Announcements

• Respect people’s privacy
• Interaction and asking questions are encouraged
• Chatham House Rules

Coldcard Vulnerability

• User reports their coldcard wallet being drained on reddit, Discussion
• Coldcard communication during and after
  • Coldcard Mk3 Security Advisory
  • Technical deep dive into the entropy issue
  • To all Coinkite users and the entire Bitcoin community - NVK
  • Adding to the Public Record on Our Ongoing Investigation - Coldcard
  • Coldcard issues “extremely important correction”
• Coldcard Mk2, Mk3, Mk4, and Q Firmware Security Vulnerability - block
• Tracing the Attacker’s Steps Through 1,082 BTC Coldcard Drain - Praveen Perera
• Coldcard Entropy Bug: An Investigative History - SimpleStacker
• Coldcard: the technical autopsy of an entropy failure - Kevin Loaec, Wizardsardine
• When random.bytes runs but doesn’t work - tuma, btcpp
• Alex Thorn, Galaxy Digital Research Part 2 Part 3
• mapping the ongoing Coldcard attack with a live dashboard - James O’Beirne
• Coldcard key exposure - orangesurf
• Coldcard and the limits of “don’t trust, verify”
• There is not 1 single compelling evidence that this was a backdoor - Raw_Avocado
• Coldcard users allegedly reporting drains since 2022
• River: Coldcard Exploit Takeaways
• MARA Slipstream “rescues” 9K bitcoin from Coldcard multisigs
• Coinkite suspends customer data blanking

Other Weird Exploits

Boltz

• Announcement
• Blockstream Swaps
• Swapmarket still operating
• Canary expires
• Boltz says it was just an oversight

BTCPay Server

• Announcement
• Response and next steps
• How to set up BTCPay Server better after the hack?

Zeus LSP

• Announcement
• Post-Mortem

BIP 110 Chain Split

• OCEAN Accused of hashrate hijacking over BIP110
• Inside OCEAN Mining during the BIP110 chain split - Bob Burnett interview
• BIP110 debate about new PoW algorithm
• Luke Dashjr announces sabbatical from OCEAN Mining
• Luke Dashjr removed from BIP maintainer role
• Lopp post-mortem
• Mechanic: It’s been 15 years, I’m out
• Some advice re Luke-less Knots - Siggy

BIPs

• BIP54: Great Consensus Cleanup - PR to implement without mainnet activation
• BIP95: Testnet 5
• BIP352: Silent Payments functions merged into libsek256k1
• BIP452: P2P UTXO Set Sharing
• BIP453: Terminology of Transaction Components
• BIP455-457: SwiftSync Specification
• BIP458: Half-Aggregation of BIP 340 Signatures
• BIP459: DahLIAS fully aggregated signatures for secp256k1
• BIP460: CISA for Taproot Key Path Spends
• BIP461: Deterministic ECDSA Signatures
• BIP Draft: CHillDKG - Distributed Key Generation for FROST

Releases

• Payjoin Dev Kit 1.0
• Ledger Bitcoin v2.5.0 human readable miniscript policies
• Proof of Work Signet Faucet - ajtowns
• Breez releases Glow - The Bitcoin App for Everyone
• Minerva Mint - Ark-backed Cashu ecash
• Clams v1 - local first accounting for Bitcoin

Research

• Bitcoin post-quantum R&D tldr
• Dropkick - a minimal commit-reveal rescue protocol - Conduition
• BIP322 verifier accepts proofs signed by unrelated keys for P2WPKH, P2SH-P2WPKH
• Call to test Bitcoin Core static binaries - Schmidty
• The DIY Signing Device Revolution is Just Beginning
• How to destroy bitcoin (and what happened to the 107 coins burned in May - bennet
• Anzen: Bitcoin self-custody trilemma - Luke Childs
• Omega Splice - Dusty Daemon

Tools

• Bitcoin, Ark, and Nostr decoder

News

• Trezor data breach
• Bitcoin Red Team
• OpenSats announces priority support for Red Team
• Amboss announces affiliate program
• odudex steps down as krux maintainer, JonDoe_le_frog becomes new maintainer
• nix-bitcoin 0.0.139 is final version
• RY3T Nova: First product built on Mujina - 256 Foundation
• Floresta roadmap Q2, Q3 2026
• Wiz seeks support to register top level domain .bitcoin
• NVK steps down from OpenSats board
• Bitcoin Security Consortium Announced