WEDNESDAY, MAY13
1. AI zero-day in the wild, 2. LDK ships Lightning server, 3. Block/Spiral launch bitcoin scanner, 4. Number Go Down
From Proto and Bitkey - part of the Bitcoin ecosystem at Block, Inc.
1. threat
Google’s Threat Intelligence Group (GTIG) has identified what it believes is the first confirmed real-world case of a threat actor using an AI-developed zero-day exploit in an active attack campaign. According to GTIG’s latest AI threat report, a prominent cybercrime group used an AI model to discover and weaponize a 2FA bypass vulnerability in a widely used open-source web administration tool, encoding the exploit as a Python script targeting a hard-coded trust exception in the authentication flow. GTIG worked with the unnamed vendor to responsibly disclose and patch the flaw before the group could execute what appeared to be a planned mass-exploitation event. Google stated it has “high confidence that the actor likely leveraged an AI model to support the discovery.” John Hultquist, chief analyst at GTIG, called it “the tip of the iceberg,” noting that frontier LLMs are particularly effective at finding high-level logic flaws that traditional static analysis tools miss. The case marks a concrete shift from theoretical concern to documented capability. AI is now an active ingredient in offensive security operations.
-EDITOR·OP_DAILY2. daemon
Lightning Dev Kit has released a production-grade Lightning node daemon for servers, packaging the same infrastructure that powers Cash App, Square, Lightspark, Lexe, and Alby into a single deployable unit any operator can run. The announcement from LDK contributor Ben Carman describes the daemon as ready to test today, with LDK noting the server is “in preview” and inviting bug reports and feature requests. The feature set is substantial: BOLT 12 offers, splicing, zero-fee commitments, async payments, and built-in Lightning Service Provider support via LSPS2, with LSPS5 webhook notifications queued for a future release. Operators get Postgres, Docker, Prometheus, Tor, and gRPC out of the box, and the node runs without a full bitcoin node using esplora, electrum, or Rapid Gossip Sync. A standout addition is a built-in MCP server enabling AI agents to manage node operations directly. The release marks a meaningful shift from LDK as a developer library toward a turnkey server deployment, lowering the barrier for any team that wants self-custodial Lightning infrastructure without building the stack from scratch.
-EDITOR·OP_DAILY3. loupe
Block and Spiral have launched Loupe, a free AI-powered vulnerability scanning service for open-source bitcoin projects, designed to close the security gap between well-resourced attackers and often under-staffed open-source maintainers. Writing on the Spiral blog, the team frames the tool as a response to a structural asymmetry: “attackers can also use these tools to identify weaknesses, while many open-source bitcoin maintainers do not have the time or tools to do the same.” Loupe runs against public repositories and only surfaces findings backed by a demonstrable test case, a deliberate design choice meant to avoid flooding maintainers with low-quality AI-generated noise. Bitcoin Core, BDK, LDK, rust-bitcoin, Cashu, Blockstream Jade, bitcoinj, and SRI have already committed to initial testing. The roadmap hands control progressively to each project’s own maintainers, with Block and Spiral funding scans in the interim. Users can run their own scans by supplying their own model access and tokens. The project is model-agnostic by design, planning a tailored software layer on top of frontier LLMs to stay current as the model landscape shifts.
-EDITOR·OP_DAILY4. deflation
Allen Farrington and Sacha Meyers have published a new essay arguing that price deflation is not an economic pathology to be managed but the natural and necessary result of free capital markets and entrepreneurial innovation. Writing in a piece titled “Number Go Down,” the authors contend that the standard fiat fear of deflation conflates two entirely distinct phenomena: “good deflation,” which follows when entrepreneurs discover cheaper ways to produce, and “bad deflation,” which is a symptom of credit unwind and balance-sheet collapse. “The fiat economist cannot distinguish between them,” they write, “and so concludes that economic progress itself is a systemic danger.” The essay traces how the widely accepted 2 percent inflation target was, by the New Zealand central banker’s own admission, “plucked out the air to influence the public’s expectations.” Farrington and Meyers argue that sound money does not produce deflationary money but rather a monetary base that allows productivity gains to appear as rising purchasing power instead of being confiscated through dilution. The essay is slated to appear as a new chapter in a second edition of Bitcoin Is Venice, planned for publication in 2027.
-EDITOR·OP_DAILYConsider subscribing and sharing OP_Daily with your community.