Hi Insiders. This is Tuma, open-source reporter from the Insider Edition.

In this week’s update we feature the latest news from Marmot — with the team working on bringing multi-device to the protocol — and the implementation of efficient animated QR codes in Cashu.

We also cover the effort by Robin Linus to make taproot annexes standard in Bitcoin Core, an attack to Second that resulted in 0.75 bitcoin stolen, and the latest patch release for Core-lightning.

#

Highlights from the Bitcoin developer ecosystem

I spent 10+ hours in open-source developer calls in the Bitcoin ecosystem last week. Here is what caught my eye:

• Marmot protocol specifications are now stable and the team if focusing on the next features, such as multi-device.

  • During the monthly community call, on Tuesday 6th, Marmot developers discussed the latest improvements in the protocol for secure, private messaging and in the White Noise application and gave an update on the next steps.
  • Marmot specifications are quite stable now and the Marmot Development Kit (MDK) is nearly on par with them. The team solved a bug that did not allow a group to have more than 50 users and is currently working on making media upload faster and more efficient and focusing on how to make Marmot itself more private.
  • Devs are now focusing on one of the most requested, multi-device — i.e. the possibility to have the same chats, with the same messages, on multiple devices. This is one of the most complex features to work on, given the decentralized nature of the protocol. The team is currently gathering ideas on that and is working toward a draft specification.

• Cashu developers are implementing efficient animated QR codes thanks to a discussion at the bitcoin++ conference in Berlin.

  • During the weekly call, on Wednesday 7th, CDK developers discussed PR2646 which aims to add binary fountain token transport, a way to make animated QR codes more efficient.
  • This new feature comes from a discussion between Cashu developer Egge and Fedimint contributor Joschisan during the Berlin bitcoin++ conference. Joschisan had previously implemented custom, efficient fountain QR codes in Fedimint.
  • The feature is also being implemented in cashu-ts — the TypeScript implementation of the Cashu protocol — and an upgrade to the NUT-16 specification is currently under discussion. Moreover, Egge published the nut-fountain repository which includes a TypeScript implementation and a playground to test the new feature in the browser.

---

A BIPs Update

There was no newsworthy update in the last days in the BIP repository. We’ll provide new updates as soon as a new BIP gets published or gets assigned a number.

---

Other News from the Bitcoin World

• Making taproot annex standard: Robin Linus — BitVM creator and developer working on Shielded CSV (now Glass Coins) — decided to open a pull request to make taproot annexes standard in Bitcoin Core.

  • A taproot annex is an optional field in the witness structure of taproot inputs that can be used to store additional data. This field still hasn’t a clear use-case and was reserved for future updates.
  • Glass Coins need to post data to the main chain, as a requirement to prevent double-spending in the client-side validated protocol. Linus’ idea would be to leverage the annex for that specific purpose. However, Bitcoin Core does not relay annexes by default. Linus’ PR aims to change that, allowing Bitcoin Core nodes to relay them.
  • As Rearden pointed out, however, two implementations already relay the annex by default, namely LibreRelay and rbitcoin.

• Bark Hacked: Second revealed that the company had been hacked on Monday 5th. An attacker exploited a bug in the Ark Server’s boarding flow and managed to steal 0.75 bitcoin of Second’s own liquidity. No users’ funds were stolen.

  • The attacker was able to exploit a bug that allowed him to board the Ark Server using only his own signature. Usually, the process requires a co-signature from the Server itself. Thus, the attacker was able to exit the ark protocol with the funds, while at the same time spending his VTXOs through Second’s Lightning gateway.
  • No funds from Second’s users were stolen, thanks the design of the Ark protocol. In fact, users’ VTXOs sit on a pre-signed exit path that no one else — server included — can spend.
  • An interesting thing about this attack was that the liquidity used to perform it was linked to the hack that hit Blink couple of weeks ago.

• Upgrade Core-lightning: The Core-lightning team released a new patch version, v26.06.9, that fixes a vulnerability that could lead to a loss of funds. The team suggested an immediate upgrade for node operators running version v26.06.8 and lower.

---

More from BTC++ Insider Edition

News Hour#

• BTC++ News Hour: Check out our Friday livestream, where Matthew Vuk and I discuss the most interesting news of the week from the Bitcoin developer ecosystem.

Articles#

• The comma is the limit - This Week in Bitcoin Core #61

Bitcoin++ — Payments Edition Livestream#

• Day 1: Check out the livestream for the first day of the Berlin event!
• Day 2: Check out the livestream for the second day of the Berlin event!

---

Looking for an opportunity to join up with some bitcoin devs in person? Join us in Seoul this November 5-6 to talk about privacy in Bitcoin!