Project Loupe

An AI-powered vulnerability scanner for open-source bitcoin projects.

Discord:

[calle @callebtc]

@moneyball @spiral_xyz project loupe is an absolute treasure for the bitcoin ecosystem!

thank you for the reviews, incredibly valuable for the Cashu project.

[Steve Lee @moneyball]

One of the best ideas @spiral_xyz has had

[Project Loupe @ProjectLoupe]

We file our findings privately. Loupe only shows up in public if a maintainer credits us, which many have:

✅ 754 commits, PRs, & release notes across 23 projects reference Loupe
✅ 610 distinct findings cited by issue number
✅ 132 merged PRs name the finding they fixed

[Project Loupe @ProjectLoupe]

🕳️ Also from a Loupe report: @theinstagibbs mapped out how a peer sending a same-txid witness variant can stall honest fee-bumping packages, and is closing those holes across two PRs. That work continues.
https://t.co/uKoBZjhalK

[Project Loupe @ProjectLoupe]

Loupe findings have been landing in Bitcoin Core. During this cycle, five PRs landed: three have been merged, two are under review. Below is a thread on what each one caught and which Core dev implemented which fix.

[Project Loupe @ProjectLoupe]

📦 In review: a package evicted right after acceptance landed in the reject filter until the next block, so a higher-fee child couldn't bump it back in. Loupe and the Bitcoin Red Team found it, @theinstagibbs fixed it.
https://t.co/tVGurcOp8z

[BTCPay Server @BtcpayServer]

Thank you to our contributors, reviewers, testers and everyone reporting issues.

Special thanks to independent security researchers, @ProjectLoupe, @premai_io, @BugBunny_ai and @MagicGrants for helping us make BTCPay Server stronger. 💚

[Project Loupe @ProjectLoupe]

A second opinion:

✅ Another model double-checks every finding
✅ It returns "inconclusive" 30.2% of the time
✅ 88% of "dismissed" findings weren’t refuted but rather not established
✅ 3,671 findings were verified more than once and only 105 got a conflicting verdict

[Project Loupe @ProjectLoupe]

Some personal news:

✅ Loupe has produced 26,821 findings across 43 open-source bitcoin repos
✅ Average successful scan took 2H 52M and returned 53.6 findings
✅ Longest scan ran for 36H 58M
✅ 26,809/26,821 findings shipped a proof-of-concept & 12,774 shipped a proposed patch

[Lightning Dev Kit @lightningdevkit]

LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft.

If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3.

1/4

[Matthew Vuk 🛳️ @matthewvuk2]

There is an arms race between the attackers and maintainers as to who has the superior frontier AI model.

“That is not a sustainable security model” - @dergoegge

@_tnull @ProjectLoupe @btcplusplus

[Matthew Vuk 🛳️ @matthewvuk2]

Elias Rohrer (@_tnull) presents the @COLDCARDwallet incident as the pivotal moment that “prompted” everyone to start scanning repos with Kimi K3.

The “report flood” ensued. Bitcoin Core had 1000+ reports. None critical.

@ProjectLoupe @btcplusplus

[Project Loupe @ProjectLoupe]

Some personal news:

✅ Loupe has produced 26,821 findings across 43 open-source bitcoin repos
✅ Average successful scan took 2H 52M and returned 53.6 findings
✅ Longest scan ran for 36H 58M
✅ 26,809/26,821 findings shipped a proof-of-concept & 12,774 shipped a proposed patch

[BTCSchellingpt @BTCSchellingpt]

upgrade your project's security posture

the cyber security landscape has fundamentally and permanently changed .. so where to start as a humble FOSS project maintainer and builder?

take a squiz at @spiral_xyz's Project Loupe:

What is it? https://t.co/G1ffy98UaW
Does it work? https://t.co/Dejh59h5rg
Where is it? https://t.co/p48kkIw8sb

[Presidio Bitcoin @PresidioBitcoin]

Excited to continue pushing out talks and discussions from our Open Source AI Summit!

Next up: Securing Open Source Software - @moneyball with @Rob1Ham, @_tnull, and @jordanmecom on how AI is reshaping open source software security:

Timestamps
0:00 - How AI is changing open-source software security
03:34 - How AI security scanning works
06:30 - Why open-weight models changed cybersecurity
09:30 - How many vulnerabilities AI scans find
11:58 - Why different scanning methods find different vulnerabilities
15:38 - How maintainers should handle AI vulnerability reports
23:29 - How AI changes responsible disclosure
30:15 - Can AI find vulnerabilities without source code?

[Spiral @spiral_xyz]

.@ProjectLoupe reads bitcoin code all day looking for vulns. Fueled by energy drinks and cold pizza, its existence is bleak but necessary.

The @StratumV2 team took its findings, fixed them, and rebuilt their security process. Their stack is now among the hardest in mining.

[Project Loupe @ProjectLoupe]

Rare to report bugs and get a rebuilt security process back. Giant ups to the @StratumV2 team on the release, and thanks for being early with us.

[Stratum V2 @StratumV2]

New SV2 releases are out, bringing security hardening and various other improvements to our libraries and applications!

🧩 SV2 Protocol libs v1.12
🏗️ SV2 Apps v0.8
⛏️ SV2 UI v0.7 (coming soon on @umbrel)

Applications updates improve Job Declaration stability and Bitcoin Core integration, Translator Proxy overhaul, and add automatic discovery of ASIC telemetry endpoints.

Protocol library highlights include a deep hardening pass over channels_sv2, a breaking refactor of the codec and framing layer, BIP323 adaptations across the protocol stack. Noise_sv2 was improved with regards to memory hygiene, nonce reuse, RNG quality, and buffer recovery. Every published crate that changed takes an incompatible version bump, so downstream consumers should expect to adapt.

We’re proud to have been early participants in @ProjectLoupe . Their findings helped shape this release and gave us a head start in adapting how we triage reports, prioritize fixes, and organize development around security. Thank you to the Loupe team for their work and support!