openoms

Building nodes for Security, Privacy and Freedom | | PGP 5BFB77609B081B65 | ⚡[email protected] | @blinkbtc #RaspiBlitz

[openoms @openoms]

Running Bitcoin Core.

[Alex Bosworth @alexbosworth]

To every developer who's stood watch over BTC/LN, past and present, inside project teams and out: thank you. You rarely get credit for the attacks you've prevented. LND v0.21.8-beta is the latest tag, so please take a minute to make sure you're running it: https://t.co/6CyLlKV22j

[LNbits @lnbits]

🚨SECURITY UPDATE🚨
v1.7.0 is now released
https://t.co/AucW45i0Ck
Please follow the upgrade guidance in the notes.

[L0la L33tz @L0laL33tz]

I built an open-source chain analysis tool that anyone can use.

It requires no payment, no login, and no data you search is ever seen by Tracey’s server.

Everything you search in Tracey is processed directly in your browser.

All of Tracey’s heuristics are public and have clearly described shortcomings. The entire website comes with tooltips explaining to you what each step does. Most of its clustering rules are pulled from the disclosed research papers, some I wrote myself to be more conservative.

I built Tracey for myself, but thought it might be useful to other people as well – especially in light of all the recent thefts of funds. It can’t help you create evidence, but it may help you find some leads on where your money is moving on bitcoin. 1/4 🔽

[LNbits @lnbits]

⚠️⚠️ All LNbits users should stop their LNbits servers IMMEDIATELY. ⚠️⚠️
Please forward this announcement.
Following a wave of attacks, we have a number of security patches to push. Until then, it's better to err on the side of caution. 🙏
Updates to follow soon.

[openoms @openoms]

@_pretyflaco Grateful to have worked with you, your energy is unmatched.
Blink will always bear the mark you have added to it.

[openoms @openoms]

Fully validating Bitcoin nodes on SDcards, maybe even on old phones.
Fit in your pocket, take anywhere.

[l0rinc @L0RINC]

@openoms @joinmarket We've removed seek compaction in the latest Core releases, so I would expect SD cards to hold up even better now.

I also have a few more ideas that would reduce needless writes, which might even make SD cards usable for (pruned) IBD: https://t.co/BEjM64YW4m

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.10 is out, and every node runner should upgrade.

This point release includes security fixes. Verify the signatures and install it as soon as possible.

https://t.co/so3JpeFPvX

[Olaoluwa Osuntokun @roasbeef]

lnd v0.20.7 and v0.21.6 have been released, which contain a Go-specific mitigation (MPTCP flag off) for CVE-2026-98432 (use-after-free in the Linux kernel's IPv4 TCP).

https://t.co/teYiy9R44U
https://t.co/ygHT5u4d3H

We recommend that all users update to this new version.

Existing binaries can be protected by running them with the GODEBUG=multipathtcp=0 env variable: https://t.co/ptTwUv5U6j.

Note that as this is a Linux kernel level vulnerability, the only way to fully mitigate the vuln is to patch your kernel, as any network facing service may be affected (known PoCs use MPTCP, but other exploit vectors may be possible).

[Bitcoin Core Project @bitcoincoreorg]

Bitcoin Core v32.1 was released!
It is available from: https://t.co/WpMuMaejz1
Release notes: https://t.co/hWQTLpfGBl

[Kukks(Andrew Camilleri) 👾 @MrKukks]

🚨🚨@BTCPayServer has updated its available opt-in woocommerce/wordpress deployment on its docker installer following the critical PHP vulnerability diosclosures.

UPDATE IMMEDIATELY IF YOU ARE USING WOOCOMMERCE DEPLOYED THROUGH BTCPAYSERVER.

SIMPLY PRESS UPDATE INSIDE YOUR BTCPAYSERVER.

Kudos to @ndeet for the quick shipping here.

[Blink Wallet @blinkbtc]

Full post-mortem of the September 19 attack, and a 50% bounty — up to 3.3 BTC — on the stolen funds:
https://t.co/8iRFY7Q13G

Bounty terms:
https://t.co/aF8d2L29Kv

On Saturday September 19 an attacker used a flaw in our admin tools to take over 35 Blink accounts and withdraw about 6.61 BTC from 24 of them. A customer called one of our engineers at 11:39 UTC. Fifteen minutes later the whole custodial service was off. By that evening the hole was closed and the service was back. By Thursday September 24 every affected customer had their exact balance back, in bitcoin and in dollars, paid for by Blink's shareholders. No customer bears any loss.

This was our fault. Not Bitcoin's, not our users'. To the 22 customers whose bitcoin was taken, and to the 3,817 people whose account details were looked up: we are sorry.

How it happened:

From October 2023 until that Saturday, anyone with a free Blink account and a web browser could give themselves the powers of our support staff: change the email or phone on any account, log in as that customer, raise their limits. Three unremarkable mistakes in how our admin tools checked permissions, stacked on top of each other, in code we inherited.

The whole team was busy moving tens of thousands of users to self-custody under new regulation. Monitoring built to catch outages didn't catch an administrator doing things no administrator should.

What it didn't touch:

The money came out of our hot wallet. Most customer funds sit in multi-signature cold storage that nothing in our admin tools can reach. Non-custodial accounts were never in play: we don't hold those keys.

What the attacker saw:

They also read the details of 3,817 other accounts, in some cases a phone number or email address. Not names, not IDs, not addresses, not passwords, not seed phrases. We wrote to every holder we could reach, saying exactly what was seen.

What stopped them:

Two-factor authentication. The attacker logged in to nine accounts that had it on and tried eighteen times to move money. Zero loss.

None of the 24 drained accounts had it on. If you take one thing from this post: Settings → Security and Privacy → Two-factor authentication. Then turn it on for your email too.

What we changed:

The flaw was fixed the same day and a third layer added two days later. The admin tools are off the public internet. The functions that change a customer's email or phone are switched off for everyone while we redesign them. All customer API keys were revoked.

The hot wallet now holds a fraction of what it did. Security fixes are developed privately and published once deployed; the code stays open source. A standing security reporting channel is live, with rewards of up to 0.1 BTC for critical findings.

Where the money is:

Some still sits where it was withdrawn to. About 5 BTC has gone through a cross-chain swap service; a small amount reached an exchange that is cooperating.

Criminal complaints are filed in El Salvador and Próspera, the regulators are notified, and we have traced the funds continuously. We are not expecting the money back.

So we are putting a 50% bounty on it.

Whoever provides the information that leads to a recovery gets 25% of what is recovered. Another 25% of anything recovered goes to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and the circular economies they choose. No cap, no end date, paid only out of funds that actually come back. Write to [email protected].

We would far rather have spent this money on grassroots Bitcoin adoption than lost it to a thief. Shame on the attacker.

One more thing:

Ignore any email or SMS about this incident that contains a link: we contacted affected users only through messages in the Blink app. We will never ask for your PIN, password, seed phrase or a login code.

The full post-mortem has the timeline, the technical detail for anyone running code derived from ours, and the bounty terms (links at the top).

[Blink Wallet @blinkbtc]

Blink team members will never ask you for a code, PIN, password or seed phrase.

Protect your account now: add email login and two-factor authentication in the app.

Full post-mortem coming soon.

Questions: [email protected]

[Blink Wallet @blinkbtc]

Every account affected by the September 19 incident has been made whole.

We restored each account to its exact pre-incident balance.

Affected users were notified directly before this post.

Thank you to our mission-aligned shareholders who stepped in.

[openoms @openoms]

Keep iOS up-to-date and have Lockdown mode switched on all the time.

[Officer's Notes @officer_secret]

Urgent security advisory for iOS users!

Install the latest iOS update immediately. Security researchers report that financially motivated attackers are now using a complete, in-the-wild exploit chain that can quietly steal cryptocurrency private keys and mnemonic seed phrases from iPhones.

The reported attack begins when a target is socially engineered into opening a malicious page in Safari. That page is said to abuse a memory-corruption flaw in WebKit / JavaScriptCore to gain arbitrary read/write access from JavaScript, then bypass Pointer Authentication Codes (PAC) to run native code, break out of the WebContent sandbox, and escalate to kernel/root privileges.

With that access, attackers can pull data from the device Keychain and from local crypto wallet apps.

The claimed impact range is iOS 13 through iOS 26.5; that range has not been independently confirmed in full. Until more is known, treat any unpatched device as potentially exposed and update as soon as a newer build is available. Also avoid untrusted links in Safari, especially if you keep wallet keys or seed phrases on the phone.

[openoms @openoms]

@lexeapp cc @ketominer

[openoms @openoms]

@silentlink1 That's rouge agent, greetings to the boss .

[Core Lightning ⚡️ @Core_LN]

Security Advisory: We are investigating reports of a potential issue affecting experimental features in Core Lightning that may impact user funds.

We urge all Core Lightning users running experimental features to disable them immediately while we investigate.

[openoms @openoms]

@silentlink1 What's the email for the datasheet?

[EVAN KALOUDIS @evankaloudis]

If you're running Core Lightning (CLN) with the experimental dual-funding feature, you probably want to disable it for now:

https://t.co/z2YCG37WXl