Skip to content

Invest1 publisher3 min readPublished

Peter Todd takes over the MARA channel that carried more than 9,000 BTC past the public mempool

Peter Todd, co-author of Bitcoin's replace-by-fee standard, now leads MARA's Slipstream, a private channel that moved over 9,000 BTC from vulnerable wallets. With two documented uses on record, both where public relay was risky or failed, the evidence that private routing is becoming a routine miner fee business is still thin.

The Investor · Invest desk

Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction

Photograph accompanying Peter Todd takes over the MARA channel that carried more than 9,000 BTC past the public mempool
Photo: mara.com

What happened

  • MARA launched Slipstream in February 2024 to carry large or non-standard Bitcoin transactions to MARA Pool outside the public peer-to-peer network.
  • A July 2026 Coldcard advisory said firmware from 2021 to July 2026 may have generated weak entropy and urged affected users to move funds on-chain immediately.
  • A recovery spend exposing a multisig script could sit unconfirmed long enough for an attacker to see it and broadcast a competing transaction with a higher fee.
  • StarkWare's first quantum-safe Bitcoin transaction failed to go through the standard mempool route and reached mainnet via Slipstream.
  • Before Slipstream, Todd built Libre Relay, a modified version of Bitcoin Core with relaxed relay rules.

Compiled by The InvestorSomething wrong?How this is made

Why it matters

  • cost Senders trade speed for privacy: a Slipstream transaction confirms only when MARA Pool finds a block, however long that takes.
  • precedent A pool that can recruit a Bitcoin Core developer of Todd's standing gives rival pools a template for staffing private submission channels of their own.
  • decision Wallet makers facing a key-exposure flaw now have a tested private route for recovery spends to weigh against broadcasting them publicly.

Only MARA's miners can confirm a transaction sent through Slipstream. The service routes it to MARA Pool alone [2], and Todd, quoted by Bitcoin Magazine, said it promises to keep transactions "secret until they're already in a block" [9]. No other pool sees the transaction, so none can compete for its fee. Cryptopolitan's report does not include Slipstream's fee schedule, its transaction count or MARA Pool's share of hashrate.

Bitcoin's relay policy is separate from its consensus rules [5]. According to the Bitcoin Core documentation, relay policy is a set of additional, locally configurable rules that nodes impose on unconfirmed transactions before accepting them into their mempools [5]. Once a transaction is in a block, those rules no longer apply [5]. A transaction can therefore be valid and still fail to reach a miner. StarkWare's quantum-safe test sat in that gap until Slipstream carried it [12].

Todd has now built both kinds of route around default policy. Libre Relay loosens the rules for any node operator who chooses to run it [6]. Slipstream grants the exception inside one pool, and the fee stays with that pool [2].

Coldcard added a second use, secrecy, to the original one of getting large or non-standard transactions mined [4][7]. Slipstream had been running for about 29 months when the advisory came out [1]. "If you've already reused addresses, this isn't relevant, and you should just try to move your funds ASAP. But if you haven't, MARA may be able to help," Todd said, according to Bitcoin Magazine [10]. On X he wrote that "it's really interesting how Slipstream was useful during the coldcard hack" [13].

The channel could go several ways from here. It could stay an emergency and testing route, used when a wallet flaw or an unusual script makes public broadcast risky or impossible, with fee income too small to matter to MARA. Pools could instead compete for private flow, with fees on sensitive and non-standard transactions going to whoever pairs hashrate with a maintainer users trust. Or Bitcoin Core's default relay rules could move toward what Libre Relay already allows [6], leaving private routing mostly for secrecy cases like Coldcard's.

I think the first fits the record best. Cryptopolitan's report says private mempools are gaining ground and that fee revenue and miner control over blockspace are becoming more central to how Bitcoin is secured [14]. The documented cases behind that claim are one wallet rescue and one experimental transaction [11][12]. The strongest counter-case is the size of the rescue: a channel that moved more than 9,000 BTC in a single incident [11] has shown real demand whenever public broadcast is dangerous. If MARA publishes volume data showing steady Slipstream traffic outside emergencies, my view is wrong.

What to watch

  • Todd's short talk on private mempools at TABConf, the first account from the channel's maintainer of how it handles transactions public nodes refuse to relay.
  • A second wallet-key flaw on the scale of Coldcard's, and whether its recovery spends go through Slipstream or through private channels run by rival pools.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories