Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Bitcoin value stabilized at around $64,000, even though high-profile open-source cryptocurrency payment platform BTCPay Server suffered a major security breach. The incident stemmed from the exploitation of a critical software vulnerability, for which the BTCPay community offered a reward of up to 3 BTC to recover the misappropriated funds.
What happened to Lightning users?
The vulnerability affected users who relied on BTCPay Server, and the group immediately recommended an immediate software upgrade or suspension of service. Although the specific damage and scale of the attack have not been fully disclosed, reports indicate that certain Lightning nodes used by organizations such as the Foundation and Citadel21 have been impacted. The focus of the hacking attack is to mine the LND administrator macaroon credentials to achieve unauthorized access to the user's Lightning wallet. It is worth noting that on-chain wallets and hot wallets are not affected by this specific vulnerability. BTCPay has provided a reward of 10% of the recovered funds, and awarded 0.21 BTC each to researcher Craig Raw and the Bitcoin Red Team Fund in recognition of their security contributions.
Will Macaroon become a weak link?
Yes, the vulnerability revolves around macaroon, which is a key authentication method for LND. Once exploited, attackers can take full control of Lightning nodes and run out of funds. To deal with this issue, operators must install the latest software updates, regenerate credentials and replace macaroons to invalidate stolen information. Administrators need to update through maintenance tools to ensure that the system reflects that the upgrade is completed before reactivating the service to prevent threats. At the same time as the macaroon issue, another unrelated vulnerability was also fixed, resolving the two-factor authentication bypass issue.
What are the broader implications?
The concerns raised by this security breach are not about the Bitcoin protocol itself, but about the application-layer software that interacts with Bitcoin. Due to the isolation of the issue, the Bitcoin main network was able to continue to operate normally. BTCPay Server has historically run on 248 websites, of which 74 are currently active. It is estimated that there are approximately 5,585 active Lightning nodes, managing approximately 2,640 BTC in funds. Merchant adoption of Bitcoin increased by 74% in 2025, which is consistent with reports of monthly Lightning Internet transactions exceeding US$1 billion. As artificial intelligence continues to reshape the cybersecurity landscape, organizations must realize that AI-driven tools can both enhance security and encourage attackers to exploit software vulnerabilities on a large scale. To protect the infrastructure that underpins Bitcoin and similar technologies, increasing vigilance over software integrity and credential protection will be key to mitigating the negative impact of future threats.
