blockstream

The Core Lightning team, which develops the open-source Bitcoin Lightning Network node software, has issued an urgent alert stating that reports indicate attackers are targeting nodes that have not installed patches, urging operators still running old versions to upgrade immediately. The team stated: "Emergency security update: If you are using version 26.06.7 or earlier, please upgrade to the latest release as soon as possible."Prior to this, Core Lightning began investigating a potential issue that could affect its experimental features and, in turn, impact user funds on September 16, and approximately six days later, version 26.06.8 was released. This update not only fixed several defects but also provided patches for security vulnerabilities reported responsibly by multiple parties, thanking the Bitcoin Red Team and 12 other individuals and organizations in the release notes, while also acknowledging anonymous reporters.According to the changelog, this round of fixes covers a bug that could cause sender nodes to crash, requests that could exhaust REST interface memory, and a vulnerability that could result in user funds facing confiscation losses when closing payment channels. To provide operators with ample upgrade windows and prevent attackers from taking advantage of reverse engineering and exploitation, this version intentionally obscured some testing content. Additionally, in August of this year, the project initiated a collaborative fixing process after reviewing a large number of AI-generated general vulnerability disclosure reports, and two days later released version 26.06.7 to close confirmed vulnerabilities.

According to the official announcement, the Bitcoin sidechain Liquid Network developed by Blockstream has initiated an independent external security audit for Elements v23.3.4, providing additional security verification for the recovery of Peg-out operations.Meanwhile, the Liquid Federation is coordinating an update to the PAK list, including replacing existing key entries and ensuring that all Peg-out keys are securely stored in cold wallets. The official statement indicates that progress on the recovery will be announced later.

Following the attack on the Liquid Network, Blockstream rejected the hacker's demand for a 10% ransom on the remaining approximately 598.5 bitcoins and requested the hacker to return the bitcoins. "Unauthorized acquisition of assets and refusal to return them is a criminal act, not responsible disclosure; this is by no means white hat hacking, but outright theft."Previously, after Blockstream confirmed that the vulnerability in the bridging node had been fixed, the Liquid Network attacker returned 3,400 BTC and retained approximately 598.5 BTC (worth about 47.3 million USD).

Blockstream tweeted that it will not pay a ransom for the return of the stolen Bitcoin from the Liquid Network, stating that acquiring assets without authorization and refusing to return them constitutes theft, which does not fall under responsible disclosure or white hat behavior.Blockstream stated that if the stolen funds are not returned, it will cooperate with law enforcement agencies, exchanges, service providers, and forensic experts to track, recover the assets, and identify the responsible parties through all legal means, while emphasizing that Bitcoin transactions are transparent and relevant evidence will not disappear. Blockstream is the main developer and technical provider of the Liquid Network. Liquid Network stated that "approximately 4,000 BTC were taken by white hat hackers," and the sidechain has therefore suspended operations.

According to Bitcoin News monitoring, the white hat hacker group behind the Liquid vulnerability exploitation incident accused Blockstream of spending only $1.5 million, or possibly not spending any funds at all, to secure assets worth $5 billion.In a new on-chain message, the group demanded that Blockstream pay a bug bounty equivalent to 10% of the related assets using its own funds, warning that refusal to pay would result in a 15% loss for holders.The group also stated that it would publish the private key used to decrypt previous conversations with Blockstream. Previously, the group had returned 3,400 BTC to the Liquid Federation, with approximately 600 BTC still not returned.

According to Bitcoin News, Blockstream has notified "white hat" hackers that the vulnerability has been fixed, and 4,000 BTC can be safely returned. The hacker, who previously extracted about 4,000 BTC from the Liquid network, expressed willingness to return the funds but needed to wait for the vulnerability to be fixed. The entire negotiation process was conducted publicly through Bitcoin OP_RETURN messages.The hacker initially proposed to return "most" of the BTC but later changed their stance, requesting that the vulnerability be fixed first: "Please fix the vulnerability first. The latest submitted code puts the chain at risk. Ensure that every node has been patched, and then we will confirm the fix and safely return the funds."The hacker also sent encrypted details of the vulnerability to Blockstream. About two hours ago, Blockstream responded with a PGP-signed OP_RETURN message: "The cross-chain bridge nodes have been patched and can safely return the funds." Currently, 3,998.5 BTC remains under the hacker's control.

SideSwap issued a statement saying that at 14:05 UTC today, a customer sent 4000 L-BTC to its peg-out service. The service processed the order as usual, L-BTC was destroyed on Liquid with a valid peg-out authorization, and at 14:28 UTC, Liquid Federation paid 3996 BTC to the customer's Bitcoin address.Blockstream subsequently confirmed that the L-BTC was minted due to a vulnerability in the Elements software. SideSwap's peg-out authorization keys and systems were not compromised, and the service cannot distinguish these tokens from other L-BTC. SideSwap is a non-custodial service, and user wallets are unaffected, with assets controlled by the users' own keys.Liquid has been suspended by the Federation, and SideSwap's exchanges, peg-ins, and peg-outs will be paused until the network is restored. Peg-outs that have been completed on Bitcoin are unaffected. Unfinished peg-ins or peg-outs can send transaction IDs to [email protected] for separate processing. Please do not send new peg-in or peg-out deposits until the service is restored.

Blockstream stated that Jade is not affected by the Coldcard random number generator vulnerability and has released firmware 1.41 after receiving extensive AI-assisted security reviews. Jade indicated that it has undergone dozens of automated AI scans and multiple manual reviews, focusing on sensitive areas such as random number generation and transaction signing.The new firmware enhances stack protection, updates dependencies, audits sensitive memory cleanup processes, and upgrades the Jade runtime environment. Blockstream claims that Jade's random number generation mechanism uses multiple entropy sources, including hardware chip noise, timing data, sensor data, and camera noise, and mixes them using SHA-512 to prevent a single entropy source failure from affecting seed generation. The team stated that other lower-severity findings are still being addressed, and firmware 1.42 is expected to be released in a shorter development cycle.

Blockstream has released a Bitcoin Improvement Proposal (BIP) proposing the SHRINCS post-quantum signature scheme. SHRINCS is a hash-based post-quantum signature scheme with a minimum size of 548 bytes, approximately 9 times larger than the existing Schnorr signatures, but much smaller than the NIST-approved ML-DSA and SPHINCS+ schemes. The scheme has completed production environment testing on the Liquid sidechain and includes a copy of the Bitcoin white paper.The scheme also has limitations. The BIP warns that security proofs are still pending, and the scheme is stateful, requiring the storage of used keys for each signature, which increases the signature size by 16 bytes with each use. In the event of device loss, approximately 5777 bytes are needed for a stateless fallback transaction recovery. Blockstream estimates that Bitcoin can maintain a speed of about 3 TPS after adopting SHRINCS, which can be increased to 6.7 TPS when combined with ZK proof aggregation.

Bitcoin infrastructure development company Blockstream announced on Twitter that due to Boltz's ongoing automated detection and multiple vulnerability attacks leading to the suspension of its exchange services, Blockstream will launch its own Blockstream Swaps service.Currently, Blockstream Swaps is in the beta testing phase, aimed at providing a toolkit for the ecosystem and will complement existing service providers.

Blockstream co-founder Adam Back commented on the controversy within the Bitcoin community regarding BIP 110, stating that he understands and sympathizes with the concerns of those supporting BIP 110, who hate spam transactions and want to protect the network. However, the proposal is essentially an act of "trying to monitor others," which would erode Bitcoin's decentralization, security, and neutrality, fundamentally conflicting with the spirit of Bitcoin.In response, Michael Saylor retweeted and stated, "There are 110 things more dangerous to Bitcoin than spam. BIP 110 turns the spam controversy into a consensus change, which will invalidate some currently valid transactions that have paid fees. This precedent is the real danger, and we should focus our energy on the truly important threats."Previously, David Bailey, chairman of the Bitcoin Treasury Company Nakamoto and chairman of Bitcoin Magazine, stated that the failure of the so-called "BIP-110" long-standing controversy constitutes an "extreme benefit" for Bitcoin and believes this further validates the network's resistance to attacks and splits.

Some observers view Morgan Stanley's entry into the U.S. spot Bitcoin ETF earlier this month as a catalyst to end the current crypto bear market, citing the large distribution capability of the Wall Street giant's $8 trillion wealth advisory network. However, Blockstream CEO and early Bitcoin community contributor Adam Back stated that "it won't happen that quickly."Back was recently speculated by The New York Times to be the anonymous Bitcoin creator Satoshi Nakamoto, which he denied. Back indicated that from a positive market signal perspective, the Bitcoin ETF could be the most significant development in recent times, even more important than a pro-crypto U.S. government, but this process is slower than most people realize.Back stated, "I think one thing people might be miscalculating is that institutional adoption is very slow. So the ETF has been bought, but when BlackRock suggested allocating 2% to 4% in its general stock portfolio, fund managers had not done that yet. They will, but slower than people expect." He mentioned that investors will not rush in overnight, and the accumulation process could take a year or even 18 months.Regarding prices, Back noted that the cyclical nature of Bitcoin's four-year halving cycle needs to be considered. He pointed out that even if some commentators believe the four-year cycle is breaking down, "people expect it to happen, so they sell to make it actually happen," and a decline could still occur. This logic will only change when people see the market strengthen, which is currently manifesting in the form of institutional capital inflows.Back stated that regarding recent comments about the accelerated development of quantum computing hardware potentially threatening Bitcoin's cryptography, institutions are more systematic in risk management and will focus on tail risks, while retail investors view it as a distant future risk.

According to Cointelegraph, Blockstream CEO Adam Back pointed out that Bitcoin's role as a store of value and the increasing institutional demand could drive its price to between $500,000 and $1,000,000 sooner than expected.

According to market news, Blockstream CEO Adam Back stated at the Paris Blockchain Week that he supports the optional advancement of Bitcoin's quantum resistance upgrade and opposes the proposal to forcibly freeze quantum-vulnerable addresses. He emphasized that "preparation is much safer than hasty responses in a crisis" and pointed out that the Bitcoin community has the coordination ability to respond quickly to urgent vulnerabilities.Previously, the BIP-361 proposal ("Post-Quantum Migration and Legacy Signature Sunset") put forward by developers Jameson Lopp and five others advocated for the gradual elimination of quantum-vulnerable addresses over five years, ultimately freezing coins that have not completed migration— including approximately 1.7 million Bitcoins held by Satoshi Nakamoto.

According to CoinDesk, Blockstream CEO Adam Back stated at Paris Blockchain Week that Bitcoin developers should advance optional quantum-resistant upgrades as early as possible, even though practical quantum computers are still far from being realized.He pointed out that Taproot's flexible design can support the introduction of new quantum-resistant signature schemes without affecting existing users. Previously, Jameson Lopp and others proposed BIP - 361, which aims to gradually phase out addresses vulnerable to quantum attacks within 5 years and freeze Bitcoin that has not completed migration. Adam Back believes that the Bitcoin community can quickly coordinate responses in emergencies without the need for pre-established freezing arrangements.

According to CoinDesk, Blockstream CEO Adam Back stated in an interview with Bloomberg that quantum computers do not currently pose a real threat to the Bitcoin network, but the industry should start preparing immediately. He pointed out that current hardware generally lacks error correction capabilities, and quantum risks are a long-term challenge rather than an immediate crisis.Adam Back emphasized that the core issue is not reaching a consensus on when quantum computers will pose a sufficient threat, but rather providing Bitcoin holders with a time window of about ten years to migrate their keys to quantum-resistant formats.He mentioned that there is currently a research team of 20 people continuously working on related tasks, publishing papers, and conducting practical deployments, with Blockstream's Liquid network already in use as an early testing platform.Additionally, post-quantum cryptography has moved from the theoretical stage to the implementation stage, with NIST expected to finalize relevant standards by the end of 2024. The main challenge facing the industry is how to coordinate a smooth migration before the risks become urgent.

According to The Bitcoin Historian, Blockstream (BSTR) CEO Adam Back revealed in an interview with CNBC that he will purchase $1.5 billion worth of Bitcoin in a few weeks, equivalent to about 21,000 Bitcoins.

According to Bitcoinmagazine, blockchain development company Blockstream has launched version 5.2.0 of the Blockstream Green app. This update connects Lightning payments with the Liquid network (a Bitcoin sidechain developed by Blockstream), utilizing atomic swaps to convert Lightning payments into Liquid Bitcoin (LBTC) secured by Jade devices.The report states that its Blockstream Jade hardware wallet is currently the first hardware wallet capable of interacting with the Bitcoin Lightning Network, allowing users to send and receive Lightning payments while securely storing funds in cold storage.

Bitcoin developer Luke Dashjr recently publicly called for Blockstream co-founder and CEO Adam Back to resign, following the latest disclosure of documents related to Jeffrey Epstein by the U.S. Department of Justice. The documents reveal that the deceased criminal Jeffrey Epstein indirectly participated in Blockstream investments through funds associated with the MIT Media Lab and had email correspondence with several Blockstream co-founders and figures in the crypto industry.Dashjr stated that these documents reveal what he calls "deep corruption" and reiterated his long-standing disagreements with Adam Back, including the historical controversy over his lack of recognition as a co-founder of Blockstream. The related documents also mention Epstein's connections with crypto companies such as Coinbase and Tether, noting that Epstein invested $3 million in Coinbase in 2014.In response, Adam Back has publicly denied any direct or indirect financial relationship with Epstein but has not commented on whether he ever visited Epstein's private island. As of now, Blockstream and other related parties have not made any further response to Luke Dashjr's call for resignation.