▼Implementation Bugs, Not Just Exploits, Threaten Custody

Score history

Daily conviction score, 0 to 100. Higher means the thesis is more strongly corroborated.

Now 59 · -2 since Oct 9 · ranged 59 to 61

Showing the last few days. Unlock full score history.

Why the conviction moved

• Oct 5
  Strengthened +2

  The Bitcoin Core SIGHASH_SINGLE signing path could let an attacker redirect funds through a valid signature, with no key compromise. That is a signer-logic flaw, not a contract exploit, which is the separate custody-risk category this thesis tracks.

• Oct 2
  Strengthened +4

  Electrum patched a Lightning backup defect that left users with seed-phrase-derived Lightning keys and anchor channels unable to sweep balances after a remote channel close, and the fix only protects newly created exports, so existing backups must be replaced. This is a key-derivation and backup implementation error, not an exploit, that silently renders funds unrecoverable — the custody-risk class the thesis says keeps surfacing alongside contract hacks.

Showing the last 2 days. Unlock the full record.

Source trail

• Supporting · October 5, 2026

  Bitcoin Core closes a signing path that could let an attacker redirect a payment without stealing keys

  The Bitcoin Core SIGHASH_SINGLE signing path could let an attacker redirect funds through a valid signature, with no key compromise. That is a signer-logic flaw, not a contract exploit, which is the separate custody-risk category this thesis tracks.

  CryptoSlate

• Supporting · October 2, 2026

  Electrum Patches a Lightning Backup Flaw That Left Users Unable to Reclaim Funds After a Remote Channel Close

  Electrum patched a Lightning backup defect that left users with seed-phrase-derived Lightning keys and anchor channels unable to sweep balances after a remote channel close, and the fix only protects newly created exports, so existing backups must be replaced. This is a key-derivation and backup implementation error, not an exploit, that silently renders funds unrecoverable — the custody-risk class the thesis says keeps surfacing alongside contract hacks.

  CryptoSlate