Critical vulnerability discovered in BTCPay Server

[DanWalker]

As open source projects are being targeted now, what then is our last line of defense? A lot of people suggested in other posts that using multisig wallets and generating the seed phrase offline and others, but are these methods enough to protect people's money. I really do not feel at ease when I see  with open source system because they were supposed to be rhe safest means of storing Bitcoin.

In fact it is not correct to say that Open source mean the safest. Also finding a vulnerability does not mean that open source is unsafe.

Big advantage of open source is that you can easily inspect or audit the code and even if a vulnerability is found, it can be patched very quickly. But open source will never free us from security responsibility.

Anyway, the most sensible approach for me is to reduce exposure of our fund. We can use small hot-wallet for daily spending. And for big saving we should use properly configured multisig. I agree with you, we should practice keeping seeds offline and keeping backups in separate place. And we should not keep more BTC than necessary in any internet-facing service.

[Pmalek]

The ColdCard case could be the beginning of something good and so far it's looking like it, maybe from now on the main focus will be 100% on the vulnerabilities on the Blockchain system.

It's always going to be a race between good actors vs bad actors. The Coldcard case has shown that both types exist (as if we didn't know that before). Some people use AI to help them take advantage of vulnerabilities to steal money. Others use it to help discover and correct problems.

And for big saving we should use properly configured multisig. I agree with you, we should practice keeping seeds offline and keeping backups in separate place.

If the keys are not generated with enough entropy, a properly generated multisig won't help you. If 2/3 keys in a multisig setup were generated by Coldcard, hackers would have the needed quorum to empty such addresses. Keeping your keys offline won't help either. Coldcard keys were offline.

Anyways, we are moving into of topic territory here so let's get back to BTCPay Server stuff.

Video instruction for updating BTCPay Server on Umbrel:
https://x.com/nmfretz/status/2085966668011028533

Two addresses connected to the theft of funds from BTCPay Server have been identified. Luckily, the scammers haven't stolen much. One contains 1.74760889 BTC, the other 0.46608022 BTC
https://x.com/pavlenex/status/2086012989262401863

[logfiles]

<...>

The warning shots were already there, but the hackers were most targeting smart contracts of different DeFi and crypto bridges. They had all the time to use AI to detect some vulnerabilities and have them fixed

I guess they are not going to act accordingly though I feel like there will always be avulnariabilty waiting to be discovered. The issue is who discovers it. The good actor or the bad actor?

[Faisal2202]

Am just fascinated by how AI has quickly become a concern to open source wallets when it is quantum computers that we should have been more scared off. If AI is already doing this, what chance would we stand against quantum computers?

Brother, since the start of 2026, I haven't gone a single day or week without hearing about a hack in the DeFi sector. Bridges, liquidity pools, and other platforms are being exploited by hackers who are finding even the tiniest loopholes in them and then draining as much money as they can. I have read about almost every hack since the start of 2026, and I can tell you for sure that this year could see an all-time high in hacking incidents.

But the last week of July was very calm. I didn't hear about any such incidents during that week, but eventually, I heard about Coldcard, Zeus Wallet, Boltz Swap, then BTCPay Server, and so on. I am sure this month is going to be a crazy month for platforms that still haven't prioritized strengthening their security.

I know what I am going to say is very brutal for those who have lost their funds, but I think this is just one phase. After this phase, AI might become less useful for finding these vulnerabilities. It is like preparing these projects to defend against AI-driven attacks so they can eventually be better prepared for quantum computers.

[OsaiEmma]

The ColdCard case could be the beginning of something good and so far it's looking like it, maybe from now on the main focus will be 100% on the vulnerabilities on the Blockchain system.

It's always going to be a race between good actors vs bad actors. The Coldcard case has shown that both types exist (as if we didn't know that before). Some people use AI to help them take advantage of vulnerabilities to steal money. Others use it to help discover and correct problems.

This is just hitting the nail on the head. AI can be dangerous and good depending entirely on who is operating it. And besides, before the emergence of AI, there have been automated tools used in different sectors, AI just made the whole process seem effortless and smooth. It's funny seeing forum members saying AI will take over the world lol, the only one taking over the world are the humans behind these AIs.

Well, I'm glad serious losses haven't occurred yet with respect to this BTCpay vulnerability, good one from the red team and every other person who assisted. Even though the coldcard case left a sour taste in our mouth, at least it has significantly improved the security consciousness of these service providers.