CTO at chaintope, Inc. Book (https://xitter.gq/t.co/D8fIEhSyJi) npub1km5zgre7f5vxr6jgf32x055xlk3gjwrj5s4aedeyjz6gr8l2yw0s8mmmlp @techmedia.bsky.social
福岡
Joined April 2009
- Tweets19K
- Following638
- Followers4.2K
- Likes5.3K
Pinned Tweet
監訳に参加させて頂いたマスタリング・ビットコイン第3版本日刊行です！内容も大幅に刷新され、TaprootやSchnorr署名まで最新のコンセンサスルールをカバーしています。英語版から少し時間が経っているので、更新などは一通り訳注でカバーしてます。
ぜひご覧ください！
amazon.co.jp/dp/4814401442/
Shigeyuki Azuchi retweeted
BTCPay Serverのホットウォレットから資金が不正に抜き取られたという報告を受け、公式が運営者にサーバーの停止を呼びかけていた件で、続報が出ました。
公式によると、調査で2.4.1（2026年7月23日リリース）以前のバージョンを狙った攻撃経路を特定したとのことです。最新の2.4.7では、ホットウォレットから資金が抜き取られたという信頼できる報告はないとしています。
公式はあらためて、すべての運営者にBTCPay Serverを最新の状態に保つよう呼びかけています。被害を受けた方には、詳細とログを [email protected] に送るよう求めています。
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.
If you were impacted, please send all details and logs to [email protected]
Shigeyuki Azuchi retweeted
Bitcoin Core v32.1 shipped this week. Over 200 of the changes in the release were testing related (185 PRs “Tests”, 47 “Fuzzing”).
Test related PRs are the most common type of PR in Bitcoin Core. What “testing” covers in and around Core:
- Manual testing where reviewers build and run PRs and think hard while trying to break things
- Unit tests
- Functional tests. Python scripts that drive actual bitcoind nodes.
- Fuzz tests that run around the clock by Fuzzor (Brink’s infra) and by Google’s OSS-Fuzz.
- Sanitizers
- Differential fuzzing. Bitcoinfuzz feeds the same inputs to Core and other implementations and flags anomalies.
- Full system fuzzing. Fuzzamoto fuzzes production binaries over P2P and RPC with no changes to Core.
- Mutation testing. bcore-mutation breaks the code on purpose to check whether the tests notice.
- Network simulation. Warnet can run hundreds of nodes to test how changes behave across a whole network.
- And in the last year, LLM assisted review and security scans.
Additionally, full network simulation using Antithesis that tests multiple nodes interacting under randomized, reproducible conditions.
Bitcoin Core has accumulated over a century of CPU time fuzzing individual functions and critical components.
This all helps Bitcoin Core’s software quality assurance, but it doesn’t just benefit Core. @dergoegge + @macrohead7's fuzzing infra found a chain split bug in btcd. Fuzzamoto has since found three more btcd bugs, and @rbitcoin_org's release notes credit Niklas for findings there.
@brunoerg’s Bitcoinfuzz has reported bugs in libbitcoin, rust-bitcoin, rust-miniscript, LND, Core Lightning, Eclair, LDK and others.
Tests are a lot of the work and also what goes unnoticed when it goes right.
Shoutout to the testers 🧡
Shigeyuki Azuchi retweeted
lnd v0.20.7 and v0.21.6 have been released, which contain a Go-specific mitigation (MPTCP flag off) for CVE-2026-98432 (use-after-free in the Linux kernel's IPv4 TCP).
github.com/lightningnetwork/…
github.com/lightningnetwork/…
We recommend that all users update to this new version.
Existing binaries can be protected by running them with the GODEBUG=multipathtcp=0 env variable: github.com/golang/go/issues/….
Note that as this is a Linux kernel level vulnerability, the only way to fully mitigate the vuln is to patch your kernel, as any network facing service may be affected (known PoCs use MPTCP, but other exploit vectors may be possible).
Shigeyuki Azuchi retweeted
Ledger isn't the only one, @Trezor devices sold by CryptoBilis also had an implant.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards and are using it to store funds, please move your funds to a newly created wallet with a new seed as soon as possible.
If you have a device you are unsure of, DM me. I'll happily cover shipping fees and analyze your device.
trezor.io/blog/news/implant-…
Bitcoin Core v32.1のリリース。
bitcoincore.org/ja/releases/…
txindexのフォーマットが変更されてサイズが約半分になるの良いな。ただ既存ノードはノードを停止してインデックスファイル削除した上でインデックスを再作成する必要がある。-reindexじゃダメみたい。
先日Bitcoin Coreのセキュリティポリシーが更新され、LLMなどで容易に発見可能と判定された脆弱性については、サポート対象の各メジャーバージョンに対する修正がリリースされた後、内容が開示されるようになった。
そして、今回3件の脆弱性が開示された。
2つめは、Linux以外のOSで動作している環境の場合に、無制限にメモリを消費させることが可能な脆弱性。
bitcoincore.org/ja/2026/10/2…
3つめは、BIP-31のnonce付きpingメッセージをサポートしないふりをして、ピアに対するメッセージキューをゆっくりと増大させることで無制限のメモリ増加を引き起こすという脆弱性。
bitcoincore.org/ja/2026/10/2…
Shigeyuki Azuchi retweeted
Bitcoin Core v32.1 was released!
It is available from: bitcoincore.org/en/download/
Release notes: bitcoincore.org/en/releases/…
Shigeyuki Azuchi retweeted
Bitcoin Core v32.1: a deeper look
First, why no 32.0?
It was tagged on October 21 but never fully announced or released. A remotely triggerable TCP crash was reported on October 23 and 32.1 shipped on October 27 (yesterday) with that fix and two others.
I'll dig into the security updates, but this release also represents months of testing, maintenance, and work to make Bitcoin easier to verify and use.
What went into these v32.1 changes and what do Bitcoin users get from them?
AssumeUTXO機能削除する提案出てるのか。まだ決まったわけではなく、スナップショットへのトラストが発生するけどバックグラウンド検証を止めるようにするプランもあるっぽい。
github.com/bitcoin/bitcoin/p…
![[Demo] validation: remove AssumeUTXO by l0rinc · Pull Request #36598 · bitcoin/bitcoin](https://pbs.twimg.com/card_img/2115695635336949760/5LmNyq3l?format=jpg&name=800x419)
Shigeyuki Azuchi retweeted
株式会社Chaintope CTO 安土茂亨氏（@techmedia_think）が、#BITCOINJAPAN2026 「BITCOINER EXPO」に登壇決定⚡
安土氏は2015年からBitcoinや暗号技術を中心にリサーチを始め、Bitcoin関連のライブラリを多数開発。
Bitcoin Optechニュースレターの翻訳に参加し、『ブロックチェーン技術概論』の共著、『Mastering Bitcoin 第3版』、『Mastering the Lightning Network』の監訳を手がける。
🗓️11/27(金)・28(土) 📍ベルサール秋葉原
参加登録・詳細はこちら：x.gd/pDyDk
Shigeyuki Azuchi retweeted
Please update your BitcoinJS and related dependencies. We have backported some fixes all the way to BitcoinJS v5.
Big thanks to everyone mentioned in this post, especially to @landabaso who helped coordinate with the reporters and publish fixes.
We've just published 15 security advisories across BitcoinJS libraries (14 High and one Medium), with patched releases available on npm.
This follows work with @junderwood4649 and the reporters to investigate the issues, prepare fixes and provide backports for the maintained release lines.
The findings cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
If you maintain an application using BitcoinJS packages, please check your direct and transitive dependencies and upgrade affected versions.
For bitcoinjs-lib, the patched releases are 7.0.5, 6.1.10 and 5.2.3, depending on your release line. Both tiny-secp256k1 and bitcoin-js/tiny-secp256k1-asmjs have fixes in 2.2.5.
The other patched releases are bip39 3.1.2 and 2.6.1, bip38 3.1.2 and 2.0.4, bolt11 1.4.2, merkle-lib 2.0.11 and bip32-utils 0.11.2.
Some fixes require changes in the application as well as a dependency update.
You can find the affected ranges, technical details and upgrade guidance here:
github.com/bitcoinjs/bitcoin…
github.com/bitcoinjs/tiny-se…
github.com/bitcoinjs/bip39/s…
github.com/bitcoinjs/bip38/s…
github.com/bitcoinjs/bolt11/…
github.com/bitcoinjs/merkle-…
github.com/bitcoinjs/bip32-u…
Thanks to the researchers and reporters: the Bitcoin Red Team (@Rob1Ham, @callebtc and @danielabrozzoni), @0xaudron, @real_a_kalout and ARSB (github.com/ARSB1).
