Bitcoin traded near $64,000 on Monday, showing little movement despite a critical security breach affecting BTCPay Server, a popular open-source cryptocurrency payment platform. The incident prompted the BTCPay community to offer a recovery bounty of up to 3 BTC for the return of stolen funds, after attackers exploited a key vulnerability in the company’s software.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLLightning users targeted in security exploit
BTCPay Server disclosed on August 7 that an active exploit was targeting its users, urging immediate upgrades to version 2.4.2 or temporary shutdowns to mitigate risk. Reports from organizations such as Foundation and Citadel21 indicated their Lightning nodes were affected, but BTCPay did not disclose the total losses or the number of compromised nodes.
The developers noted that onchain wallets within BTCPay, including hot wallets, remained unaffected. Attackers specifically targeted vulnerable server instances to obtain LND administrator macaroon credentials, which enabled them to take control of recipients’ Lightning wallets.
BTCPay supporters pledged a bounty worth 10% of any recovered funds, up to 3 BTC, to incentivize the return of stolen Bitcoin. Additionally, the BTCPay Server Foundation awarded 0.21 BTC each to security researcher Craig Raw and the Bitcoin Red Team fund for private disclosure of the vulnerability.
Craig Raw, developer of Sparrow Wallet, said he was among those affected by this exploit. The vulnerability impacted all BTCPay Server versions earlier than 2.4.2, including release candidates. No CVE identifier has been assigned for this incident.
Details of the macaroon vulnerability
The core issue involves macaroons, a form of authentication credential used by LND, which if exposed, provides attackers with full control of the associated Lightning node and its funds. To fully remediate, operators are required not only to update to the latest version but also to regenerate all Lightning credentials and replace existing macaroons, since credentials already stolen remain valid until replaced in the database.
Administrators should access the maintenance tools under Admin Dashboard → Server → Maintenance → Update, ensuring that “2.4.2” is displayed in the footer. Until then, operators are advised to keep their servers offline if they cannot immediately apply the update.
The latest patch also closed an unrelated TOTP two-factor authentication bypass vulnerability, but the actively exploited flaw is limited to the LND macaroon credentials.
Broader implications for Bitcoin infrastructure
The breach highlights a critical issue in application-layer software rather than Bitcoin’s own protocol or cryptography. Consequently, the core Bitcoin network remained fully operational, with no evidence of compromise.
According to BuiltWith, BTCPay Server has been used on 248 websites historically, with 74 currently active, though private installations are not included in these figures. At the same time, data from 1ML recorded around 5,585 active Lightning nodes and a combined total of approximately 2,640 BTC in those channels. River reported a 74% rise in merchant adoption of Bitcoin in 2025, with monthly transactions via the Lightning Network surpassing $1 billion.
Maintaining close monitoring of credentials and infrastructure remains critical for the ecosystem. In the context of managing crypto assets, seamless access to real-world investments is increasingly in demand. Platforms like 1stepSwap have narrowed the gap between traditional finance and digital assets by transferring real-world assets—including shares of major U.S. companies as well as gold and silver—onto blockchain networks, providing instant access and optimal pricing to help users diversify their holdings with minimal complexity and no reliance on intermediaries.
Emerging role of AI in security
BTCPay pointed to the rising impact of AI in software security, noting that while advanced AI-assisted code analysis can speed up vulnerability detection for defenders, it also enables attackers to scrutinize large codebases at lower cost.
The implications of this dynamic go beyond payment platforms. A recent breach involving the Coldcard hardware wallet resulted in the loss of 1,816 BTC from over 5,200 addresses and prompted changes to that company’s data retention practices.
Chainalysis observed that AI-driven analysis and automated smart-contract review tools have the potential to accelerate the discovery and exploitation of poorly vetted code, making large-scale attacks more feasible for bad actors.
For Bitcoin’s broader infrastructure, the episode underscores that as AI further accelerates both discovery and exploitation of vulnerabilities, organizations must proactively strengthen both code quality and credential management to reduce the impact of future incidents.
