Elias Rohrer

Doing bitcoin things @spiral_xyz.

[rbitcoin @rbitcoin_org]

LDK Node can now start against rbitcoin on a fresh regtest chain. Off mainnet, Esplora /fee-estimates returns an empty map instead of a 503, so clients apply their own fallback. Mainnet is unchanged. Reported by @_tnull, who wants rbitcoin in LDK Node's integration tests.

[bitcoin++ @ seoul, nov 5-6 🇰🇷 @btcplusplus]

Project Loupe - AI powered security scanning for Bitcoin OSS Projects https://t.co/WPIcY1l5lY

[Matt Corallo 🟠 @TheBlueMatt]

Giving up on esplora, mempool-esplora, and electrs. rbitcoin is the only thing we support now.

https://t.co/woiAkZVQKA

[bitcoin++ @ seoul, nov 5-6 🇰🇷 @btcplusplus]

LIVE NOW: @_tnull from @spiral_xyz talking about Project Loupe, their open source security scanning harness

[Spiral @spiral_xyz]

Proof of value.

[Project Loupe @ProjectLoupe]

We file our findings privately. Loupe only shows up in public if a maintainer credits us, which many have:

✅ 754 commits, PRs, & release notes across 23 projects reference Loupe
✅ 610 distinct findings cited by issue number
✅ 132 merged PRs name the finding they fixed

[Bitcoin Optech @bitcoinoptech]

Clara Shikhelman (@ClaraShik) and Elias Rohrer (@_tnull) joined Optech to discuss Newsletter #426:

News
● Dynamic one-byte message type IDs for BIP324 (45:02)
● Discussion of conventions for tagged hash tags in BIPs (49:04)
● Proposal for onchain, private bitcoin transfers with no consensus changes (1:15)

Releases and release candidates
● Bitcoin Core 32.0rc3 (53:34)

● Core Lightning 26.06.9 (54:38)
● LDK v0.3-rc3 (23:38)
● LDK v0.2.7 (24:33)
● BTCPay Server 2.4.5 (56:55)

Notable code and documentation changes
● Bitcoin Core #36277 (59:51)
● Bitcoin Core #36365 (1:05:09)
● Bitcoin Core #36338 (1:07:53)
● Bitcoin Core #32895 (1:10:38)
● Core Lightning #9582 (1:12:38)
● Eclair #3390 (1:18:03)
● LDK #5057 (33:00)
● LDK #5042 (35:55)
● LDK #5046 (38:25)
● LDK #5028 (41:43)
● LND #11290 (1:20:41)

[Lexe @lexeapp]

Introducing LexeConnect: a new protocol to connect a Lexe wallet to your app in one tap.

Your app requests the scopes it needs. The user taps Approve in Lexe. Your app receives a scoped, revocable credential and can now receive, pay, or read from the user's wallet. Full video 👇

[Steve Lee @moneyball]

Fixmaxxing

[Tony @tonklaus]

Here's the Stable Channels Lightning Server dashboard UX 👇 built on @lightningdevkit by @benthecarman, @_tnull @Biresh_Biswas et al. (node IDs/numbers changed)

Little ⓘ buttons explain Lightning jargon throughout. We hope to bring it to Umbrel ASAP when LDK Server ships!

[Spiral @spiral_xyz]

There should be a word for when vuln scanners and devs work side-by-side to quickly patch large amounts of issues. Catch-and-patch? Fixmaxxing? Anyway,

👇

[Spiral @spiral_xyz]

New vertical: AI Caramba lets the goose team open up about anything AI. In this first edition, @dosinga explains how goose replaced the agent loop with a state machine that can be turned off anywhere and resumed like nothing happened. Where does it go in between? Hell if we know.

[Project Loupe @ProjectLoupe]

Loupe findings have been landing in Bitcoin Core. During this cycle, five PRs landed: three have been merged, two are under review. Below is a thread on what each one caught and which Core dev implemented which fix.

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.9 is out. Upgrade now.

It fixes a newly reported vulnerability that can lead to loss of funds. Nodes running 26.06.8 or earlier are affected.

Verify the signatures and install it as soon as possible.

https://t.co/3Sj5Y8WX6F

[Project Loupe @ProjectLoupe]

A second opinion:

✅ Another model double-checks every finding
✅ It returns "inconclusive" 30.2% of the time
✅ 88% of "dismissed" findings weren’t refuted but rather not established
✅ 3,671 findings were verified more than once and only 105 got a conflicting verdict

[Mistral AI @MistralAI]

Meet Mistral Large 4, aka Le Chonk.

• 1T parameters, natively multimodal. 49B active.
It is the best open weights model from US or Europe on aggregated benchmarks.
• State-of-the-art on critical workloads, including cyber defense, manufacturing and finance and it surpasses closed frontier models on visual grounding.
• Forged in Europe end-to-end and is deployable from Europe via our own Mistral Cloud infrastructure.
• Available to all via API today. Working with cybersecurity partners privately.

Open weights release end of October.

[Stephan Livera @stephanlivera]

Lightning Into x402 | Ben Carman SLP779
@benthecarman of @spiral_xyz on L402 vs x402, agent wallets that already know Bitcoin, open weights, and Mesh LLM.

Timestamps
00:00 — Intro
00:50 — L402, x402, and MPP
01:09 — What HTTP 402 Actually Is
02:41 — Meet x402 in the Middle
03:44 — Facilitators and Coinbase Default
06:06 — x402 Standard vs Coinbase Commerce
07:26 — Stables Dominate Early Volume
08:03 — Agentic Payments Still Near Zero
08:55 — Agents Already Know Bitcoin
12:05 — Personal Agents vs B2B Agents
13:03 — Pay-Per-Query Agent Wallets
16:14 — Businesses on Bitcoin Are Easier
16:39 — AI Climb and Builder Craft
22:29 — Won't Fund OpenAI — Still Uses Them
25:38 — Cost Deflation = Human Freedom
28:57 — Best AI tools as of Oct 2
31:16 — Terminal Bench and Real Evals
32:25 — Bench Maxing vs Real Feel
34:59 — Four Years From ChatGPT
36:56 — Quantization Without the LARPs
39:51 — Mesh Alliance and Mesh LLM
42:37 — Goose, LDK, Think Big

[Lightning Dev Kit @lightningdevkit]

LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft.

If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3.

1/4

[Matthew Vuk 🛳️ @matthewvuk2]

There is an arms race between the attackers and maintainers as to who has the superior frontier AI model.

“That is not a sustainable security model” - @dergoegge

@_tnull @ProjectLoupe @btcplusplus

[Matthew Vuk 🛳️ @matthewvuk2]

Elias Rohrer (@_tnull) presents the @COLDCARDwallet incident as the pivotal moment that “prompted” everyone to start scanning repos with Kimi K3.

The “report flood” ensued. Bitcoin Core had 1000+ reports. None critical.

@ProjectLoupe @btcplusplus