We’re doing what we can for bitcoin so that bitcoin can do what it must for the world: bitcoincore.org/en/2026/10/28/…
2
4
24
896
Project Loupe retweeted
Mike Schmidt broke down Bitcoin Core v32.1 and surfaced something important: Core updated its disclosure policy specifically because LLM tools are making bugs easier to find.
"Core's recently updated policy fast-tracks the disclosure of easily discoverable vulnerabilities. LLM-assisted security scans helped motivate the change."
All three vulnerabilities disclosed today were found by Project Loupe, an AI-powered scanner built at Spiral. If defenders can find them with LLMs, attackers can too.
Beyond security, v32.1 packs 715 merged PRs from 111 authors. Fee estimation now factors in live mempool conditions. Initial sync is 1.2-3x faster. The libevent dependency is fully replaced with in-house code. Stratum v2 keeps advancing.
The infrastructure keeps getting stronger.
0
1
13
822
The technology is moving fast. Responsible disclosure needs to move with it.
Project Loupe has entered the chat
Finding the 3 'easily discoverable' vulnerabilities in Bitcoin Core v32.1
Although @ProjectLoupe was actually ahead of the curve, announcing they would be doing LLM scans back in May before the ColdCard and other hacks:
"Loupe’s ultimate goal is to find vulnerabilities, report them, and see them eliminated, making bitcoin safer and bitcoin holders more secure."
Great vision by @moneyball and team
x.com/bitschmidty/st…
0
2
8
445
🥾🪳
Great work by @ProjectLoupe and @L0RINC for finding these bugs!
While they are vulnerabilities, they are low / medium severity and the Bitcoin protocol is resilient.
No loss of funds possible from these issues.
A learning from this is that some of these were found earlier than reported within the Red Team, but the initial findings did not identify the full blast radius so they were not immediately passed along to the security list.
Thank you to all of the Bitcoin Core developers who work hard building on Bitcoin so it can be the best money ever!
0
2
9
955
Project Loupe retweeted
Thank you to our contributors, reviewers, testers and everyone reporting issues. Special thanks to independent security researchersn @ProjectLoupe @premai_io @BugBunny_ai and @MagicGrants
for helping us make BTCPay Server stronger. 💚
for helping us make BTCPay Server stronger. 💚
2
3
14
1,694
Project Loupe retweeted
@moneyball @spiral_xyz project loupe is an absolute treasure for the bitcoin ecosystem!
thank you for the reviews, incredibly valuable for the Cashu project.
thank you for the reviews, incredibly valuable for the Cashu project.
0
1
6
396
Project Loupe retweeted
One of the best ideas @spiral_xyz has had
Project Loupe - AI powered security scanning for Bitcoin OSS Projects x.com/i/broadcasts/1…
1
8
38
2,107
We file our findings privately. Loupe only shows up in public if a maintainer credits us, which many have:
✅ 754 commits, PRs, & release notes across 23 projects reference Loupe
✅ 610 distinct findings cited by issue number
✅ 132 merged PRs name the finding they fixed
✅ 754 commits, PRs, & release notes across 23 projects reference Loupe
✅ 610 distinct findings cited by issue number
✅ 132 merged PRs name the finding they fixed
0
5
22
3,317
Loupe findings have been landing in Bitcoin Core. During this cycle, five PRs landed: three have been merged, two are under review. Below is a thread on what each one caught and which Core dev implemented which fix.
2
20
52
5,581
📦 In review: a package evicted right after acceptance landed in the reject filter until the next block, so a higher-fee child couldn't bump it back in. Loupe and the Bitcoin Red Team found it, @theinstagibbs fixed it.
github.com/bitcoin/bitcoi…
github.com/bitcoin/bitcoi…
1
2
5
231
🕳️ Also from a Loupe report: @theinstagibbs mapped out how a peer sending a same-txid witness variant can stall honest fee-bumping packages, and is closing those holes across two PRs. That work continues.
github.com/bitcoin/bitcoi…
github.com/bitcoin/bitcoi…
0
2
7
229
Project Loupe retweeted
Thank you to our contributors, reviewers, testers and everyone reporting issues.
Special thanks to independent security researchers, @ProjectLoupe, @premai_io, @BugBunny_ai and @MagicGrants for helping us make BTCPay Server stronger. 💚
Special thanks to independent security researchers, @ProjectLoupe, @premai_io, @BugBunny_ai and @MagicGrants for helping us make BTCPay Server stronger. 💚
0
2
20
3,154
A second opinion:
✅ Another model double-checks every finding
✅ It returns "inconclusive" 30.2% of the time
✅ 88% of "dismissed" findings weren’t refuted but rather not established
✅ 3,671 findings were verified more than once and only 105 got a conflicting verdict
✅ Another model double-checks every finding
✅ It returns "inconclusive" 30.2% of the time
✅ 88% of "dismissed" findings weren’t refuted but rather not established
✅ 3,671 findings were verified more than once and only 105 got a conflicting verdict
Some personal news:
✅ Loupe has produced 26,821 findings across 43 open-source bitcoin repos
✅ Average successful scan took 2H 52M and returned 53.6 findings
✅ Longest scan ran for 36H 58M
✅ 26,809/26,821 findings shipped a proof-of-concept & 12,774 shipped a proposed patch
2
2
7
2,346
Project Loupe retweeted
LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft.
If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3.
1/4
If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3.
1/4
14
23
48
12,689
Project Loupe retweeted
There is an arms race between the attackers and maintainers as to who has the superior frontier AI model.
“That is not a sustainable security model” - @dergoegge
@_tnull @ProjectLoupe @btcplusplus
“That is not a sustainable security model” - @dergoegge
@_tnull @ProjectLoupe @btcplusplus
0
9
18
1,510
Project Loupe retweeted
Elias Rohrer (@_tnull) presents the @COLDCARDwallet incident as the pivotal moment that “prompted” everyone to start scanning repos with Kimi K3.
The “report flood” ensued. Bitcoin Core had 1000+ reports. None critical.
@ProjectLoupe @btcplusplus
The “report flood” ensued. Bitcoin Core had 1000+ reports. None critical.
@ProjectLoupe @btcplusplus
2
15
27
4,054