BTCPay Server Warns Of Active Exploit As Bitcoin's Token Wars Escalate
Bitcoin's open-source payment infrastructure is the latest target in a widening wave of AI-assisted attacks. BTCPay Server, Boltz, and a volunteer group calling itself the Bitcoin Red Team all made moves this week that point to the same problem: attackers are finding bugs faster than developers can patch them.
A LIVE EXPLOIT ON BITCOIN'S PAYMENT RAILS
BTCPay Server issued an urgent security advisory after confirming that attackers are actively exploiting a critical vulnerability that could allow unauthorized access to Bitcoin payment servers and potentially lead to loss of funds. The project credited members of the Bitcoin Red Team, including Rob Hamilton, Craig Raw, Calle, and Evan Kaloudis, for privately reporting the vulnerability through responsible disclosure.
BTCPay Server urged users to immediately upgrade to version 2.4.2, and advised operators unable to patch right away to shut down their servers until they could update. The project also told users to replace credentials known as macaroons, recreate the macaroons.db file, refresh authentication strings for other Lightning Network backends, and move funds out of any hot on-chain wallet generated in BTCPay.
THE RED TEAM RACING THE CLOCK
The Bitcoin Red Team is not a company. It is a volunteer effort that has been grinding through the entire Bitcoin codebase since the Coldcard theft. By August 6, the group had found 4,962 potential issues while reviewing 390 Bitcoin-related projects, classifying 720 of those findings as high or critical severity.
AnchorWatch chief executive Rob Hamilton said the volunteer red team filed more than a dozen security disclosures after scanning 150 repositories on about $20,000 of AI spend. A pseudonymous developer working alongside the group, known as Calle, said reviewers are averaging one critical exploit found per hour per person. The work traces directly back to the theft that hit Coinkite's Coldcard Mk3 hardware wallet, where a seed-generation flaw let attackers sweep 594 BTC, then worth roughly $38 million, from about 500 wallets in July.
LIGHTNING SWAPS GO DARK
The pressure has already forced one Lightning service offline. Bitcoin swap provider Boltz suspended its service after several exploits, saying AI-assisted attacks were finding vulnerabilities faster than its team could fix them. Other wallets that relied on Boltz's infrastructure had to respond in turn, while Zeus, a separate Lightning wallet, said its own investigation found no comparable issue. Zeus said no customer funds were lost or placed at risk, that its investigation had not identified a vulnerability in Lightning node software, and that no evidence currently connects the Zeus incident to the BTCPay Server vulnerability.
A $6 MILLION DARE TO ANTHROPIC
The same week produced a very different kind of test. BitGo CEO Mike Belshe transferred 100 bitcoin into a public BitGo wallet and challenged Anthropic to prove its AI hacking capabilities against institutional cryptocurrency custody, transferring exactly 100 bitcoin into a publicly visible wallet before posting its address on X.
"Either Anthropic is terrible at building sandboxes, or excellent at marketing (or both). But enough with the 'hacking monster' games. Do it for real. I put this in a BitGo wallet for you. Go get it."
The wallet contained exactly 100 bitcoin, valued at roughly $6 million at prevailing market prices, and blockchain records showed the funds remained in the address following the challenge, with no outgoing transactions recorded as of Sunday. Anthropic has not accepted.
Every piece of this week's news points to the same asymmetry: the cost of attacking Bitcoin's code has collapsed, and the defenders are the ones now working around the clock to close the gap. The BitGo wallet sitting untouched is the clearest scoreboard anyone has put on the table so far.
This story comes from the Simply Bitcoin Live show. Watch the full episode.
