KVAZAR

AI-driven agentic Fullstack Security Research

Built by @0xaudron, @real_a_kalout

[KVAZAR @kvazar_ai]

https://t.co/ZA4esHIbjT

[Valkyri @ValkyriSecurity]

🚨 MAJOR SECURITY ALERT

On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.

Expect the fix to be released today. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

Kindly update it ASAP.

https://t.co/C616WcrjYx

[0xaudron @0xaudron]

🚨 RGB Protocol v0.11.2-rc.1 is out

- We (me and @real_a_kalout ) dropped a few crits/higs with the use of Kvazar to @RGB_Bitcoin

- Mentioned by @RGBAssociation in an announcement of the biggest update since mainnet.

Meanwhile, @kvazar_ai is already working with multiple protocols and ecosystems to uncover vulnerabilities across both previously audited and unaudited codebases.

And we're seeing some promising results 🚀

The goal is simple: find what others missed

DMs open if you're looking to security max 👀

[KVAZAR @kvazar_ai]

@pashov @real_a_kalout 🤝

[Ali Kalout (0xAlix2) @real_a_kalout]

Happy to see @kvazar_ai being brought up at ETHSofia 🙌

Great talk by @pashov on security in the age of AI, and a nice surprise to see our Bitcoin security piece on the big screen.

[0xaudron @0xaudron]

🚨 Lightning got hit again!

Real whitehat security agent @kvazar_ai uncovered multiple critical and high security issues on Lightning.

We prove again and again, what we are capable of. The best is yet to come!

Kindly upgrade to v26.06.8

[KVAZAR @kvazar_ai]

Reported several vulnerabilities to Bitchat a month ago. When can we expect updates @jack, @callebtc ?

[KVAZAR @kvazar_ai]

https://t.co/VCxpVjLZ8q

[KVAZAR @kvazar_ai]

Security gap is merely created by not taking care of security, lol. Meanwhile other ecosystem were busy investing and working on security through audits, bug bounties, monitoring, revirews and assesments.

The bitcoiners were just pushing code, now that code never got security reviews, and they never promoted security research on their protocols.

Even with time, the code becomes insecure. So even prior audit is not trustable means for a protocols security. Without continuous security in the pipelining this kind of things are bound to happen.

It's so clear why that massive gap formed. Btw we are writing about this.

[KVAZAR @kvazar_ai]

🚨 JUST IN: We have found the most probable root cause for the @Liquid_BTC incident.

And we have reported responsibly to @Blockstream security email with the security issues already. You will hear more details soon once everything is investigated.

[Liquid Network 🌊 @Liquid_BTC]

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.

What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.

Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident.

Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.

Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.

You can monitor the situation via @mempool's https://t.co/M46Zhn8nlY site below:

https://t.co/B8j9u4j6i4

[KVAZAR @kvazar_ai]

@Blockstream Official statement so far : https://t.co/1crXY0d4S6

[Liquid Network 🌊 @Liquid_BTC]

We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.

What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.

Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident.

Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.

Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.

You can monitor the situation via @mempool's https://t.co/M46Zhn8nlY site below:

https://t.co/B8j9u4j6i4

[KVAZAR @kvazar_ai]

🚨 4000 BTC (~$320 million) was moved out of Liquid Network

The whitehats said "we are whitehats, contact us on chain" when asked to contact to security email of @Blockstream.

Also it is known that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.

https://t.co/kWs6BBEdv5

Checkout the @Liquid_BTC and Blockstream channels for updates on the situation.

[KVAZAR @kvazar_ai]

🚨HIGH Security issue was discovered in Knuth (version <1.3.0) by Kvazar

Remote DoS via integer-overflow bounds checks in byte_reader (P2P block deserialization) was found which was fixed in v1.3.0.

Read fully: https://t.co/0lYf7F4NVl

[Knuth @KnuthNode]

🚀 Knuth v1.3.0 is out.

This one is all about the transaction relay and mining path.

Highlights:

🧩 A high-performance BCH mempool: concurrent maps with pluggable backends (cfm / parlay), wired into the organizers for admit/evict, resolving chained unconfirmed parents, per-tx sigchecks cached, and persisted to disk (mempool.dat) across restarts.

⛏️ Mining: block templates assembled straight from the mempool (GBT) and cached in the core, exposed through getblocktemplatelight, submitblocklight and getmininginfo.

🔌 An optional JSON-RPC server: blockchain queries, mempool, block-header, sendrawtransaction and friends.

🧰 A wider C-API: mempool and mining readers on the chain interface, both sync and async.

🔐 Security: fixed a remotely triggerable DoS in P2P block deserialization, and stopped regtest from accidentally running as mainnet.

🔗 https://t.co/LdPBsaJQut

#BitcoinCash #BCH #Knuth #Cpp23

[KVAZAR @kvazar_ai]

🚨We’ve uncovered a lot of 0-days across the Bitcoin ecosystem.

Some will need immediate action, once they’re public. Don’t mistake that for the ecosystem getting weaker.

It means we’re finally looking deeper. This is just the beginning.

More research, more tooling, more eyes on the code.

Bitcoin security is getting better. And we’re here for it.

[0xaudron @0xaudron]

🚨JUST IN : Thanks for 4k followers, fam🎉

It's time, we should celeberate. And the only way we know is by "hacking" your code, legally and responsibly.

We’re opening up "3 FREE SECURITY SCANS" with @kvazar_ai for builders shipping serious protocols.

We’re opening the submissions for codebase across:
- Smart Contracts
- Solana Programs
- Bitcoin Infrastructure
- TEE
- DLT
- Web2

We’re not looking for random repos. Bring us something serious - strong idea, real product, and mostly importantly a codebase you’re actively shipping.

We’ll select 3 projects that we find the most interesting and put them through Kvazar.

Over the past few months, Kvazar has been finding bugs across some pretty solid stacks. Now we want to turn that firepower toward projects in this community.

You get the full security report, passed through our triage. No pitch, no paywall.

Just free security research for builders who are actually shipping for celebration.

DM me personally or @kvazar_ai or reach us at:
📩[email protected]

[KVAZAR @kvazar_ai]

🚨 JUST IN: Kvazar discovered security issues in one of Bitcoin’s most important wallet firmware.

Kvazar contributed security research to Blockstream Jade, with reported issues fixed in Jade firmware 1.0.41.

We’re continuing to work with @Blockstream across multiple projects

[Blockstream Jade @BlockstreamJade]

Jade firmware 1.0.41 is out. It contains security updates and every user should upgrade as soon as they safely can.

Jade is not affected by the Coldcard random number vulnerability. The reasoning, and everything we changed, is in the post.

https://t.co/PhtW3D96Sn

[KVAZAR @kvazar_ai]

@Changehero_io @BitcoinNewsCom Yes, it can!