Blockstream

Multisig is Back 2FA Protected and 2-of-3 accounts, open again in the Blockstream app. https://blog.blockstream.com/multisig-is-back-in-the-blockstream-app/

Core Lightning 26.06.8 is out, and every node runner should upgrade. This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now. A number of tests are being held back temporarily to make the underlying issues harder to reverse-engineer while node runners have time to upgrade. Please upgrade as soon as possible. https://github.com/ElementsProject/lightning/releases/tag/v26.06.8

We have published the technical security assessment of the September 6 Liquid incident, which details the root cause and mechanics of the exploit, an incident timeline, and the engineering and security changes being implemented in response. https://blog.blockstream.com/liquid-network-security-incident-assessment/

Following the recent incident affecting the Liquid Network and the movement of funds, Blockstream, as Liquid’s technical provider, and the Liquid Federation have been working diligently to resolve the ongoing situation and ensure the return of assets. Updated software has been deployed as the Federation members prepare the network for a coordinated restart. Our teams remain focused on further hardening the network. We want to thank the broader Bitcoin community for their patience, support, advice, and assistance throughout this process. We will continue to provide updates as progress is made.

Blockstream Info has been rebuilt, for Bitcoin and Liquid. Watch the next block fill. Read real analysis on any transaction. Check Liquid's backing yourself, in one dashboard. Everything new: https://blog.blockstream.com/blockstream-explorer-rebuilt/

blockstream.info has been rebuilt, for Bitcoin and Liquid. Watch the next block fill. Read real analysis on any transaction. Check Liquid's backing yourself, in one dashboard. Everything new: https://blog.blockstream.com/blockstream-explorer-rebuilt/

Core Lightning 26.06.7 is out and recommended for every node runner. It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published. https://blog.blockstream.com/core-lightning-26-06-7/

Jade firmware 1.0.41 is out. It contains security updates and every user should upgrade as soon as they safely can. Jade is not affected by the Coldcard random number vulnerability. The reasoning, and everything we changed, is in the post. https://blog.blockstream.com/reflections-on-the-coldcard-fallout/

Your Jade never has to touch the computer. QR Connect and air-gapped signing land in the desktop app, so Jade pairs, unlocks and signs entirely over QR codes. Lightning arrives too, in Beta. Switch it on in settings, no second app to run. https://blog.blockstream.com/blockstream-app-desktop-3-5-0/

A popular concern says post-quantum signatures cannot run on the hardware wallets people already own. Blockstream Research implemented hash-based schemes on four popular devices. All four signed. SLH-DSA, the NIST standard, in about two minutes at worst. https://blog.blockstream.com/hardware-wallets-post-quantum-signatures/

Jade doesn’t use a physical secure element. We just published a full post on how the Virtual Secure Element works: https://blog.blockstream.com/jade-virtual-secure-element/

Beta access: https://blockstream.typeform.com/to/y1L5wyZT

Announcing Blockstream Swaps. Trustless atomic swaps for Bitcoin, Liquid, and Lightning. Hold BTC or LBTC and pay Lightning invoices without managing channels or inbound liquidity. Reach Lightning from cold storage while keeping full control of your funds. Built as a complementary service to strengthen ecosystem resilience and redundancy. Currently in beta. Full announcement: https://blog.blockstream.com/announcing-blockstream-swaps/

Post-quantum signatures aren't one-size-fits-all, and now developers can find the SHRINCS setup that fits theirs. Blockstream Research's explorer lets you tune signature size, signing cost, and verification cost to match your wallet, node, or miner. Their sweep of 25,935 candidates found a fallback signature about 2 KB smaller than NIST's SLH-DSA, and 28% cheaper to verify. https://blog.blockstream.com/searching-for-shrincs-parameters/

Jade is unaffected by the recently disclosed RNG vulnerability affecting other hardware wallets. Every Blockstream Jade recovery phrase comes from multiple independent entropy sources. On an affected device? Here's how to migrate calmly, step by step: https://blog.blockstream.com/jade-unaffected-coldcard-vulnerability/

The Blockstream Jade lineup (Jade Classic, Jade Core, and Jade Plus) is unaffected by the recently reported RNG issue with another company. We are preparing a blog post outlining best practices for anyone moving bitcoin to a new wallet, including how to generate fresh keys, verify addresses, conduct a test transaction and securely retire an old recovery phrase. Frontier LLMs are uncovering previously overlooked vulnerabilities, and Blockstream is using the same tools to strengthen the QA reviews of our product suite. But AI is not a substitute for open source: transparent hardware and firmware enable independent scrutiny, faster disclosure and quicker fixes. This is why Blockstream Jade continues to champion both open source software and hardware. https://x.com/Blockstream/status/2083030032927306010

Simplicity has been live on Liquid mainnet for nearly a year. Now the full developer toolchain is here. Build high-assurance Bitcoin contracts in a zero-friction environment with autocomplete, instant testing, post-quantum signatures, and a finalized lending template. Here's what builders can ship today and what's coming next. https://blog.blockstream.com/building-on-simplicity-what-ships-today-what-is-coming-next/

New 0-conf infrastructure for Liquid and other Elements-based deployments is here. Swap services, exchanges and applications that accept Liquid payments now have access to near-instant transfer times. Details in the technical explainer below. https://blog.blockstream.com/0-conf-for-elements-and-liquid-a-technical-explainer/

Simplicity's site just got a full redesign. Simplicity lets you prove exactly how a contract behaves before it goes live. No surprise fees, no transactions failing mid-execution. The security guarantees are part of the language, not bolted on after. Live on Liquid mainnet, running real financial contracts, and built for the developers and institutions building high-assurance Bitcoin applications. https://blog.blockstream.com/welcome-to-the-new-simplicity/