An AI-powered vulnerability scanner for open-source bitcoin projects. Discord: https://teapaw.org/t.co/VF8q4cOqdC
Joined May 2026
- Tweets43
- Following0
- Followers1.4K
- Likes29
Project Loupe retweeted
SV2 Apps add Bitcoin Core v32 support and block submission over IPC, and continue addressing @ProjectLoupe findings across Pool, JDS, JDC and Translator Proxy.
Protocol library highlights include hardening of buffer_sv2, codec_sv2 and framing_sv2, message field renames to match the spec, and support for application-supplied jobs in channels_sv2. All changed published crates introduce breaking changes except noise_sv2, so downstream consumers should review the release notes when upgrading.
SV2 UI adds experimental Telegram notifications, multiple custom pools, clearer fallback pool status, and improvements to onboarding, logs and recovery. Setup now supports Bitcoin Core v32.
Findings from @ProjectLoupe continue to guide security improvements across the stack. Thank you to the Loupe team and everyone helping turn those findings into fixes!
This milestone introduces our SV2 interoperability project, a new effort to test protocol compatibility across different SV2 implementations. The goal is to catch interoperability issues early, make it easier for implementers to validate their software against the spec, and help ensure different SV2 implementations work reliably together. Contributions and feedback are welcome!
We’re doing what we can for bitcoin so that bitcoin can do what it must for the world: bitcoincore.org/en/2026/10/2…
Project Loupe retweeted
Mike Schmidt broke down Bitcoin Core v32.1 and surfaced something important: Core updated its disclosure policy specifically because LLM tools are making bugs easier to find.
"Core's recently updated policy fast-tracks the disclosure of easily discoverable vulnerabilities. LLM-assisted security scans helped motivate the change."
All three vulnerabilities disclosed today were found by Project Loupe, an AI-powered scanner built at Spiral. If defenders can find them with LLMs, attackers can too.
Beyond security, v32.1 packs 715 merged PRs from 111 authors. Fee estimation now factors in live mempool conditions. Initial sync is 1.2-3x faster. The libevent dependency is fully replaced with in-house code. Stratum v2 keeps advancing.
The infrastructure keeps getting stronger.
The technology is moving fast. Responsible disclosure needs to move with it.
Project Loupe has entered the chat
Finding the 3 'easily discoverable' vulnerabilities in Bitcoin Core v32.1
Although @ProjectLoupe was actually ahead of the curve, announcing they would be doing LLM scans back in May before the ColdCard and other hacks:
"Loupe’s ultimate goal is to find vulnerabilities, report them, and see them eliminated, making bitcoin safer and bitcoin holders more secure."
Great vision by @moneyball and team
teapaw.org/bitschmidty/status/211…
🥾🪳
Great work by @ProjectLoupe and @L0RINC for finding these bugs!
While they are vulnerabilities, they are low / medium severity and the Bitcoin protocol is resilient.
No loss of funds possible from these issues.
A learning from this is that some of these were found earlier than reported within the Red Team, but the initial findings did not identify the full blast radius so they were not immediately passed along to the security list.
Thank you to all of the Bitcoin Core developers who work hard building on Bitcoin so it can be the best money ever!
Project Loupe retweeted
Thank you to our contributors, reviewers, testers and everyone reporting issues. Special thanks to independent security researchersn @ProjectLoupe @premai_io @BugBunny_ai and @MagicGrants
for helping us make BTCPay Server stronger. 💚
Project Loupe retweeted
One of the best ideas @spiral_xyz has had
Project Loupe - AI powered security scanning for Bitcoin OSS Projects teapaw.org/i/broadcasts/1nxnRBMEo…
We file our findings privately. Loupe only shows up in public if a maintainer credits us, which many have:
✅ 754 commits, PRs, & release notes across 23 projects reference Loupe
✅ 610 distinct findings cited by issue number
✅ 132 merged PRs name the finding they fixed
Loupe findings have been landing in Bitcoin Core. During this cycle, five PRs landed: three have been merged, two are under review. Below is a thread on what each one caught and which Core dev implemented which fix.
📦 In review: a package evicted right after acceptance landed in the reject filter until the next block, so a higher-fee child couldn't bump it back in. Loupe and the Bitcoin Red Team found it, @theinstagibbs fixed it.
github.com/bitcoin/bitcoin/p…
🕳️ Also from a Loupe report: @theinstagibbs mapped out how a peer sending a same-txid witness variant can stall honest fee-bumping packages, and is closing those holes across two PRs. That work continues.
github.com/bitcoin/bitcoin/p…
Project Loupe retweeted
Thank you to our contributors, reviewers, testers and everyone reporting issues.
Special thanks to independent security researchers, @ProjectLoupe, @premai_io, @BugBunny_ai and @MagicGrants for helping us make BTCPay Server stronger. 💚
A second opinion:
✅ Another model double-checks every finding
✅ It returns "inconclusive" 30.2% of the time
✅ 88% of "dismissed" findings weren’t refuted but rather not established
✅ 3,671 findings were verified more than once and only 105 got a conflicting verdict
Project Loupe retweeted
LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft.
If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3.
1/4
Project Loupe retweeted
There is an arms race between the attackers and maintainers as to who has the superior frontier AI model.
“That is not a sustainable security model” - @dergoegge
@_tnull @ProjectLoupe @btcplusplus
🤖 Made with AI
Project Loupe retweeted
Elias Rohrer (@_tnull) presents the @COLDCARDwallet incident as the pivotal moment that “prompted” everyone to start scanning repos with Kimi K3.
The “report flood” ensued. Bitcoin Core had 1000+ reports. None critical.
@ProjectLoupe @btcplusplus
🤖 Made with AI
