@Arminsdevi
iAccount based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States Android App
Account-level information from X, not a live location or the device used for a specific post.
Facinated by the Bitcoin privacy problem Researcher at @mitDCI Host @bostonbitdevs
Joined May 2021
- Tweets716
- Following800
- Followers2.8K
- Likes6.9K
Armin retweeted
Lillian Wang of @mitDCI publishes her report: "A Comparison of Bitcoin Covenant Proposals for Vaults"
dci.mit.edu/posts/bitcoin-va…
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.
Armin retweeted
Quick explanation and thoughts on yesterday's Liquid hack:
nehanarula.org/2026/09/07/li…
Armin retweeted
The widely used @mempool fee recommendation algorithm looks at your nodes next 3 projected blocks, finds the median fee rate of each and computes priority tiers.
In contrast, Bitcoin core has historically only used *confirmed* blocks for it's fee estimate, but a new mempool based fee estimate algorithm has now been merged.
This new bitcoin core approach is only used to *lower* the fee estimate meaning estimates quickly drop if the mempool clears out, but won't instantly rise if a flood of high feerate transactions come in after a period of low fees.
github.com/bitcoin/bitcoin/p…
Armin retweeted
New from our Bitcoin Wizards division: The Many Headaches of CoinJoin. The anonymity set you were promised assumes an adversary with no memory and no block explorer. Real adversaries have both and who knows what else.
Armin retweeted
Thanks to everyone that came out last night!
Never forget when we were talking about the future of Boltz, opened up Twitter, and this was the first thing that appeared.
Armin retweeted
LLMs are used very successfully to find vulnerabilities in Bitcoin software.
Can they also help prove the security of a modern cryptographic library for Bitcoin?
To explore this question, @remix7531 and I are publishing libshrincs.
delvingbitcoin.org/t/libshri…
libshrincs is a handwritten C library implementing WOTS+C, the one-time signature used by SHRINCS.
It is a proof of concept and should not be used in production.
Its machine-checked proofs connect the C implementation to an unforgeability theorem.
The current theorem does not yet give a full post-quantum security bound.
The post and review tutorial describe its current limits.
Code and proofs:
github.com/remix7531/libshri…
Review tutorial for the security proof (no Rocq or SSProve background required):
github.com/remix7531/libshri…
@remix7531 has written three excellent posts on the library and verification work:
Towards libshrincs
remix7531.com/post/towards-l…
The grind was the only detector
remix7531.com/post/the_grind…
Choosing a verification toolchain
remix7531.com/post/choosing_…
Armin retweeted
Bitcoin Core v32.0 is targeted for release in October:
- Up to 3x faster initial sync. Block validation now fetches transaction inputs from disk in parallel instead of one at a time
- The libevent external dependency is fully removed, continuing Core's push to cut third-party dependencies
- Max peer connections raised from 125 to 200 to have more open slots for new nodes to sync from, faster block propagation, and a harder network to eclipse or partition
- Mempool-based fee estimation to cut fee overestimation (in progress)
- Transaction relay rate limiting is now global instead of per-peer, keeping a node's CPU and memory usage steady when transaction volume spikes
- Ships with features from libsecp256k1 0.8.0 with verification up to 11% faster, plus the new Silent Payments module (BIP 352)
- PSBTv2 (BIP 370) support, now the default for PSBT-creating RPCs for better coordination of unsigned transactions for multisig and hardware wallet setups
- New exportwatchonlywallet command to export a wallet as a watch-only file, no private keys, and restore it on your online node
- Core now enables Tor's proof-of-work DDoS defense on the onion service it creates for your node, where the Tor daemon supports it
Additional tests, bugfixes, and features included as well.
Feature freeze is ~August 20, rc1 ~September 10, final release targeted for ~October 10. (Test the release candidates when they ship!)
Armin retweeted
Anything interesting happening in bitcoin lately?
Join us for Boston BitDevs this Thursday August 13 at Fidelity to talk about it!
RSVP here 👇
app.evento.so/e/evt_9fcVYNxo…
Armin retweeted
Excited about the newly released version 2.5.0 of the Ledger Bitcoin app. Upgrade!
For many taproot🥕 miniscript policies it brings a long-awaited UX improvement: human-readable policy description, in addition to the descriptor template (which is opaque for most users). 🧵
Armin retweeted
🚨PSA for LND + BTCPay Server users🚨
Don’t assume you’re safe after upgrading.
You’re going to want to explicitly destroy your macaroons and macaroons.db and recreate them fresh. This also applies to auth mechanisms for other LN backends.
Also, if you generated a hot on-chain wallet in BTCPay you want to move those funds.
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.
Armin retweeted
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.
⚠️ This repo gained many stars in 24h. DO NOT RUN IT.
It claims to reproduce the vulnerable COLDCARD RNG, but an LLM-assisted review found a dependency that downloads and executes an infostealer that searches for wallet seeds, private keys and passwords.
github.com/domaup/coldcard-p…
Armin retweeted
Replying to @TheBlueMatt @lopp
Not intending to Monday morning quarterback, but I wanted to sharing my approach to defensive coding around RNGs:
1. Identify each source of entropy used by the RNG and instrument them. Measure how much min-entropy each source provides across different environments. /1