UPDATED 8:27 PM ET A GoCheckMy site
GoCheckMyCrypto Crypto, checked.
The Edition

Afternoon Edition, Saturday, August 8, 2026

The Desk

Active exploit drains Lightning nodes running BTCPay; immediate patching required

Attackers exploited a critical vulnerability in BTCPay Server to steal credentials and drain Lightning nodes running LND software. BTCPay ordered immediate updates to version 2.4.2 or server shutdown. Hardware-wallet maker Foundation and the Citadel21 publication reported their Lightning nodes were swept. The Bitcoin Red Team disclosed the flaw rapidly, and attackers were already exploiting it against live servers.

Attackers exploited a critical vulnerability in BTCPay Server to steal credentials and drain Lightning nodes running LND, the most widely used software for operating a Lightning node, according to CoinDesk's reporting. BTCPay told anyone running LND to update immediately to version 2.4.2 or take the server offline.

The flaw allowed an unauthenticated remote attacker to obtain `.macaroon` files, or credentials that give software permission to interact with an LND Lightning node, per CoinDesk. BTCPay said the attacks it reviewed targeted those files, which could then be used to take control of the node and move funds. Attacks occurred late Friday after the vulnerability was exploited against live servers, according to CoinDesk's reporting.

Hardware-wallet maker Foundation was among the victims. Chief Executive Zach Herbert told CoinDesk attackers drained the company's BTCPay Lightning node overnight, closing its channels and sweeping the funds. Its BTCPay on-chain hot wallet was untouched. Citadel21, the bitcoin publication run by pseudonymous commentator hodlonaut, also reported that its Lightning node had been swept, though it said little money was held there.

Continued →

The Afternoon Brief 7:04 PM UTC

Bitcoin trades at $63,653.85, down 0.34 percent over the past 24 hours, down 1.59 percent over the past week, and down 2.97 percent over the past month, per the desk's Market Pulse board, all three windows pointing the same direction. That softness sits alongside a macro data point that, per CoinDesk's reporting, moved rate markets more than anything crypto-specific did today: U.S. nonfarm payrolls fell 23,000 in July against a forecast 80,000 gain, with June and May both revised sharply lower, pulling September Fed rate-hike odds from 55 percent to 46 percent.

The day's crypto-specific stories clustered around security and enforcement rather than price action. Attackers exploited a critical BTCPay Server vulnerability to drain Lightning nodes running LND, per CoinDesk, prompting BTCPay to order immediate patching to version 2.4.2 or server shutdown; Foundation and the Citadel21 publication both reported nodes swept. Separately, a possible Bitcoin fork tied to BIP-110 carries replay-attack risk for anyone selling forked coins before early September, though CoinDesk's reporting places miner signaling near just 2.6 percent as of Friday against the 55 percent needed to activate, well below the threshold that would make the split consequential.

On the legal and policy side, Bybit won a preliminary injunction freezing stolen assets tied to North Korea's Lazarus Group, following the February 2025 theft of roughly $1.5 billion in Ethereum, a step CoinDesk characterizes as a rare court victory against a state-sponsored actor, though enforcement still depends on identifying the asset holders. The U.S. Treasury's OFAC also sanctioned two exchanges, Shelbit and Aban Tether, for processing more than $5 million in funds linked to Iran's Revolutionary Guard Corps. And Trump Media terminated its CRO treasury venture with Crypto.com, walking back a partnership announced less than a year ago and citing market saturation, after having purchased $105 million of CRO in September 2025.

The reporting does not tie today's security and enforcement stories to a single cause; they read as separate developments in ongoing threads (Lightning infrastructure hardening, the BIP-110 fork debate, and sanctions enforcement against Iranian networks) rather than a coordinated pattern. The jobs-driven rate repricing is the one driver the reporting explicitly connects to broader risk sentiment, including precious metals and bitcoin.

The desk's boards show a mixed picture. The Fear & Greed Index reads 30, within its recent 30-day range of 22 to 33, still in Fear territory despite the dovish jobs surprise. ETF flows lean constructive: bitcoin funds logged a fifth straight day of net inflows through Aug. 7, $101.7 million that day and $865.3 million over the last five sessions, while ether funds saw a fourth consecutive inflow day, $49.6 million on Aug. 7 and $243.7 million over five sessions. The Whale Watch board shows $168.1 million in bitcoin moving off exchanges in the past 24 hours, largely from Kraken; that follows a run of four weekly prints that moved from a net $279.9 million onto exchanges to net outflows of $380.9 million, $1.27 billion, and $132.2 million in the most recent week, a shift toward coins leaving exchanges. Leverage data shows SOL shorts absorbing $2.29 million in liquidations against just $63,630 in longs over 24 hours, and BTC shorts losing $381,917 against $1,285 in longs, both consistent with a market that leaned short into today's softness.

The coming days carry several named checkpoints. BTCPay operators running LND face an immediate deadline to patch or shut down, with the scope of drained funds still unclear pending a fuller accounting. Miner signaling for BIP-110 is worth tracking for any move toward the 55 percent activation threshold, with the fork window closing in early September; the desk's regulatory tracking also lists Sept. 1, 2026 as a checkpoint date tied to the CLARITY Act. Bybit's case against North Korea moves next to naming specific defendants and testing whether exchanges or stablecoin issuers cooperate in freezing wallets. The XRP Ledger community awaits whether Confidential Transfers reaches the 80 percent validator support needed to activate. And the labor data itself sets up August and September payrolls reports as the next test of whether the July weakness reflects a durable trend or a one-off miss.

Back issues: 2026-10-15 · 2026-10-14 · 2026-10-13 · 2026-10-11 · 2026-10-10 · 2026-10-09 · 2026-10-08 · 2026-10-06 · 2026-10-05 · 2026-10-04 · 2026-10-03 · 2026-10-02 · 2026-10-01 · 2026-09-23
GoCheckMyCrypto is a site of Go Check My Brands LLC · Every source linked · Never financial advice Standards & Corrections · Archive