bitcoin++ gets exploited

keynote

Kickoff

niftynei

Time

Thu, Feb 26 · 10:15 AM – 10:30 AM

Location

Main Stage

Type

keynote

Duration

15m

Speakers

niftynei

bitcoin++

X Nostr GitHub Instagram Website

talk

Differential Fuzzing: When Implementations Disagree

Erick Cestari

Time

Thu, Feb 26 · 10:45 AM – 11:15 AM

Location

Main Stage

Type

talk

Duration

30m

Differential fuzzing compares how different implementations handle the same input. When they disagree, you've found a bug. I'll walk through how the technique works and share some real bugs it's caught.

Speakers

Erick Cestari

Vinteum

X GitHub Website

talk

The Vibes are off: Foundations Matter

Danny Morabito

Time

Thu, Feb 26 · 10:45 AM – 11:15 AM

Location

Talks Stage

Type

talk

Duration

30m

AI agents and "vibecoding" are everywhere. Derek Ross vibes 7 apps before breakfast, junior engineers panic, and everyone's convinced coding is dead. Just vibe it and ship it, right? Reality check: We're 32 months past Dario Amodei's "AI will write 90% of code in 6 months" prediction (thanks for counting, Primeagen). The vibed apps are all falling apart in production. Every time someone ships code they don't understand, a kitten dies. That's just physics, ask Claude to explain it to you and vibe write a paper about it. **The nuance matters:** In the hands of experienced developers who actually review the code, AI tools are game-changing, they are actually time savers and actually helpful. But skip the long and tedius manual review and it's a disaster. We're seeing vibed apps get hacked daily from data leaks to services hijacked for crypto scams and basic security practices ignored entirely. Still not convinced? Look at our infrastructure fragility: Cloudflare and AWS crash regularly now it's become a meme even among non technical people, and Windows had an RCE vulnerability in *Notepad*. NOTEPAD!!! The fundamentals still matter. Maybe more than ever.

Speakers

Danny Morabito

WhiteNoise and Arx

Nostr GitHub

talk

Recap: A network wide DoS bug in Bitcoin Core

0xB10C

Time

Thu, Feb 26 · 11:15 AM – 12:00 PM

Location

Main Stage

Type

talk

Duration

45m

An overview on surveying the network and catching Denial of Service bugs.

Speakers

0xB10C

OpenSats

X GitHub

talk

From Vibe Coding to Agentic Engineering

Breno Brito

Time

Thu, Feb 26 · 11:15 AM – 12:00 PM

Location

Talks Stage

Type

talk

Duration

45m

From Linus Torvalds (Linux) and Eric Raymond (The Cathedral & The Bazaar) to Andrej Karpathy (OpenAI) and Armin Ronacher (Flask), everyone is relying more and more into AI to write code. In this talk, I’ll share the leading AI coding workflows being used right now, as best practices are still being figured out.

Speakers

Breno Brito

Cozinha de Pedra

X Nostr GitHub Website

talk

From PGP to Marmot: Three Decades of Messaging Protocol Exploits and Defenses

Max Hillebrand

Time

Thu, Feb 26 · 1:00 PM – 1:45 PM

Location

Main Stage

Type

talk

Duration

45m

Encryption keeps getting better. Messaging systems keep getting exploited. Each generation of encrypted messaging solved a real problem. PGP encrypted content, leaked every header. OTR added forward secrecy, died if one party went offline. The Signal Protocol solved async delivery and reached a billion users through WhatsApp, on centralized servers. Decentralized projects attacked the server problem: Briar over Tor and local mesh, Session through onion routing, Matrix via federation. Real projects with real users. Each accepted a constraint somewhere else: no group encryption standard, text-only media, metadata visible to operators. So far, every step forward has left a gap. Modern attackers have adapted. The "Careless Whisper" timing attack profiles Signal users through delivery receipts, no decryption needed. FORCEDENTRY compromised iPhones via iMessage with zero clicks. Google Project Zero called it one of the most technically sophisticated exploits they had ever seen. The FBI built ANOM, a complete encrypted phone platform, sold it to 12,000 users, and read every message from a server they controlled: 800 arrests in 16 countries. This talk traces the full arc: what each protocol generation fixed, what it left open, how attackers adapted. The recurring lesson is architectural: encryption protects content, while servers, phone numbers, and centralized infrastructure expose everything around it. Marmot Protocol is the next step in this evolution, built on everything that came before. MLS (RFC 9420) provides group encryption with forward secrecy, post-compromise security, and O(log N) scaling, after five years of IETF standardization, with production deployments at Cisco, Discord, and Google. Nostr removes the central server, and Nostr keypairs replace phone numbers. Users control their own infrastructure, the same principle Bitcoiners already apply to money. The talk covers the full attack surface of encrypted messaging and where Marmot fits.

Speakers

Max Hillebrand

Marmot & White Noise

X Nostr GitHub Website

talk

Fuzzing Around And Finding Out In BDK (TBD)

Leonardo

Time

Thu, Feb 26 · 1:00 PM – 1:45 PM

Location

Talks Stage

Type

talk

Duration

45m

TBD

Speakers

Leonardo

Bitcoin Dev Kit ; Vinteum

X Nostr GitHub

talk

Exploiting P2P: How Mostro Hacks the Exchange System

Francisco Calderón

Time

Thu, Feb 26 · 1:45 PM – 2:30 PM

Location

Main Stage

Type

talk

Duration

45m

Every exploit starts by finding a vulnerability. Centralized exchanges are the financial system's biggest one — KYC as a mass surveillance vector, custodial databases as honeypots, and single points of failure that governments can pressure, censor, or shut down. Mostro is the exploit. Built on Lightning Network and Nostr, it attacks every surface: NIP-59 gift wrap makes trade communications invisible (even relays can't see who's trading with whom), hold invoices keep escrow non-custodial (Mostro never touches your sats), pseudonymous reputation replaces identity documents, and disposable relay infrastructure means there's no server to seize. This talk walks through Mostro's architecture as a systematic hack against financial censorship — from the personal story of being blacklisted in Venezuela for signing a political petition, to the technical deep dive of how each protocol choice neutralizes a specific attack vector. Includes a live demo showing what a trade looks like from inside the app and what it looks like from outside (spoiler: just opaque encrypted blobs on a social media relay). The real exploit isn't technical — it's giving millions of people access to free exchange when their government says they can't have it.

Speakers

Francisco Calderón

Mostro

X Nostr GitHub Website

talk

Fee Is a Lie, Attacking Lightning via Mempool Policy

Gustavo Stingelin

Time

Thu, Feb 26 · 1:45 PM – 2:30 PM

Location

Talks Stage

Type

talk

Duration

45m

Lightning security relies on the assumption that valid transactions can be confirmed when needed. This talk examines why that assumption breaks down under adversarial mempool policy. It explains how pinning attacks, replacement cycling, and fee manipulation allow attackers to delay or invalidate time-critical Lightning transactions using only standard, policy-compliant behavior. The talk then explores how zero-fee commitment channels and pay-to-anchor redesign the fee model, changing the Lightning threat surface and highlighting lessons for building protocols that must survive hostile mempools.

Speakers

Gustavo Stingelin

Vinteum Fellow

X Nostr GitHub

workshop

Reconstructing Hardware Wallet Exploits

Mike Tolkachev

Time

Thu, Feb 26 · 3:00 PM – 4:00 PM

Location

Workshops Stage

Type

workshop

Duration

1h

Hardware wallet exploits have rarely been caused by broken cryptography but more often by subtle issues in system design, implementation, and assumptions. This workshop examines why these exploits were possible by reconstructing historical failures from publicly disclosed incidents across popular hardware wallets. Participants work with a simplified and deliberately vulnerable "toy wallet" on a constrained microcontroller to reproduce these conditions in a controlled environment and apply the defensive changes that mitigated them. Attendees leave with practical insight into how Bitcoin custody systems have broken in the past and how to reason about future exploit risks.

Speakers

Mike Tolkachev

Specter Association

X Nostr GitHub

talk

Fuzzamoto: Full System Fuzzing for Bitcoin Protocol Implementations

⁨Niklas Gögge

Time

Thu, Feb 26 · 3:15 PM – 4:00 PM

Location

Main Stage

Type

talk

Duration

45m

This talk will introduce listeners to Fuzzamoto, a full-system fuzzing framework for Bitcoin protocol implementations built on LibAFL and powered by Nyx for snapshot-based fuzzing. We'll explore how Fuzzamoto enables coverage-guided fuzzing of Bitcoin nodes in a realistic environment, moving beyond unit-level harnesses to catch bugs that only emerge through full system interaction. Attendees will learn about the architecture, the challenges of fuzzing complex P2P protocol implementations, and findings from applying Fuzzamoto to real-world Bitcoin software.

Speakers

⁨Niklas Gögge

Security Engineer, Brink

X Nostr GitHub Website

talk

Mapping the Mobile Wallet Attack Surface

Oscar Lafarga

Time

Thu, Feb 26 · 3:15 PM – 4:00 PM

Location

Talks Stage

Type

talk

Duration

45m

This talk demystifies how native mobile wallets store and handle sensitive key material on-device. Using Fedi’s in-app browser as a sample / case study, we’ll walk through how WebLN payments and NIP-07 Nostr signing are used to create a convenient UX and what security assumptions and attack surfaces come with that design.

Speakers

Oscar Lafarga

Fedi

X GitHub Website

talk

Bitcoin Security Is a House of Cards (Unless You Understand This Talk)

jaonoctus

Time

Thu, Feb 26 · 4:00 PM – 4:30 PM

Location

Main Stage

Type

talk

Duration

30m

In this talk, we tear down the illusion that Bitcoin's security is flawless. From the transaction malleability bugs that shaped SegWit, to signature failures that leak private keys through nonce reuse, you'll see how small mistakes can cascade into catastrophic failures across wallets, contracts, and Layer 2s.

Speakers

jaonoctus

ZBD

X Nostr GitHub Website

talk

Hardening silent payments

Nymius

Time

Thu, Feb 26 · 4:00 PM – 4:30 PM

Location

Talks Stage

Type

talk

Duration

30m

Silent payment scanning is a resource intensive task that must be done in the most efficient way possible. During the most recent iterations of development in libsecp256k1 library, a concern was raised about the existence of an attack vector that could slow down significantly the scanning for a single receiver. In this talk you will learn about the solutions proposed, iterations on the problem and adversarial thinking in action.

Speakers

Nymius

BDK

X Nostr GitHub

hackathon

Hackathon Kickoff

Alex Lewin, niftynei

Time

Thu, Feb 26 · 4:30 PM – 5:00 PM

Location

Main Stage

Type

hackathon

Duration

30m

The hackathon kicks off

Speakers

Alex Lewin

Fedi

X GitHub

niftynei

bitcoin++

X Nostr GitHub Instagram Website