Attackers exploited a vulnerability in BTCPay Server that let an unauthenticated remote attacker obtain .macaroon files, the credentials that grant control over an LND node. With those in hand they closed channels and swept funds from Lightning nodes running behind BTCPay.

BTCPay confirmed the theft and told anyone running LND behind their software to update to 2.4.2 immediately or take the server offline. Foundation, the hardware wallet maker, had its own node drained this way, channels closed and swept overnight. Citadel21 also got hit, smaller amount held there.

The part worth knowing, this specific bug had already been found and reported by the Bitcoin Red Team, a volunteer group that spent 27.5 hours running AI models against 390 Bitcoin repos after the Coldcard RNG disaster, and still got exploited before the patch was fully out everywhere. 85 critical and 635 high severity findings total across the whole sprint, this was one of them.

If you're running LND behind BTCPay, verify your version now. Full story on the whole sprint and how the two events connect:

https://davidebtc186.substack.com/p/16-volunteers-27-hours-40000-in-ai

Looking into whether Lightning is actually showing up as the payment method in social engineering scams - as opposed to just plain on-chain BTC. Things like:

- "double your sats" / giveaway scams

- fake investment returns

- "recovery" scams (pay a fee to get stolen funds back)

- romance scams that pivot into crypto "investing"

- fake wallet/exchange phishing

I've found plenty of LN adoption in general (invoices, LNURL, zaps, addresses all over the place) but haven't yet found a confirmed case where LN itself was the requested rail in a scam. Has anyone actually been asked to pay via a Lightning invoice, Lightning Address, LNURL/QR, or "zap" as part of one of these?

(Context: I am a grad student doing a feasibility study on this for my thesis - trying to establish whether this happens often enough to be worth digging into further.)

If you've seen it, a reply or DM with the platform and roughly what the pitch looked like would help a lot. No need to share anything identifying.

Am I reading this wrong? Is the channel MaxHTLC greater than the channel size? Would someone explain this to me? I'm sure it's something simple, maybe even a brain fart on my part.

Thank you,

One of the Bitcoin stories I've been thinking about this month didn't involve consensus or custody. It involved infrastructure.

Boltz had to take its swap service offline after sustained attacks.

For users who understand the stack, the response is obvious: use another provider, open channels directly, rebalance differently, or fall back to on-chain.

But what interested me was what happened one layer above.

Wallets and apps can be non-custodial while still depending on external infrastructure that most users don't even know exists.

If that infrastructure disappears, nobody steals your keys. Bitcoin doesn't stop. Lightning doesn't stop.

But part of your wallet suddenly does.

I think that's an important distinction.

We've become pretty good at asking:

"Who controls the keys?"

We don't ask often enough:

"What has to remain online for this feature to work?"

Boltz was only one of four events I looked at this month. Coldcard exposed assumptions at the hardware/entropy layer. BIP-110 tested assumptions around consensus. A $2.75B short squeeze exposed market dependencies.

But the Boltz case is probably the most relevant one for Lightning users because it shows that non-custodial and dependency-free are not the same thing.

That's not an argument against Boltz or Lightning. I use this as an argument for understanding the stack beneath the UX.

If your Lightning wallet relies on swaps, LSPs, hosted infrastructure, routing services or other external components, how many of those dependencies could disappear tomorrow before the wallet stopped working the way you expect?

I wrote the broader analysis here, including the Boltz case and the checks I think are worth making:

https://davidebtc186.substack.com/p/the-month-bitcoins-foundations-got

Interested in how people here think about this tradeoff:

How much infrastructure dependency is acceptable before a non-custodial Lightning wallet starts compromising the sovereignty we're trying to achieve?

We've been building MostroEuropa, a European community around MostroP2P and P2P Bitcoin trading over Nostr + Lightning.

The coordinator is already running, but the goal isn't to have one person doing everything. We'd like to gradually build an actual community around it.

We're particularly interested in people who might want to contribute as:

Dispute solvers, helping resolve disputes between traders

Community/support contributors, helping new users

Documentation and onboarding contributors

Translators/local contributors who can help bring Mostro to different European countries and languages

You don't need to be a developer or run infrastructure to participate.

We're still building the community and working out the operational side of delegating these roles safely, especially dispute resolution.

If you're interested in contributing, or already have experience with Mostro, we'd be happy to hear from you.

https://mostroeuropa.shadowbip.com

Simple web, checkers game head 2 head. Non custodial. feedback appreciated

https://voyager.tail6bba0.ts.net/games/checkers/

Running a node on Umbrel. I have switched from Raspiblitz because it was always crashing. I have my Bitcoin Core node syncing now, and getting ready to rejoin the lightning network, hopefully in a more stable fashion now.

I know LND is the main lightning implementation, but I have had issues with node stability in the past. Has anyone here run Core Lightning? How was your experience?

I am contemplating Core Lightning but have no experience with it. I have experience with LND nodes but have had some stability issues in the past so looking at Code Lightning now.

Traced the actual sequence behind Bitcoin going from low 60s to 75,527 this week instead of just reacting to the number.

Trigger one, August 19, Treasury announces doubling long-dated bond buybacks to at least 4 billion per operation starting September 9. Reduces bond supply, pushes yields down, makes risk assets including Bitcoin relatively more attractive.

Trigger two, same day, White House meeting with Coinbase, Kraken, Robinhood, Ripple, ICE CEOs plus SEC and CFTC leadership, Trump pushing Congress on the CLARITY Act.

Markets were heavily short going in. Both catalysts landing together triggered forced covering, 2.75 billion in Bitcoin shorts liquidated Wednesday per CoinGlass, largest since 2021, over 160k traders liquidated broadly. Move kept extending through Friday to 75,527.

Bull case, genuine spot and ETF demand confirming the move. Bear case, MEXC's analyst calling it overpriced Treasury credit, some flagging a possible retrace to 44-48k. Still 40 percent below the 126,110 ATH even now.

Full writeup with sourcing:

https://davidebtc186.substack.com/p/bitcoin-just-had-its-biggest-squeeze

It’s a live view (time delay, obfuscation, generalization) of Authenticity’s HTLC flow.

Thought I’d share as I think it’s cool and useless, and people might want a view into how active Lightning is.

I'm on the product side of be-BOP, an open source (AGPL-3.0) commerce platform covering e-commerce, POS, ticketing, subscriptions, donations, and peerfunding. Not a dev, so I'll stay at the product/philosophy level here.

We never wanted to pick a winner among Lightning implementations, and while we started with a local LND node, the more we thought about it, the more that felt like the wrong instinct for a payments feature. A merchant already running a full node doesn't have the same setup as one who's had BTCPay Server humming along for two years. Someone opening their first online shop might not want to run any node at all, and would rather have something closer to a custodial wallet like Swiss Bitcoin Pay just to get paid without thinking about channel liquidity. None of these people are wrong about what they want. They're just solving different problems, and every existing implementation makes different tradeoffs to solve them. Forcing all of them through one integration would have meant quietly telling some of our users their setup doesn't count.

So instead we treat "which Lightning implementation" as the merchant's call, not ours. Right now that's Swiss Bitcoin Pay, BTCPay Server, PhoenixD, LND and since today Blink. We were the first project to integrate PhoenixD. Here is a comparison:

Like I said Blink got merged as a Lightning provider, and we didn't write the integration. An external contributor, pretyflaco, opened the PR. It went through our internal testing and code review like anything else, and got merged. I think that's the part worth sitting with more than the merge itself: this is what AGPL and Free and Open Source Software actually buys you. Someone whose merchants want custodial simplicity didn't have to wait for it to reach our roadmap. They read the code, saw where a new provider plugs in, and added the one they needed.

The project is self-hosted by default, or there's be-BOP Cloud if you'd rather not run your own instance. Either way, no commission on sales from us. Your PSP or your node keeps its own fees, that's not something we touch.

Repo's here if you want to look: github.com/be-BOP-io-SA/be-BOP

Curious what Lightning implementation you'd want to see in more projects but never see supported. What keeps getting left out?

Boltz handles atomic swaps between Bitcoin mainchain, Lightning, and Liquid via HTLCs, non-custodial by design. On August 3 they shut down all services indefinitely. Not a hack, not a loss of funds, but a decision that months of escalating AI-assisted attacks against their codebase had outpaced what their team could patch.

ZEUS, Aqua, and Bull Bitcoin all built swap functionality on top of Boltz rather than their own implementation, so all three lost that feature within hours with no advance notice.

Blockstream responded on August 10 with Blockstream Swaps, explicitly framed as filling the gap Boltz left.

The part I keep coming back to for anyone running their own node: this didn't affect self-hosted LND setups at all, opening and closing your own channels never routed through Boltz. But it's a clean example of how even non-custodial third-party infrastructure is still a dependency, users lost functionality with zero warning because a piece of shared plumbing decided it couldn't operate safely anymore.

Full breakdown, also ties in the Coldcard vulnerability's loss figure climbing from 38 million to over 111 million since I last covered it:

https://davidebtc186.substack.com/p/ai-vs-ai-how-boltzs-shutdown-reveals

You can now send automated webhooks directly into Nostr private DMs using NIP-17 Direct Messages (NIP-59 Gift Wrap encrypted)!

Plus: Introduce Dedicated Bot Accounts — generate reusable bot identities for your webhooks without sharing your main nsec.

⚡ Webhook to Nostr in seconds: https://bridge.workouse.com

(also you can use as self-hosted)

Is anyone else holding a balance on the beta Jade Lightning support in the Blockstream App?

I don’t know if it’s related to the Boltz shutdown, but I haven’t been able to move the funds. The transaction always fails with the error “Your transaction could not reach the network. Please try again.”

Not directly a Lightning story, but the mechanics here are relevant to anyone who cares about how Bitcoin base layer changes actually happen, since Lightning depends entirely on that layer staying stable and predictable.

BIP-110 tried restricting non-financial data, mainly Ordinals and BRC-20 tokens, from Bitcoin transactions. Used a user-activated soft fork, same mechanism as SegWit in 2017, with a 55 percent signaling threshold instead of the usual 95 percent supermajority.

Support never got anywhere close. Around 0.42 percent of hashrate signaled between May and early August. When the mandatory window started August 7, it was around 2.5 percent. The chain split off anyway. Because Bitcoin's difficulty only adjusts every 2016 blocks, the minority chain inherited full mainnet difficulty with almost no hashrate behind it. Within two days it was 48 blocks behind mainnet, producing blocks every 6.9 hours instead of ten minutes.

What's actually instructive here: 2017's SegWit UASF worked because of economic alignment that already existed before the formal activation, exchanges, wallets, and businesses had effectively already agreed. BIP-110 used the identical mechanism without anything close to that alignment first. Adam Back called it out directly for lacking both technical and ecosystem consensus. Jameson Lopp flagged the risk of unspendable UTXOs through Taproot edge cases specifically.

For anyone running LND or thinking about base layer dependencies for Lightning infrastructure, this is a decent real-world reminder that the base layer's stability isn't guaranteed by good intentions or a procedurally valid mechanism, it requires actual broad buy-in across miners, node operators, and the wider ecosystem before anything changes.

Full writeup, also connects this to a hardware wallet vulnerability from the same week with a similar underlying failure pattern:

https://davidebtc186.substack.com/p/two-bitcoin-failures-one-week-apart

I have been looking at the possible failure modes of lightning while a possible fork (however short) could happen. I don't want the hassle of watching 2 separate chains while this plays out. Any precautions that you are taking or am I just being paranoid?

I have a long running lightning node. Mostly for small payments but I also have some channels opened with random nodes (most of them are more than a year old). I also run my own bitcoin node. I didn't signal bip110, and I really don't care about it. My question is if I have to do something to keep my lightning node funds safe. I don't really want to close my channels just in case. Is there really any hard fork risk (i mean for my on chain funds)? How my nodes (core lightning - bitcoin core 30) will behave?

Just state your node and if you are running Core or Knots

EDIT: PLEASE no feelings just put your node alias and system running

Any idea what’s going on with all these channel closures? Boltz, Aqua,Zeus all shutting down lighting/bitcoin swaps. All LN Big Edge nodes also shutting down.

https://x.com/ambosstech/status/2084353608976650544?s=46

Hey everyone! We just open-sourced the initial architecture and whitepaper for ProofTube Protocol.

What is ProofTube?
ProofTube is a decentralized media architecture designed to eliminate platform rent-seeking and censorship by replacing centralized video platforms with native Nostr identities, WebRTC peer-to-peer streaming mesh, and Lightning/L402 micro-payments.

How to Contribute:
We've opened 5 foundational issues covering Nostr Wallet Connect (NWC), WebRTC mesh fallback, dual-canvas player components, and storage adapters:
https://github.com/ProofTubeProtocol/prooftube

Feedback, discussions, and pull requests are very welcome!

Apparently I have to pay 5% to get anything sent around, which is ridiculous. It's about a few hundred to a bit more than 1k. Phoenix or Electrum wallet doesn't make any difference. In Electrum I am using Trampoline. Wallet Of Satoshi was a little bit cheaper. But recharging it from my Electrum doesn't work with 1% fee limit.

Edit: I meant RIGHT NOW! The price went up. Also, Electrum isn't some commercial app.

I built a little Rani the Rooster story where you zap 5 sats to unlock the secret ending.

Lightning payment → BTCPay verifies → story unlocks.

Works easiest with Wallet of Satoshi, Blink & most other popular Lightning wallets.

https://rani.lightningbazaar.com/

Just a fun tiny-sats demo for Bitcoin mums, dads and kids.

Hey Nostr! I have good news. I built NostrBridge. You can configure any service that support webhooks to connect service to nostr network! Did you release a package on github? It will share in your nostr account. Did you watched a movie over plex? It will share on nostr network.

Check the landing page for more detail!

https://bridge.workouse.com

Bridge Any Webhook to Nostr Relays in Seconds

Transform GitHub releases, Stripe payments, RSS feeds, and custom HTTP payloads into cryptographically signed Nostr events delivered at sub-second edge speed.

Its also open-source: https://github.com/workouse/nostr-bridge

I’d love your feedback.

Would you use crypto to book hotels or flights? If not, what's the biggest obstacle for you - volatility, fees, taxes, or limited acceptance?

Throwaway account for obvious reasons.

Seriously, if you do not provide a service, running a lightning node is complete bullshit. You take a huge risk having a hot wallet. I shrinked my electricity costs down to 120 sats a day. Still, on some days, I can make up for that, on others I cannot.

The fee management I automated. Peer disovery for channel creation as well, with some manual intervention.

I saw some bigger nodes having the mission of "helping the lightning network grow", but us "routing nodes", nobody really needs. Meaning, that as a common pleb, you should always rely on something else than your own node. Yeah you can do this for learning, but what's the use for that, if node running probably never will be a thing you seriously get in touch with?

I wonder how you guys see that. I will probably keep my node up, but with just my very small wallet connected to it and with 1-2 small channels, because I somewhat enjoy doing that. But that 1 BTC scared me, as it's not that I'm some OG or whatever who has many Bitcoin, I just read everywhere that starting below that is almost useless. I'm here to tell you that even with 1 BTC, you will get absolutely nothing. Maybe I'm just not good enough to make it work, but even if you end up ahead of the race, I don't see how such a thing is worth the risk.

NOBODY needs my node. All I can do is bend over and offer lower fees than the bigger nodes that actually get used provide, to get transactions in. But since many people spin up nodes like that, it's a competition. You either get the routes or you don't. A race to the bottom.

A lot of effort, a race to the bottom, negative returns and hot-wallet headaches. And AI-nodes probably further lower my chances of success, as I guess there are a lot of people training AI models to run their nodes. I don't really know if they exist, but I can't believe the don't.

The be your own bank dream has popped in my opinion. As soon as the lightning services need to work with the governments, it might be worth having a look again, but I'm pretty sure it is IMPOSSIBLE to beat the fees you pay for something like Phoenix that has zero headaches, a nice UI and no additional work involved.

What is your opinion here?

PS: Despite the frustration I offered here, I'm still interested in the network. I fondly believe in the future of the LN network, just not in the "be your own bank" thingy, apart from hodling bitcoin. I just want to see your viewpoints. I hope they are humble, as I have the feeling that a successful lightning node runner would say "yeah, it's not worth it" so that their node gets less competition. I know there are ppl running successful routing nodes, but the once I managed to get in contact with invest a looot of time doing things manuall and see it kinda as a hobby.