BTCPay Server supporters have backed a recovery bounty equal to 10% of funds retrieved from a recent Lightning wallet exploit, with the reward capped at 3 BTC if all stolen assets are recovered.

The BTCPay Server project said on Monday that the bounty is part of its response to a critical security flaw that exposed LND administrator credentials on vulnerable installations, days after users were told to immediately upgrade to version 2.4.2.

The open-source Bitcoin payment processor has not disclosed how much cryptocurrency was stolen or how many servers were compromised. However, several affected users, including Foundation and Citadel21, have reported that funds held in their Lightning nodes were drained.

BTCPay said the vulnerability affected all releases before version 2.4.2, including release candidate versions of 2.4.2. The flaw allowed an attacker to obtain LND admin macaroon credentials from exposed BTCPay instances and then access wallets connected to the affected Lightning nodes.

A macaroon works as an authentication credential for a Lightning node, with an administrator macaroon providing extensive permissions over the associated wallet. Access to those credentials can therefore allow an unauthorized party to control funds held through the affected LND setup.

BTCPay Server exploit was fixed in version 2.4.2

Following the discovery, BTCPay released the final version of 2.4.2 with a fix for the vulnerability and urged operators running older versions to update their servers.

The project said the security issue was specific to LND credentials and did not expose users running other Lightning implementations through the same attack route. Operators who do not use Lightning were also not affected by the LND credential issue, although BTCPay recommended that all users install the latest release.

BTCPay’s onchain wallets were not compromised through the vulnerability, including onchain hot wallets maintained by users of the software, according to the project.

The distinction limits the known attack path to connected LND wallets rather than the full range of Bitcoin funds that can be managed through a BTCPay installation.

Although BTCPay has yet to release figures for the losses, reports from individual users have confirmed that the exploit resulted in stolen funds. The project is preparing a full postmortem that is expected to provide more information about the vulnerability and the response.

BTCPay has also started introducing stronger code-scanning and review procedures with assistance from several external organizations.

The response follows a difficult year for crypto security. In April,crypto.news reported that CertiK had recorded more than $600 million in crypto losses during 2026 at the time, while the security firm warned that AI-assisted attacks and weaknesses in infrastructure were becoming important risks for projects.

Researchers receive 0.42 BTC for finding the flaw

Alongside the recovery bounty, the BTCPay Server Foundation is paying rewards to the researchers who identified the vulnerability before it was publicly disclosed.

The foundation is donating 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team fund. Raw discovered the security issue and privately reported it to BTCPay, allowing developers to prepare a fix before details of the flaw became public.

Raw later said he had also been affected by the exploit.

Bitcoin Red Team operates as a volunteer security research group whose members include Rob Hamilton, Calle and Evan Kaloudis. The group works on finding and reporting vulnerabilities affecting Bitcoin-related software.

BTCPay’s decision to fund both researchers comes alongside the separate recovery bounty backed by project supporters. Under the proposed terms, 10% of successfully recovered funds can be paid as a bounty, while a complete recovery would carry a maximum reward of 3 BTC.

Recovery incentives have also surfaced after other crypto exploits this year. In July, crypto.news examined efforts to recover roughly 16 million ADA taken from 374 Cardano wallets in a late-June exploit. EMURGO outlined a process to return affected assets while an independent forensic team conducted a separate investigation into the incident.

AI may have helped uncover the BTCPay Server exploit

As part of its initial assessment, BTCPay raised the possibility that artificial intelligence tools could have played a role in finding the vulnerable code.

The project said improving AI models have reduced the time and cost required to inspect large software repositories for weaknesses, changing the capabilities available to both attackers and security researchers.

Bitcoin software presents an attractive target because exploitable weaknesses can provide direct access to assets, BTCPay said, adding that other areas of the software industry could eventually face similar problems as AI-based code analysis becomes more capable.

Concerns over AI-assisted attacks had already surfaced elsewhere in the crypto sector. CertiK reported in June that crypto hacks and exploits caused $68.3 million in losses during May, down nearly 90% from roughly $650 million in April, but the firm also recorded an increase in AI-assisted malware targeting code repositories and coding tools, as previously covered by crypto.news.

A July analysis of AI security also examined how increasingly capable models can identify and exploit software vulnerabilities, with the technology arriving during a year already dominated by large crypto security incidents.

The BTCPay incident differs from attacks based primarily on social engineering or compromised signing devices because the entry point was a software vulnerability that exposed sensitive LND authentication credentials.

Coldcard exploit raised similar AI concerns

The BTCPay attack has followed another major Bitcoin security incident involving Coldcard hardware wallets, where the suspected use of AI to inspect older code was also raised after funds were stolen.

At least $116 million in losses have been confirmed from the Coldcard exploit so far. Coinkite, the company behind Coldcard, said it considered it likely that someone had used AI to examine older publicly available firmware and identify the weakness.

The two incidents have put code review under increased attention at a time when attackers have already moved beyond conventional smart contract vulnerabilities.

In April, crypto.news reported on more than $17 billion lost across 518 documented crypto hacks and exploits over the previous decade, citing DefiLlama data. The report found that private key leaks, credential theft, phishing and attacks against wallets and infrastructure had become major sources of losses alongside flaws in smart contracts.

Chainalysis has separately estimated that attackers stole $36.7 million from unverified, closed-source smart contracts during the first six months of 2026 by decompiling contract bytecode. The blockchain analytics firm assessed that AI was very likely involved in this activity.

For BTCPay users, the immediate remediation remains the official 2.4.2 release. The project has said it will publish a more detailed postmortem on the exploit while its new code-scanning and review procedures are being developed with external organizations.

Easing concerns over the situation in the Strait of Hormuz provided support for risk-sensitive assets. On 8 August, the Iranian side reported progress in talks with Oman over a possible new route through the strait, although the implementation of any agreement remains dependent on additional conditions. Reduced concerns over potential disruptions to energy supplies helped improve investor sentiment, although uncertainty surrounding the region continues to create the potential for increased volatility.

Technical Analysis of Ethereum

The ETH/USD technical picture shows that after peaking around $1,975 in late July, the price formed a pattern resembling a contracting triangle. The breakout occurred on 10 August, when a large red candle broke below both the triangle’s lower boundary and the lower boundary of the current market profile at $1,894, creating the conditions for a downside move out of the pattern. As a result, the price moved into the zone between the lower profile boundary and the green support level at $1,854. Continued selling pressure could pave the way for a test of this area.

If the trend reverses and the price returns to the profile range, market participants should focus on the area comprising the POC at $1,915 and the upper profile boundary at $1,925. Above these levels lies the red resistance level at $1,942. It is also worth noting that the breakout was accompanied by an increase in volume, indicating stronger selling activity at that point. Following the decline, the RSI + MAs indicator shows readings of 32, 52 and 53. The oscillator has moved out of the neutral zone, while the moving averages remain some distance from crossing below its lower boundary.

Summary

Geopolitical developments surrounding the Strait of Hormuz remain one of the key factors influencing sentiment across the cryptocurrency market, while the breakout from the contracting triangle on 10 August pointed to increased selling pressure in the short term. Ethereum’s further performance will depend on how the market responds to the latest news flow.

FXOpen offers the world’s most popular cryptocurrency CFDs*, including Bitcoin and Ethereum. Floating spreads, 1:2 leverage — at your service (additional fees may apply). Open your trading account now or learn more about crypto CFD trading with FXOpen.

*Important: At FXOpen UK, Cryptocurrency trading via CFDs is only available to our Professional clients. They are not available for trading by Retail clients. To find out more information about how this may affect you, please get in touch with our team.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Ravencoin disclosed on Aug. 11 that a critical consensus vulnerability had been exploited since Aug. 7, allowing vulnerable nodes to accept invalid blocks beginning at height 4,487,776. 

The project warned in its notice that a recovery chain being mined by 2Miners and RavenMiner could trigger a deep reorganization spanning “approximately three days” if it becomes dominant.

The alert followed an emergency software release from 2Miners on Aug. 10. The pool said the flaw sits in KAWPOW block header validation and allows an attacker to bypass the normal memory intensive mining process. Ravencoin advised exchanges to halt RVN deposits and withdrawals and told users to treat confirmations after block 4,487,775 as potentially reversible.

Ravencoin bug allowed cheap invalid blocks

2Miners said the KAWPOW header contains an nHeight field that was not checked against a block’s actual position in the chain. By manipulating that value, an attacker could reach a validation path that skipped full proof of work verification and accepted a supplied mix hash without confirming genuine ProgPoW work.

The emergency release said blocks created through the flaw carried no genuine ProgPoW work and were “orders of magnitude cheaper” to produce than honest blocks at the same difficulty. It also documented two effects seen on mainnet: affected nodes could fail after restarting, while nodes attempting to synchronize could encounter broken header sequences and fail to catch up.

2Miners said exploitation continued from Aug. 7 through its Aug. 10 release. Between heights 4,489,527 and 4,491,615, it identified 96 affected blocks among 2,089 examined. A separate sample covering the period before Aug. 7 found no affected blocks, supporting the identified starting point.

2Miners ships emergency patch as recovery continues

2Miners released version 4.6.1.1-hf1, which rejects blocks whose declared header height differs from their actual chain position starting at 4,487,776. The patch also adds a checkpoint at 4,487,775 and rebuilds chain state when damaged index data prevents a node from continuing normally.

The pool said node operators, exchanges, miners and explorers should upgrade. Its release warns that the first restart can take several hours because the software replays about 4.49 million blocks and 28 million transactions while rebuilding chain state. Operators running several nodes were advised to upgrade them individually.

Ravencoin’s official GitHub notes separately said there was not yet a core version patching both the KAWPOW problem and a different asset transfer quantity overflow bug. Maintainer Hans Schmidt recommended using the 2Miners code for the mining problem until a combined patch becomes available.

Exchanges halt transfers as RVN falls 19%

Upbit suspended Ravencoin deposits and withdrawals on Aug. 10, citing a network issue, before the project’s broader warning. Its notice leaves trading available while transfers remain halted. Bitget also suspended RVN deposits and withdrawals for wallet maintenance beginning Aug. 10.

CoinGecko data showed RVN trading near $0.00288 on Tuesday, down about 19.1% over 24 hours. Its market capitalization had fallen to roughly $47.3 million while 24 hour trading volume approached $11 million.

Ravencoin has experienced a different protocol vulnerability before. In 2020, attackers exploited a flaw to create about 315 million unauthorized RVN, as crypto.news reported in earlier Ravencoin exploit coverage. The earlier incident involved excess token issuance, while the current vulnerability concerns proof of work validation and competing chain histories.

In related block reorganization coverage, an 18 block Monero reorg in 2025 invalidated previously confirmed transactions. The episode illustrates why exchanges often become cautious about transaction finality when proof of work networks develop competing histories.

What happens next for the Ravencoin chain

Ravencoin said 2Miners and RavenMiner controlled a majority of network hash rate and were mining from the last unaffected block while excluding the exploited branch. The project cautioned that if their chain becomes dominant, transactions confirmed after 4,487,775 may disappear from the accepted history. Some could return to mempools and be mined again, but Ravencoin said this is “not guaranteed.”

The next milestones are a stable dominant chain, wider adoption of patched software and a combined upstream Ravencoin release. Until then, the project’s guidance remains for exchanges to suspend transfers and for users not to rely on recent confirmations. Ravencoin also stressed that its warning should not be interpreted as support for a rollback or any particular recovery plan.

The SEC Reg Crypto proposal is heading to an Aug. 14, 2026, open meeting, where the U.S. Securities and Exchange Commission will consider whether to issue proposed rules creating a tailored offering regime for certain investment contracts involving crypto assets. The meeting is scheduled for 10 a.m. ET. If approved, the proposed release would begin the formal public-comment process once published.

SEC Schedules Regulation Crypto Assets for Aug 14

The SEC’s Aug. 10 Sunshine Act notice confirms that the Commission will hold an open meeting on Friday, Aug. 14, at 10 a.m. ET. The meeting will take place at the SEC’s headquarters in Washington, D.C., and will also be available through the agency’s webcast.

The official agenda identifies the matter as “Regulation Crypto Assets.” The Commission will consider whether to issue a release proposing new rules to create a tailored offering regime for certain investment contracts involving crypto assets.

The initiative is commonly referred to as “Reg Crypto,” while the SEC’s official agenda uses the title “Regulation Crypto Assets.” The matter falls under the SEC’s Division of Corporation Finance. The agency lists Jim Moloney, Sebastian Gomez Abero, Valian Afshar, Patrick Faller, John Fieldsend and Irene Paik as staff members for the agenda item.

The SEC’s notice does not announce a final rule. It states that the Commission will consider whether to issue a proposal. If approved and issued, the proposal would move into the public-comment and rulemaking process.

The meeting notice was dated Aug. 10, with the open meeting scheduled four days later. The SEC currently has three sitting commissioners, all Republicans. Their votes will determine whether the SEC issues the proposal for public comment.

Reg Crypto Could Create a Pathway for Crypto Fundraising

The proposed framework could address how certain crypto projects raise capital under a tailored offering regime. The framework could give eligible crypto firms a pathway to raise capital for projects without immediately triggering the SEC’s full registration requirements.

That would potentially give qualifying projects a defined route for fundraising in the United States while operating within a framework established by the agency. For crypto founders and fundraising platforms, the potential change could address uncertainty around how certain digital-asset projects structure offerings in the U.S. market.

Regulatory uncertainty has also encouraged some crypto offerings to seek jurisdictions outside the United States. A tailored U.S. framework could provide qualifying projects with another option for raising capital domestically. The precise scope of the fundraising pathway remains unknown because the SEC’s Aug. 10 notice does not specify registration exemptions, eligibility requirements or other detailed conditions.

The framework would not necessarily create a blanket exemption for token issuers or crypto companies. Its impact would depend on the eligibility requirements, disclosures, investor protections and continuing obligations included in the proposed release.

A Potential Exit Mechanism Could Address Continuing SEC Oversight

The framework could also address what happens after a crypto project is no longer actively managed by its development team. A potential mechanism could allow certain projects to seek relief from continuing SEC oversight once their teams are no longer involved in hands-on management.

The precise legal effect and eligibility conditions remain unknown. That would not mean a project automatically leaves the SEC’s jurisdiction simply because its team stops managing it day to day.

Any relief would depend on the legal mechanism and conditions established in the proposed framework, if such a mechanism is included. The SEC’s official notice does not confirm an exit mechanism.

It only states that the Commission will consider proposed rules creating a tailored offering regime for certain investment contracts involving crypto assets. The proposed release will therefore be critical for determining whether an exit pathway is included, which projects could qualify and what conditions would apply.

Aug 14 Would Begin a Longer Rulemaking Process

The Aug. 14 meeting would be the start of a longer process rather than the completion of a new crypto rule. If the Commission approves the proposal and it is published, the public would have an opportunity to submit comments.

The comment period is expected to last roughly two to three months, after which the SEC could review the responses and revise the proposal before considering a final rule. A final rule would generally provide a more formal and durable framework than informal staff statements or speeches, although it could still be challenged, amended or replaced.

The proposed rule would not immediately create binding requirements for crypto businesses. Instead, the proposal would establish the SEC’s intended regulatory approach and give market participants an opportunity to respond before the agency considers whether to adopt a final rule.

The eligibility requirements, disclosure obligations, investor protections, continuing requirements and any potential exit mechanism would therefore need to be assessed from the proposed release itself.

Clarity Act Consideration Moves Into September

The SEC’s planned action comes as Senate consideration of the Digital Asset Market Clarity Act has moved into September after lawmakers did not complete the relevant procedural step before the August recess.

Senate leaders have scheduled a Sept. 15 cloture vote on the motion to proceed to the legislation. That vote would determine whether the Senate can advance to consideration of the bill. It would not constitute final passage.

The CLARITY Act is intended to provide a broader legal foundation for crypto market rules in the United States. The delay leaves the SEC able to pursue rules within its existing authority while Congress considers whether to establish a broader statutory framework.

SEC Chairman Paul Atkins has said the agency can address many crypto market-structure issues through its existing authority. He has also indicated that congressional legislation would provide clearer, longer-term direction than SEC rulemaking alone.

The two regulatory tracks therefore remain important for crypto businesses. A final SEC rule could establish requirements within the agency’s authority, while legislation could provide broader statutory rules governing the U.S. digital-asset market.

SEC’s Crypto Work Extends Beyond the Aug 14 Proposal

The Regulation Crypto Assets proposal is part of the SEC’s wider work on digital-asset regulation. The SEC has issued an interpretation clarifying the application of federal securities laws to certain crypto assets and transactions.

That interpretation includes a taxonomy covering categories such as digital commodities, digital collectibles, digital tools, stablecoins and digital securities. The proposed offering regime would address another part of the regulatory framework by establishing rules for certain investment contracts involving crypto assets.

The distinction between an interpretation and a final rule is significant. The SEC’s interpretation explains how existing federal securities laws apply to specified crypto assets and transactions, while a final rule adopted through rulemaking would establish regulatory requirements within the agency’s authority.

The Aug. 14 meeting therefore represents the beginning of a proposed rulemaking process rather than the completion of the SEC’s crypto regulatory framework.

What Crypto Businesses Should Watch Next

The immediate question is whether the Commission votes to issue the proposed release. If it does, the document will provide the first detailed view of how the SEC intends to structure the tailored offering regime.

Crypto businesses will need to examine which investment contracts qualify, what conditions apply, what disclosures are required and what investor protections are included. The potential fundraising pathway will also require close attention.

Qualifying projects could potentially receive a route to raise capital without immediately triggering full SEC registration requirements, but the actual proposal will determine the scope and conditions of that route. The potential exit mechanism will require similar scrutiny.

For now, the confirmed development is that the SEC will meet on Aug. 14, 2026, to consider whether to issue proposed rules creating a tailored offering regime for certain investment contracts involving crypto assets.

If approved, the proposed release will determine how the fundraising pathway, eligibility requirements, investor protections, continuing obligations and any potential exit mechanism are structured. Until that document is issued, those details should not be treated as final SEC rules.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

Zama has listed its native ZAMA token on Revolut across the European Economic Area, giving the privacy-focused blockchain project access to a fintech platform serving more than 70 million customers.

Zama said on Monday that the listing also puts ZAMA in front of more than 15 million Revolut customers who already use the app to trade cryptocurrencies, while allowing existing users to purchase the token without opening another account or completing additional identity checks.

South Korea is set to broaden its crypto “Travel Rule” so it applies to essentially all on-chain transfers between regulated virtual asset service providers, eliminating a previously used value threshold. The change is part of Cabinet-approved amendments to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information, approved on Tuesday by the country’s government.

The update is designed to close loopholes that allowed some users to avoid Travel Rule compliance by breaking up transactions into smaller pieces. Alongside the Travel Rule expansion, the amendments tighten anti-money-laundering (AML) controls for transfers involving overseas exchanges and personal wallets.

Key takeaways

• South Korea will remove the 1 million won threshold, making the Travel Rule apply to transfers between registered VASPs regardless of transaction size.
• Receiving platforms will need to collect sender and recipient information, and can request missing data or reject transactions when required information isn’t available.
• The amendments introduce new AML obligations for transfers involving foreign exchanges and personal wallets, including restrictions based on counterparty risk.
• New monitoring requirements apply to certain cross-border transfers, and the rules are supported by a cited example involving repeated withdrawals under the old threshold.

Travel Rule broadened beyond the value threshold

Under the new framework, South Korea’s Travel Rule will cover all transfers between registered virtual asset service providers (VASPs), not just those above a set minimum amount. The Financial Intelligence Unit (FIU) said the threshold could be circumvented by splitting transfers into smaller transactions, thereby reducing the likelihood that required compliance steps would be triggered.

The FIU referenced a case involving Tether USDt (USDT). According to the agency, a user deposited roughly 200 million won into a crypto exchange and then made 216 withdrawals, with each withdrawal valued below 1 million won—illustrating how repeated small transfers could be used to structure activity around the prior limits.

By removing the threshold, the government aims to make the compliance requirement more consistent. In practical terms, the amendments require receiving platforms to obtain sender and recipient information for incoming transfers subject to the rule. If information is missing, the receiving VASP may request the necessary details. Where required data cannot be obtained, it may reject the transaction.

Risk-based AML rules for foreign exchanges and personal wallets

The Cabinet-approved amendments also add AML requirements tied to counterparty risk for transfers involving overseas crypto exchanges and personal wallets.

Registered local VASPs will be expected to decide which foreign transfers to allow based on the risk profile of the counterparty. Transfers to overseas exchanges assessed as low-risk would generally remain permitted. Transactions involving other foreign exchanges and personal wallets would be allowed when the sender and recipient are the same person—reflecting a tighter standard for cross-actor transfers.

Where the counterparty is classified as high risk, the amendments indicate those transactions will be prohibited. The government’s rationale is that suspected money laundering involving overseas exchanges and personal wallets has increased, and that weaknesses in existing AML coverage for those channels have been exploited.

In addition to the risk-based gating, the rules require crypto platforms to build out monitoring capabilities. The decree calls for suspicious transaction monitoring systems for transfers worth at least 10 million won when the transfer involves foreign exchanges or personal wallets.

Broader compliance expectations for registered VASPs

Beyond Travel Rule and transfer screening, the amendments also strengthen the broader regulatory foundation for crypto service providers. The decree strengthens registration requirements by expanding scrutiny of elements including financial soundness, internal controls, staffing, and infrastructure standards. It also broadens oversight of major shareholders, reflecting a more intensive approach to operator accountability.

The government’s intent appears twofold: first, to reduce opportunities to route around compliance through transaction structuring; and second, to bring more systematic AML oversight to cross-border and self-custody-related flows, where authorities have indicated existing rules have been insufficient.

When the changes take effect

The VASP registration provisions will take effect on Aug. 20. However, current providers will receive an additional year to meet certain requirements related to financial, staffing, infrastructure, and internal control obligations.

For the Travel Rule expansion and the related transfer-related AML obligations, the amendments take effect six months after the decree is promulgated. That staggered timeline gives exchanges and other regulated providers time to adjust compliance systems—particularly around sender/recipient data handling and counterparty risk assessments.

With these updates, South Korea is moving toward more comprehensive transmission of transfer information across regulated rails while simultaneously tightening controls for cross-border activity and personal wallet flows. Investors, traders, and users should watch for how exchanges implement sender/recipient data requests, what counterparty risk models they publish internally, and how strictly they will enforce rejections when required information can’t be provided—changes that could affect user experience for transfers just as much as they affect compliance outcomes.