Bitcoin traded up 0.61% on Saturday, reaching $64,986 and coming close to the critical $65,000 level. This advance came amid heightened anxiety among cryptocurrency participants following two notable security incidents: a severe exploit targeting BTCPay Server and uncertainty tied to a possible BIP-110 protocol fork.
USDT
AAPLMajor BTCPay security breach exposes Lightning funds
Late Friday, attackers exploited a vulnerability in the BTCPay Server platform, which is widely used to facilitate Bitcoin payments for merchants. By targeting Lightning Network nodes integrated via LND software, the attackers were able to access authentication files called “macaroons.” These digital credentials gave them the power to seize control of Lightning nodes, terminate payment channels, and move cryptocurrency out of wallet balances.
BTCPay’s developer team promptly confirmed the breach, urging users to either upgrade to version 2.4.2 immediately or to shut down their servers entirely to prevent further losses. The team did not disclose the extent of the breach or the value of assets stolen to date.
BTCPay developers warned operators to “upgrade to v2.4.2 or shut down immediately,” citing an active exploit draining Lightning node holdings.
Foundation, a leading manufacturer of hardware wallets for digital assets, confirmed that funds in its Lightning node were entirely drained following the breach. The company reported that its standard on-chain hot wallet remained unaffected. Citadel21, a publication focused on Bitcoin, also disclosed suffering losses from compromised Lightning wallet balances.
Despite the attack, traditional on-chain wallets running through BTCPay were not compromised. However, assets stored on LND node on-chain wallets may still be at risk of exposure.
Mini dictionary: BTCPay Server is an open-source platform that enables merchants to accept Bitcoin payments directly without relying on intermediaries. The infrastructure can support both on-chain and Lightning Network transactions.
BIP-110 fork triggers network split fears
A separate technical challenge emerged with BIP-110, a proposed Bitcoin upgrade intended to restrict certain types of non-transactional data from being embedded in the blockchain. BIP-110’s activation is set for block height 961,632, placing the network on edge due to potential for chain fragmentation and transaction replay attacks.
As of Friday, only 2.6% of Bitcoin’s mining power supported BIP-110, far below the 55% threshold needed for broad activation. With most miners not signaling support, client nodes running the BIP-110 protocol will automatically reject blocks not adhering to the new rules after activation, risking a split into competing blockchains.
| Network | BIP-110 Support | Consensus Threshold |
|---|---|---|
| Main Bitcoin Chain | 2.6% mining support | 55% required |
| BIP-110 Fork | Blocks 961,632-961,633 only | N/A |
If a chain split occurs, Bitcoin holders will retain equivalent balances on both chains. Kevin Loaec, a software developer, highlighted the risk that selling assets on one version without proper separation could allow attackers to leverage replay vulnerabilities and potentially steal funds on the main chain.
Kevin Loaec emphasized the risk, noting that “liquidating forked assets without isolating wallet balances may expose genuine BTC to replay attacks.”
Mini dictionary: A replay attack involves intercepting and retransmitting valid data in order to duplicate a transaction across multiple blockchain forks, which can cause investors to lose funds.
ETF inflows surge, wallet growth hits annual peak
Amid the technical and security turmoil, institutional appetite for Bitcoin intensified. Eric Balchunas, lead ETF analyst at Bloomberg, reported that US-based spot Bitcoin exchange-traded funds attracted approximately $1 billion in net capital inflows over the past week. This ranks as their strongest week since April, and third-highest since October 2025.
Balchunas added that the recent breach of Coldcard, a hardware wallet platform, may have prompted some investors to favor regulated investment products like ETFs, though he acknowledged the link remains speculative. The Coldcard incident reportedly resulted in the theft of $116 million in BTC due to a flaw in its private key generation firmware.
Additionally, Santiment, a blockchain analytics provider, documented a spike in newly created Bitcoin wallets. Over the past week, 2.27 million new wallets appeared on-chain, marking the highest level in a year. Santiment noted that major security breaches often motivate users to create new wallets and shuffle assets, contributing to significant wallet activity. At the same time, increased retail participation often attracts accumulation from larger Bitcoin holders.
At last check, Bitcoin was trading at $64,933, down $74 from the previous session’s close.
