An AI-powered vulnerability scanner for open-source bitcoin projects. Discord: https://xitter.cf/t.co/VF8q4cOqdC
Joined May 2026
- Tweets37
- Following0
- Followers1.2K
- Likes24
Project Loupe retweeted
One of the best ideas @spiral_xyz has had
Project Loupe - AI powered security scanning for Bitcoin OSS Projects xitter.cf/i/broadcasts/1nxnRBMEo…
We file our findings privately. Loupe only shows up in public if a maintainer credits us, which many have:
✅ 754 commits, PRs, & release notes across 23 projects reference Loupe
✅ 610 distinct findings cited by issue number
✅ 132 merged PRs name the finding they fixed
Loupe findings have been landing in Bitcoin Core. During this cycle, five PRs landed: three have been merged, two are under review. Below is a thread on what each one caught and which Core dev implemented which fix.
📦 In review: a package evicted right after acceptance landed in the reject filter until the next block, so a higher-fee child couldn't bump it back in. Loupe and the Bitcoin Red Team found it, @theinstagibbs fixed it.
github.com/bitcoin/bitcoin/p…
🕳️ Also from a Loupe report: @theinstagibbs mapped out how a peer sending a same-txid witness variant can stall honest fee-bumping packages, and is closing those holes across two PRs. That work continues.
github.com/bitcoin/bitcoin/p…
Project Loupe retweeted
Thank you to our contributors, reviewers, testers and everyone reporting issues.
Special thanks to independent security researchers, @ProjectLoupe, @premai_io, @BugBunny_ai and @MagicGrants for helping us make BTCPay Server stronger. 💚
A second opinion:
✅ Another model double-checks every finding
✅ It returns "inconclusive" 30.2% of the time
✅ 88% of "dismissed" findings weren’t refuted but rather not established
✅ 3,671 findings were verified more than once and only 105 got a conflicting verdict
Project Loupe retweeted
LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft.
If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3.
1/4
Project Loupe retweeted
There is an arms race between the attackers and maintainers as to who has the superior frontier AI model.
“That is not a sustainable security model” - @dergoegge
@_tnull @ProjectLoupe @btcplusplus
🤖 Made with AI
Project Loupe retweeted
Elias Rohrer (@_tnull) presents the @COLDCARDwallet incident as the pivotal moment that “prompted” everyone to start scanning repos with Kimi K3.
The “report flood” ensued. Bitcoin Core had 1000+ reports. None critical.
@ProjectLoupe @btcplusplus
🤖 Made with AI
Some personal news:
✅ Loupe has produced 26,821 findings across 43 open-source bitcoin repos
✅ Average successful scan took 2H 52M and returned 53.6 findings
✅ Longest scan ran for 36H 58M
✅ 26,809/26,821 findings shipped a proof-of-concept & 12,774 shipped a proposed patch
Project Loupe retweeted
upgrade your project's security posture
the cyber security landscape has fundamentally and permanently changed .. so where to start as a humble FOSS project maintainer and builder?
take a squiz at @spiral_xyz's Project Loupe:
What is it? projectloupe.org/about
Does it work? projectloupe.org/p/loupe-pro…
Where is it? github.com/project-loupe/lou…
Project Loupe retweeted
Excited to continue pushing out talks and discussions from our Open Source AI Summit!
Next up: Securing Open Source Software - @moneyball with @Rob1Ham, @_tnull, and @jordanmecom on how AI is reshaping open source software security:
Timestamps
0:00 - How AI is changing open-source software security
03:34 - How AI security scanning works
06:30 - Why open-weight models changed cybersecurity
09:30 - How many vulnerabilities AI scans find
11:58 - Why different scanning methods find different vulnerabilities
15:38 - How maintainers should handle AI vulnerability reports
23:29 - How AI changes responsible disclosure
30:15 - Can AI find vulnerabilities without source code?
Project Loupe retweeted
.@ProjectLoupe reads bitcoin code all day looking for vulns. Fueled by energy drinks and cold pizza, its existence is bleak but necessary.
The @StratumV2 team took its findings, fixed them, and rebuilt their security process. Their stack is now among the hardest in mining.
Rare to report bugs and get a rebuilt security process back. Giant ups to the @StratumV2 team on the release, and thanks for being early with us.
Rare to report bugs and get a rebuilt security process back. Giant ups to the @StratumV2 team on the release, and thanks for being early with us.
New SV2 releases are out, bringing security hardening and various other improvements to our libraries and applications!
🧩 SV2 Protocol libs v1.12
🏗️ SV2 Apps v0.8
⛏️ SV2 UI v0.7 (coming soon on @umbrel)
Applications updates improve Job Declaration stability and Bitcoin Core integration, Translator Proxy overhaul, and add automatic discovery of ASIC telemetry endpoints.
Protocol library highlights include a deep hardening pass over channels_sv2, a breaking refactor of the codec and framing layer, BIP323 adaptations across the protocol stack. Noise_sv2 was improved with regards to memory hygiene, nonce reuse, RNG quality, and buffer recovery. Every published crate that changed takes an incompatible version bump, so downstream consumers should expect to adapt.
We’re proud to have been early participants in @ProjectLoupe . Their findings helped shape this release and gave us a head start in adapting how we triage reports, prioritize fixes, and organize development around security. Thank you to the Loupe team for their work and support!