BitDevs Arnhem meeting 031!
It’s time for another BitDevs! A big thanks to Four Digits for hosting us at their office. Drinks will be provided, so please ensure you have some dinner beforehand or bring it along to the seminar.
Friday, September 18th, 2026
The venue is at Jansbinnensingel 26, Arnhem — about a 10 minute walk from Arnhem Centraal train station.
- Doors open: 6:30PM
- Start (sharp): 7:00PM
- End (sharp): 9:00PM
Afterwards we’ll head to a nearby café that accepts bitcoin.
As a reminder, the ground rules of BitDevs are as follows:
- No photos, videos, or recordings.
- Chatham House Rule: you may
reiterate the contents of the meeting without attribution.
These rules exist so that BitDevs participants can speak freely within the event.
Agenda
Consensus
- BIP-110 now closed: The “Reduced Data Temporary Softfork”, which proposed temporarily limiting transaction data fields at the consensus level, has been marked closed following a chain split with stalled mining.
Security
- Coldcard entropy hack: A firmware bug in Coldcard Mk2/Mk3 used a predictable PRNG instead of the secure hardware RNG when generating keys, dropping entropy to ~40 bits and letting attackers brute-force and drain thousands of wallets.
- Bitcoin red team: Calle (callebtc) calls for a coordinated Bitcoin “red team” to proactively hunt and responsibly disclose vulnerabilities across Bitcoin software.
Lightning Network
- Wavelength: Lightning Labs’ new toolkit that abstracts Lightning behind a simple non-custodial API, letting any developer or AI agent give an app a self-custodial bitcoin wallet without running infrastructure.
- CLN faces a major security vulnerability: A serious Core Lightning vulnerability has been flagged, with users urged to update; the root issue has not yet been disclosed.
- https://x.com/murchandamus/status/2092668704790315288
- CLN ping-flood DoS disclosure: A separate, already-disclosed DoS where attackers crash Core Lightning nodes by flooding them with max-size
ping messages while refusing to read replies, growing the outgoing queue unbounded until an OOM kill; now fixed by routing all messages through proper flow-control gates.
- Boltz taken over after security incidents: Boltz suspended its Bitcoin/Lightning swap service on August 3 after escalating AI-assisted attacks, and its founders have now exited as an unnamed group of Bitcoin veterans takes over to fund and fix it.
]]>