r/Monero

Cześć! 🇵🇱

Thanks to Cake Wallet we're organising a meetup in Kraków 🇵🇱 this Friday!
Join us for bowling 🎳, pool 🎱 and a chat about Monero 🧡

Meetup is taking place in Forum - the chosen venue for MoneroKon 7

Sign ups:
OrangeFren.com/event/101
Meetup.com/cake-wallet-meetup-in-monerokon-7-venue/events/316150487

MAGIC Grants contracted Trail of Bits, a leading cybersecurity and research firm, to audit certain cryptography for Monero's forthcoming FCMP++ upgrade. This upgrade will substantially increase the privacy of Monero transactions.

> FCMP++ is short for "Full Chain Membership Proofs + Spend Authorization + Linkability."

MAGIC Grants has assisted the Monero community with a number of security reviews, both for and outside of the Monero FCMP++ upgrade. Trail of Bits was selected for this project through a competitive bidding process.

The Trail of Bits audit was prepared by Joe Doyle under the direction of Jim Miller, Engineering Director, Application Security and Cryptography.

The review consisted of two engineer-weeks of effort. Doyle's efforts primarily involved reviewing incremental modifications to the Monero cryptography core libraries.

Doyle found that the changes made are focused and appear to be correct, though he suggested a larger test suite and better documentation. The review produced six informational findings. Zero high, medium, and low-severity findings were discovered.

Five of these findings have been resolved, and one of these has been partially resolved.

The partially resolved finding concerns fragile memory layout assumptions in a Rust FFI function. Compile-time static assertions have been added to safeguard the FFI interface, though Trail of Bits says that the interface itself remains fragile.

Further information on all six findings and their resolutions are available in the public audit report.

MAGIC Grants would like to thank Trail of Bits for their detailed review of this project, We would like to thank Justin Berman for their efforts in developing Monero and selecting the appropriate audit scope. Finally, we would like to thank the Monero community donors for funding this audit.

Read the Audit Report

This is related to the FCMP++ Integration Audit CCS.

Link to the original MAGIC Grants post.

I forked the original monero well maintained core (wallet2) and cuprate Node. I optimized network throughput and scanning algorithm. Combined with an easy to use approach to make monero accessible to the masses. Strong already established core and new easy to use frontend.

# Increased speed, privacy (Tor for everything excluded block sync)

# Monero registry. Secure your name like bob.mfw on monero Blockchain with MFW Registry.

# Monero Enthusiast - community listings to get connected.

# MFN - Monero Fast Node. Optimized cuprate fork with more features.

The app will be released for Android, iOS, Windows, Mac and Linux. Fully open source including multiple features. Checkout more here: https://xmr.tex8.com

Thanks to all early supporters for this project. Working on miner optimization and vanity address service. (Will be open source as well)

Start with the wrench, end with a map of whoever owns crypto. Things could not be more bearish for French hodlers. There's an old joke in crypto security: you can encrypt your keys with a password so strong that a supercomputer would take a billion years to crack it, and none of it matters, because a criminal with a five-dollar wrench and your home address will get the password in about ninety seconds. Looks like this stopped being funny in France.

A French tax official, with legitimate access to the government's financial records, allegedly stole files on the country's wealthy crypto holders. Names. Home addresses. Phone numbers. And crucially, how much each person held. Then they sold it. A second breach, from a crypto tax firm called Waltio, leaked roughly 50,000 more user records in January. Somewhere out there, criminal groups bought these lists, and what they were holding was essentially a shopping catalog: here is a person, here is where they sleep, here is exactly how much it's worth to break into their house.

Before 2025, France averaged fewer than one of these violent attacks a month. In 2025 it climbed to 1.9 a month. In the first half of 2026 it hit 4.6 a month, one attack roughly every six days. Chainalysis puts the global haul from violent crypto robberies at $30 million so far this year, and France has become the epicenter of it. Not because France has the most crypto. Because someone handed the criminals a map.

In one case near Brest, armed men arrived at a family home at nine in the morning. The father, the one who actually worked in crypto, wasn't there. So they isolated the two young children in a separate room, tied and gagged the mother and both grandparents, and threatened to cut off the mother's finger until she unlocked the wallet and transferred 700,000 euros. A neighbor noticed something wrong and called police three and a half hours later. In earlier French cases, captors did sever fingers before the ransom arrived. The president of Binance France had three hooded men try to storm his home; they hit the wrong address and injured a woman who lived there instead.

This is the self-custody dream colliding head-on with physical reality, and the crypto world has been remarkably quiet about the collision because it undercuts the whole pitch. "Be your own bank" sounds like freedom right up until you realize that a bank has a vault, armed guards, insurance, and no clerk whose personal home address is attached to the contents. When you are your own bank, YOU are the vault, and the vault sleeps in an unguarded house with its family. The entire value proposition of holding your own keys, that no institution can freeze or seize your money, is the exact same property that makes a wrench so effective: there's no fraud department to call, no chargeback, no reversal. Once it's transferred under duress, it's gone forever, and everyone knows it, which is precisely why the coercion works.

And the France angle exposes the deeper trap. The government created this catastrophe by demanding crypto holders disclose their holdings for tax purposes, then failing to secure the list, then, remarkably, advancing a law that would require even more disclosure of self-custodied wallets. The tax agency itself warned that centralizing this data would create "a prime target for hackers." They were right. They did it anyway. So holders are now squeezed from both sides: disclose your wealth to a state that can't protect the data, and become a target, or don't, and become a criminal.

We spent fifteen years optimizing against digital threats and building a world where the cheapest attack is a physical one. France just showed everyone the blueprint, and the wrench isn't a joke anymore.

Apple pay, bank transfer, cash by mail, cash in person and more ways to now get monero

We’ve had people test it and no issues so we are now the first directory to have it listed.

You see it all first on xmrhub.org🥂

https://xmrhub.org/account/listing.html?slug=chicksx

With the whole Coldcard thing, I've been reevaluating my setup and felt it was worth redoing everything for peace of mind but I didn't want to make the same mistake of remaining uninformed and placing my trust in some random seed generation code. So I went ahead and built my own from the ground up.

Full transparency, I used AI, but it was all built one thing at a time, with extensive testing at each step in the process to ensure functionality, and I audited/verified the cryptographic flow each time any part of it was touched. I loathe AI slop and the last thing I want to do is contribute to the living nightmare that now is, so I was very careful to ensure everything was correct and functional.

It uses the Linux CSPRNG to produce 256bits of system entropy, with the option to use purely manual entropy via flipping coins, rolling dice or drawing from a deck of cards. There's also a mixed entropy mode that combines manual entropy with fresh CSPRNG output. Once entropy has been generated/entered, it generates a 25-word Monero seed, primary address and the corresponding public/private keys. It's also capable of verifying an existing seed or private spend key, deriving and displaying the same wallet information so it can be checked independently. It doesn't connect to the blockchain, store wallets, or sign transactions - it boots into an initramfs environment, doesn't mount persistent storage for writing, and the wallet secrets only exist in RAM during the session.

I designed it specifically for a Raspberry Pi Zero W (purely because that's all I could get my hands on due to shortages) and the 1.44" 128x128 Waveshare LCD/button HAT, so just a pre-warning that compatibility with other boards/displays is likely not good, and as the Zero W's radios kinda go directly against the whole purpose of an air-gapped device, Wi-Fi/Bluetooth are disabled through the boot configuration, their firmware blobs aren't included in the production image, and there's a runtime check that prevents wallet generation if an unexpected active network interface is detected. A non-wireless Pi Zero 1.3 is definitely the better hardware choice but I figured this is at least a sufficient solution while we wait for the rampocalypse to blow over.

I've tested it in both directions: generated a wallet on the device and restored it in Monero GUI, then generated a wallet in Monero GUI and entered that seed + private spend key into the device to verify - addresses and keys matched. I won't claim that I've mathematically proven the entire device "unhackable" because I haven't, but I will say that I've done my best to make sure it does what it's supposed to correctly with no funny business. The physical randomness assumptions, Linux CSPRNG, hardware/boot chain etc are still assumptions/trust boundaries, which I've tried my best to document.

Anyway, all that to say, the project got way more serious than the little weekend paper-wallet generator I originally intended to make, so figured why not clean up the codebase and release it as others might find it helpful, useful or interesting to dig into. I've uploaded the source code to GitHub, along with a ready-to-flash build to the releases page. I'd absolutely love any and all feedback!

Hey everyone! I hope you are doing well. I just got back from DEFCON and it got me thinking about Monero and privacy. And it started with, how can I make Monero easier to use, send, work with, etc. I wanted it to be like tap-2-pay, or Venmo/PayPal, so I built DUCAT. Currently an Android client. https://github.com/karazajac/ducat as a way to do this. Its built using thr Veilid network (http://veilid.com/) so its p2p and private. I am also sharing early for feedback as its still on beta and only working with stagenet!

**DO NOT SENT REAL MONERO TO THE WALLETS CREATED HERE**

Eventually it will move to main, also the ability to link your cold wallet to transfer funds, but it should be viewed as a hot wallet for day to day activity.

Finally, while it normally works like Venmo, it also has a robust chat and different modes you can put the app into. Point of Sale, Taxi, Bar Tab, and Donate. Which will more or less do what they say as a way for small businesses to use.

Check it out and please let me know if this is something you would use.