Greetings Hackers!
Post your hackathon project as a reply in this thread! Whoever has the most sats by the end of the day will win the "Community Favorite" prize!
Please use the following format:
## [Project Name]
### Team:
• [Name 1] – [GitHub/Twitter/Nostr/etc.]
• [Name 2] – [GitHub/Twitter/Nostr/etc.]
• [Add more if needed]
### What We Built (1–3 sentences):
[Clear, direct description of your project. Include screenshots / videos if relevant]
### Stack:
[Bitcoin layer/primitives used, frameworks, languages, tools.]
### Submission:
[Link to loot submission]
### Repo:
[Link to GitHub/GitLab/etc.]
### Next Steps:
[What you’re improving, shipping next, or help you’re looking for.]
FYI the
###headings only work in posts. for comments using boldface is the replacement, or maybe nesting bulletslocalprobelocalprobe
Team:Team:
What We Built:What We Built:
If your browser (Firefox does; Chrome/Brave/Edge are ok) leaks that are running a Bitcoin node (mainnet/testnets) on the same machine as your browser, localprobe alerts you about it by showing a privacy alert when you visit a website. Currently, https://b10c.me does (test by running
bitcoind -regtestand visiting https://b10c.me). This leak might be used by e.g. advertisers to show you Bitcoin related ads.Stack:Stack:
plain JS
Submission:Submission:
https://loot.fund/hackathons/bitcoin-exploits-edition/applications/13
Repo:Repo:
https://gist.github.com/0xB10C/4e6b3d8394bb375323e887945091ead5
Next Steps:Next Steps:
Using the same technique, we can actually harm remote Bitcoin nodes by DDoSing them from the browser. I've been working on a demo of this.
MinesploitMinesploit
Team:Team:
What We Built:What We Built:
Security research framework for Bitcoin mining infrastructure. Hypothesis-first design: spin up a Stratum server, connect a real CPU miner, test your attack.
Example:
pool = StratumServer().start(); miner = CPUMiner(pool=pool).start();— now you're mining with real hashrate, ready to test your hypothesis.While stress-testing Stratum V2 we found an interesting bug regarding share accounting (responsible disclosure in progress 👀).
Stack:Stack:
Repo:Repo:
https://github.com/johnnyasantoss/minesploit
Next Steps:Next Steps:
Signal21Signal21
Team:Team:
What We Built:What We Built:
The exploit at bitcoin++ isn't code — it's your calendar. The 40HPW meme exists because the Bitcoin rabbit hole is real: podcasts, YouTube channels, meetup streams, RSS feeds. Signal21 exploits that exploit back. Configure your sources and topics once, pay 21 sats, and get a single AI-synthesized audio briefing — deduplicated, filtered to what you actually care about, streaming to your browser before it's even done generating. Time is the only non-renewable resource. We built the reclaim button.
Stack:Stack:
Submission:Submission:
https://loot.fund/hackathons/bitcoin-exploits-edition/application/create/new
Repo:Repo:
https://github.com/murdawkmedia/signal21
Next Steps:Next Steps:
looks like you and @murdawkmedia posted the same thing?
oh dang - double post. embarassing.
EnergySatsEnergySats
Team:Team:
• majoal0 – @majoal0What We Built (1–3 sentences):What We Built (1–3 sentences):
I built functional prototype that turns hotel and Airbnb energy savings into real Bitcoin. Guests earn satoshis for every appliance they keep off during their stay — paid out instantly via Lightning Network at check-out.
When a guest checks in through the app, a real-time energy savings meter starts running. Every appliance they choose to keep off — air conditioner, electric shower, TV, refrigerator — generates satoshis credited to their in-app balance.
At check-out, the guest withdraws their earned satoshis instantly via a Lightning Network payment — either by scanning a QR code from their wallet or pasting a BOLT11 invoice.
Stack:Stack:
Submission:Submission:
https://loot.fund/hackathons/bitcoin-exploits-edition/applications/24
Repo:Repo:
https://github.com/majoal0/EnergySats/
Next Steps:Next Steps:
I'm planning to support native Airbnb integration and IAMMETER. This way I'll have a scalable solution and production-ready product.
This is a pretty cool idea! I used to run an air bnb and I always hated it when people would leave the heater running even though they were out all day. Definitely saw it in my power bill. A way to incentivize them to pay attention would have been awesome!
So far this is a really cool idea
I like it simply for not using AI
Stealth — Bitcoin Wallet Privacy AnalyzerStealth — Bitcoin Wallet Privacy Analyzer
Team:Team:
• Breno Brito - https://github.com/brenorb - https://twitter.com/brenorb - brenorb@zaps.lol • LordBabuino - npub1dkpmrtcuqlngclt27ftd8yec3vrmmxsehkvq2l6uns64w4q656rqapwlwd - jorge.x7@gmail.com - x.com/JorgeSantanaDev • Miranda - https://x.com/_hsmiranda - https://github.com/hsmiranda - https://nosta.me/35f80bdae3821a833935fa43c4bdc41d34ff9e5695f6ae3fbb35d0d2406855c0 • Renato Britto - x.com/natobrittoWhat We Built (1–3 sentences):What We Built (1–3 sentences):
Stealth is a local, read-only privacy auditor for Bitcoin wallets that analyzes UTXOs and detects privacy vulnerabilities such as address reuse, clustering signals, dust linkage, and exchange-origin fingerprints. It surfaces institutional-grade privacy insights directly to users without requiring private keys or sending data to third parties. Users can import a descriptor and immediately see where and how their privacy is exposed, along with actionable recommendations on how to improve their privacy.
Stack:Stack:
Bitcoin primitives: descriptors, UTXOs, transaction graph analysis
Backend: Java, Python, Quartus
Frontend: React, TypeScript
Node integration: Bitcoin node backend
Architecture: local-first, read-only privacy analysis engine
Landing page: Shakespeare
Submission:Submission:
https://loot.fund/hackathons/bitcoin-exploits-edition/applications/8
Repo:Repo:
https://github.com/LORDBABUINO/stealth
Next Steps:Next Steps:
This seems like a very useful concept. I'm curious about how the age spread and behavioral fingerprint work. Cool to see people working on stuff like this.
When we spend an old UTXO with a new one, it's telling everyone you're an OG, which can mean you have lots of Bitcoin, for example.
A behavioral fingerprint pattern would be, for example, receiving $5k from your boss every 1st day of the month, at 2pm. This can leak that it's your salary when you spend it, it can review which company you work for depending on the privacy practices of your employer, and help an attacker to link your addresses, which otherwise, would be completely isolated.
deleted by author