Sats Well Spent
What doesn't kill us makes us stronger: providing support for the Red Team, strengthening open-source software, and building resilience in the agentic age.
Growing up, I had weekly or bi-weekly room checks.
Why?... I couldn’t tell you.
Asking a ten year old boy to keep his room clean is a futile exercise. Usually, I’d get a few minutes’ notice before the inspection… so into the closet everything went. Layer upon layer of junk, compressing like sediment, each level carbon-dated to the room check conducted days prior.
About once a month, the dreaded request would come: “Clean out your closet… we’re giving away anything you don’t need.” Every purge ended the same way: the wood-paneled Chrysler Town & Country minivan sagging under a hundred pounds of clothes, toys, and other unwanted stuff.
I’ve been told there are five love languages, but I’d argue there are at least six… my mom’s was cubic feet. She loved us in bulk… that’s how I thought of it, anyway. We lived in a house filled and refilled with things nobody asked for.
We weren’t ungrateful, but truthfully, all I needed at the time were my Pokémon cards, my Nintendo 64, and a few Lunchables.
The surplus always ended up just down the street, at the local Goodwill. After the 20th or so sacrificial closet ritual, I finally inquired about Goodwill’s business model and learned we were “donating” things to people who needed them more. We were helping a charity!
I was a skeptical ten year old… so questions were asked. “If we’re donating for free, why do they sell our stuff? Who is getting the money?”
Eventually, I learned the Goodwill execs running the “charity” were making hundreds of thousands of dollars a year. At the time, my entire financial world was begging for quarters to buy watermelon Airheads at the local pool. So, learning that someone was middlemanning my donated clothes for $500,000 a year felt like a betrayal. That's two million Airheads. Every year.
That broke something in me.
My vocabulary wasn’t vast at the time, but I had understood “charity” to mean giving to others, out of love, for nothing in return. This particular “charity” took my stuff, took my closet labor, sold both at a markup, and paid themselves first. That ruined the giving… for me at least.
I went on strike after that.
That childhood memory has stuck with me. The lessons I learned from that charity’s flaws became the principles OpenSats was built on.
Most FOSS projects start as passion projects. Small, niche tools built for small, niche needs. Every once in a while one of these tools is so valuable that it outgrows its humble origins and evolves into load-bearing infrastructure for entire ecosystems.
Downloads are free. Development and maintenance are not. More adoption leads to more feature requests, security fixes, and upkeep. In our increasingly AI-dominated landscape, issues and pull requests arrive automated and exponential. Demand from the code rises, but the supply of developers does not.
The tragedy in FOSS isn’t that the code disappears.
It’s that the person maintaining it does.
Many developers eventually leave their projects… not for something they love more, but for something that pays the bills. The highest bidders for their time are usually the companies that benefit most from open source and contribute the least to its survival. The worst actors acquire the people most qualified to build tools that could make them obsolete. Brain drain away from the most accessible, beneficial, and desperately needed projects.
That’s why OpenSats exists: to fight that brain drain and keep the best people building in the open.
When we started, we looked at the traditional charity model… the one that takes a cut, pays itself first, and forwards only what is leftover to the cause. We built something that can’t work that way.
OpenSats was built as a lean, 100% passthrough non-profit. Operations are funded separately, so we never take a percentage of the donations intended for developers. Most charities skim 15-30% of donations for operations. We take nothing. Every bit of every donation to our open-source funds goes to our grantees.
We also wanted no single points of failure and no concentrated power. No benevolent dictator. Every important decision is made by a nine-person board of unpaid volunteers. We structured the whole organization so no individual has undue influence, and to prevent the kind of self-dealing that once broke my trust in my local Goodwill.
I’m proud of what our grantees have built, everyone who has contributed, and the organization we’ve put together.
The purpose of life is to discover your gift. The work of life is to develop it. The meaning of life is to give your gift away.
— David Viscott
That’s what FOSS developers do every day.
Our job is to make sure they can keep doing it.
— Ben Price
Founder of OpenSats
Rooted in Resilience
For most people, October 31 is a day for dressing up and trick-or-treating. For bitcoiners, it's Whitepaper Day: the day that Satoshi Nakamoto introduced Bitcoin to the world. He summarized his invention in a single line: "a new electronic cash system that's fully peer-to-peer, with no trusted third party." In the whitepaper, he went on to describe the benefits of such a system: "A purely peer-to-peer version of electronic cash would allow online payments to be sent directly from one party to another without going through a financial institution."
Money that you can send from one computer to another, without going through any institution—without relying on trust. Bitcoin is resilient precisely because it doesn't rely on trusted third parties. Its design avoids central points of failure, making it an anti-fragile network, not unlike the mycelial networks we know from the natural world.
Briefly, and non-technically, Bitcoin is the first example of a new form of life. It lives and breathes on the internet. […] It lives because anyone, anywhere, can run a copy of its code. […] It lives because if any one copy is corrupted it is discarded, quickly and without any fuss or muss.
— Ralph Merkle
While we will never be able to be as anti-fragile as the Bitcoin network is, OpenSats strives to be as resilient as an organization can be. Our large board and passthrough commitment are a testament to that, as our founder mentioned above. The goal is to support our grantees for the long term in a sustainable way, which is why recurring donations are vital to what we do. So if you have a minute to set up a recurring donation, please consider doing so.
Visit our funds page to learn more about our various funds and their respective purposes. You can donate directly in bitcoin, by wire transfer, or through a donor-advised fund (DAF).
Thank you.
Code Red: All Hands on Deck
A smooth sea never made a skilled sailor, or so the saying goes. One of the criticisms leveled at Bitcoin was that it is too boring. The institutions are here. Bitcoin is gradually being adopted as an asset. Ergo, nothing exciting is happening. Calm seas. Smooth sailing.
The weather changed at the end of July, and the smooth sea turned into a maelstrom in the aftermath of vulnerabilities found by kimi-k3 and friends. As mentioned in one of our blog posts, parts of our infrastructure were exposed to these vulnerabilities as well, prompting us to take action to protect donor and grantee funds. As people started red teaming Bitcoin software and racking up costs, the OpenSats board decided to launch a new fund and grant program as a response: the Red Team fund and token reimbursement for red-teaming, respectively. Our job is to send sats to where they're needed most, which is why we decided to help those that are already helping. We announced the first round of grants shortly after, and have been evaluating security-related grant applications ever since.
While it was devastating to watch wallets of fellow bitcoiners being drained, it was at the same time inspiring to see so many people come together to fight the various fires and do everything in their power to make sure that users' funds are safe. As our founder mentioned in his letter above, OpenSats is purpose-built to weather storms like these: no benevolent dictator, no single point of failure.
Sending sats directly to the people we fund—via the Bitcoin network, with no intermediaries—is what makes operating at our scale possible in the first place. In the last couple of months we gave grants to people in Bangladesh, Kenya, Cameroon, Liberia, Albania, Singapore, and Paraguay, just to name a few. Bitcoin truly is a global movement, as a glance at the map of OpenSats grantees shows.
In total, OpenSats has allocated $21,646,000 USD to free and open-source projects and sent ~24.6 billion sats to 252 grantees in 40 countries.
Sats Sent
Even with all these exploits going on, Bitcoin continues to function, unbothered. Every 10 minutes a new block is found. Every 10 minutes transactions are settled. Efficient, permissionless, trustless.
In Q3 2026, OpenSats sent over 33 BTC, equivalent to over $2.2 million, to support open-source work. The transaction fees for these payouts were 26,599 sats, or $19.09. We paid the equivalent of 0.0008% in transaction fees. The unfailing operation of the Bitcoin network is what makes our work possible.
In Q3, July was our strongest month in terms of payouts, with 1,273,064,984 sats sent, followed by August and September with 1,115,030,189 sats and 937,341,097 sats respectively.
In total, we sent 3,325,436,270 sats during the quarter, equivalent to $2,220,911.53. The Red Team Fund awarded $209,500 in grants and paid out $10,233 in Q3. Some grants awarded in Q3 are being paid out in Q4.
Have a look at our Q3 financial statements for the fund breakdown, visit our transparency page for more reports, or browse our project pages to see how many sats each listed project has received in total.
Spotlight: Stories Worth Telling
Two of this quarter's spotlights highlight work directly related to the red teaming efforts mentioned above.
What makes Bitcoin really interesting is that it does not rely only on technical mechanisms to make the system work. It also relies on incentives.
Bruno uses fuzzing and AI tools to find vulnerabilities.
So my interest in open source grew pretty naturally out of my interest in privacy.
Daniela helps get vulnerability reports to the teams that can address them.
Our other two spotlights explore access to data and the tools developers use to collaborate.
Partly out of spite, I made it my quest to offer as much on-chain data as I could to as many people as possible, for free, forever.
nym21 built free Bitcoin analytics out of spite, and made them so good that the professionals who charge for the same data quietly started using his.
Read the full series on our blog.
Heartbeat: Proof of Work
When we announced OpenSats Heartbeat six months ago, it was mostly focused on GitHub activity. Thanks to Dan Conway's work featured above, this is not the case anymore. Heartbeat now supports ngit/GRASP natively, in addition to other nostr activity. We also launched the PoW feature, which summarizes a developer's activity across time.
It is worth pointing out that ngit/GRASP isn't another platform, but a protocol-based alternative. In other words: an alternative that doesn't have a single point of failure. As nostr-native git systems mature, we are seeing an increasing number of developers opting into this particular GitHub alternative, fiatjaf among them:
Software Shipped
This quarter our grantees shipped more security updates than we can count, implemented wallet recovery improvements, and wrote plenty of tests to make sure that their software is as solid as it can be. Some highlights:
- BTCPay Server: Following August's security incident, Version 2.4.4 strengthened permissions around invoices, API keys, and administration. Docker deployments also restricted the application's access to its host.
- Cove: Version 1.3.0 added encrypted cloud backups using passkeys and progressive scanning, letting users access their wallets while discovery continues.
- Amber: The nostr signer shipped v6.5.0 with fixes for authorization and replay protection, encryption of connection secrets at rest, and removal of key material from logs and crash reports.
Work on libraries, node software, and testing continued too:
Bitcoinfuzz expanded its differential testing to complete MuSig2 signing sessions and block validation across Bitcoin Kernel bindings.
Utreexod gained a separate proof store and the ability to serve proofs while still syncing.
Nutshell, a Cashu mint implementation, added scheduled mutation testing to check whether its tests catch deliberately introduced defects.
Cashu wallet recovery: CDK removed network calls from wallet repository startup, allowing wallets to initialize from saved mint information. The native Cashu wallet also improved partial iCloud restores: users can open a recovered wallet even if one mint is unavailable.
Citrine, a local relay for Android, shipped v3.2.0 with streamed query results and memory limits to address out-of-memory crashes.
Have a look at OpenSats Heartbeat to follow releases, commits, and pull requests across the projects we support.
View HeartbeatHighlights from Our LTS Grantees
Our long-term support grantees contribute across projects. Here are a few highlights from their Q3 work, plus an October milestone:
Calle: Alongside his Cashu work, Calle contributed to Bitchat for Android. The 2.0.1 release added a standalone Wear OS client and live push-to-talk, and was its first reproducible full-app release. In October, Bitchat reached #1 among social apps in the French App Store on October 22, followed by #1 among all free apps on October 24, ahead of Claude, Gemini, and ChatGPT.
Jason Donenfeld: In cgit, the code browser used by git.kernel.org, a September change to syntax highlighting moved that work into the browser, reducing server load amid heavy AI crawler traffic.
0xB10c: During August's BIP-110 fork, b10c connected more than 50 nodes to fork-observer and livestreamed what happened, showing which chain tips mining pools were building on. He also improved the tool's handling of traffic spikes.
Marco Falke: Alongside Bitcoin Core review and testing work, Marco contributed a workaround for a macOS linker bug in September, while testing uncovered an unsafe memory race during test shutdown that was fixed earlier that month.
Looking Ahead
Since Q3 ended, we've announced new grants and recurring support for the work ahead:
- Supporting the Foundations of Bitcoin Development: Four new grants and one renewal support Bitcoin Core development, testing, and review.
- Finding Vulnerabilities, Funding Defenders: Our first Red Team grants help five researchers cover AI token costs for Bitcoin security work.
- Long-Term Support for l0rinc: Sustained support for his work on Bitcoin Core performance, maintenance, and review.
- Recurring Donation from Strive: We received the first donation under Strive's monthly commitment to the Red Team Fund.
Built for the Long Term
Operationally speaking, 2026-Q3 was one of the roughest quarters for OpenSats. Navigating a sea of vulnerabilities while running an organization that is built upon open-source software and infrastructure—infrastructure that is being attacked without pause—has been challenging.
We want OpenSats to be as resilient as possible, which is why we rely on a wide array of people to provide input and make decisions about funding and organizational changes.
Speaking of changes: we believe that our grant programs must adapt to the new reality being shaped by agentic systems. Coding agents can be an accelerant if they are wielded with expertise and care. High-agency people can now do more, build more, and move the needle more than ever. We want to support those people as best as we can, and we want to make sure that highly motivated people have the means to work on freedom tech for the long term. We'll share more thoughts on this topic in an upcoming blog post.
The mission of OpenSats remains the same: support and maintain a sustainable ecosystem of funding for free and open-source projects and contributors, especially Bitcoin-related projects and projects that help Bitcoin flourish. Sustainability implies resilience; anything that isn't resilient to change (or attack, for that matter) won't be around for the long term. To make sure that we will be, one of our main focus points in Q4 will be working towards more resilience across the board: more recurring funding, more experts joining our evaluation committees, less reliance on third-party systems, as well as more redundancy and fault tolerance.
The Great Hardening
It seems that new vulnerabilities are being found and exploited every day right now. Software that has been audited by hundreds, even thousands of people. Software that has been around for decades; software that most of the internet relies upon.
Finding vulnerabilities is painful. However, you can't fix what you haven't found, so from an open-source ecosystem perspective, all these exploits will eventually, hopefully, leave us with stronger software, better testing, and more resilient systems. Yes, right now it's mayhem out there. But the only way out is through, or, as the saying goes: "If you're going through hell, keep going."
Developers and security researchers who are red-teaming Bitcoin software are at the forefront of this battle. We want to do what we can to support them through our Red Team Fund.
We appreciate your support and are grateful that you are on this journey with us. Once more: if you have a minute to set up a recurring donation, please consider doing so:
This is the third issue of Sats Well Spent. You can read our previous issues for 2026-Q1 and 2026-Q2. If you'd like the next issue delivered to your inbox, subscribe below.
Subscribe to our Newsletter
Quarterly updates on grantee highlights and the impact your support enables.
No spam. Unsubscribe anytime.