gm, Defiers!

These were the biggest crypto and DeFi stories today:

BTCPay Server: Lightning nodes drained as an actively exploited flaw forces an emergency patch
SharpLink says burning validator rewards would rip out DeFi's base rate
Flash Trade will wind down unless a buyer takes the Solana perp DEX

Zach Herbert learned his company's Lightning node was empty before he learned why. Foundation, the maker of the Passport hardware wallet, runs BTCPay Server for payment processing. Overnight, every channel closed and the balance was swept.

BTCPay Server told operators at 11:51 a.m. ET Friday that a critical vulnerability was being actively exploited, and to install version 2.4.2 or turn their servers off. hodlonaut's Citadel21 node went the same way, and nobody has published a count of how many nodes were hit.

That is three failures in nine days at the base of bitcoin's stack. A 2021 Coldcard firmware bug that sent seed generation to a weak randomizer has drained more than $114 million since July 30, from holders using air-gapped devices and steel seed plates. On Aug. 3 the swap bridge Boltz halted service indefinitely, saying attackers iterate faster than a team its size can patch. The Bitcoin Red Team formed after Coldcard and filed 4,962 findings across 390 projects in 27.5 hours this week; it missed this one. BTCPay founder Nicolas Dorier credited Sparrow Wallet developer Craig Raw with working out the attack after being robbed himself.

Read more below!

WATCH

The Ethereum EIP-8363 Debate

We hosted EIP-8363 co-author Jérôme de Tychey in a debate with ether.fi chief executive Mike Silagadze on whether Ethereum should burn a rising share of validator rewards once half the supply is staked. Silagadze put a $1 million public bet on his side of it. De Tychey's answer to the timing objection: “There is never a pressing thing to solve.” Two days of founder opposition preceded the call.

HACKS

Lightning Nodes Drained As BTCPay Server Users Race To Patch

Attackers emptied Lightning nodes belonging to BTCPay Server users on Friday, after the self-hosted bitcoin payment processor said a critical vulnerability was under active exploitation and told merchants to install version 2.4.2 or shut down. Foundation chief executive Zach Herbert said his node was drained overnight, all channels closed and funds swept; hodlonaut reported the same for Citadel21. Neither disclosed amounts. Patching alone leaves the door open: BTCPay told users to refresh macaroons and macaroons.db, the credential files that authorize access to an LND node, and to move funds out of any hot wallet generated inside BTCPay. Stolen macaroons survive an update.

	TICKER	VALUE	24H
	Lightning Nodes Drained As BTCPay Server Users Race To Patch BTCPay Server says a critical vulnerability is being actively exploited and can cause loss of funds, telling operators to install version 2.4.2 or turn servers off. thedefiant.io

Why this matters: Namecheap and hundreds of smaller merchants take bitcoin through this software, and each one has to patch its own server while the credentials attackers already copied still work.

BLOCKCHAINS

SharpLink Opposes Ethereum Proposal to Burn a Growing Share of Validator Rewards

Joseph Chalom said SharpLink opposes EIP-8363, the draft proposal to burn part of validator rewards as Ethereum's staking ratio climbs, in an article published on X on Friday. The tapered issuance burn cuts validator yield to zero once about half of all ETH is staked, leaving validators on transaction tips that today account for 15% of staking income. Chalom's objection: staking yield is the de facto base rate underneath DeFi, and liquid staking tokens, roughly $35 billion in total value locked, are core collateral across onchain lending. The proposal is still at the discussion stage.

Why this matters: The corporate ETH treasuries are on the record against the burn, and their argument runs through $35 billion of liquid staking collateral sitting in lending markets.

DEFI

Solana Perp DEX Flash Trade to Wind Down Unless It Finds a Buyer

Flash Trade said Friday it will wind down unless it finds a party to acquire the Solana perpetuals exchange, and said money was not the reason, citing “direction, shrinking market participants, and our own honest read on the crypto market.” It is selling its tech stack, brand and intellectual property, with proceeds distributed pro rata to FAF holders; the team takes no percentage and team tokens are excluded. No dates are set, and withdrawals stay open until clear notice. The exchange never raised outside capital and has paid roughly $520,000 in USDC of revenue share to holders.

Why this matters: Dango halted trading on July 29 and Flash Trade is next in line. Perp venues outside the top few are closing while the largest platforms keep growing.