hodlonaut

This account is verified. Learn more

@hodlonaut

Citizen Journalist. Always looking to learn. Speaking my mind. Behind citadel21.com @ctdl21

Norway Joined April 2017

1K Following 160K Followers 60K Posts

Latest posts 5

Pinned post

hodlonaut @hodlonaut Oct 14

CAPTURE Part 4: THE MACHINE

The fourth and final installment is out.

Bitcoin Magazine wasn’t just covering the fight over Bitcoin’s future. Its parent operated an Ordinals trading desk, invested in businesses tied to the ecosystem, and maintained editorial policies that exempted parts of that same business.
Then came an $80,000/month marketing contract, with an option for Nakamoto Inc. to buy BTC Inc at a valuation tied to its earnings, in a window that included the OP_RETURN fight. Nakamoto exercised the option.
Readers were not consistently told about these commercial relationships.
A documented investigation into the commercial interests and media infrastructure surrounding the Bitcoin Core controversy.
citadel21.com/the-machine

www.citadel21.com The Machine — Citadel21

hodlonaut @hodlonaut 6h

NGU was never the beating heart of Bitcoin. It was always a side effect of people opting into something that could not be inflated, seized, censored, or politically allocated. Decentralization and unfuckwithability were the heart and the product; the price was the market’s delayed and ever increasing recognition of that product.

When the properties that made it unfuckwithable are no longer being defended, the downstream effect of NGU stops being reliable. Capital that once had to accept the hard constraints can now get a diluted version through centralized vehicles, while the base layer itself drifts toward the same political and economic capture it was built to escape.

hodlonaut @hodlonaut 2d

In 2020, Jeremy Rubin proposed “transaction sponsors,” a different approach to the fee-bumping problem than Zhao's TRUC later took on. His case for it: “the rough surface” of Core’s mempool policies left second-layer protocols “either vulnerable to attacks (such as transaction pinning) or must go through great amounts of careful protocol engineering to guard against known mempool attacks.”

In Feb 2022, when Gloria Zhao was floated as mempool maintainer, Rubin said on IRC: "glozow is currently one of the main people writing new mempool code, so her being a maintainer probably doesn't help much."

Lead maintainer laanwj: "that was exactly my point."

By June laanwj had changed his mind, and Zhao got the role. She went on to write TRUC's sibling eviction. That is where the recently disclosed High severity vulnerability (CVE-2025-62861) lived.

"oh great, exactly the kinda shit i've been warning about"

🤷‍♂️

my Verified account @JeremyRubin 4d

oh great, exactly the kinda shit i've been warning about
View quoted post on X

hodlonaut @hodlonaut 3d

The venerable @adam3us shitting on @LukeDashjr and Knots for not merging TRUC (that was just disclosed as having a High severity vulnerability)🤷‍♂️

"and @lukedashjr broke TRUC in knots because ... no sensible reason, some random pedantry."

"knots is blocking TRUC, the lightning pinning fix, but it has nothing to do with the data bucket (it's a special transaction pattern), but to do with @lukedashjr having a pedantic disagreement about the design..."

"And also @lukedashjr should stop being silly and stop blocking TRUC lightning pinning fixes."

"and for nonsensical reasons blocks TRUC lightning pinning attack fixes. wouldn't recommend running LN on knots"

Aged like fine wine... 👌

hodlonaut Verified account @hodlonaut 3d

Bitcoin Core just disclosed CVE-2025-62861, rated High severity: after a reorg, miners on 28.0 to 29.1 could be left unable to build valid blocks, and Core says it could be exploited. Fixed Oct 2025, disclosed now per policy.

The bug lived in TRUC (BIP 431), the mempool policy Gloria Zhao (glozow) proposed and championed, specifically inside the sibling-eviction logic she wrote in PR #29306.

Zhao went from a cold email by Chaincode's Adam Jonas in January 2020 to Brink's first fellow that December and to maintainer over mempool policy by July 2022. The area she was given primary authority over is where the bug lived.

The decisive ACKs and the merge came from the same informal network the CAPTURE series documents: Suhas Daftuar (Chaincode co-founder), Ava Chow (who backed Zhao's maintainership and merged the PR), and Greg Sanders (who later wrote the OP_RETURN uncap Zhao merged).

Nobody caught this bug, inside the network or out. But when social credit and authority are routed away from independent reviewers, and the same few people design, approve, merge and fix, there are fewer chances to catch the next one. TRUC added another layer of rules and exceptions so Lightning-style protocols can fee-bump more easily. Complexity for extra use cases is not free.

The CAPTURE series documents how an informal network of Chaincode Labs and Brink funders and organizers, including John Newbery and Adam Jonas, selectively funded and elevated certain developers, most notably Zhao, while grants, review attention and social credit were routed away from more experienced independent contributors such as Luke Dashjr, Vasil Dimov and Jon Atack.

Those decisions concentrated authority in a small overlapping group, which later exercised it in the policy changes culminating in the OP_RETURN uncap.

citadel21.com/the-network
citadel21.com/the-lever
citadel21.com/the-merge

View quoted post on X

hodlonaut @hodlonaut 3d

Bitcoin Core just disclosed CVE-2025-62861, rated High severity: after a reorg, miners on 28.0 to 29.1 could be left unable to build valid blocks, and Core says it could be exploited. Fixed Oct 2025, disclosed now per policy.

The bug lived in TRUC (BIP 431), the mempool policy Gloria Zhao (glozow) proposed and championed, specifically inside the sibling-eviction logic she wrote in PR #29306.

Zhao went from a cold email by Chaincode's Adam Jonas in January 2020 to Brink's first fellow that December and to maintainer over mempool policy by July 2022. The area she was given primary authority over is where the bug lived.

The decisive ACKs and the merge came from the same informal network the CAPTURE series documents: Suhas Daftuar (Chaincode co-founder), Ava Chow (who backed Zhao's maintainership and merged the PR), and Greg Sanders (who later wrote the OP_RETURN uncap Zhao merged).

Nobody caught this bug, inside the network or out. But when social credit and authority are routed away from independent reviewers, and the same few people design, approve, merge and fix, there are fewer chances to catch the next one. TRUC added another layer of rules and exceptions so Lightning-style protocols can fee-bump more easily. Complexity for extra use cases is not free.

The CAPTURE series documents how an informal network of Chaincode Labs and Brink funders and organizers, including John Newbery and Adam Jonas, selectively funded and elevated certain developers, most notably Zhao, while grants, review attention and social credit were routed away from more experienced independent contributors such as Luke Dashjr, Vasil Dimov and Jon Atack.

Those decisions concentrated authority in a small overlapping group, which later exercised it in the policy changes culminating in the OP_RETURN uncap.

citadel21.com/the-network
citadel21.com/the-lever
citadel21.com/the-merge

Bitcoin Core Project Verified account @bitcoincoreorg 4d

A new high severity advisory has been posted: bitcoincore.org/en/2026/11/10/…
View quoted post on X