Bitcoin traded just below the $65,000 mark on Saturday as market participants absorbed two separate threats to the network's operational integrity: a critical flaw in BTCPay Server exploited by attackers to take control of Lightning Network nodes, and the possibility of a BIP-110 fork that could expose holders to replay attacks.
Late on Friday, attackers leveraged a vulnerability in BTCPay Server to obtain credentials that control nodes running LND, the software used to facilitate rapid, low-fee Bitcoin payments on the Lightning Network. As of 04:54 ET (08:54 GMT), Bitcoin was trading up 0.61% at $64,986.0.
BTCPay's team confirmed that funds were taken and advised operators to either update immediately to version 2.4.2 or take their servers offline. The project has not released figures on how many operators were affected or the total amount of Bitcoin lost to the exploit.
The underlying issue enabled unauthenticated attackers to retrieve "macaroon" files, a form of credential used to grant access to LND nodes. With those files, attackers could assume control of Lightning wallets, force the closure of payment channels and transfer funds away from targeted nodes.
Hardware wallet maker Foundation reported that attackers drained its BTCPay Lightning node, but said the breach did not reach its on-chain hot wallet. A Bitcoin-focused publication, Citadel21, also reported losses from a Lightning node.
BTCPay-generated standard on-chain wallets were not affected by the flaw. However, the report noted that on-chain wallets tied to an LND node could still be exposed if attackers obtained the relevant credentials. Operators are expected to provide a fuller account of the incident once they have had time to implement the patch.
Separately, Bitcoin holders are confronting risks linked to a proposed BIP-110 fork that could begin around block 961,632 this weekend. The proposal would temporarily restrict non-payment data stored within Bitcoin transactions.
Miner signalling for BIP-110 stood near 2.6% on Friday, far short of the 55% threshold commonly required for activation. Despite that low signalling rate, machines running BIP-110 software are configured to reject non-signalling blocks once the activation height is reached, which could produce a minority chain.
In the event of a split, holders would initially possess equivalent balances on both chains. The act of selling coins on the forked chain could expose corresponding real BTC to replay attacks because the same signed transaction may be valid on both networks. Developer Kevin Loaec advised holders who cannot separate balances across chains to leave those funds untouched to avoid creating an opportunity for replay.
On a different technical front, the XRP Ledger's proposed version 3.3.0 includes an option for confidential transfers aimed at institutional tokenised assets. That functionality would encrypt account balances and payment amounts while providing mechanisms for selective disclosure to issuers, auditors and regulators. Activation of the feature would require at least 80% validator support for two consecutive weeks.
Market reactions on Saturday were modest, with most major altcoins tracking Bitcoin's modest gains.
- Ether rose 0.32% to trade at $1,916.82.
- XRP was trading at $1.0353, up 0.41%.
- Solana increased 2.16% to $74.78.
- Cardano was down 0.55%.
- Among meme coins, Dogecoin advanced 1.44%, while $TRUMP was unchanged for the day.
Operators, custodians and holders are being forced to weigh the immediate operational fix for the BTCPay vulnerability against the separate systemic risk that a contentious fork could pose to coin fungibility and transaction safety. The short-term market response has been limited, but the need for patches and careful handling of fork-related balances has become a pressing operational priority.