MARA Holdings secured $600 million of new borrowing on Aug. 4 after pledging 18,750 BTC worth about $1.2 billion as initial collateral, according to its Aug. 6 quarterly filing with the U.S. Securities and Exchange Commission. 

The financing came from Coinbase Credit and Two Prime Lending as MARA directs more capital toward energy assets, Bitcoin mining, artificial intelligence and high performance computing.

The loans were completed after the June quarter, when MARA reported holding 35,577 BTC with a fair value of about $2.1 billion. The pledged 18,750 BTC therefore equals roughly 53% of its reported quarter end Bitcoin holdings. MARA said it “expects to use the proceeds” for general corporate purposes, including financing part of the cash consideration for its planned Long Ridge Energy & Power acquisition.

MARA pledged 18,750 Bitcoin as collateral for $600M in new borrowing. 💸

That equals about 53% of its 35,577 $BTC holdings.

The loans were arranged through Coinbase Credit and Two Prime Lending. pic.twitter.com/iVti2eWxQV

— CryptosRus (@CryptosR_Us) August 9, 2026

MARA gets $600M while refinancing another $150M

Although the two facilities carry $750 million of combined principal, only $600 million represents new borrowing. Coinbase provided a $450 million facility consisting of $300 million in fresh funding and the refinancing of MARA’s existing $150 million Coinbase credit line. Two Prime separately provided a fully drawn $300 million term loan.

Coinbase’s debt carries a floating rate equal to the midpoint of the federal funds target range plus 3.875%. The Federal Reserve maintained its target range at 3.50% to 3.75% on July 29, which puts the current rate on the Coinbase facility at about 7.5%. The loan matures on Aug. 4, 2028 and automatically extends for another year unless either party cancels the extension.

Meanwhile, Two Prime’s $300 million facility carries a fixed annual interest rate of 7.65% and matures on Aug. 3, 2028. At the currently applicable rates, the two loans would generate about $56.7 million in annual interest expense if the full principal remained outstanding for a year. That figure is calculated from the disclosed rates rather than provided as MARA guidance.

Bitcoin collateral adds liquidity and margin risk

The financing shows MARA using its Bitcoin reserves as a source of liquidity alongside outright BTC sales. At June 30, the company already had 4,528 BTC pledged as collateral and another 4,742 BTC loaned to third parties. During the first six months of 2026, MARA also sold about 23,093 BTC for $1.6 billion to fund operations, pursue growth opportunities and manage liquidity.

MARA ended the second quarter with 35,577 BTC, down 29% from 49,951 BTC a year earlier. The company reported quarterly revenue of $174.9 million and a $611.3 million net loss, while declining Bitcoin prices contributed to a $342.7 million fair value loss on its holdings.

However, borrowing against Bitcoin also exposes the company to collateral requirements if BTC prices decline. MARA must maintain agreed collateral ratios under both lending arrangements. If the value of pledged assets falls below specified margin call limits, it must add collateral or take other permitted action to restore those ratios.

Failure to provide enough collateral would constitute an event of default and could allow Coinbase or Two Prime to liquidate pledged Bitcoin. The filing does not disclose the exact margin call thresholds, so public information does not show the Bitcoin price that would trigger additional collateral requirements.

Long Ridge connects the loans to MARA’s AI expansion

MARA has linked part of the new financing to its proposed acquisition of Long Ridge Energy & Power in Hannibal, Ohio. The company announced the transaction in April at an enterprise value of about $1.5 billion, including assumed debt. Long Ridge includes a power generation business and more than 1,600 acres that MARA plans to combine with its existing infrastructure at the site.

MARA says the property could support several workloads, including Bitcoin mining, power generation, AI infrastructure and high performance computing. Those plans remain forward looking. The company has not announced completed AI tenant contracts for the campus, although it said it had received interest from prospective customers.

The Ohio deal is part of a wider infrastructure expansion. MARA agreed in July to acquire a powered site covering more than 1,200 acres in Matagorda County, Texas. The purchase price can reach $600 million through milestone based payments, while MARA says the site could eventually support up to 2 GW of capacity.

MARA has also been reshaping its balance sheet to finance that strategy. In related coverage, the company sold 20,880 BTC during the first quarter and used part of the proceeds to repurchase convertible debt. By June 30, MARA said total debt had fallen to about $2.4 billion from $3.6 billion at the end of 2025.

What happens next for MARA

The next major milestone is completion of the Long Ridge transaction. MARA’s SEC filing says the acquisition carries an enterprise value of approximately $1.5 billion, including up to roughly $900 million of assumed debt. The company has also obtained a Barclays commitment for a 364 day senior secured bridge facility of up to $785 million as backstop financing for part of that debt if needed.

Closing is not guaranteed. MARA disclosed that it could owe a $75 million termination fee if the acquisition is not completed by Nov. 30, 2026. That deadline can extend to June 30, 2027 if certain regulatory conditions remain unresolved.

For now, the Coinbase and Two Prime loans give MARA $600 million of additional liquidity without requiring another immediate large Bitcoin sale or equity issuance. In return, a large portion of its Bitcoin treasury is now tied to lender collateral requirements. The balance between those financing benefits and the risk of lower BTC prices will remain a key factor as MARA moves toward the Long Ridge closing and continues building its U.S. energy and AI infrastructure portfolio.

The result was sobering. On the day after the 10 mass shootings with the most fatalities, traffic deaths rose by an average of 14.3%, about 20 additional deaths nationwide. Put another way, the extra deaths on the road equaled roughly 75% of the number of people killed in the shootings themselves.

Any surprising result invites an obvious question: Could it be a coincidence? To find out, we repeated the analysis 10,000 times, substituting fake, random dates for the dates of mass shootings. A spike as large as the one we observed arose only once in 10,000 iterations, making it clear that our findings were highly unlikely to have occurred by chance. The increase held across nearly every kind of driver, region, and weather condition, and it persisted even in states far from the shooting, which argues against local explanations like road closures or emergency response. And when we examined active-shooter incidents with no fatalities—events that drew much less public attention—we observed no rise in traffic deaths.

The rules, effective Jan. 1, 2027, cover transactions above $10,000 sent to overseas providers or self-custody wallets, along with other transfers flagged for review.

Brazil’s central bank will require virtual asset service providers (VASPs) to place precautionary holds of up to 24 hours on certain transfers to foreign platforms or self-custody wallets as part of new measures aimed at preventing fraud. 

On Friday, the Banco Central do Brasil (BCB) said the requirement will apply to funds received above $10,000, either in a single transaction or based on a customer’s total transactions in a day. Providers must also hold other transfers requiring further scrutiny under their risk-management policies. 

The rules take effect on Jan. 1, 2027. Providers must notify customers of holds and keep records of fraud incidents, attempted fraud and corrective actions. A VASP may complete its assessment and release a transfer before the 24 hours expire, provided that it follows parameters set out by the central bank. 

The measure adds Brazil to a growing list of jurisdictions tightening crypto safeguards as regulators confront scams that exploit the speed and cross-border reach of digital assets. 

Brazil joins global push against crypto scams

Brazil’s move follows anti-scam measures introduced in other jurisdictions. In Japan, the Financial Services Agency and National Police Agency asked crypto exchanges to restrict withdrawals after customers deposit fiat currency or buy digital assets. 

The authorities also called for platforms to require customers to preregister withdrawal addresses and impose a waiting period before newly added addresses can be used. 

Other proposed safeguards include customer-specific withdrawal limits, stronger monitoring, phishing-resistant multifactor authentication and checks that the name of a bank remitter matches the crypto account holder. 

Unlike Brazil’s regulation, the Japanese measures are not binding. In addition, exchanges can determine implementation based on their operations and exposure to misuse. 

Related: Brazil bars crypto settlement in regulated cross-border payment rails

European regulators have warned of criminals impersonating watchdogs and crypto companies as users search for licensed service providers after the EU’s Markets in Crypto-Assets licensing deadline. 

France’s financial regulator reported cases involving fake websites, while the European Securities and Markets Authority said scammers had misused its identity and logo in falsified documents. 

Magazine: 10 weirdest things ever tokenized… including farts

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

BTCPay Server has taken a defensive step for Bitcoin Lightning users, temporarily blocking public remote connections to Lightning Network nodes running LND after attackers reportedly exploited a critical vulnerability to steal credentials and move funds.

The project said Lightning payments can still be processed, but external wallets—such as Zeus—will be unable to connect via a BTCPay Server domain or a Tor onion address in Docker-based deployments until BTCPay decides it is safe to re-enable that remote access pathway.

Key takeaways

• BTCPay Server has temporarily restricted public remote access to LND nodes in Docker deployments to reduce the chance of further credential misuse.
• Version 2.4.2 installs LND 0.21.1 and automatically regenerates Lightning “macaroon” credentials for standard BTCPay installations.
• Operators are urged to look for signs of compromise, including unauthorized payments, unexpected channel closures, unfamiliar peers, and mismatches between onchain/Lightning balances.
• Deployments that expose LND through routes outside BTCPay—such as a user-managed reverse proxy, Tor service, or forwarded ports—must rotate credentials separately.

Why BTCPay is limiting remote access

In a statement shared by BTCPay Server on X, the team said the restriction is designed to prevent external wallets from reaching affected Lightning nodes through BTCPay’s publicly exposed endpoints. The immediate concern is not the Lightning protocol itself, but how remote access can be abused when attackers gain control over the credentials that authorize actions on an LND node.

BTCPay emphasized that the change is intended to be temporary. It also indicated its plan is to bring remote access back once it determines it is safe—an important operational detail for service providers that rely on broad wallet connectivity for day-to-day payments.

What version 2.4.2 changes in LND authentication

BTCPay’s fix centers on credential rotation. According to the project’s security guidance, attackers were able to obtain “macaroon” credential files without proper authentication. Macaroons are the authorization artifacts LND uses to control access to node capabilities. If an attacker acquires them, the potential outcome is full take-over of the LND node and the ability to move funds.

BTCPay said version 2.4.2 addresses the issue by installing LND version 0.21.1 and automatically regenerating macaroon credentials on standard BTCPay setups. For operators, this is significant because it reduces the likelihood of lingering compromised credentials after an update—though it does not eliminate the need for active incident checks.

The project advised operators to verify whether compromise attempts occurred by reviewing several common indicators: unauthorized payments, unexpected channel closures, unfamiliar peers, and discrepancies between their records and either onchain or Lightning balances.

Actions operators must take beyond updating BTCPay

BTCPay’s instructions also draw an important line between what the software controls and what an operator configures. The team stated that installing the update does not automatically close access routes managed independently by the operator. If an LND node is exposed through other paths—such as a reverse proxy configured by the operator, a Tor service not run through BTCPay, or a forwarded port—then credential rotation may need to happen separately.

That distinction matters because it changes the practical remediation workflow. Updating BTCPay may fix the credential lifecycle for standard deployments, but it may not fully protect a node that is independently reachable. For operators, the key is to inventory how their LND node is reachable and ensure authorization material is rotated everywhere that the node can be accessed.

Reported impacts from operators

BTCPay’s warning is not theoretical. At least two operators publicly reported that their Lightning nodes were drained after the incident.

Foundation CEO Zach Herbert said the Lightning node associated with the hardware-wallet company’s setup was drained overnight. He later clarified that the company’s hot wallet was unaffected, while its Lightning channels were closed and funds were swept. The operators did not disclose the amount lost.

Bitcoin publication Citadel21 also reported that its Lightning node had been swept, without specifying the size of the loss.

While these reports are limited, they underline the risk that credential compromise can translate into direct fund movement via Lightning channels—reinforcing why BTCPay is restricting public remote access and why operators are being asked to check channel and peer activity closely.

Broader security implications for Bitcoin users

BTCPay’s incident comes amid a wider pattern of security problems affecting popular Bitcoin products. The BTCPay breach is described as part of the most recent wave of vulnerabilities impacting Bitcoin-adjacent tooling, following a Coldcard hardware-wallet flaw that was linked to more than $100 million in confirmed losses, as referenced in earlier coverage by Cointelegraph.

In other words, the underlying Bitcoin network is not the target; the failures occur in the surrounding systems—wallets, custody interfaces, and node management software—that users depend on to interact with the protocol.

For Lightning operators, the immediate next steps are clear: update to BTCPay Server version 2.4.2 (or apply the relevant fixes), verify that macaroon credentials are rotated as expected, and actively audit for unauthorized payments, unexpected channel behavior, unfamiliar peers, and balance mismatches. As BTCPay evaluates when to restore remote access, operators should also monitor how their own exposure routes outside BTCPay are configured—because those may determine whether the risk has truly been eliminated.

BTCPay Server has temporarily blocked public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) after attackers exploited a critical vulnerability to obtain credentials and move funds. The project says Lightning payments can still proceed, while it works to make remote access safe again.

In a security-driven update, BTCPay Server announced that version 2.4.2 installs LND version 0.21.1 and automatically regenerates the “macaroon” credential files used to control LND on standard deployments. Operators are also urged to inspect their nodes for signs of compromise, including unauthorized payments, unexpected channel closures, suspicious peers, and mismatches between recorded balances and what’s actually present onchain or in Lightning.

Key takeaways

• BTCPay Server 2.4.2 restricts public remote connections to LND on Docker deployments, preventing external wallets from connecting via BTCPay domains or Tor onion addresses.
• The update automatically installs LND 0.21.1 and regenerates LND macaroon credentials on standard BTCPay installations.
• Operators should monitor for unauthorized payments, unexpected channel closures, unfamiliar peers, and balance discrepancies as indicators of theft.
• If an operator exposes LND through their own reverse proxy, Tor service, port forwarding, or other routes outside BTCPay, credentials must be rotated separately.

Why BTCPay moved to block remote LND access

BTCPay Server’s advisory centers on a specific failure mode: a critical vulnerability that, according to BTCPay, allowed an unauthenticated remote attacker to obtain the macaroon credential files that authorize control of an LND node.

Those credentials are effectively the key material that lets a party manage or act on behalf of the node. BTCPay warned that exposed credentials could enable attackers to take control of the LND instance and move funds.

To reduce the attack surface while remediation is rolled out, BTCPay temporarily restricted public remote connections to Lightning nodes running LND software through BTCPay-managed endpoints. In its statement, BTCPay highlighted that the change blocks external wallets—including Zeus—from connecting through a BTCPay Server domain or a Tor onion address in Docker deployments.

Importantly for day-to-day operators, BTCPay said Lightning payments can continue. The restriction is framed as a stopgap measure until the project believes it is safe to restore the prior remote-access functionality.

What the 2.4.2 update changes for operators

BTCPay’s fix is delivered through version 2.4.2. The project says this release installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard BTCPay installations.

That automatic rotation is designed to address the core risk identified in the security advisory: attackers who acquired credentials could use them after the fact unless the underlying authorization artifacts are replaced. By updating both the LND version and the credentials used for control, BTCPay is effectively forcing the authorization state to reset for typical deployments.

Alongside the software changes, BTCPay provided a targeted checklist for operators to validate that compromise has not occurred. The project advised checking for:

• Unauthorized payments, which would indicate someone managed the node outside the operator’s intent.
• Unexpected channel closures, which can signal hostile channel management or forced routing behavior.
• Unfamiliar peers, which may reveal that an attacker established connections to the node.
• Discrepancies between what operators expect and what appears in their onchain or Lightning balances.

Crucially, BTCPay also addressed a deployment reality: not every operator exposes LND only through BTCPay’s own routing. For those running their own reverse proxy, Tor service, forwarded port, or alternative access path, BTCPay said installing the update does not close access routes managed independently. In those cases, operators must rotate credentials separately for any LND exposure outside BTCPay-controlled endpoints.

Public reports of losses, without disclosed amounts

After the vulnerability and remediation became part of the public conversation, at least two operators reported losses linked to their Lightning nodes being swept, though neither disclosed the amount taken.

Foundation CEO Zach Herbert stated that the hardware-wallet company’s Lightning node was drained overnight. He later clarified that its hot wallet was unaffected, while its Lightning channels were closed and the funds were swept—suggesting the compromise was confined to Lightning-channel controls rather than broader wallet infrastructure.

Separately, Bitcoin publication Citadel21 reported that its Lightning node had been swept. Like Herbert’s comments, the publication did not provide figures for how much was lost.

While the reports do not establish the scale of the incident across all BTCPay users, they do reinforce the advisory’s practical implication: credential exposure can translate into actionable control over Lightning funds, and remediation needs to happen quickly and thoroughly.

Security incidents keep targeting Bitcoin infrastructure around the network

BTCPay’s incident is the latest in a run of security problems affecting popular Bitcoin products. Earlier coverage from Cointelegraph highlighted a Coldcard hardware-wallet flaw associated with more than $100 million in confirmed losses, underscoring that the targets have tended to be software and infrastructure components built around Bitcoin—not the Bitcoin protocol itself.

This pattern matters because it shifts risk away from “Bitcoin as a network” and toward the systems people use to interact with it: wallets, node operators, payment servers, and bridging software between users and blockchain operations. In practice, that means the most valuable defenses are often operational—timely patching, correct credential rotation, careful exposure management, and continuous monitoring for anomalies.

BTCPay’s temporary restriction of remote access can be read as another step in that operational defense model: reduce inbound paths that could allow credential abuse, even as updates roll out and operators harden their setups.

For now, the most important thing for BTCPay operators is to apply version 2.4.2 and verify their exposure paths, then audit their nodes for the specific compromise indicators BTCPay listed. Readers should also watch for whether BTCPay restores remote-access features once it determines the remaining risk has been fully mitigated for the relevant deployment types.