TheNostr Observer

The Month-Old Map: Open Pull Request Left 4,000 Bitcoin Vulnerable on Liquid

A bug fix committed August 3 sat unmerged in plain sight while the hole remained live on the network — leaving an open blueprint for anyone reading the code.

By the Observer Editorial Desk

Twenty-four hours after the Liquid sidechain suffered a catastrophic multi-million dollar drainage, the post-mortem over what went wrong has shifted from cryptographic federation design to basic repository hygiene. As analysts and node runners inspected the commit history, an uncomfortable truth emerged: the flaw was not uncovered in the dark by zero-day exploit hunters, but sat waiting in public version control.

Ungovernable highlighted the timeline: The fix for the bug that drained Liquid had a commit dated the 3rd of August. The pull request carrying it was still open on the 1st of September. In open-source protocol engineering where multi-million-dollar bridges depend on contract logic, public branches carry deadly weight. As Ungovernable stated, Which means the patch was public while the hole it closed was still live on the network. Anyone reading that repo could see exactly what to look for. His indictment was unsparing: If you are sitting on 4,000 Bitcoin of other people's money, an open pull request is a map for anyone who bothers to read it.

The on-chain reality of the recovery remains precarious. In Bitcoin block 965,950, exactly 3,400 Bitcoin was returned to the federation reserve, but 598.5 Bitcoin remains withheld by the perpetrators as an unauthorized bounty, accompanied by demands that Blockstream pay ten percent from its corporate balance sheet. On the sidechain, block 4,050,336 was rewritten to purge the exploit block after functionaries upgraded to Elements 23.3.4, yet the remaining L-BTC assets stand at approximately eighty-five percent real reserve backing.

Custodians and services are cautiously gingerly testing the waters. Coinos reported: Coinos' Liquid node is updated to elements-23.3.4 and withdrawals have resumed. Deposits are still on hold until network peg-outs are allowed again. Meanwhile, commentators rejected any romanticization of the attackers as benevolent white hats. Dissecting the negotiations conducted over blockchain OP_RETURN messages, jsm observed: Morality does not have a price tag.

Dispatched from reporting by Ungovernable, Bitcoinlighthouse, Coinos, and jsm.

GitWorkshop on FIPS: Code Repositories With No Cloudflare, No DNS, and No Routing

Pete Winn and Johnathan Corgan demonstrate peer-to-peer code collaboration operating entirely outside traditional web gatekeepers.

By the Observer Technology Desk

While centralized infrastructure providers faced scrutiny, experiments in peer-to-peer sovereign networking surged forward. Developer Pete Winn showcased a modified GitWorkshop instance serving source code repositories across FIPS — an encrypted overlay network operating without standard web crutches.

Winn celebrated the architectural leap: Sat on my network, no tunnels, no cloudflare, no dns, no routing. He hailed the demonstration as The Cypher Punk Future we deserve!, noting that removing the friction of reverse proxies and certificate management creates an experience far friendlier to ordinary users.

Explaining how the network protects communication without central routing authorities, Johnathan Corgan clarified the cryptographic design: No, there are two totally independent layers of encryption involved. The end-to-end layer negotiates encrypted sessions known only to terminal nodes, while The second is hop by hop between peers. Under this scheme, intermediate forwarding nodes pass opaque data blobs without insight into payload content.

Dispatched from commentary by Pete Winn on GitWorkshop, Pete Winn on the demo, and Johnathan Corgan.

Hodl Hodl Deploys Autonomous AI Agents to Stress-Test Escrow Contracts

Trading bots given testnet keys probe edge cases in multi-sig dispute resolution before software hits production.

By the Observer Technology Desk

Rather than relying solely on human audits, peer-to-peer exchange Hodl Hodl has unleashed autonomous AI agents into testnet environments to actively attempt breaking contract logic.

The team explained the testing pipeline: We gave AI agents testnet wallets and told them to act like real traders, placing trades, running escrow flows, just to see what they'd break. By simulating unexpected timing sequences and conflicting claims, the autonomous bots revealed latent vulnerabilities in multisig release orders. As Hodl Hodl concluded: They found real issues. We patched them before they ever touched production.

Dispatched from an announcement by Hodl Hodl.