BTCPay Server exploit drains Lightning wallets amid Coldcard fallout

Bitcoin ↘ 0.29% infrastructure is reeling from twin security crises this week after the Coldcard hardware wallet exploit surpassed $111 million in confirmed stolen funds and a separate critical vulnerability in BTCPay Server allowed attackers to drain merchant Lightning nodes.

Coldcard Losses Mount

Galaxy Research said Friday that at least $111 million in Bitcoin has been confirmed stolen from Coldcard wallets, with total losses likely exceeding $130 million as research continues. Analysis of 250 victim reports found a median individual loss of 1.022 BTC, with stolen coins having sat untouched for a median of 3.5 years. One victim lost nearly 59 BTC.bitcoinmagazine

The exploit traces to a firmware bug in Coldcard Mk3 devices — introduced with version 4.0.1 in March 2021 — that caused seed generation to fall back on a weak software pseudorandom number generator instead of the hardware's true random number generator. Manufacturer Coinkite suspects attackers used AI to discover the flaw in publicly available code. The initial wave on July 30 drained 594.5 BTC — roughly $70 million — in just 41 minutes across four consecutive blocks.cointribune+3

The breach sent nearly one million Bitcoin addresses into motion on July 31, a 54% spike above the monthly average, as holders scrambled to move funds to alternative storage.cointribune

BTCPay Server Exploit Hits Lightning Nodes

In a separate incident disclosed late on August 6, attackers exploited a critical flaw in BTCPay Server to steal credentials from Lightning nodes running LND software. The vulnerability allowed unauthenticated remote attackers to obtain "macaroon" files — credentials granting full control over LND nodes — enabling them to close payment channels and transfer funds.investing+2

Hardware wallet maker Foundation confirmed its BTCPay Lightning node was drained, though its on-chain hot wallet was not reached. Bitcoin publication Citadel21 also reported losing funds. BTCPay urged all users to update immediately to version 2.4.2 or take servers offline.x+3

"Not a drill," wrote Francis Pouliot, CEO of Bull Bitcoin. "Inform everyone you know using BTCPay to shut it down immediately".forbes

AI-Driven Security Response and Market Impact

A volunteer group called Bitcoin Red Team has been conducting an AI-assisted security audit across the Bitcoin ecosystem, scanning 425 projects in 55 hours and logging 6,700 findings, including 1,029 rated high or critical. The effort reportedly cost between $10,000 and $20,000, using models including Kimi K3 and OpenAI Cyber Harness. However, how many of those findings represent confirmed vulnerabilities remains unclear, as false-positive rates and patch outcomes have not been published.cryptorank

Blockaid CEO Ido Ben-Natan told The Block that the Coldcard exploit exposes crypto's "original sin" of relying on private keys as a single point of failure. "Very soon everyone in the world is gonna have one of the best hackers in the world at their fingertips," he warned, describing crypto as the canary in the coal mine for AI-driven cybersecurity threats.theblock

Despite the turmoil, Bitcoin's price has remained resilient, trading near $65,000 as investors continued buying through exchange-traded funds.investing+1