BTC has been climbing and now sits near $65k. The weekend’s market was calm. But this weekend in the Bitcoin community was destined to be anything but peaceful.

A Troubled Weekend

Last Friday, the open-source self-custody payment processor BTCPay Server posted an urgent advisory: a critical vulnerability was being actively exploited by attackers and could lead to loss of funds. The official guidance was for all users to upgrade immediately to 2.4.2, and for those who could not upgrade in time, to shut their servers down[1].

What Is BTCPay Server?

What is BTCPay Server? It is the payment tool most trusted by Bitcoin’s hardest-core users. Merchants use it to accept payments with zero fees, and the funds go straight into their own wallets without passing through any third party[2]. From Bitcoin Beach in El Salvador, to an entire commercial district in Costa Rica, to the domain giant Namecheap, all use it to receive Bitcoin. Riding on it, Namecheap has collected over $73 million in Bitcoin across 1.1 million transactions[2].

Those who use BTCPay are among the most custody-averse users in the Bitcoin world. They run their own nodes, manage their own private keys, and hold their money firmly in their own hands. To them, self-custody is security itself.

What was breached this time was precisely the fortress this group took the most pride in.

The Flaw in the Auth Chain

The vulnerability lay in BTCPay’s API authentication. The system supports a form of Basic authentication — a simplified auth method — where a username and password alone can call the API. Normally, once an admin enables two-factor authentication, a username and password are not enough; a dynamic verification code is also required. But there was an ordering error in the code: Basic authentication was allowed through before the system checked whether the user had 2FA enabled[3].

It was precisely this priority error in the authentication chain that rendered 2FA meaningless. The permissions an attacker gained through this flaw let them further steal the macaroon credential file of the LND node, thereby taking control of the Lightning node, closing channels, and sweeping the funds. More critically, old credentials remained valid even after an upgrade — they had to be manually destroyed and regenerated.

As long as an attacker obtained the admin account’s username and password — whether through weak-password brute force, credential stuffing, or some other channel — they could bypass two-factor authentication and log straight into the backend. The official disclosure did not say how the attackers obtained the credentials, nor how many servers were hit[4]. But the known victims are enough to send a chill down anyone’s spine.

Who Got Drained

Hardware wallet maker Foundation had its own Lightning node drained overnight — all channels force-closed, funds swept away[5]. The Lightning node of Bitcoin magazine Citadel21 was also emptied[5]. It all happened silently.

How the Bug Was Found

What is even more intriguing is how this vulnerability was discovered. Craig Raw, the developer of Sparrow Wallet, lost some of his own funds, dug through logs, investigated, and only then pinned down the problem and reported it to the project[6]. The first person to find the vulnerability turned out to be a user.

Lightning Nodes, Not Hot Wallets

What got drained were all Lightning nodes, not ordinary hot wallets. This detail is worth noting. Lightning nodes are natively always online, and the funds in their channels can be force-closed at any moment. BTCPay’s selling point is self-managed funds, yet the Lightning node is precisely the part that most depends on a trusted runtime environment. This exposes the fragility of self-custody tools in a “hot” state — self-custody is not the same as cold storage, and running an LN node is essentially operating a “small financial server.”

It is like locking gold in a safe, but hanging the key on the door lock — and never changing it.

The Self-Custody Bargain

“Misfortune is where fortune rests, and fortune is where misfortune lurks.” Self-custody grants people freedom from third-party interference, but also pushes the full burden of security onto each individual’s own shoulders. BTCPay has no central operator; the patch must be applied by every server owner themselves. The moment the vulnerability was disclosed, the whole world knew — and those who had not patched were running naked[6].

An August of Self-Custody Failures

What is even more unsettling is the timing. This August, Bitcoin’s self-custody tools have been failing one after another. First, the Coldcard hardware wallet was found to have a vulnerability, with over $100 million in Bitcoin stolen[7]. Then the Bitcoin exchange service Boltz suspended operations after being attacked, claiming that AI-assisted attacks found vulnerabilities too fast for the team to keep up[8]. And now BTCPay.

The Shadow of AI

This vulnerability was not dug out by AI — it was found by a human. Craig Raw, with a refusal to accept the loss, unearthed the truth from the logs[6]. But the shadow of an attack-defense imbalance in the AI era already looms over the entire self-custody ecosystem.

The Real Vulnerability Is Cognitive

Technical vulnerabilities will be patched sooner or later; what is truly hard to patch is the vulnerability in our understanding. Many equate self-custody with security, yet overlook that self-custody means being your own security team. A single line of buggy code can puncture the most devout faith — and that faith itself should not be built on blind trust.

“A thousand-mile dike collapses from an ant’s nest.” The security of Bitcoin has never rested on any single tool or any single verification, but on lesson after lesson, layer upon layer of redundancy, and every holder’s reverence for their own assets.

Panic is spreading through the community, but if we look calmly, we see that every crisis also forces evolution. History proves that Bitcoin’s security layer has been hardened, layer by layer, through attacks.

We voluntarily give up the ease of custody, all for the peace of mind that comes from self-mastery. But sacrifice and gain have always been a higher-order dialectic.

Rebirth from the Ashes

Some spare no effort to hype a kind of panic: that in the AI era, attackers will be even more unstoppable.

Yet there is reason for the opposite, more optimistic view. Because AI is open, egalitarian, and empowering enough, every self-custody individual can now possess unprecedented security knowledge and self-audit tools, achieving at minimal cost a level of security that in the past only large institutions could reach by spending enormous sums on an entire security team.

Consider how one can run security scans, refactor, and optimize a tool like bitaddress, then customize a cold-wallet utility to fit one’s own needs — a task that, without the assistance of a model like DeepSeek V4, would be impossible to accomplish on shallow cryptography knowledge and coding ability alone.

Therefore, as large AI models grow ever more capable in security, and as people’s awareness and practice of using them to strengthen their own defenses become ever more mature, the descent of self-custody to every individual will accelerate into reality. This, perhaps, is the true path of self-custody faith’s rebirth from the ashes.

References

  • [1] BTCPay Server urgent security advisory: a critical API authentication vulnerability under active exploitation; all users told to upgrade to 2.4.2 immediately or shut servers down.
  • [2] BTCPay Server overview — a zero-fee, self-custody payment processor with funds going direct to the merchant’s own wallet; adopted by Bitcoin Beach, Costa Rican merchants, and Namecheap ($73M+ in BTC, 1.1M transactions).
  • [3] Vulnerability detail — Basic auth passed before the 2FA check due to an ordering error; attackers could steal the LND macaroon, seize the Lightning node, and sweep funds; old credentials stayed valid post-upgrade and had to be manually rotated.
  • [4] Official disclosure did not state how credentials were obtained or how many servers were compromised.
  • [5] Known victims: hardware wallet maker Foundation and Bitcoin magazine Citadel21 both had Lightning nodes drained.
  • [6] Bug discovered by Sparrow Wallet developer Craig Raw after he lost personal funds; once public, every unpatched server was exposed.
  • [7] Coldcard hardware wallet vulnerability with $100M+ in Bitcoin stolen.
  • [8] Boltz exchange service suspended after an AI-assisted attack outpaced the team’s fixes.