and activities. Francesco is not worried, though. He is sure that the new president and the team will be able to fill this gap and continue on the same track of the people before them.

The new president has already been chosen. Luca Visconti, former Project Manager for the AI team, will take the presidency soon. The handover has already started and Francesco is delighted about his successor.

“I was impressed by how active he was and by the dedication with which he approached the responsibilities of the role”

According to Francesco, after years of expanding the network outside of the borders of Turin, the new president will have to focus the association back to where it all began. Engaging students, spread Bitcoin awareness among them, and grow the team.

Bitcoin++ Insider Edition would like to thank BitPolito president Francesco Pelle for his availability and wishes him a bright future for his Bitcoin career. We also would like to congratulate Luca Visconti for his new role and wish him a term full of success and satisfaction.

In this week’s update by @npub1jeq…nmal we feature nutroot ...

2026-08-31T14:07:39Z

In this week’s update by tuma (npub1jeq…nmal) we feature nutroot secrets, the latest improvement to the Cashu protocol (Cashu (npub17fz…9yxv)), which allows spending conditions to be included directly in the secret.

We also cover the first Shielded CSV developer call, where devs provided an overview of the high-level architecture. The team also announced that the protocol was renamed Glass Coins.

Finally, we discuss the most interesting news from the Bitcoin ecosystem. In particular, we cover BIP SHRINCS, the vulnerabilities found in Core-lightning, and the discontinuation of the Hardware Wallet Interface (HWI) library.

quoting
naddr1qv…qf5n

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature nutroot secrets, the latest improvement to the Cashu protocol, which allows spending conditions to be included directly in the secret.

We also cover the first Shielded CSV developer call, where devs provided an overview of the high-level architecture. The team also announced that the protocol was renamed Glass Coins.

Finally, we discuss the most interesting news from the Bitcoin ecosystem. In particular, we cover BIP SHRINCS, the vulnerabilities found in Core-lightning, and the discontinuation of the Hardware Wallet Interface (HWI) library.

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

Cashu devs are working on nutroot secrets, a new way to express spending conditions inspired by taproot.

During the monthly community call, on Thursday 27th, Cashu developers discussed the latest changes to the protocol specifications (NUTs). Notably, discussion focused around PR421, which introduces the so-called nutroot secrets. The PR has not been merged yet, since devs are waiting for the different projects to implement this feature.

Nutroot secrets change the way the protocol manages spending conditions. Instead of relying on a separate JSON file, the secret commits to a merkle tree which includes all the different spending conditions.

While nutroot secrets are clearly inspired by how taproot works in Bitcoin, developers clarified that only the commitment structure has been used and little else. No taproot property should be taken for granted.

Nutroot secrets comes with a new cryptographic algorithm. Developers decided to migrate to a new curve, BLS12-381, from the current scheme using secp256k1. This is because BLS makes signature publicly verifiable. The new algorithm is being introduced through PR371.

Shielded CSV has been renamed Glass Coins, and promises a better transaction throughput on Bitcoin with improved privacy.

On Thursday 27th, Robin Linus, Jonas Nick, and Liam Eagen held the first developer call for Shielded CSV, a private payments protocol designed for maximum throughput and minimal latency.

The protocol is based on Client-side Validation (CSV), a technique that allows users to validate transactions off-chain, while relying on on-chain transactions only to prevent double-spending. The protocol comes with a minimal on-chain footprint.

The founders announced that the protocol had been renamed Glass Coins and shared a specifications file containing all the high-level information about it.

A BIPs Update

There was no newsworthy update in the last few days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

Other News from the Bitcoin World

A BIP for SHRINCS: Blockstream’s Head of Research Jonas Nick announced the first draft of BIP SHRINCS, the first proposal for a post-quantum signature scheme for Bitcoin.

The proposed scheme, called SHRINCS, provides the ability to obtain small signatures — in the context of post-quantum cryptography — of 548 bytes. It does so by using a stateful signature scheme — smaller signatures, but you must keep track of used keys (state) —, while giving the user the possibility to fall back to a stateless scheme in case the state is lost, at the cost of bigger signatures ( > 5kB).

If you want to know more about SHRINCS, the Insider published a deep dive on SHRINCS some months ago. We also published a deep dive on SHRIMPS, a proposal to minimize risks in a post-quantum world that can be combined with SHRINCS.

Vulnerabilities on CLN: Last week, Core-lightning contributors announced that several vulnerabilities had been found in the Lightning implementation. According to Christian Decker, no known vulnerability can be leveraged to steal funds.

Christian Decker also provided information about the approach that CLN was following to address the vulnerabilities. The team will provide an embargoed release by publishing signed binaries without making the source code available. 14 days after the release, developers will publish the source code, which can be used by anyone to verify the released binaries thanks to their reproducible build system.

The patch release v26.06.7 was published on August 28th. The team invited anyone running a CLN to upgrade as soon as possible. In case anyone wants to wait for the source code to be released before upgrading, the suggestion is to restart the node using the --offline command, which allows the node to cut out external connections, without losing on-chain enforcement against potential cheating peers.

Goodbye HWI: Bitcoin Core contributor Ava Chow announced that the Hardware Wallet Interface (HWI) library — which enables support to hardware signers in Bitcoin Core — will be put in maintenance mode. This means that no new functionality will be added from now on, except for MuSig2 which is currently under development.

One of the reason behind the choice, other than being a solo-dev project, is the fact that it is developed in Python and it does not allow for reproducible builds. This means it cannot be shipped with the whole Bitcoin Core package.

BHWI — developed by Wizardsardine — has been chosen as the possible successor to HWI. The library is built in Rust and it already supports the major hardware signers on the market.

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

Radar Chat made #bitcoinforsignal a reality, but the seed was ...

2026-08-26T14:16:41Z

Radar Chat made #bitcoinforsignal a reality, but the seed was planted way before. It all started with one year ago, during the Bitcoin++ (btcplusplus (npub1dwa…7c52)) hackathon in Berlin

quoting
naddr1qv…0nsu

Last month, on July 7th, news spread amongst Bitcoiners. Someone had finally added support for bitcoin payments to Signal, the open-source, end-to-end encrypted messaging app.

Well, not Signal exactly. Radar Chat, a newly launched fork of the open source Signal project, takes the private communication network of Signal and adds Bitcoin, p2p electronic cash.

One of the minds behind the integration is Cake Wallet’s COO, Seth for Privacy.

On X, he presented Radar Chat to the world, describing it as the best way to address one the biggest issues our digital life has: sending money and communicating should be our most private acts, but in reality this is where surveillance is strongest. Radar Chat aims to provide a unified tool for people to protect themselves from surveillance for both the movement of money and information.

Radar Chat’s launch is exciting, but it is not exactly novel. Someone had already created a proof of concept of a similar solution some months before Radar Chat finally saw the light of day, and launched a campaign to raise awareness on the fact that private messaging needs private money.

It All Started with an Hackathon

Back in October 2025, developers from all over Europe came together in Berlin, Germany to compete to win the Bitcoin++ — Lightning Edition Hackathon.

One team had a simple, but powerful idea. Not many people know about it, but Signal has a built-in cryptocurrency wallet which can be used to exchange money between users. It only supports MobileCoin, a shitcoin that not even its creator remembers exists. The team, composed of some of the most knowledgeable developers in the Cashu ecosystem, decided to swap that wallet with a Cashu one, using the UniFFI bindings for Swift and Kotlin available on the Cashu Development Kit.

The project, Nuts Are Pure Signal, won. At the hackathon finals, they demoed sending ecash tokens back and forth between an Android and an iOS device using their custom Signal client.

The Android fork is still available on GitHub.

Private Messaging Needs Private Money

Less than two weeks later, the Cashu team, with the help of the Bitcoin Design Community, launched a dedicated campaign to raise awareness on the fact that private communication and private money go hand-in-hand.

The campaign was well received, with prominent bitcoiners, such as Peter Todd and Jack Dorsey, vocally supporting the effort. Bitcoin Designer Erik Cativo discussed in a retrospective that one of the strong points of the campaign was its focus on the design, which helped “presenting the idea elegantly and professionally”. The X hashtag #bitcoinforsignal remains the proof of the impact of the campaign.

Closing the Loop

Seth did not forget to give credit to the campaign. On July 10th, he published the following tweet with the #bitcoinforsignal hashtag.

Radar Chat is not based on Cashu, but provides a Lightning wallet based on Spark. While the technology is different, the ethos remains the same.

Freedom of speech and freedom to transact belongs together.

What’s Next?

In his review of “A Lodging of Wayfaring Men”, Max Hillebrand chooses Bitcoin++ as one of the modern lodges in which the future is being built. “Bitcoin++ pulls protocol engineers into the same room to prototype and ship across a single shared agenda,” he says. Having hackathon projects inspire real products and real advancement in the ecosystem is one of the things we are more proud of.

Next Stop: Berlin

Bitcoin++ is coming back to Berlin next month, 1-3 October 2026. Join us, if you want to be part of the builders shaping the future of Bitcoin!

In this week update by @npub1jeq…nmal,we feature the current ...

2026-08-24T14:04:30Z

In this week update by tuma (npub1jeq…nmal),we feature the current effort from the LDK team to add support for recurrent payments in BOLT12. We also discuss a new plugin for Core-lightning to rebalance channels in a node.

We also cover the most interesting news from the Bitcoin ecosystem. Notably, we talk about Iceberg, a new nested threshold MuSig2 signature scheme, that allows Lightning operators to thresholdize one participant inside a multi-signature protocol.

quoting
naddr1qv…vhp5

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week update we feature the current effort from the LDK team to add support for recurrent payments in BOLT12. We also discuss a new plugin for Core-lightning to rebalance channels in a node.

We also cover the most interesting news from the Bitcoin ecosystem. Notably, we talk about Iceberg, a new nested threshold MuSig2 signature scheme, that allows Lightning operators to thresholdize one participant inside a multi-signature protocol.

Highlights from the bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

The LDK team is working to introduce recurrent payments in BOLT12.

During the biweekly call, on Monday 17th, LDK contributors discussed PR4882 in rust-lightning which aims to introduce recurrent payments int BOLT12.

PR4882 is implementing the protocol flow and all the primitives needed for recurring payments to work. On the other hand, recurrence tracking, persistence, and scheduling will be handled downstream — For example in LDK Node.

The implementation of recurrent payments is going hand in hand with the drafting of the specification in the BOLT repository. Specifically, LN contributors are working on PR1240.

A plugin for Core-lightning for rebalancing channels in a node.

During the biweekly call, on Monday 17th, Core Lightning developers discussed a new plugin to rebalance channels called xrebalance , develoeped by the main CLBOSS maintainer Ken Sedgwick.

Rebalancing is done through independent circular self-payments between different channels on the same node, leveraging the askrene plugin for improved routing computation.

The plugin is still experimental and under active development, and works out-of-the-box with CLN versions v26.04 or higher.

A BIPs Update

In the last days there was some movement in the BIP repository. Specifically, one new BIP has been assigned a number by BIP maintainer Murchandamus.

Numbered BIPs

A list of BIPs that recently got assigned a number

BIP332: Stale Tip Relay

Assigned On: Aug 20th, 2026

Layer: Peer Services

PR2241 introduces BIP 332, which defines a new, opt-in P2P message called staletip whose goal is to announce recent stale chain tips to peers. The message contains the block height at which a stale branch diverges (the fork point), a vector containing the block headers belonging to the stale branch, and a flag signaling willingness to serve that block data. This may be useful for monitoring the network health, since increases in the stale block rate may expose validation or relay bottlenecks, network partitions, or selfish mining behavior.

Other News from the Bitcoin World

Iceberg, a multisig for managing Lightning channels: Paul Gerhart, Nadav Kohen, Jesse Posner, and Matias Furszyfer published a paper presenting a new cryptographic primitive, nested threshold multi-signatures, which allows to thresholdize one participant inside a multi-signature protocol.

As a first implementation of this scheme, the group presented Iceberg, the first construction for nested threshold MuSig2 signatures. It enables one side of a Lightning channel to operate as a t-of-nthreshold group while appearing to the counterparty as a standard MuSig2 participant.

The proposed scheme can be used today, without any modification neither to the Bitcoin protocol, nor to Lightning.

New major version for Coco: The Cashu team announced that a new major version — v2.0.0 — for Coco had been released.

Coco is a TypeScript library that provides the easiest way to develop Cashu-based wallets or integrate the ecash protocol in various applications.

The latest version brings the library up-to-date with the latest developments in the Cashu ecosystem. It implements minting and melting operations through BOLT12 (NUT-25) and on-chain payments (NUT-30), payment requests based on NUT-18, and custom units.

The new Simplicity Community: Blockstream announced the official launch of the Simplicity Community, a place for devs to discuss the latest technical developments on the smart contract language and showcase the latest applications built on it.

Responsible disclosure of an LND bug: Recently, Bastien Teinturier responsibly disclosed a vulnerability he found on LND nodes running versions before v20.0. Specifically, an LND node would forget about a collaboratively closed channel after one single confirmation, losing protection against chain reorgs. In case of a reorg, an attacker would be able to publish a revoked commitment transaction for the channel. Since the node had already forgotten the channel, it would not publish a penalty transaction, letting the attacker drain all of the channel’s funds.

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

In this week update by @npub1jeq…nmal, we feature a security ...

2026-08-17T14:07:37Z

In this week update by tuma (npub1jeq…nmal), we feature a security patch released by Fedimint (fedimint (npub1su3…cngd)) to fix several vulnerabilities in the federated ecash protocol. No funds were lost, nor any federation was affected.

We also cover several important news from the Bitcoin ecosystem. We discuss first stable release of Payjoin, the Boltz team stepping down, a new library for SHRINCS, and a new Bitcoin node implementation in Rust, rbitcoin.

quoting
naddr1qv…jllz

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week update we feature a security patch released by Fedimint to fix several vulnerabilities in the federated ecash protocol. No funds were lost, nor any federation was affected.

We also cover several important news from the Bitcoin ecosystem. We discuss first stable release of Payjoin, the Boltz team stepping down, a new library for SHRINCS, and a new Bitcoin node implementation in Rust, rbitcoin.

Highlights from the bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

Fedimint released a security patch on August 13th which fixes several vulnerabilities on the federated ecash protocol.

During the weekly call, on Monday 10th, Fedimint contributors discussed a security patch applied to fix some vulnerabilities. The patch was backported to previous versions and two new releases, v0.10.1 and v0.11.2, were published soon after.

According to the Fedimint team, the vulnerabilities were responsibly disclosed by the Red Team and Loupe. Devs contacted all known federations and had all of them upgrade to the new patched version. No funds were lost, nor any federation was affected.

The security patch fixes around 30 small vulnerabilities. According to PR8997, the various issues can fall in different categories, such as contract funding and claiming on the LNv1/LNv2 modules, consensus version gating, panic containment, gateway module correctness, and wallet module.

A BIPs Update

In the last days there was some movement in the BIP repository. Specifically, one new BIP has been assigned a number by BIP maintainer Murchandamus.

Numbered BIPs

A list of BIPs that recently got assigned a number

BIP461: Deterministic ECDSA Signatures

Assigned On: Aug 13th, 2026

Layer: Applications

PR2224 introduces BIP461, which defines how to obtain deterministic ECDSA signatures. A signature is now encoded using the Distinguish Encoding Rule (DER), which results in two numbers r and s , treated as big-endian signed integers. Due to the sign, in case a r number has its most significant bit set to 1 , hence treated as negative, a null byte is added to keep it positive. BIP461 describes how to do low r grinding of an ECDSA signature, to avoid adding an additional byte to it. The described process is deterministic, following RFC6979.

Other News from the Bitcoin World

Stable Payjoin: On August 12th, Payjoin contributors announced the release of the first stable version of the payment batching protocol, v1.0.0.

The release includes support for both the legacy Payjoin, described in BIP78, and the most recent asynchronous version, defined in BIP77.

The Rust crate comes also with UniFFI bindings for several programming languages, such as Python, Dart, C#, and JavaScript.

The first stable release comes after more than three years of development and integration with several wallets.

The Boltz team steps down: On August 12th, Boltz announced that the whole founders team had step down from the company.

In the X post, the team explained that the decision was taken due to the impossibility “to withstand the current level of attacks in the long run,” given the limited resources with which they have been operating over the years.

According to the team, a new group of veteran bitcoiners is taking on Boltz. The identities of the new team have not been revealed yet.

A library for SHRINC: Blockstream’s Head of Research Jonas Nick announced the release of libshrincs, a hand-written and formally-verified C implementation of WOTS+C , the one-time signature scheme used by SHRINCS.

A Rust Bitcoin Node: Rearden announced on X that he has been working on a new Bitcoin node implementation in Rust, called rbitcoin. While it is not deemed production ready yet, it already supports Electrum, Esplora, and core RPC interfaces.

Listen to the Insider: The Insider Edition now has a dedicated podcast feed where you can listen to our audio-only interviews. Check it out!

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!

Episode 1 of Live from Bitcoin++: Fabian Jahr explains CISA (BIP ...

2026-08-13T15:47:59Z

Episode 1 of Live from Bitcoin++: Fabian Jahr explains CISA (BIP 459) in under a minute. 🎙⚡️

In this week update by @npub1jeq…nmal, we feature Fedimint ...

2026-08-10T14:08:24Z

In this week update by tuma (npub1jeq…nmal), we feature Fedimint exposing APIs for atomic swaps, the Cashu Development Kit (CDK) (Cashu (npub17fz…9yxv)) adding support for Iroh, and Marmot (marmotprotocol (npub1mar…r6m9)) upgrading to version 2 of the messaging protocol.

We also cover several important news from the Bitcoin ecosystem. We discuss the current effort by the Red Team to find vulnerabilities in Bitcoin related projects and responsibly disclosing them to maintainers, Boltz (Boltz (npub1psm…8970)) stopping its swap service, a critical bug in BTCPayServer (btcpayserver (npub155m…dcvg)), and the BIP110 fork.

quoting
naddr1qv…safa

Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week update we feature Fedimint exposing APIs for atomic swaps, the Cashu Development Kit (CDK) adding support for Iroh, and Marmot upgrading to version 2 of the messaging protocol.

We also cover several important news from the Bitcoin ecosystem. We discuss the current effort by the Red Team to find vulnerabilities in Bitcoin related project and responsibly disclosing them to maintainers, Boltz stopping its swap service, a critical bug in BTCPayServer, and the BIP110 fork.

Highlights from the bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

PR8913 is exposing APIs for raw Hashed Time-Locked Contracts (HTLCs) APIs in Fedimint.

During the weekly call, on Monday 3rd, Fedimint developer discussed PR8913, a new feature providing raw HTLCs APIs. This feature has been widely requested by the community, and the PR, which is still in draft, is addressing this need.

The main goal for exposing such an interface is to enable atomic swaps between fedimint ecash and other Bitcoin layers, such as Ark, Cashu, and even Bitcoin on-chain.

While the mechanism is already implemented in the Lightning module LNv2, the APIs are not yet exposed to the clients in its raw form.

PR2285 in the Cashu Development Kit (CDK) is adding support for Iroh.

During the weekly call, on Wednesday 5th, CDK contributors discussed PR2285, which aims to introduce a new crate to support Iroh.

Iroh is a P2P transport layer for fast and reliable connection between devices. Instead of relying on IP addresses, every Iroh endpoint is actually a cryptographic key.

The new feature would allow mints and wallets to communicate over Iroh, instead of relying only on HTTP. The PR introduces a new iroh:// URL scheme so wallets can connect to mints through their public key.

Marmot has been officially upgraded to the version 2 of the protocol.

During the monthly call, on Tuesday 4th, Marmot developers discussed the official upgrade to version 2 of the messaging protocol based on Nostr and Messaging Layer Security (MLS). The new specifications are organized according to the protocol surface, effectively deprecating the precious MIP-based approach.

The new version aims to make the protocol more stable, mainly from the group consensus point of view (message ordering, user additions/removals, etc.), allowing each user to reach the same state deterministically. It also aims to make Marmot agnostic with respect to the transport layer.

Marmot v2 is currently being integrated in the White Noise client. Its release is expected soon, promising a smoother, faster, and more stable experience.

A BIPs Update

There was no newsworthy update in the last days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

Other News from the Bitcoin World

The Red Team: Following the COLDCARD incident, a group of developers announced a huge red teaming operation to find critical vulnerabilities affecting Bitcoin-related software.

The effort, lead by AncorWatch CEO Rob Hamilton, is currently ongoing. According to the last report, the team has discovered around 8000 vulnerabilities, with more the 1200 of critical or high severity level. Bugs are being responsibly disclosed to the various project maintainers.

The Red Team is making heavy use of LLMs to discover vulnerabilities, in particular leveraging the frontier, open-weight model Kimi K3. As of today, this is probably the only model able to dive into cybersecurity issues without hitting those limits introduced by producers.

As of today, devs focused on red teaming Bitcoin have spent tens of thousand dollars in LLM tokens to bring on their work. Many people have already donated to the cause, while no-profits as OpenSats have launched specific funds to provide grants to people assessing security of Bitcoin software.

Boltz stopped: On Monday, August 3rd, Boltz announced that they were stopping their service until further notice. As of today, operations haven’t got back to normal yet.

According to the Boltz team, the decision came after months of continuous exploits from AI-assisted and automated attacks to their infrastructure. While no users’ funds were stolen, Boltz itself incurred in losses as a result of the attacks.

Critical bug in BTCPayServer: On Friday, August 7th, the BTCPayServer team announced a vulnerability in their software was actively being exploited by attackers, resulting in loss of funds.

The critical bug affects those instances of BTCPayServer (version < v2.4.2) running with an LND Lightning node. The issue allows an attacker to obtain the .macaroon credentials for the node without authenticating. Those credentials can be used to take full control of the LND node, effectively letting a remote attacker move funds.

Check BTCPayServer’s security advisory for more information and migration guides. We recommend any user with running an instance to upgrade immediately to v2.4.2.

BIP110 forked: On Saturday, August 8th, at block height 961632 the period for mandatory signaling for activation of BIP110 began.

Block 961632 was mined by AntPool. The pool did not signal for BIP110, effectively rejecting the soft fork. Soon after, Ocean mined a block signaling for activation, thus creating a chain-split.

The legacy chain soon took up steam, with new blocks coming regularly. On the other hand, miners on the BIP110 chain were able to only mine another block. Later on, hashrate on the BIP110 chain moved back to the legacy one. BIP110 did not activate.

Proposal to remove Luke Dashjr from BIP editor: Following the failure of the BIP110 activation, Murch launched a motion to remove Luke Dashjr from the role of BIP editor. The proposal is based on several factors: lack of involvement in the BIP processes, decisions taken over BIP110 with conflict-of-interest concerns, and break of trust and communication with the other editors.

Coinswap protocol: CitadelFOSS is close to release their implementation of the Coinswap protocol, the foundation for a decentralized atomic-swap marketplace. The protocol is nearly ready for a launch on mainnet, and the developers are actively looking for wallets willing to integrate it in their stack. According to the team, they ready to provide any tech assistance, and the integration requires a few simple API calls.

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Berlin this October 1- 3 to talk about payments in Bitcoin!