River

Bitcoin Red

Bitcoin

Better

On Monday, <a href="https://coinmarketcap.com/currencies/bitcoin/" rel="noopener noreferrer nofollow">Bitcoin</a> hardly shifted at all and was traded around the figure of $64,000; meanwhile, supporters of BTCPay Server promised a <a href="https://x.com/BtcpayServer/status/2086875600103367109" rel="noopener noreferrer nofollow">bounty of up to 3 BTC</a> to recover stolen funds that resulted from a critical weakness in the open-source payment software.The lack of enthusiasm means that traders likely view the event as a threat to merchants and Lightning users but not to Bitcoin. The market value of Bitcoin was estimated to be $1.28 trillion, and it had experienced a drop of approximately half a percent according to CoinMarketCap. The hack influenced software built on top of Bitcoin rather than the network itself.<h3 class="wp-block-heading" id="strong-prices-held-while-some-lightning-nodes-drained-strong">Prices held while some Lightning nodes drained</h3>On August 7, BTCPay Server revealed that the <a href="https://x.com/BtcpayServer/status/2085755643659522240" rel="noopener noreferrer nofollow">vulnerability</a> was actively being abused and encouraged its users to upgrade to version 2.4.2 or stop their servers until they have a chance to fix the problem. Among the users who reported that their Lightning nodes were attacked were <a href="https://x.com/zherbert/status/2085788368365875378" rel="noopener noreferrer nofollow">Foundation</a> and <a href="https://x.com/hodlonaut/status/2085784250293317636" rel="noopener noreferrer nofollow">Citadel21</a>. However, BTCPay did not provide the total amount of loss or the number of affected nodes.The project said its own onchain wallets, including hot wallets, were not affected. Instead, attackers could obtain <a href="https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/" rel="noopener noreferrer nofollow">LND administrator macaroon credentials</a> from vulnerable BTCPay instances and use them to control connected Lightning wallets.<h3 class="wp-block-heading" id="strong-backers-put-up-10-of-anything-recovered-strong">Backers put up 10% of anything recovered</h3>To help victims recover their funds, BTCPay supporters pledged a <a href="https://x.com/BtcpayServer/status/2086875600103367109" rel="noopener noreferrer nofollow">bounty</a> worth 10% of any stolen funds recovered, capped at 3 BTC if the full amount is returned.The BTCPay Server Foundation is also donating 0.21 BTC each to security researcher Craig Raw and the Bitcoin Red Team fund for discovering and privately reporting the vulnerability. Raw, the developer of Sparrow Wallet, said he was among those affected.<h3 class="wp-block-heading" id="strong-what-the-macaroon-flaw-lets-attackers-do-strong">What the macaroon flaw lets attackers do</h3>All BTCPay Server versions before <a href="https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/" rel="noopener noreferrer nofollow">2.4.2</a>, including release candidates for that version, were vulnerable to the LND credential risk. BTCPay has not publicly assigned a CVE identifier to the incident.The macaroon is a type of authentication credential used by LND to authorize API access. The vulnerabilities allowed malicious users to obtain the LND administrator macaroon from an impacted server, giving them control over the linked Lightning node and wallets.The mechanism to update should be accessed through the Admin Dashboard → Server → Maintenance → Update, where the operators will be able to check if the footer reads 2.4.2. If they are unable to conduct the update right away, BTCPay suggests turning off the server.Merely applying the patches may not be sufficient. Operators must refresh their Lightning credentials and macaroons since already stolen credentials may still be valid. Per the <a href="https://docs.lightning.engineering/lightning-network-tools/lnd/macaroons" rel="noopener noreferrer nofollow">LND documentation</a>, deletion of the macaroon files does not render the previously issued credentials invalid – the macaroon database must also be replaced.Version 2.4.2 also addressed a separate <a href="https://github.com/btcpayserver/btcpayserver/pull/7491" rel="noopener noreferrer nofollow">TOTP two-factor authentication bypass</a> via Greenfield Basic Authentication that was reported on August 4. However, this situation is unrelated to the LND flaw currently being exploited.<h3 class="wp-block-heading" id="strong-why-the-surrounding-software-is-the-soft-spot-strong">Why the surrounding software is the soft spot</h3>This incident is mainly an infrastructure issue since the defect in question relates to the <a href="https://www.cryptopolitan.com/btcpay-emergency-patch-exposes-merchant-side-bitcoin-security-risk/" rel="noopener noreferrer nofollow">application layer of BTCPay</a>, rather than to the consensus rules or cryptography that Bitcoin relies on. As a result, the Bitcoin network continued to operate without any issues.A sizeable footprint still exists. BuiltWith specifies that <a href="https://trends.builtwith.com/payment/BTCPay-Server" rel="noopener noreferrer nofollow">248 websites</a> have used BTCPay Server at various times, including 74 currently operational websites, though such measurements do not include private installations.Meanwhile, 1ML has reported there are about 5,585 <a href="https://1ml.com/statistics" rel="noopener noreferrer nofollow">active Lightning nodes</a> at the moment, and the total amount of BTC available in them is approximately 2,640 BTC. River claims that <a href="https://river.com/content/bitcoin-adoption-2026" rel="noopener noreferrer nofollow">Bitcoin adoption</a> by merchants has increased by 74% in 2025, with the monthly transactions made in the Lightning Network reaching over $1 billion.<h3 class="wp-block-heading" id="strong-ai-on-both-sides-of-the-exploit-strong">AI on both sides of the exploit</h3>BTCPay said the incident also highlights how AI is changing <a href="https://x.com/BtcpayServer/status/2086875402572562755" rel="noopener noreferrer nofollow">software security</a>. Better AI-assisted code analysis can help defenders find vulnerabilities faster, but it can also lower the cost for attackers to examine large open-source codebases.That concern extends beyond payment software. The recent Coldcard breach drained roughly 1,816 BTC from more than 5,200 addresses, with the fallout extending beyond the stolen funds as the company temporarily changed its <a href="https://www.cryptopolitan.com/coldcard-overhauls-data-retention-policy/" rel="noopener noreferrer nofollow">data-retention practices</a>.Chainalysis has also warned that AI-assisted analysis and easier <a href="https://www.chainalysis.com/blog/attackers-exploiting-unverified-smart-contracts/" rel="noopener noreferrer nofollow">smart-contract decompilation</a> could make attacks against poorly scrutinized code easier to scale.For Bitcoin infrastructure, the lesson is broader than any single bug: AI can accelerate vulnerability discovery, but successful attacks can have consequences far beyond compromised code, from drained wallets and disrupted payments to investigations and changes in how companies handle customer data.&nbsp;&nbsp;If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.

Bitcoin holds near $64,000 as BTCPay backers pledge 3 BTC exploit bounty

Table of Contents

Cryptopolitan_News

Other articles published on Aug 11, 2026

Australian Dollar Holds Ground Ahead of RBA Policy Decision

Silver Price Forecast: XAG/USD Slips Near $66.00 as Fed Rate Hike Fears and Oil Surge Weigh

Arthur Hayes: U.S.-Japan Yen Support Could Boost Dollar Liquidity and Trigger Bitcoin Rally

Court Upholds Dismissal of Official Who Mined Crypto on Public Institute’s Servers

Euro Steadies Near 1.1550 Against Dollar as Traders Await US CPI Data

Anonymous Address Moves $7.3M in HYPE Out of Coinbase Prime

Join our free newsletter for daily crypto updates!