Pyggie

[tim-clancy.eth @_Enoch]

Ethereum doesn't play a narrative game because it has every narrative. It is the most decentralized network, with the widest geographic and stake-weighted validator distribution. It is the most secure network, protected by a pool of slashable Ether that even now gives it a raw total cost of attack that far outstrips all else. It stands alone as having effective client diversity, an achievement of ecosystem coordination that reduces the chance of a software bug becoming a protocol bug. Ethereum has non-probabilistic finality without sacrificing liveness, the self-healing mechanism of the inactivity leak, a sharded data availability layer, and perfect uptime.

Ethereum is the World Computer, it is the cryptographic bulletin board with guaranteed liveness, it is the unstoppable neutral verifier of proofs, it is the hardest database in existence. It is the global settlement layer for finance, finance that pretends to be decentralized, and decentralized finance. It is where you can vote, collaborate with friends, keep your art, keep your life savings, and record your life's works. Ethereum is the Unreasonable Man's katechon of liberatory technology in a world increasingly eroding Free speech, Free software, Free association, and Free markets.

Ethereum did this without taking shortcuts; scaling has always remained conservative to keep the CROPS requirement of at-home self-verification not only feasible, but easily feasible. It does this without hiding its problems; MEV is a scourge but it is transparent, where it can be reasoned about. It takes the time to prioritize important hardening features like FOCIL even when it requires the painful decision not to focus on other improvements.

Ether doesn't play a narrative game because it has every narrative. It is programmable. It is an unconfiscatable store of value with predictable and sustainable monetary policy. It is the pristine decentralized asset of the greatest network, by which virtue it is pristine collateral in decentralized finance. This makes Ether private nonvolatile money, able to mint a number of anonymous stable cash equivalents that are cheaply transferable anywhere and everywhere. It is an inherently productive asset in both its own flourishing ecosystem and as the wage of soldiers receiving the minimal viable pay to secure us all.

The future is incredibly bright. We have all of the tools we need and simply need to actually build liberatory technology with them. Ethereum upholds incredible underlying CROPS promises, but not everything that exists atop it is accessible in a CROPS way. The sovereignty of most users is eroded bit by bit in various ways and various trust assumptions. There is no reason that we cannot do better, there is no reason that we cannot fix this, and I am excited to dedicate my life to this cause.

[_gabrielShapir0 @lex_node]

https://t.co/mATaf8dzLL

[vitalik.eth @VitalikButerin]

Some of my perspective on where the @ethereumfndn is going.

First of all, this is only my own view. The board is not just me, and I have no extra special powers on the board that the other board members do not. @aerugoettinea is the one executing much of this transition. My input has been largely on technical questions. The board is in the process of expanding, and my own power within the org will continue to decrease, which is honestly what I want.

The 2025 era brought many important improvements to EF and its ability to execute. Many issues were resolved, and EF continues to benefit from its improved efficiency and greater focus on concrete goals to this day. And so with those problems resolved, early this year, the largest remaining hole that I perceived was something different nagging at me: I would regularly spot people saying things like "vitalik says these beautiful things about ethereum needing to be decentralized, and have privacy, and be a sanctuary technology, but why do the EF's actions not reflect that?"

Now, you may have been hearing something different. You may not have been sensing a feeling of crisis at all, and maybe were hearing people saying that finally we were taking execution and BD seriously and the main task for us is to keep going that way and be even better and faster. Then probably there is genuine difference between you and me, in what kinds of criticism I take most seriously, and what kinds of critics through their criticism are most able to make me feel pain.

As an analogy, let's briefly switch over to a different domain.

One belief you can have about Google is that it is a success story, and has brought a lot of good to humanity in organizing the world's information. Another belief you can have about Google is that they had a beautiful idealistic beginning, but at some point the corruption of mainstream corporate attitudes seeped in, and they slowly bit by bit completely abandoned the "don't be evil" slogan.

My belief on Google specifically is probably somewhere between the two. BUT, if you had taken me back in time to ~2008, and offered me a button to press to make Google one or two standard deviations more "dogmatic", eg. give Richard Stallman permanent veto power over some key policies, I would immediately press it.

Why? Because a choice for one company is not a choice for the world, or even one country. Google existed and exists in the context of a technology industry generally drifting away from early idealistic don't-be-evil roots and toward greed for financial gain, totalizing visions of accelerated superintelligence, infiltration by sociopaths, and craven capitulation to (or worse, active participation in) government pressure for ideological control, surveillance and war. And so *one company* doing something different, positioning itself to be what George Bernard Shaw calls the Unreasonable Man, resisting the trend of the times, would have been better for freedom, balance of power and stability of society as a whole, than *all* large companies bending to dominant trends. This is a part of my version of pluralism.

This line of thinking is not just mine, but I also is not too far off from what Aya and others had in mind with the Mandate.

Now how does this all get to the role of the EF?

EF is not a "center of Ethereum", rather EF is "one node, with a defined purpose, alongside other nodes". We've always said that the EF should be the latter, but many in the Ethereum ecosystem (and even within the EF) wanted us to be the former. Now, we are taking action to ensure that we will be the latter.

This is particularly important because EF is a limited organization, with limited resources and limited organizational capacity. The EF has only ~0.16% of all ETH (less than many other individual ETH holders), whereas among other blockchains it's common for "the central foundation" to have 10-50%. Fiscally, the EF was originally designed to fulfill a limited work scope defined in the token sale docs and other pre-launch materials (building the chain software; getting through Frontier, Homestead, Metropolis, Serenity), which was fully completed in 2022; it was not designed to be an eternal steward.

And so today, the EF is choosing to use its remaining resources to pursue longevity over breadth (yes, this means we sell less ETH). The EF focuses *specifically* on those activities critical to the success of ethereum as a censorship/capture-resistant, open, private and secure system, that would not happen otherwise. This means making hard choices, and in some cases even activities that we highly approve of and people that we highly respect becoming outside of the EF. People of great technical talent, public respect and even alignment with the mission and CROPS being outside of the EF is in fact necessary if we want important tasks to be able to attract outside capital. This also means the EF taking opinionated stands culturally.

This is all intended in cooperation with all other parts of ethereum. We recognize that many other parts of the ethereum world highly respect CROPS and related values. But highly respecting is not the same as choosing to specialize and totally dedicate to a domain (Compare in a different domain: I think reducing animal cruelty is important, and I like vegan food, but am not full unconditional vegan myself)

EF is still in a transition period, and we expect its new long-term form to stabilize over the next few months. What are the guiding principles of this new form? Again, I am only one person, but I can give my answer from a technical perspective (there are also critical non-technical aspects).

At the core, *Ethereum must be impressive*. We are living in an age of highly intelligent AI and all kinds of other technological acceleration. "Status quo EVM, with a hard fork or two a year to optimize for short-term needs of users" is not interesting.

To some, "impressive" means: 250ms latency and 1M TPS. I think Ethereum trying to go that route is a mistake. Being as fast and as scalable as possible, and only a small epsilon more decentralized than the others, is a route to mediocrity, and if we try it we will lose.

I think Ethereum should scale. But I think Ethereum should strive the hardest to be deeply impressive in a different dimension: the CROPS dimension. This means things like:

* Provably bug-free Ethereum. This is a goal that all cybersecurity researchers would have thought is absurd and impossible, up until roughly 6 months ago. Now, it's on the cusp of being possible, thanks to AI-assisted formal verification. So we should be frontrunners in doing this.

* Available chain consensus. Ethereum is, and with lean consensus will cotninue to be, the ONLY chain that has both (i) traditional-BFT style properties that it's safe under asynchrony up to a high level of fault tolerance, and (ii) the bitcoin PoW-style property that under synchrony it's safe up to 49% attackers. As far as I can tell, literally no other chain has this or is planning for it; bitcoin goes for (ii) only and most other chains go for (i) only. Some will remember I fought hard for this, Unreasonably insisting that it is not OK for ethereum to rely on social consensus and hard forks to rescue ethereum from 34% of nodes going offline. It's OK for chains like hyperledger, bnb, solana, tempo, etc. It's not OK for bitcoin or ethereum or eg. zcash.

* Intermediary minimization. The fact that smart contract wallets, protocols like railgun, etc have to send transactions through intermediaries to get included onchain is honestly embarrassing, and it's a constant point of fragility. Hence the work on FOCIL and EIP-8141 (and 7701 and years of work before) to make transaction sending intermediary-minimized with public mempool and strong inclusion properties, in a truly general-purpose way, that covers not just eg. secp256r1, but also privacy protocols and much more. Kohaku is pushing intermediary minimization at the user layer, pulling Ethereum away from the dystopian status quo world where our wallets don't even verify the chain, send our private data out to a dozen third-party servers, and toward a brighter CROPS future.

Some of these goals are Unreasonable - maybe Ethereum would be "fine" getting only 50% of the way - what if we depend on intermediaries, but make it easy to switch? But going 50% of the way would not make Ethereum Deeply Impressive in the CROPS way. So we push for 100%.

Fortunately all these goals are compatible with high TPS, this is a major focus of research (esp. on scaling the state). Well-designed L2s can also help, especially L2s optimized for specific applications (eg. high-volume trading, privacy...). These goals are even compatible with significantly lower slot times, thanks to Raul's work on erasure-coded P2P, and many other optimizations.

The most high-value "product" of the ethereum blockchain, financially speaking, is ETH the asset. Ethereum secures $250 billion of ETH. The types of properties of Ethereum that I mentioned above are very good for ETH the asset. Nearly 90% of my net worth is in ETH, and most of the remainder is ~$40m of onchain fiat of which every dollar has already been allocated for some open-source biotech or software or hardware initiative. That said, there are aspects of supporting ETH the asset - *necessary* aspects even - that are outside the scope of the EF. This is where we need other heroes (some of whom hold more ETH than the EF does) to step in and help. EF has been recently thinking more about how it will relate to other such organizations, and give them needed initial support.

EF will be a smaller ship than in previous years, a more opinionated one - in some cases more opinionated in ways that might be difficult to comprehend - but a longer-lasting one, and one suited to making sure that ethereum brings something meaningful to the world. We are grateful to all those inside and outside the EF who are helping to make this happen.

[terence @terencechain]

A quick post on how ePBS changes Ethereum scaling:
https://t.co/texbKsqMAb

[banteg @banteg]

thorchain gg20/tss attack path

i reproduced the suspected gg20 leakage mechanics against the tss-lib version they used. it accepts malformed paillier material, exposes a type 5 / type 7 oracle shape, and the go-tss wrapper misses some important checks.

https://t.co/sHObFm9ggE

[MEV-X @MEV_X_project]

Jared from subway just sandwiched @VitalikButerin: https://t.co/H9mP1CTa8y

this is the most Ethereum thing that has ever happened, MEV doesn't care who you are🥪

[soispoke.eth @soispoke]

Alice swaps privately on L1

tldr: Privacy protocol users today depend on broadcasters that can see, frontrun, and censor their transactions. In this thread we show how four future protocol upgrades can remove this dependency step by step. Native AA (EIP-8141) and 2D nonces let users self-submit with no off-chain infrastructure. Encrypted frame transactions hide swap parameters until after block ordering is committed. FOCIL guarantees inclusion as long as one honest includer can see the transaction pending in the public mempool.

👇🧵

[Aave @aave]

Aave LLC has filed an emergency motion to vacate a restraining notice served on Arbitrum DAO on May 1, 2026 that attempts to seize approximately $71 million in ETH belonging to victims of the April 18 exploit.

A thief does not gain lawful ownership of stolen property simply by taking it, and the law is clear on this. Those assets were recovered to be returned to users victimized in the April 18, 2026 exploit. Freezing them harms the very people this recovery effort is designed to protect.

We’ve asked the court for an expedited hearing and a temporary vacatur, and we are continuing to work alongside the Arbitrum community and DeFi United to make affected users whole.

[Ranko X @r4nk0X]

🧵 you can hold the most private coin on earth. doesn't matter if your wallet app pings 40 servers the second you open it. your IP is out before you generate a key.

so I tested 13 web3 wallets on first launch:

clean android, no sim
apks via gplaydl
wifi + vpn
pcapdroid per app

[Steven Goldfeder @sgoldfed]

Surely one of the most complex decisions ever made in Arbitrum governance history but a few things worth noting:

1. To all those screaming for the past few days “Arbitrum has a centralized sequencer so they can move funds”, take a few minutes to learn how Arbitrum works. The sequencer has absolutely no power to move funds and was not the one who acted here.

2. The decision to act was made entirely by the Arbitrum Security Council, a group of 12 individuals elected by the Arbitrum DAO (the annual election is currently underway — vote now!), which required 9/12 of them to agree.

The council is independent from the Arbitrum Foundation and Offchain Labs (1/12 of the elected members is an OCL engineer), and came to this decision by themselves after much deliberation.

You may not like the existence of security councils and you can form your own opinion on whether you agree with their actions, but this process was extremely distributed and coordinated by independent actors, and ina world where security councils exist, Arbitrum’s is a masterclass on how a truly independent security council should operate.

3. For many, the ultimate goal is to get rid of the security council entirely, but this is complicated.

Technically it’s easy — the security council is elected by the DAO and operates at its pleasure, and the DAO can turn it off at any time.

But the harder question is _should_ the DAO do that? L1s have the ability to hard fork. Security councils control the analogous power for the L2. If you get rid of it, you lose the ability to hard fork. You can still update the chain via DAO vote but that’s a slow process and you can no longer do fast emergency actions (which includes both actions like the security council took today as well as the ability to quickly upgrade the code in case an exploitable vulnerability in the software stack is discovered).

As I’ve said many times, the best path that I see to getting rid of security councils is for the L1 itself to take on this burden for its most important L2s (as defined by objective criteria). In that case, in the case of a vulnerability or an exploit the conversation for L1 and L2 will be identical — does this warrant an L1 hard fork. I’m hopeful that we can reopen this conversation in the coming weeks.

[Pyggie @pyggie9]

What really happened

[Zach Rynes | CLG @ChainLinkGod]

Look guys, it's actually really straightforward, a bunch of people staked their ETH on the Ethereum blockchain to earn yield, except they didn't want their capital to be locked up, so they actually staked with a liquid staking protocol called Lido who provided them a liquid staking receipt token called stETH, except they decided to juice their yield further by depositing their stETH receipt tokens into a restaking protocol called Eigenlayer, except they didn't want to lock up their capital, so they actually restaked with a liquid restaking protocol called KelpDAO who provided them with a liquid restaking receipt token called rsETH, except they decided to juice their yield further by depositing their rsETH tokens into a lending protocol called Aave so that they could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero that was hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry

[Zach Rynes | CLG @ChainLinkGod]

Look guys, it's actually really straightforward, a bunch of people staked their ETH on the Ethereum blockchain to earn yield, except they didn't want their capital to be locked up, so they actually staked with a liquid staking protocol called Lido who provided them a liquid staking receipt token called stETH, except they decided to juice their yield further by depositing their stETH receipt tokens into a restaking protocol called Eigenlayer, except they didn't want to lock up their capital, so they actually restaked with a liquid restaking protocol called KelpDAO who provided them with a liquid restaking receipt token called rsETH, except they decided to juice their yield further by depositing their rsETH tokens into a lending protocol called Aave so that they could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero that was hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry

[Arbitrum @arbitrum]

The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications.

After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users.

As of April 20 11:26pm ET the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties.

[⟠ @ryanberckmans]

the great news is that pretty much all of this is totally preventable

ethereum and ETH are rapidly growing to global ubiquity. this doesn't change that one bit

future defi solutions won't make these amateur errors (they'll eventually seem like amateur errors... already do to many experts)

attacker supremacy from AI won't last, it's working through a backlog of exploits. the limit result will be much permanently more secure protocols and eth's neutrality and capital gravity well will be more valuable than ever

if you have ETH lent in aave, imo you should get out right now by using onchain limit orders to sell to whale loopers who are actively buying aETH unwind leverage. you can take as little as a 1.1% haircut based on ongoing txns in mid 6-figs, which is much lower than some estimates of final socialized losses.

why can ETH lenders take only a 1.1% haircut now? because loopers want to avoid liquidation from high rates caused by 100% utilization. on the bad debt side, loopers actually win from socialized losses because their debt token (aETH) is the one taking the haircut, so they'd owe less in ETH terms.

the most remarkable thing in this crisis is clearly that billions of dollars in backbone eth lending on aave were in fact exposed to signer risk in a 3rd party bridge... effectively some random downstream fellow was actually an aave admin.

aave additionally has negligently low borrow rates during 100% utilization, leading to extremely dangerous illiquidity. what if ethusd crashed for any reason... eg. if stocks were open and a politician said the wrong thing, btc goes down 5%, eth goes down 8%... this can lead to broader contagion and bad debt.

protocols and their teams like fluid (who've had low level dynamic withdrawal rate limits in protocol from day 1 so can't be insta drained) and spark (who seem to have excellent scientific gov and no exposure for eth lenders to 3rd party bridge admins) deserve respect and attention for doing what they knew was right and possible even before the ecosystem had a forcing function to care about it. same goes with other kinds of security practices that are still fringe, maybe including formal verification and ipfs hashes for frontends

nearly 24h since the attack, the lack of material updates from affected protocols, including kelp, layerzero, and aave, suggests to me the ongoing severity of the situation. many factors are in play, there's probably no great solution, somebody is going to lose big

is just the bridged rsETH (that argubly took bridge risk intentionally) fully on the hook for the bridge failure, and L1 rsETH should be unaffected? however L1 rsETH *was* affected due to gov choices in aave. does aave's junior debt program, umbrella, take the full wipeout? however umbrella's terms & conditions say they have no bridge risk, which aave gov effectively violated without umbrella holders realizing it. does layerzero bear responsibility for allowing their users to be subject to terrible admin config in one of their ecosystem bridges? i'm probably missing aspects here, it's very messy.

Just Use Aave is dead... nobody is going to Just Use Anything anymore

the future of this industry is to do the smart obvious stuff even when it's unpopular, like withdrawal rate limits, better interest rate gov, avoiding toxic market share steroids like degen bridge looping affordances.

and for 10x better user recognition and higher standards around protocol hygiene and security differentiation. degen stuff is fun and amazing but only when you understand the true risks

in sum, if you are lending ETH in aave, get out now at a ~1.1-1.5% haircut by selling to loopers actively unwinding because when the dust settles, a material haircut for Aave v3 ETH lenders is a possibility

ethereum and ETH are growing well to global ubiquity and will be massive net beneficiaries of our industry successfully navigating this crisis season of backlogs of exploits discovered by AI and preventably poor practices in defi architecture/gov. trillions await

[monetsupply.eth @MonetSupply]

because the final allocation of losses between rsETH on Ethereum (which is technically "fully backed") and external chains is still tbd, i can only read this as a statement of Aave Labs' preference - they would rather rsETH on mainnet to have zero haircut, and for rsETH on L2s/external chains to bear the full loss (essentially zeroed out)

ultimately, the allocation of losses will be mostly decided by Kelpdao team (and lawyers)

but we can consider why this outcome would be aave labs' preference, and what would be the impact on users if this is how it ends up working out

# aave labs preference

aave core market on ethereum is covered by umbrella insurance module, and is also explicitly covered by aave dao backstop (eg dao committed to using treasury to backstop against bad debt). so if rsETH on ethereum ends up with no haircut, then not only are umbrella users completely unaffected (other than potentially GHO stakers to cover unbacked GHO on external chains), but the aave treasury remains intact

aave core is also the primary money-maker for the aave protocol, and preserving this is probably top priority for labs team

# user impacts

if rsETH on Ethereum has no socialized losses/haircut, users on Aave core would end up being mostly unimpacted

however, certain L2 networks would face an extremely heavy burden, with WETH suppliers taking a direct hit from unbacked rsETH

current rsETH collateral across external chains includes:
- Base: $71 million
- Arbitrum: $152 million
- Mantle: $116 million
- Ink: $21 million
- Linea: $1.4 million

in some cases, rsETH backed loop positions may comprise a large share of the backing of aWETH, meaning that any assets borrowed against ETH may also be at risk of a haircut (USDC and USDT0 markets)

mantle, arbitrum, and base seem to have the highest risk here, with mantle in particular having the majority of aWETH backed by potentially zero value rsETH. it is possible that Aave could successfully maneuver these chains into bailing out their markets (this may be part of the reason why Aave Labs prefers no loss socialization on Ethereum, to force the issue with relatively better capitalized chain ecosystems)

we also note that ethena has a material deposit amount in the mantle USDT pool (https://t.co/CXOGQR7OZu) which may face a haircut, potentially exceeding their excess capital buffer. if this is the case, then this would become another vector of contagion risk into Aave markets including Core and Plasma (which has been relatively less affected as it had no rsETH exposure at the time of the hack)

# comparison with full socialization

personally, i think that concentrating losses on external chains is actually a worse outcome for Aave

in the case where losses are spread evenly including Ethereum users, this would engage Umbrella ETH depositors (roughly $50 million) and also enable using rsETH collateral on Aave Core to repay part of the debt, likely reducing the uncovered loss on Ethereum mainnet to an amount lower than Aave's current treasury reserves

the loss levels on external chains would then be at much more manageable levels, with less risk of cascading spillover into large haircuts on stablecoin markets or impairment to other key aave collateral assets like USDe

awaiting further updates from the Kelpdao team to see how this will play out in practice

[DCF GOD @dcfgod]

You and your friend give mainnet eth to kelp, they stake it and give you rseth as a claim token for your eth + ongoing yields

You decide to keep your rseth

Your friend decides to deposit into a bridge and get another claim token on a different chain to his rseth in the bridge

The bridge contract has its rseth which backs your friends bridged tokens stolen

Should you get a haircut despite not being deposited in the bridge? Or should your friend take all the losses as he knew he was exposed to the bridge risk by using it?

[banteg @banteg]

it's really crazy that layerzero doesn't have some redundant sanity check and allows to bridge 116,500 rseth from a chain with a supply of 49

anyway here is my investigation https://t.co/4J0f7fscck

[Keone Hon @keoneHD]

A recent viral clip showed Don Wilson of DRW criticizing public blockchains for their lack of MEV-resistance. Wilson argued that, as a result of this, public blockchains are not suitable for financial markets.

This critique isn't going to go unanswered. Last night, Category Labs published a frontier research result for encrypted mempools. This is a significant result that leads the way to practical MEV resistance, and is how our industry will prevail against the private blockchain crowd.

Background

When you submit a transaction on a blockchain, it sits in a pending state where it may be frontrun by a bot.

The cleanest fix would be for users to encrypt transactions until they're included in a block, but doing that efficiently is very hard: you need a committee of servers that can jointly decrypt only the transactions that make it into each block, fast enough to keep up with block times.

Up to now, this idea hasn't been practical, as the best threshold encryption schemes are too slow, introduce censorship attacks, or introduce impractical operational steps for users or validators.

Category Labs has a solution: BTX, a new scheme for Batch threshold encryption (BTE) that is actually practical and performant. This leads the way to encrypted mempools on Monad.

The result

Batched Threshold Encryption (BTE) lets a committee of servers jointly decrypt a specified set of encrypted results from a pool while keeping the rest private.

Prior BTE schemes each had a drawback:
- some required per-block MPC setup
- some bound each ciphertext to a specific block or epoch (limiting rollover and enabling censorship)
- some required users to pick an index from a small namespace (resulting in occasional collisions)
- and the ones that avoided all these issues were either computationally prohibitive or required a common reference string (CRS) that grows with the number of sessions.

BTX, the new mechanism proposed in the paper, is simultaneously:
- epochless
- collision-free
- computationally efficient, and
- compact

In the paper, the authors implement BTX and benchmark it against the strongest two prior schemes (PFE from Boneh et al. and BEAT++ from Agarwal et al.). (BEAT++ is a prior result by most of the authors of the present paper.)

BEAT++ is fast but has a censorship-enabling design flaw; PFE is clean but slow and has bigger ciphertexts; and Fernando et al. (a third leading scheme) is clean but doesn't scale to long-lived deployments. BTX is the first construction that's simultaneously collision-free, epochless, compact, and fast.

BTX is a significant result solving a huge problem. Check out the paper in the next post.

[Trail of Bits @trailofbits]

Google used a ZK proof to disclose a quantum breakthrough that cuts the cost of breaking cryptocurrency by 20x without handing attackers the circuit. We found anyone could forge a “proof” of an even stronger attack. 🧵

[Eli Ben-Sasson | Starknet.io @EliBenSasson]

ELI5 of @avihu28's brilliant paper:

1. In a Bitcoin tx there are two parts:
(1) The first part used to show that you own a Bitcoin. That part can be made post-quantum safe.
(2) The second part that says who controls it next. That part can also be made post quantum safe.
BUT, till yesterday, the ONLY THING binding the two parts together was a *quantum susceptible signature*.

This means that Darth Vader can see your TX, take his quantum computer, break your quantum susceptible signature, and replace your second part (sending the Bitcoin to your friend) with his second part (sending the Bitcoin to himself).

Avihu found a brilliant way, which uses another brilliant idea (BINOHASH) by the brilliant @robin_linus, to BIND together the two parts in a way that is unbreakable by a quantum computer. So now even Darth Vader cannot take your bitcoin.

The downside, acknowledged by Avihu, is that this solution comes with a tech-ish complex UX and won't be cheap. It can serve as a fall back solution but a better one would be to agree to a soft fork that allows for Bitcoin transactions to be signed with post quantum secure signatures.

Which option do you prefer?