Live Chat
Block has joined the x402 Foundation and contributed a Bitcoin Lightning payment specification, adding a Bitcoin option to an open standard for payments by AI agents, the company announced Sept. 24. The x402 repository merged the specification on Sept. 23. Its author, Ben Carman, is a Bitcoin and… Read the full story at The Defiant
Bitcoin infrastructure company Blockstream has announced a new feature allowing users to make trustless swaps.
Dubbed Blockstream Swaps, the idea is that Bitcoiners will be able to quickly move between the main chain and Lightning network.
It comes after non-custodial Bitcoin swap provider Boltz suspended its service after it said attackers were finding vulnerabilities faster than its team could fix using AI.
“In support of the broader Bitcoin and Liquid ecosystem, Blockstream is launching Blockstream Swaps,” Blockstream said.
“This initiative was already under development to ensure a resilient suite of utility for the ecosystem, and it complements the providers already doing this work rather than replacing any one of them.”
The idea, added Blockstream, is users can move funds across layers while never losing full control over their funds.
To use Lightning, users will not need to run a node or channel — as is normally needed with Lightning — and can simply hold a Bitcoin or LBTC balance and let a swap convert at the moment of payment.
LBTC is the native asset of the Liquid Network, a Bitcoin layer-2 sidechain created by Blockstream.
“This initiative was already under development to ensure a resilient suite of utility for the ecosystem, and it complements the providers already doing this work rather than replacing any one of them,” added Blocksteam’s announcement.
Boltz this month suspended its Bitcoin swap service. It said that a surge in AI-assisted attacks left it unable to continue operating safely.
Crypto hacks have surged, with security experts warning that cybercriminals are using AI to search for bugs in crypto projects and then take advantage of errors auditors may have missed.
Hardware wallet maker Foundation and the Bitcoin zine Citadel21 both said their nodes were swept, in some cases hours before the project’s public alert. BTCPay says the flaw under attack is not the one disclosed in its changelog.
Attackers emptied Lightning nodes belonging to BTCPay Server users on Friday, including one run by hardware wallet maker Foundation, after the self-hosted bitcoin payment processor warned that a critical vulnerability was being actively exploited and told merchants to update to version 2.4.2 or shut their servers down.
Because BTCPay is self-hosted, there is no operator who can patch on behalf of its users. Every merchant, exchange and wallet running the software has to apply the fix on its own machine, and the thefts were already underway before the warning went out. The software sits behind bitcoin checkout for Namecheap, which ran $73 million in BTC revenue across 1.1 million transactions through BTCPay between May 2020 and October 2024, along with hundreds of smaller merchants and several wallet backends.
“There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds,” the project wrote at 11:51 a.m. ET. “If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.” The post passed 550,000 views within five hours.
Founder Nicolas Dorier published release 2.4.2 the same morning with a one-line warning at the top: “This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can.” The notes also tell integrators to upgrade NBXplorer, BTCPay’s wallet-tracking backend, to version 2.6.10.
Zach Herbert, chief executive of Foundation, the company behind the Passport hardware wallet, said his node was gone before he read the alert. “How many BTCPay lightning nodes were swept? Our Foundation node was drained overnight by attackers,” he wrote at 2:01 p.m. ET.
Herbert narrowed the damage an hour later: “This was just our BTCPay server that we use for payment processing, the hot wallet was untouched – only the lightning node was drained. All channels were closed and funds were swept.”
hodlonaut, the pseudonymous bitcoin commentator behind the zine Citadel21, reported the same pattern. “This is an ongoing attack on BTCPayserver users. Citadel21’s lightning node was just swept,” he wrote. “Fortunately there were not much funds there.”
At least one other operator described closed channels and drained funds in the replies to BTCPay’s warning. Neither Herbert nor hodlonaut disclosed amounts, and no one has published a tally of how many nodes were hit or how much bitcoin moved.
The flaw surfaced because someone got robbed. Dorier credited Craig Raw, the developer of Sparrow Wallet, for working out what was happening.
“We got extremely lucky that a dev was impacted who could analyze the logs to understand what was going on,” Dorier wrote. “Somehow, this wasn’t found AI scans, but by him losing money. :(“
That cuts against the premise of the Bitcoin Red Team, the volunteer group that has spent this week running AI-assisted audits across bitcoin’s open-source stack and that BTCPay thanked for the disclosure. Dorier said the group’s scans missed it.
“The AI report we got from red team didn’t include this one,” he wrote. “But this bug was really sneaky, I am not surprised a simple scan didn’t find it, or thought it was low risk.”
BTCPay has not said which flaw is being exploited, and Dorier ruled out the one authentication bug the changelog does disclose. After a user posted a Grok-generated explanation pinning the attack on that bug, Dorier replied: “This bug was found by the Red team, this isn’t the critical bug in question.”
The disclosed bug is a two-factor authentication bypass in Greenfield, BTCPay’s API, fixed on Aug. 4. The handler checked only for FIDO2 hardware keys before enforcing a second factor, so accounts protected by an authenticator app could be reached with an email and password alone and receive an unrestricted permission claim. The browser login screen enforced 2FA correctly the whole time.
Dorier followed that with a breaking change switching off Greenfield basic authentication five minutes after an account is created, reasoning that the scheme is almost never used and that turning it off shrinks the blast radius of related bugs. The release also rate-limits public invoice creation on payment requests, and a commit landed on release day marked nine controller methods across five files as non-routable, removing endpoints reachable over HTTP by accident.
A technical writeup is coming. “We are working with Bitcoin Red Team to fully process the details of vulnerability and will follow up with detail technical post shortly,” core contributor Uncle Rockstar wrote. Dorier, asked about holding details back, said: “I am wondering if it makes sense to wait… now that it is exploited in the wild.”
Patching alone does not close the incident. BTCPay told users to completely refresh macaroons and macaroons.db, the credential files that authorize access to an LND Lightning node, and to refresh authentication strings for other Lightning backends. Anyone who generated a hot on-chain wallet inside BTCPay should move those funds and recreate the wallet.
Kaloudis, whose ZEUS wallet runs on LND, put it more bluntly: “Don’t assume you’re safe after upgrading.”
Stolen macaroons survive a software update. An attacker who copied them before the patch keeps node access until the credentials are destroyed and reissued, which matches what the victims describe: channels force-closed and balances swept rather than the server itself compromised again.
The alert lands nine days into the worst stretch for bitcoin infrastructure security in years.
A 2021 Coldcard firmware bug that routed seed generation to a weak software randomizer has drained roughly $114 million in BTC since July 30 across more than 5,200 addresses, with victims describing the loss of life savings. On Aug. 3, the swap bridge Boltz halted its service indefinitely, saying “attackers now iterate faster than a team our size can find and patch.”
The Bitcoin Red Team formed in response to Coldcard. Calle, who helps run it, said on Aug. 5 that 16 researchers had filed 4,962 findings across 390 projects in 27.5 hours, including 85 critical and 635 high-severity issues.
Bitcoin traded near $64,800 on Friday afternoon, up 0.7% over 24 hours and 2.6% on the week, per CoinGecko, showing no reaction to the disclosure.
BitGo, a digital asset infrastructure company, announced it now offers Bitcoin Lightning Network access directly from its qualified custody platform. The move makes it one of the first companies to provide Lightning payments for institutional custody.
The service aims to give clients faster and cheaper Bitcoin transactions while keeping institutional security standards intact. It builds on BitGo’s earlier self-custody Lightning solution.
The new offering is powered through a partnership with Voltage, a Lightning Network infrastructure provider. Clients can now use Lightning without running their own nodes or managing keys. BitGo and Voltage handle infrastructure, channels, liquidity, and key management.
Through simple APIs, clients can create wallets, send payments, generate invoices, and track transactions. The platform integrates fully with BitGo’s existing wallet infrastructure, policies, and permissions.
Enterprises adopting Lightning usually face challenges like maintaining nodes, channels, liquidity, and keys. BitGo removes these hurdles. Institutions can now access Lightning with minimal setup and zero operational overhead.
BitGo, along with Ripple, Circle, Fidelity Digital Assets, and Paxos, received conditional approval from the OCC to become federally chartered national trust banks.
This shift from state to federal oversight allows them to offer nationwide fiduciary and digital asset custody services, enhancing regulatory clarity, institutional confidence, and the mainstream adoption of cryptocurrencies.
This move comes as Bitcoin’s Lightning Network hits a new all-time high of 5,637 BTC in capacity, driven largely by institutional inflows even as broader user adoption and node growth lag.
Data from AMBOSS shows the surge, concentrated in November and December, surpasses the previous peak from March 2023, signaling renewed confidence among major exchanges like Binance and OKX, which have added significant BTC to Lightning channels.
Despite rising capacity, the network’s number of nodes and channels remains below historical highs, highlighting a gap between capitalization and widespread use.
The increase coincides with ecosystem developments, including Tether’s $8 million investment in Lightning-focused startup Speed and Lightning Labs’ release of Taproot Assets v0.7, enabling reusable addresses, auditable asset supplies, and larger, more reliable transactions.
These upgrades position the Lightning Network as more than a micropayment system, offering potential for higher-value transfers that leverage Bitcoin’s security, speed, and low fees while expanding real-world financial applications on the network.
“By offering institutional access to Lightning directly from custody, we are allowing our clients to focus on innovation instead of infrastructure,” said Mike Belshe, BitGo CEO and co-founder. “We are combining the speed and lower transaction costs of Lightning with the trusted security of BitGo to make bitcoin practical for everyday payments.”
Lightning Stock Exchange (Lise), a new trading platform headquartered in France, has secured a Distributed Ledger Technology Trading and Settlement (DLT TSS) license from the Prudential Supervision and Resolution Authority (ACPR).
The approval marks a major step toward launching what Lise describes as Europe’s first fully tokenized equity exchange dedicated to small and medium-sized enterprises (SMEs).
“This approval authorizes us to operate the first tokenized stock exchange dedicated to equities in Europe,” said Lise’s managing director, Mark Kepeneghian, in a LinkedIn statement announcing the milestone.
Backed by leading French financial institutions including BNP Paribas and Bpifrance, Lise operates as a subsidiary of Kriptown — a company that brands itself as a “neo-exchange for startups and SMEs” focused on digital assets.
The exchange aims to bridge traditional finance with blockchain innovation, offering a regulated venue for SMEs to raise capital through tokenized equity offerings.
The DLT TSS license falls under the European Union’s DLT Pilot Regime, which provides a regulatory framework for market infrastructures using distributed ledger technology.
Introduced in March 2023, the DLT Pilot Regime governs the trading and settlement of financial instruments that qualify as crypto assets under the Markets in Financial Instruments Directive (MiFID II).
According to Lise, the license enables the creation of next-generation market infrastructure by integrating both market and post-trade functions within a single system.
This approach combines the roles of multilateral trading facilities (MTFs) and central securities depositories (CSDs), allowing for a more streamlined and efficient trading environment.
The company described the move as a “profound shift in how financial markets operate,” suggesting that blockchain-based settlement could significantly reduce transaction costs and processing times while improving transparency and security.
Lise’s approval follows its emergence from stealth in April 2025, when the company outlined its mission to “fundamentally rethink” the concept of initial public offerings (IPOs).
By leveraging blockchain technology, Lise plans to create a secure and cost-efficient alternative to traditional public listings.
“The first tokenized IPOs are expected to take place in early 2026, following the completion of issuer onboarding and final operational readiness testing,” Kepeneghian told Cointelegraph.
The company expects its debut tokenized IPO to serve as a proof-of-concept for its model, with plans to tokenize 10 additional IPOs in 2027.
The initiative has attracted attention from several major European banks.
In August, Caceis — the asset servicing arm of French banking group Crédit Agricole — acquired a minority stake in Kriptown to support Lise’s development.
Caceis said the move aligns with its long-term digital asset strategy and commitment to transforming financial market infrastructure.
Lise’s tokenization push comes amid growing momentum for tokenized securities across Europe.
Earlier this year, crypto exchanges such as Gemini and Kraken began offering tokenized securities to EU clients under the bloc’s evolving regulatory framework.
With its regulatory approval and backing from established financial players, Lise’s entry marks a milestone in Europe’s shift toward blockchain-based capital markets — one that could reshape how SMEs access funding in the digital age.
