Lightning Nodes Swept While BTCPay Users Read the Warning
The flaw surfaced because a developer got robbed and read his own logs, after this week's AI audits missed it
gm, Defiers!
These were the biggest crypto and DeFi stories today:
- BTCPay Server: Lightning nodes drained as an actively exploited flaw forces an emergency patch
- SharpLink says burning validator rewards would rip out DeFi's base rate
- Flash Trade will wind down unless a buyer takes the Solana perp DEX
Zach Herbert learned his company's Lightning node was empty before he learned why. Foundation, the maker of the Passport hardware wallet, runs BTCPay Server for payment processing. Overnight, every channel closed and the balance was swept.
BTCPay Server told operators at 11:51 a.m. ET Friday that a critical vulnerability was being actively exploited, and to install version 2.4.2 or turn their servers off. hodlonaut's Citadel21 node went the same way, and nobody has published a count of how many nodes were hit.
That is three failures in nine days at the base of bitcoin's stack. A 2021 Coldcard firmware bug that sent seed generation to a weak randomizer has drained more than $114 million since July 30, from holders using air-gapped devices and steel seed plates. On Aug. 3 the swap bridge Boltz halted service indefinitely, saying attackers iterate faster than a team its size can patch. The Bitcoin Red Team formed after Coldcard and filed 4,962 findings across 390 projects in 27.5 hours this week; it missed this one. BTCPay founder Nicolas Dorier credited Sparrow Wallet developer Craig Raw with working out the attack after being robbed himself.
Read more below!
The Ethereum EIP-8363 Debate
We hosted EIP-8363 co-author Jérôme de Tychey in a debate with ether.fi chief executive Mike Silagadze on whether Ethereum should burn a rising share of validator rewards once half the supply is staked. Silagadze put a $1 million public bet on his side of it. De Tychey's answer to the timing objection: “There is never a pressing thing to solve.” Two days of founder opposition preceded the call.
Lightning Nodes Drained As BTCPay Server Users Race To Patch
Attackers emptied Lightning nodes belonging to BTCPay Server users on Friday, after the self-hosted bitcoin payment processor said a critical vulnerability was under active exploitation and told merchants to install version 2.4.2 or shut down. Foundation chief executive Zach Herbert said his node was drained overnight, all channels closed and funds swept; hodlonaut reported the same for Citadel21. Neither disclosed amounts. Patching alone leaves the door open: BTCPay told users to refresh macaroons and macaroons.db, the credential files that authorize access to an LND node, and to move funds out of any hot wallet generated inside BTCPay. Stolen macaroons survive an update.
 |
SharpLink Opposes Ethereum Proposal to Burn a Growing Share of Validator Rewards
Joseph Chalom said SharpLink opposes EIP-8363, the draft proposal to burn part of validator rewards as Ethereum's staking ratio climbs, in an article published on X on Friday. The tapered issuance burn cuts validator yield to zero once about half of all ETH is staked, leaving validators on transaction tips that today account for 15% of staking income. Chalom's objection: staking yield is the de facto base rate underneath DeFi, and liquid staking tokens, roughly $35 billion in total value locked, are core collateral across onchain lending. The proposal is still at the discussion stage.
Solana Perp DEX Flash Trade to Wind Down Unless It Finds a Buyer
Flash Trade said Friday it will wind down unless it finds a party to acquire the Solana perpetuals exchange, and said money was not the reason, citing “direction, shrinking market participants, and our own honest read on the crypto market.” It is selling its tech stack, brand and intellectual property, with proceeds distributed pro rata to FAF holders; the team takes no percentage and team tokens are excluded. No dates are set, and withdrawals stay open until clear notice. The exchange never raised outside capital and has paid roughly $520,000 in USDC of revenue share to holders.
Other Stories Worth Your Time
Tokyo Lawson Register Scans a Barcode for a 322-Yen JPYC Stablecoin Payment — HashPort ran the trial through the store's standard point-of-sale register on Aug. 6, with no stablecoin hardware added at the till. It settled on Polygon in about five seconds, and a second phase covering USDC and USDT runs Aug. 17.
Rarible Launches Solana NFT Marketplace With Claynosaurz as First Collection — the marketplace now lists Solana alongside Ethereum, MegaETH and Base, with dedicated Explore, Mint and Gacha pages. It arrives on the network where Magic Eden has long been the dominant venue.
Can LP Agents Outrun Their Own Debt? Inside Ratehopper's Self-Repaying Loan Competition (Partner) — Ratehopper's Range Hunter competition sets self-repaying loan agents against their own borrowing costs, with contest onboarding open now.
Trending on The Defiant
Uniswap's New Launchpad Out-Launched Pons On Its First Day On Robinhood Chain · DEFI
Robinhood Chain's DEX Volume Fell 72% While Transactions And Deposits Set Records · BLOCKCHAINS
Traders Push CLARITY Act Odds Into 2027 After Thune Skips Cloture Filing · REGULATION
ether.fi Removes Restaking From weETH, Nearing A Full EigenLayer Exit · DEFI
Free newsletters
Good reporting. Delivered.
Choose your coverage: crypto and DeFi, the future of finance, or both.
Free. Unsubscribe anytime.
