Silent Payments let you share one static address while every payment lands somewhere new and unlinkable. Making that work for multiparty wallets is a harder problem. @olkurbatov of @blksresearch takes it on at @btcplusplus Seoul, November 5-6. 🇰🇷

PISA is here: Watch the Payjoin + CISA integration demo we built at @LuganoPlanB with the support of @cypher_tank. See the code, spec and more at This is a joint effort by @payjoindevkit and @bitcoinbrink.

Bitcoin is built to last. Keeping it secure is long-term work. We're excited to share our work this week at @LuganoPlanB: @adam3us on lessons from the cypherpunk movement, @n1ckler on post-quantum signatures, and self-custody workshops with our engineers.

In August 2019 I met with Tamás Blummer. He told me about his terminal illness, and we spent most of our time talking about what he called his legacy: side memory and defiads (defiant ads). I've always thought it was a missed opportunity that nobody picked that work up. Maybe the idea is just hard to get across, and I rarely succeed at it. defiads is a peer-to-peer network in which every node stores the same fixed-size pool of advertisements, 1 GB by default. Every ad is a byte-blob whose place in the pool is backed by a time-locked Bitcoin UTXO, bound to the content via pay-to-contract. Ads are ranked by sats locked per byte. When the pool fills up, the lowest-ranked ads are evicted. So the advertiser pays nobody. The cost of an ad is the opportunity cost of the locked capital. This is an application you can build with Bitcoin and not with tradfi: a time-locked UTXO is a commitment of capital that any peer can verify without a counterparty. What it's best used for is an open question. Ads, whistleblowing, a communication platform for autonomous agents? Tamás's side memory post on bitcoin-dev: Code:

Announcing LayerTree: a new tree-based scaling solution for Bitcoin that permits O(1), independent of the number of users in the system: A single UTXO can hold the balance of millions of users as an off-chain Merkle-sum tree. Transaction introspection techniques permit batched exit from the system in a single transaction w/o any pre-signing:

The full CUTS paper is now available. It has the full specification, proofs for the bounds we previously estimated, a reuse analysis that also covers Winternitz and FORS, and some worked examples/test vectors. Feedback welcome 🤙

Stoked to announce this! Zark is a transfer-of-ownership protocol that collapses offchain histories into compact zero-knowledge proofs. Previous bitcoin l2 implementations have shown that co-signers can be blinded and unaware of what they’re signing. In some designs, users validate the history of offchain coins they receive. Zark compresses these histories into recursive zero-knowledge proofs. A side effect is that this removes the need for users to learn who a coin’s previous owners are. Zark is based on the statechain paradigm. It enables users to transfer ownership of bitcoin UTXOs offchain with the help of a co-signer. In Zark, users can also engage in offchain coinswaps to transfer ownership for bitcoin UTXOs for other bitcoin UTXOs. We’re looking at adding support to swaps against tokens on alternative networks, like we did in our bitcoin dark pools demo with @mercurylayer. Current research areas for us: - Leaf splitting while retaining privacy for branches - Scalability! - Optimizing zk-circuits and proving system Circuits are written in @noirlang.

Post-quantum transactions that require only 96 bytes on-chain: @will_wjk (Imperial College) et al. published a very interesting variant of Shielded CSV, called Compact Shielded CSV. I've always thought the CSV model is attractive in a PQ setting: the blockchain only stores the nullifier, so miners don't have to verify a signature before it gets into a block. Compact Shielded CSV goes a step further: the on-chain nullifier carries no signature at all, only what they call a "degriefer". Pre-quantum that's more than Shielded CSV's 64 bytes, but post-quantum it's much less. Unlike Shielded CSV, which operates on top of Bitcoin, Compact is its own blockchain. That matters for the degriefer: a Compact miner who includes a nullifier with an invalid degriefer can't claim the block reward. Shielded CSV could adopt the degriefer, but on Bitcoin there is no such penalty. Anyone who sees your nullifier before it's confirmed can front-run it with bogus copies for ~100 bytes of fees each, and your spending proof then has to show for every one of them that it's invalid. This is something we deliberately avoided in the design of Shielded CSV. With PQ signatures as large as they are, it probably is a reasonable trade-off. Compact also never discusses reorgs, which are a significant part of the Shielded CSV design. Integrating the degriefer into Shielded CSV would require combining it with the existing reorg handling.

I'm glad to share that our book on zero-knowledge protocols now has a full chapter on post-quantum zero-knowledge proving systems with over 100 pages! It covers lattice-based Σ-protocols, LaBRADOR, and ZK-STARKs, with all the necessary prerequisites included. Link below 👇

In case people think I am advocating for not being cautious, or thinking that AI won't be an issue for any cryptography, that's not the case. Let me word what I think would be a balanced approach regarding AI and crypto. 1/n

📎 Shielded bitcoin protocols like @ShieldedCSV need to post a little data with each payment. Taproot already has a slot for that: the annex. Core just won’t relay it. Opened a PR to make annexes standard. Policy only, consensus untouched. Reviews welcome:

Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible. We’ve received reports that attackers are targeting unpatched nodes. Keeping your node up to date is an important step in protecting your funds.

Can you believe the second-funniest person on Bitcoin Twitter apparently does more than shitpost? Stu found and responsibly disclosed the Liquid exploit before the red team even existed.

This is the logical next step, given how much AIs can optimize hash-based signatures (e.g., HG-WOTS) and prove their security. I'm somewhat pessimistic that a single score can meaningfully express what makes a signature scheme good. score, signature bytes × verification cycles, is just one particular trade-off between the two, and its cost model targets zkVM proving, not verification on ordinary CPUs. But the techniques and proofs it produces are likely to carry over to other settings, and I'm looking forward to the results.

Lots of good questions since we published Shielded Bitcoin. Bitcoin++ asked us to tackle a dozen of them — covering common misconceptions, trade-offs, and open avenues for research. Enjoy digging into this conversation with @ClaraShik and @btcinsider__.