Socratic Seminar #85
Thanks to nummyx and NadaNada for sponsoring food and drinks for this meetup!
Security
- Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
- Keystone wallet leak
- BTCpayServer: Security Incident Affecting BTCPay Server 2.4.1 and Earlier
- LNbits: All users should stop their LNbits servers immediately
- Second: Exploit against its Ark server
- bitcoinjs-lib security advisories
- Disclosure: Memory-exhaustion DoS in Eclair 0.14.0
- CLN: Self-Referential Channel Announcement DoS disclosure
- BTCPay Server 2.4.7
- An opt-in vulnerability-finding service for open-source software
Research
- A Subexponential Time Algorithm for Elliptic Curve Discrete Logarithm
- Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days
- Argo: Leaking a Secret from an Invalid Groth16 Proof
- CUTS: Chained Uniform-sum Tree Signatures
- Compact Shielded CSV: Post-Quantum, Private, Lightweight Client-Side Validation Blockchain
- Claude reveals ECDSA curve origins
- Shielded Bitcoin: Private Transfers on the Bitcoin L1
- Verifiable Data on Bitcoin: FlatMerkle Commitments, Refutable Proofs, and FlatChecks
- MuCPay: Breaking the Quadratic Bottleneck in Scriptless Multi-Party Oracle-Based Conditional Payments
- Revisiting Elliptic++ for Bitcoin Forensics: Feature Reconstruction and Leakage-Resistant Evaluation
- Who Patches the Lightning Network? Evidence from Release Lines in Gossip, 2023-2026
Network Data
- Compact block reconstruction degradation between September - October 2026
- /Satoshi:31.0.0/ peers with no service flags and protocol 70015 pushed transactions, then stopped together on Oct 18
- Peer Map: a closer look at your node’s peers
- Effect of Linux Kernel CVE-2026-99999 (CVSS 9.3, PwnScape) on the Bitcoin network
- Large disruption in Tor exit node population: visible in your data?
- Exploiting the Lightning Network for Cross-layer Deanonymisation of Bitcoin Nodes
Local/Legal
- Erste Sparkassen starten Bitcoin-Handel
- Getting ready to operate Taler in Germany
- Austrians against DAC8
- Bitcoin-Haltefrist vor dem Aus: Fällt diese Woche eine Entscheidung?
- Neuer BMF-Entwurf: Behörden sollen leichter auf Kryptokonten zugreifen können
- Manipulierte Krypto-Wallets: MediaMarkt zieht Ledger-Geräte aus dem Verkauf zurück
Miscellaneous
- Latest CoreDev Transcripts
- SPirits
- eCash (BIP300 fork) mainnet live since block 973,728
- Magic Internet Math: Red Teaming Bitcoin’s Elliptic Curve
- Liquid Network Staged Recovery Update
- Blink: Phase two - following the coins in public
- Bitcoin Poker
- OpenSats: Finding Vulnerabilities, Funding Defenders
- OpenSats: Supporting the Foundations of Bitcoin Development
- Peter Todd joins MARA Foundation as Lead Maintainer of Slipstream
- Does BTCPay Server Still Serve a Purpose?
- Bisq: Open Source Software Development in the Age of AI
- When one signature spends multiple coins
- Implant reported in a Trezor sold by CryptoBilis
- Chainalysis discloses data breach from offensive agentic techniques
- We made the bitcoin-dev mailing list readable
- LayerTree - A Bitcoin scaling design
- Ride the Wave: Integrate Bitcoin Payments with Wavelength on Mainnet
- Stealmybitcoin
- Binance hack details
- Nikita starts nummyx
Mailing Lists
bitcoin-dev
- Bitcoin Core security policy update
- Testnet 5 launch
- Lichen: L2s In CHannels ENforced on bitcoin
- LN-GAP : Lightning governed by arbitrary programs
- [Proposal] Tapleaf 0xc2: An overview of the Great Script Restoration (GSR)
- Quantum Landmines and Vulnerable Coin Auctions
Delving Bitcoin
- Silent Payments for Multiparty Wallets
- Descriptor syntax for hash preimages
- The Long Road to Bitcoin Payments
- Machine-checked soundness of BIP340 batch verification with 128-bit derived randomizers
Pull requests
BIPs, BOLTs and Proposals
- BIP139: Wallet Metadata Export Format
- BIP460: CISA for Taproot Key Path Spends (merged)
- BIP458: Half-Aggregation of BIP 340 Signatures (merged)
- BIP459: DahLIAS fully aggregated signatures for secp256k1 (merged)
Bitcoin Core
- Bitcoin Core 32.1
- CVE-2026-117350 - Unbounded memory growth through TCP urgent data on non-Linux systems
- CVE-2026-117349 - Slow unbounded memory growth on paused pre-BIP31 peers
- CVE-2026-117346 - Undo file overflow under extreme conditions
- net: always complete all initial private broadcast connections #36277
- BIP-352: fix P2PKH pubkey extraction from malleated scriptSig #36338
- policy: Allow non-standard scripts with -acceptnonstdtxn=1 (test nets only) #29843
- addrman: use uniform sampling inside buckets #36449
LND
- bolt12handler+devrpc: dispatch invoice requests and add CreateOffer #11374
- [1/?] Local reputation: subsystem core, read only #10919
- build: disable MPTCP listeners by default #11456
Core Lightning
- v26.06.9 Quantum-Resistant Lightning Channel VI
- v26.06.9 Quantum-Resistant Lightning Channel VI
- Unverified dual funding tx signatures #9575
Eclair
- Never relay HTLCs expiring after upstream HTLCs #3409
- Check remote previous
txOutagainst the blockchain #3411 - Eclair v0.14.6