Crypto news

Bitcoin's BIP-110-enforcing branch stalled at block 961,633 on Sunday, producing only two blocks, while the non-enforcing chain advanced to 961,721, widening the gap to 88 blocks. The branch's blocks were mined by a pseudonymous group called Roughnecks using Ocean's DATUM protocol, according to the BIP-110 monitor. The divergence began after BIP-110 entered mandatory signaling at block 961,632, with only 2.53% of preceding blocks signaling support. BIP-110 nodes reject non-signaling blocks, while ordinary nodes accept both. The enforcing branch must mine through the rest of the adjustment period before difficulty adjusts, slowing progress without more hashpower. BIP-110 faces opposition from prominent advocates. Strategy executive chairman Michael Saylor shared the proposal's objectives but warned it threatened Bitcoin's neutral rules and consensus. Blockstream CEO Adam Back cautioned that the consensus-level change could damage Bitcoin's credibility and potentially make certain unspent transaction outputs unspendable.

BTCPay Server, a self-hosted Bitcoin payment processor, has confirmed that attackers exploited a critical vulnerability to steal funds from users running versions prior to 2.4.2. The flaw allowed unauthenticated remote attackers to obtain LND credential files, potentially granting full control of Lightning Network nodes and access to funds. The project has urged all operators to update immediately, with LND users specifically advised to upgrade to version 2.4.2 and LND 0.21.1, which automatically regenerates credentials. Those unable to patch were told to take servers offline. The incident follows another major security breach: Galaxy Research confirmed that 1,719 Bitcoin, worth about $111 million, has been stolen from Coldcard users, with estimated losses expected to exceed $130 million. Neither attack targeted the Bitcoin protocol itself, but rather exposed weaknesses in surrounding tools.

BIP-110 is a proposed one-year change that limits non-financial data on Bitcoin and has sparked a debate over how Bitcoin's block space should be used.

BTCPay Server warned users on Friday that attackers are actively exploiting a critical vulnerability, urging administrators to update to version 2.4.2 immediately or shut down their servers to prevent unauthorized access. The Bitcoin payment processor advised users to replace credentials, recreate the macaroons.db file, and refresh authentication strings for Lightning Network backends, as well as move funds from hot wallets and recreate them. The project credited Bitcoin Red Team for reporting the flaw but did not disclose how it works, when attacks began, or if funds were stolen. The warning follows a trend of AI-assisted attacks targeting crypto projects, including recent incidents involving Zcash, Coldcard, and Bitcoin swap provider Boltz.

A critical vulnerability in BTCPay Server, an open-source Bitcoin payment processor, allowed attackers to drain funds from connected Lightning nodes. The flaw involved persistent macaroons, API-key-like credentials that remained valid after software updates, requiring a manual refresh. Hardware wallet maker Foundation and Citadel21 publisher hodlonaut were among the first confirmed victims, with their Lightning channels force-closed and funds swept clean. BTCPay Server released version 2.4.2 and an NBXplorer update on August 7, urging operators to upgrade immediately or shut down servers. The exploit is separate from a prior authentication bug patched days earlier. Technical analyses are expected soon, as the incident raises concerns about security review pace amid ongoing audits of Bitcoin infrastructure.

A volunteer team of sixteen Bitcoin developers used AI to audit 390 projects, flagging 4,962 security vulnerabilities in 24 hours, including 85 critical and 635 high-severity bugs. The developer behind Cashu, Calle, called the situation 'extremely bad,' noting the volume is overwhelming maintainers and causing chaos. The group is publishing findings quickly, as maintainers can verify them with the same AI tools. However, coordinating the reports to the right people remains a challenge, according to Rob Hamilton, who is building the automated setup. He views it as 'version one' of a powerful but evolving process. The audit comes as the ecosystem deals with the Coldcard exploit, which stole up to $114 million due to a dormant bug. It also highlights the dual-use nature of AI in security: Anthropic's model found a 27-year-old bug for under $50, and Google caught criminals using AI-discovered flaws.

Crypto at risk of becoming "canary in a coal mine" when it comes to demonstrating how AI could impact cybersecurity.

Strategy Inc., formerly MicroStrategy, has raised approximately $15 billion through AI-designed hybrid securities to fund its Bitcoin purchases. CEO Michael Saylor revealed on a podcast that ChatGPT helped create the new instruments after the company hit limits with traditional convertible bonds, resulting in the STRK preferred stock and the variable-dividend STRC. The company has deployed the capital into Bitcoin, bringing its holdings to 843,738 BTC as of late May 2026. While the AI-generated structures passed standard regulatory review, the approach raises concerns about concentration risk, as Strategy's corporate identity now relies heavily on a single asset, potentially straining its obligations during a prolonged downturn.

Bitcoin's active addresses spiked to about 980,000 on July 31, 2026, the highest since December 2024, driven by panic after Coinkite disclosed a critical vulnerability in Coldcard Mk3 hardware wallets. The flaw, traced to a March 2021 firmware update (version 4.0.1), compromised the random number generator, potentially exposing seed phrases. Coinkite urged affected users to migrate funds immediately. Coordinated attacks began July 30, draining between 1,367 and 1,596 BTC (roughly $89 million to over $100 million) from thousands of long-dormant wallets. Firmware 5.0.3 was released to fix the issue, but analysts suggest the incident could accelerate investor movement toward regulated custody via spot Bitcoin ETFs, while affected users are advised to regenerate seeds on patched firmware.

Attackers exploited a critical vulnerability in BTCPay Server to drain Lightning nodes running LND, prompting urgent calls to update to version 2.4.2 or take servers offline. The flaw allowed unauthenticated access to LND credential files, enabling fund theft. Victims include hardware-wallet maker Foundation and bitcoin publication Citadel21, whose Lightning nodes were swept. BTCPay's standard on-chain wallets were not affected, but funds in LND's on-chain wallet remain at risk. A full postmortem is expected soon.