CTO at chaintope, Inc. Book (https://teapawt.net/t.co/D8fIEhSyJi) npub1km5zgre7f5vxr6jgf32x055xlk3gjwrj5s4aedeyjz6gr8l2yw0s8mmmlp @techmedia.bsky.social
福岡
Joined April 2009
- Tweets19K
- Following638
- Followers4.2K
- Likes5.3K
Pinned Tweet
監訳に参加させて頂いたマスタリング・ビットコイン第3版本日刊行です！内容も大幅に刷新され、TaprootやSchnorr署名まで最新のコンセンサスルールをカバーしています。英語版から少し時間が経っているので、更新などは一通り訳注でカバーしてます。
ぜひご覧ください！
amazon.co.jp/dp/4814401442/
PIPEs v2でWE候補とされたAADPは先月alloc init自身の論文で破られている↓公開範囲では修正版もなく、Shielded Bitcoinのペグイン・ペグアウトを実現する技術は現状ないのでは？
eprint.iacr.org/2026/1594
まだペーパーは公開されてないけど、先月のカンファレンスの発表あたりが近い？
ただいずれもペーパーの公開と第三者の検証待ちかな。
strapi.rbg.tum-blockchain.co…
Shigeyuki Azuchi retweeted
google、Appleログインで生成されたウォレット(Web3Auth)について一部不審なトランザクションが検知されているようです。
もしこれらで生成されたウォレットを使用している場合は一旦資産を別のところに避難させておいた方が良さそうです。
集約署名系のBIPが公開された模様。
BIPs 458, 459, and 460 have been published:
• BIP458: Half-Aggregation of BIP 340 Signatures
github.com/bitcoin/bips/blob…
• BIP459: DahLIAS fully aggregated signatures for secp256k1
github.com/bitcoin/bips/blob…
• BIP460: CISA for Taproot Key Path Spends
github.com/bitcoin/bips/blob…
Shigeyuki Azuchi retweeted
Core Lightning 26.06.10 is out, and every node runner should upgrade.
This point release includes security fixes. Verify the signatures and install it as soon as possible.
github.com/ElementsProject/l…
Shigeyuki Azuchi retweeted
BTCPay Serverのホットウォレットから資金が不正に抜き取られたという報告を受け、公式が運営者にサーバーの停止を呼びかけていた件で、続報が出ました。
公式によると、調査で2.4.1（2026年7月23日リリース）以前のバージョンを狙った攻撃経路を特定したとのことです。最新の2.4.7では、ホットウォレットから資金が抜き取られたという信頼できる報告はないとしています。
公式はあらためて、すべての運営者にBTCPay Serverを最新の状態に保つよう呼びかけています。被害を受けた方には、詳細とログを [email protected] に送るよう求めています。
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.
If you were impacted, please send all details and logs to [email protected]
Shigeyuki Azuchi retweeted
Bitcoin Core v32.1 shipped this week. Over 200 of the changes in the release were testing related (185 PRs “Tests”, 47 “Fuzzing”).
Test related PRs are the most common type of PR in Bitcoin Core. What “testing” covers in and around Core:
- Manual testing where reviewers build and run PRs and think hard while trying to break things
- Unit tests
- Functional tests. Python scripts that drive actual bitcoind nodes.
- Fuzz tests that run around the clock by Fuzzor (Brink’s infra) and by Google’s OSS-Fuzz.
- Sanitizers
- Differential fuzzing. Bitcoinfuzz feeds the same inputs to Core and other implementations and flags anomalies.
- Full system fuzzing. Fuzzamoto fuzzes production binaries over P2P and RPC with no changes to Core.
- Mutation testing. bcore-mutation breaks the code on purpose to check whether the tests notice.
- Network simulation. Warnet can run hundreds of nodes to test how changes behave across a whole network.
- And in the last year, LLM assisted review and security scans.
Additionally, full network simulation using Antithesis that tests multiple nodes interacting under randomized, reproducible conditions.
Bitcoin Core has accumulated over a century of CPU time fuzzing individual functions and critical components.
This all helps Bitcoin Core’s software quality assurance, but it doesn’t just benefit Core. @dergoegge + @macrohead7's fuzzing infra found a chain split bug in btcd. Fuzzamoto has since found three more btcd bugs, and @rbitcoin_org's release notes credit Niklas for findings there.
@brunoerg’s Bitcoinfuzz has reported bugs in libbitcoin, rust-bitcoin, rust-miniscript, LND, Core Lightning, Eclair, LDK and others.
Tests are a lot of the work and also what goes unnoticed when it goes right.
Shoutout to the testers 🧡
Shigeyuki Azuchi retweeted
lnd v0.20.7 and v0.21.6 have been released, which contain a Go-specific mitigation (MPTCP flag off) for CVE-2026-98432 (use-after-free in the Linux kernel's IPv4 TCP).
github.com/lightningnetwork/…
github.com/lightningnetwork/…
We recommend that all users update to this new version.
Existing binaries can be protected by running them with the GODEBUG=multipathtcp=0 env variable: github.com/golang/go/issues/….
Note that as this is a Linux kernel level vulnerability, the only way to fully mitigate the vuln is to patch your kernel, as any network facing service may be affected (known PoCs use MPTCP, but other exploit vectors may be possible).
Shigeyuki Azuchi retweeted
Ledger isn't the only one, @Trezor devices sold by CryptoBilis also had an implant.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards and are using it to store funds, please move your funds to a newly created wallet with a new seed as soon as possible.
If you have a device you are unsure of, DM me. I'll happily cover shipping fees and analyze your device.
trezor.io/blog/news/implant-…
Bitcoin Core v32.1のリリース。
bitcoincore.org/ja/releases/…
txindexのフォーマットが変更されてサイズが約半分になるの良いな。ただ既存ノードはノードを停止してインデックスファイル削除した上でインデックスを再作成する必要がある。-reindexじゃダメみたい。
先日Bitcoin Coreのセキュリティポリシーが更新され、LLMなどで容易に発見可能と判定された脆弱性については、サポート対象の各メジャーバージョンに対する修正がリリースされた後、内容が開示されるようになった。
そして、今回3件の脆弱性が開示された。
2つめは、Linux以外のOSで動作している環境の場合に、無制限にメモリを消費させることが可能な脆弱性。
bitcoincore.org/ja/2026/10/2…
3つめは、BIP-31のnonce付きpingメッセージをサポートしないふりをして、ピアに対するメッセージキューをゆっくりと増大させることで無制限のメモリ増加を引き起こすという脆弱性。
bitcoincore.org/ja/2026/10/2…
Shigeyuki Azuchi retweeted
Bitcoin Core v32.1 was released!
It is available from: bitcoincore.org/en/download/
Release notes: bitcoincore.org/en/releases/…
Shigeyuki Azuchi retweeted
Bitcoin Core v32.1: a deeper look
First, why no 32.0?
It was tagged on October 21 but never fully announced or released. A remotely triggerable TCP crash was reported on October 23 and 32.1 shipped on October 27 (yesterday) with that fix and two others.
I'll dig into the security updates, but this release also represents months of testing, maintenance, and work to make Bitcoin easier to verify and use.
What went into these v32.1 changes and what do Bitcoin users get from them?