0xaudron retweeted
I'll be speaking at DSS alongside @Sabanaku77!
We'll be talking about Web3 Security Monitoring Internals, from on-chain threat detection to incident response.
See you all at DSS and Devcon!
We'll be talking about Web3 Security Monitoring Internals, from on-chain threat detection to incident response.
See you all at DSS and Devcon!
The DSS 2026 timetable is live.
Nov 1–2 · Mumbai · Amber + Pearl
Pick your talks, save a shortlist and share it with @summit_defi.
Agenda: defisecuritysummit.org/2026/agenda
Tickets: luma.com/9qtxqqxx
7
6
49
2,064
0xaudron retweeted
🎉 GIVEAWAY ALERT: We have one extra @EFDevcon ticket to sponsor!
Need a ticket? Tell us why in the comments within 24 hours. We’d love to see you at Devcon! 🚀
Need a ticket? Tell us why in the comments within 24 hours. We’d love to see you at Devcon! 🚀
4
4
13
345
0xaudron retweeted
We've just published 15 security advisories across BitcoinJS libraries (14 High and one Medium), with patched releases available on npm.
This follows work with @junderwood4649 and the reporters to investigate the issues, prepare fixes and provide backports for the maintained release lines.
The findings cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
If you maintain an application using BitcoinJS packages, please check your direct and transitive dependencies and upgrade affected versions.
For bitcoinjs-lib, the patched releases are 7.0.5, 6.1.10 and 5.2.3, depending on your release line. Both tiny-secp256k1 and bitcoin-js/tiny-secp256k1-asmjs have fixes in 2.2.5.
The other patched releases are bip39 3.1.2 and 2.6.1, bip38 3.1.2 and 2.0.4, bolt11 1.4.2, merkle-lib 2.0.11 and bip32-utils 0.11.2.
Some fixes require changes in the application as well as a dependency update.
You can find the affected ranges, technical details and upgrade guidance here:
github.com/bitcoinjs/bitc…
github.com/bitcoinjs/tiny…
github.com/bitcoinjs/bip3…
github.com/bitcoinjs/bip3…
github.com/bitcoinjs/bolt…
github.com/bitcoinjs/merk…
github.com/bitcoinjs/bip3…
Thanks to the researchers and reporters: the Bitcoin Red Team (@Rob1Ham, @callebtc and @danielabrozzoni), @0xaudron, @real_a_kalout and ARSB (github.com/ARSB1).
This follows work with @junderwood4649 and the reporters to investigate the issues, prepare fixes and provide backports for the maintained release lines.
The findings cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
If you maintain an application using BitcoinJS packages, please check your direct and transitive dependencies and upgrade affected versions.
For bitcoinjs-lib, the patched releases are 7.0.5, 6.1.10 and 5.2.3, depending on your release line. Both tiny-secp256k1 and bitcoin-js/tiny-secp256k1-asmjs have fixes in 2.2.5.
The other patched releases are bip39 3.1.2 and 2.6.1, bip38 3.1.2 and 2.0.4, bolt11 1.4.2, merkle-lib 2.0.11 and bip32-utils 0.11.2.
Some fixes require changes in the application as well as a dependency update.
You can find the affected ranges, technical details and upgrade guidance here:
github.com/bitcoinjs/bitc…
github.com/bitcoinjs/tiny…
github.com/bitcoinjs/bip3…
github.com/bitcoinjs/bip3…
github.com/bitcoinjs/bolt…
github.com/bitcoinjs/merk…
github.com/bitcoinjs/bip3…
Thanks to the researchers and reporters: the Bitcoin Red Team (@Rob1Ham, @callebtc and @danielabrozzoni), @0xaudron, @real_a_kalout and ARSB (github.com/ARSB1).
5
18
37
7,136
0xaudron retweeted
🚨 Multiple bitcoinjs packages vulnerable to high severity security issues
Thousands of wallets, applications, SDKs and infrastructure projects rely on libraries that most teams will never audit themselves.
The numbers speak for themselves:
- bip39 being used by 220k projects k
- bitcoinjs-lib with ~520k downloads/week
- tiny-secp256k1 with ~300k downloads/week
Other packages are also affected. The stack on the internet is changing with improved security standards. Expect more disclosures, fixes and hacks if you don't stay up to date.
Update all the packages to patched versions as specified:
> bitcoinjs-lib: 7.0.5, 6.1.10, 5.2.3
> bip39: 3.1.12
> tiny-secp256k1: 2.2.5
> bip38: 0.11.2
> bip32-utils: 0.11.2
> merkle-lib: 2.0.11
> bolt11 : 1.4.2
At @kvazar_ai we are using our AI audit engine to dig more deeper in supply chain, infra, stacks most usually miss.
The internet runs on open source repo like bitcoinjs. Its security depends on what we (whitehats) uncover before attackers do.
Let us know if you would like us to uncover your security , feel free to DM🤝
Thousands of wallets, applications, SDKs and infrastructure projects rely on libraries that most teams will never audit themselves.
The numbers speak for themselves:
- bip39 being used by 220k projects k
- bitcoinjs-lib with ~520k downloads/week
- tiny-secp256k1 with ~300k downloads/week
Other packages are also affected. The stack on the internet is changing with improved security standards. Expect more disclosures, fixes and hacks if you don't stay up to date.
Update all the packages to patched versions as specified:
> bitcoinjs-lib: 7.0.5, 6.1.10, 5.2.3
> bip39: 3.1.12
> tiny-secp256k1: 2.2.5
> bip38: 0.11.2
> bip32-utils: 0.11.2
> merkle-lib: 2.0.11
> bolt11 : 1.4.2
At @kvazar_ai we are using our AI audit engine to dig more deeper in supply chain, infra, stacks most usually miss.
The internet runs on open source repo like bitcoinjs. Its security depends on what we (whitehats) uncover before attackers do.
Let us know if you would like us to uncover your security , feel free to DM🤝
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages
We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues , protocols, bitcoin infra and sdks :
> bitcoinjs-lib: CVE-2026-107846, GHSA-8247-5gp7-95qh, GHSA-4mfv-5394-26c7, GHSA-88jr-9qj4-ccm4, GHSA-h52v-8xwg-7j95
(patch versions: 7.0.5, 6.1.10, 5.2.3)
> bip39: CVE-2026-107847, GHSA-39w3-8jr6-f676
(latest patch version: 3.1.12)
> tiny-secp256k1: CVE-2026-107853, GHSA-85g9-f6v5-wqq7, GHSA-rm9w-7fv8-3rhx
(latest patch version: 2.2.5)
All of the above packages have ~500k downloads/week.
Also, multiple other CVEs/disclosures took place over more libs of bitcoinjs by other researchers like the ARSB and Bitcoin Red Team:
> bitcoinjs-lib: GHSA-4vm8-79jj-j6w4 (patch versions: v7.0.5, 6.1.10, 5.2.3)
> bip38: GHSA-mj7w-64jg-8f98
> bip32-utils: GHSA-wvw7-chj5-hr2g(patch version: 0.11.2)
> merkle-lib: GHSA-g353-54jg-j6gg (patch version: 2.0.11)
> bolt11: CVE-2026-107855 (patch version: 1.4.2)
There are a total of 15 findings (14 highs, 1 medium) and cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
It was greating coordinating with @junderwood4649, @landabaso.
0
5
20
1,187
🚨 Multiple bitcoinjs packages vulnerable to high severity security issues
Thousands of wallets, applications, SDKs and infrastructure projects rely on libraries that most teams will never audit themselves.
The numbers speak for themselves:
- bip39 being used by 220k projects k
- bitcoinjs-lib with ~520k downloads/week
- tiny-secp256k1 with ~300k downloads/week
Other packages are also affected. The stack on the internet is changing with improved security standards. Expect more disclosures, fixes and hacks if you don't stay up to date.
Update all the packages to patched versions as specified:
> bitcoinjs-lib: 7.0.5, 6.1.10, 5.2.3
> bip39: 3.1.12
> tiny-secp256k1: 2.2.5
> bip38: 0.11.2
> bip32-utils: 0.11.2
> merkle-lib: 2.0.11
> bolt11 : 1.4.2
At @kvazar_ai we are using our AI audit engine to dig more deeper in supply chain, infra, stacks most usually miss.
The internet runs on open source repo like bitcoinjs. Its security depends on what we (whitehats) uncover before attackers do.
Let us know if you would like us to uncover your security , feel free to DM🤝
Thousands of wallets, applications, SDKs and infrastructure projects rely on libraries that most teams will never audit themselves.
The numbers speak for themselves:
- bip39 being used by 220k projects k
- bitcoinjs-lib with ~520k downloads/week
- tiny-secp256k1 with ~300k downloads/week
Other packages are also affected. The stack on the internet is changing with improved security standards. Expect more disclosures, fixes and hacks if you don't stay up to date.
Update all the packages to patched versions as specified:
> bitcoinjs-lib: 7.0.5, 6.1.10, 5.2.3
> bip39: 3.1.12
> tiny-secp256k1: 2.2.5
> bip38: 0.11.2
> bip32-utils: 0.11.2
> merkle-lib: 2.0.11
> bolt11 : 1.4.2
At @kvazar_ai we are using our AI audit engine to dig more deeper in supply chain, infra, stacks most usually miss.
The internet runs on open source repo like bitcoinjs. Its security depends on what we (whitehats) uncover before attackers do.
Let us know if you would like us to uncover your security , feel free to DM🤝
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages
We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues , protocols, bitcoin infra and sdks :
> bitcoinjs-lib: CVE-2026-107846, GHSA-8247-5gp7-95qh, GHSA-4mfv-5394-26c7, GHSA-88jr-9qj4-ccm4, GHSA-h52v-8xwg-7j95
(patch versions: 7.0.5, 6.1.10, 5.2.3)
> bip39: CVE-2026-107847, GHSA-39w3-8jr6-f676
(latest patch version: 3.1.12)
> tiny-secp256k1: CVE-2026-107853, GHSA-85g9-f6v5-wqq7, GHSA-rm9w-7fv8-3rhx
(latest patch version: 2.2.5)
All of the above packages have ~500k downloads/week.
Also, multiple other CVEs/disclosures took place over more libs of bitcoinjs by other researchers like the ARSB and Bitcoin Red Team:
> bitcoinjs-lib: GHSA-4vm8-79jj-j6w4 (patch versions: v7.0.5, 6.1.10, 5.2.3)
> bip38: GHSA-mj7w-64jg-8f98
> bip32-utils: GHSA-wvw7-chj5-hr2g(patch version: 0.11.2)
> merkle-lib: GHSA-g353-54jg-j6gg (patch version: 2.0.11)
> bolt11: CVE-2026-107855 (patch version: 1.4.2)
There are a total of 15 findings (14 highs, 1 medium) and cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
It was greating coordinating with @junderwood4649, @landabaso.
0
5
20
1,187
0xaudron retweeted
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages
We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues , protocols, bitcoin infra and sdks :
> bitcoinjs-lib: CVE-2026-107846, GHSA-8247-5gp7-95qh, GHSA-4mfv-5394-26c7, GHSA-88jr-9qj4-ccm4, GHSA-h52v-8xwg-7j95
(patch versions: 7.0.5, 6.1.10, 5.2.3)
> bip39: CVE-2026-107847, GHSA-39w3-8jr6-f676
(latest patch version: 3.1.12)
> tiny-secp256k1: CVE-2026-107853, GHSA-85g9-f6v5-wqq7, GHSA-rm9w-7fv8-3rhx
(latest patch version: 2.2.5)
All of the above packages have ~500k downloads/week.
Also, multiple other CVEs/disclosures took place over more libs of bitcoinjs by other researchers like the ARSB and Bitcoin Red Team:
> bitcoinjs-lib: GHSA-4vm8-79jj-j6w4 (patch versions: v7.0.5, 6.1.10, 5.2.3)
> bip38: GHSA-mj7w-64jg-8f98
> bip32-utils: GHSA-wvw7-chj5-hr2g(patch version: 0.11.2)
> merkle-lib: GHSA-g353-54jg-j6gg (patch version: 2.0.11)
> bolt11: CVE-2026-107855 (patch version: 1.4.2)
There are a total of 15 findings (14 highs, 1 medium) and cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
It was greating coordinating with @junderwood4649, @landabaso.
We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues , protocols, bitcoin infra and sdks :
> bitcoinjs-lib: CVE-2026-107846, GHSA-8247-5gp7-95qh, GHSA-4mfv-5394-26c7, GHSA-88jr-9qj4-ccm4, GHSA-h52v-8xwg-7j95
(patch versions: 7.0.5, 6.1.10, 5.2.3)
> bip39: CVE-2026-107847, GHSA-39w3-8jr6-f676
(latest patch version: 3.1.12)
> tiny-secp256k1: CVE-2026-107853, GHSA-85g9-f6v5-wqq7, GHSA-rm9w-7fv8-3rhx
(latest patch version: 2.2.5)
All of the above packages have ~500k downloads/week.
Also, multiple other CVEs/disclosures took place over more libs of bitcoinjs by other researchers like the ARSB and Bitcoin Red Team:
> bitcoinjs-lib: GHSA-4vm8-79jj-j6w4 (patch versions: v7.0.5, 6.1.10, 5.2.3)
> bip38: GHSA-mj7w-64jg-8f98
> bip32-utils: GHSA-wvw7-chj5-hr2g(patch version: 0.11.2)
> merkle-lib: GHSA-g353-54jg-j6gg (patch version: 2.0.11)
> bolt11: CVE-2026-107855 (patch version: 1.4.2)
There are a total of 15 findings (14 highs, 1 medium) and cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
It was greating coordinating with @junderwood4649, @landabaso.
4
12
31
4,412
The way how @GearboxProtocol maintains their bytecode/code to audit mapping looks pretty neat : bcr.gearbox.finance
0
0
27
1,150
0xaudron retweeted
🚨ANNOUNCEMENT: We've merged teams with @CustodiaLab.
We have joined forces. The real work started long before the announcement. Expect deeper research, more 0-day hunting, and exploit research across Web2 and Web3
With @kvazar_ai working around the clock, we're building toward one goal: "PATCH THE WORLD"
The hunt never stops. Always on duty to catch the critical.🫡
We have joined forces. The real work started long before the announcement. Expect deeper research, more 0-day hunting, and exploit research across Web2 and Web3
With @kvazar_ai working around the clock, we're building toward one goal: "PATCH THE WORLD"
The hunt never stops. Always on duty to catch the critical.🫡
🚨 BIG NEWS: Custodia Security is merging with @ValkyriSecurity
We share one vision: Web3 security must go beyond smart contracts.
By bringing our teams together, we’re strengthening our ability to secure the entire stack, from protocols and dApps to the infrastructure behind🧵
2
1
11
323
🚨WHOLE INTERNET IS VULNERABLE:
Seems like reality to some but actuality to many after the recent incidents. From what I have seen, very famous protocols, applications use dependencies and supply chain where it is written, "use at your own risk, this project is not audited".
Still, billion and infact, trillion dollar businesses are using that in their stack. The project is 12-15 years older, and still vast majority of the internet projects depend on them inclduing the hardware wallet. So yeah, atp things are vulnerable by design and are not ready to fight the current progress.
"Patch the planet" is a real deal, but on the parallel "Hack the world" is also an ongoing operation.
Now projects should have a standard that atleast basic prompting and tooling should never find vulnerabilities. Let me tell you the truth—even "basic prompting" can find bugs on most projects atp.
Seems like reality to some but actuality to many after the recent incidents. From what I have seen, very famous protocols, applications use dependencies and supply chain where it is written, "use at your own risk, this project is not audited".
Still, billion and infact, trillion dollar businesses are using that in their stack. The project is 12-15 years older, and still vast majority of the internet projects depend on them inclduing the hardware wallet. So yeah, atp things are vulnerable by design and are not ready to fight the current progress.
"Patch the planet" is a real deal, but on the parallel "Hack the world" is also an ongoing operation.
Now projects should have a standard that atleast basic prompting and tooling should never find vulnerabilities. Let me tell you the truth—even "basic prompting" can find bugs on most projects atp.
1
0
19
883
0xaudron retweeted
People in the field of cybersecurity like to differentiate greatly between defence and offense like two complete different things. It’s not, companies with major infra should spend thousands of trillions of tokens exploiting and hacking their own system 24/7, let it wild, then patch at the same time. There’s so many gates and possible paths to get into something, the tech we have built over decades has so many different things depending on eachother, the amount of possibilities are endless.
Train the most offensive malicious models imaginable, remove all the safeguard weights. A model with morality built in will never protect against a model that’s been trained to do whatever it takes to get to the end goal.
Train the most offensive malicious models imaginable, remove all the safeguard weights. A model with morality built in will never protect against a model that’s been trained to do whatever it takes to get to the end goal.
6
5
128
4,558
0xaudron retweeted
for anyone new to this: the first Tether dollar was created on BTC in 2014.
by 2026, only about six cents of every hundred @tether dollars still lived there.
@RGB_Bitcoin is one attempt to bring it back. we told the whole story, in a 27-minute documentary.
Link below ⬇️
by 2026, only about six cents of every hundred @tether dollars still lived there.
@RGB_Bitcoin is one attempt to bring it back. we told the whole story, in a 27-minute documentary.
Link below ⬇️
@RGB_Bitcoin just delivered its biggest update since mainnet, with huge improvements on multiple levels.
Congratulations to the RGB Protocol team for this great achievement!
2
2
8
229
Fixing bugs is becoming tougher and more expensive than finding them at this point. With the emergence of AI-driven security, the CVE market has lost its relevance.
Just think about the recent PHP RCE CVEs and the panic around them. What if there are more like these that we simply don’t know about yet? Given the current state of things, that seems realistic.
This has been going on for quite some time, so nothing new there. But what’s new is that security research is now in more hands than ever before.
Just think about the recent PHP RCE CVEs and the panic around them. What if there are more like these that we simply don’t know about yet? Given the current state of things, that seems realistic.
This has been going on for quite some time, so nothing new there. But what’s new is that security research is now in more hands than ever before.
1
0
22
1,007
0xaudron retweeted
🚨 MAJOR SECURITY ALERT
On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.
Expect the fix to be released today. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
Kindly update it ASAP.
php.net/archive/2026.p…
On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released.
Expect the fix to be released today. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
Kindly update it ASAP.
php.net/archive/2026.p…
0
4
11
921
🚨 RGB Protocol v0.11.2-rc.1 is out
- We (me and @real_a_kalout ) dropped a few crits/higs with the use of Kvazar to @RGB_Bitcoin
- Mentioned by @RGBAssociation in an announcement of the biggest update since mainnet.
Meanwhile, @kvazar_ai is already working with multiple s to uncover vulnerabilities across both previously audited and unaudited codebases.
And we're seeing some promising results 🚀
The goal is simple: find what others missed
DMs open if you're looking to security max 👀
- We (me and @real_a_kalout ) dropped a few crits/higs with the use of Kvazar to @RGB_Bitcoin
- Mentioned by @RGBAssociation in an announcement of the biggest update since mainnet.
Meanwhile, @kvazar_ai is already working with multiple s to uncover vulnerabilities across both previously audited and unaudited codebases.
And we're seeing some promising results 🚀
The goal is simple: find what others missed
DMs open if you're looking to security max 👀
@RGB_Bitcoin just delivered its biggest update since mainnet, with huge improvements on multiple levels.
Congratulations to the RGB Protocol team for this great achievement!
1
4
40
1,598
Soon #1
Top 3 researchers this week:
🥇 @xalerafera
🥈 @0xaudron
🥉@tchkvsky_eth
Congratulations! 🎉
Want your handle here? Join active programs: hackenproof.com/programs
5
0
78
1,932
