BTCpay lightning infrastructure naka experience ng exploit!

[arwin100]

Another platform na naman ang nadali at mapapaisip ka talaga kung safe ba talaga yung site or merchants na ginagamit mo.

Narito ang detalye.

BTCPay confirmed funds were stolen and told anyone running LND, the most widely used software for operating a Lightning node, to update immediately to version 2.4.2 or take the server offline.

The project has not disclosed how many users were hit or how much bitcoin was taken.

The flaw allowed an unauthenticated remote attacker to obtain “.macaroon” files, or credentials that give software permission to interact with an LND Lightning node. BTCPay said the attacks it reviewed targeted those files, which could then be used to take control of the node and move funds.

Hardware-wallet maker Foundation was among the victims. Chief Executive Zach Herbert said attackers drained the company's BTCPay Lightning node overnight, closing its channels and sweeping the funds. Its BTCPay on-chain hot wallet was untouched.

Source: https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes

Grabe no andami nang mga platforms ang na hack at malamang maaari pang maka experience ng ganito. Another good reminder nanaman ito na wag talagang mag impok ng malaking pundo sa ganitong platform. At mag deposit lang kapag kailangan natin gumawa ng transaction sa kanila.

Tumatalino na ang mga hacker ngayon at parang lahat na ata kayang kaya na nila pasukin.

Ano opinyon nyo sa recent exploit na ito?

[abel1337]

No system is safe, kahit pa gaano yan ka unhackable as declared by the owners, Hindi ako nainiwala.jan. May mga system lang na mahirap ma penetrate pero naniniwala ako hindi ito impossible. Up until 2 months ago, akala natin lahat ay lahat ng hardware wallet is safe pero last month ay may na witness tayong history making exploit sa isang hard wallet. This is why mas better padin na mag store tayo ng funds sa mga pinag kakatiwalaan natin, at sa tingin natin mahirap ma hack.

I was hacked before and kahit sa mga non custodial wallet eh hindi nako nag lalagay ng substantial amount of crypto. Sa mga platforms like cex, service platforms like this one is hindi ako mag titira kahit small funds pa. Sila ang satingin ko prone sa hacking eh.

I still trust my hardwallet brand kaya dito padin nakastore bitcoins ko.

[SFR10]

Tumatalino na ang mga hacker ngayon at parang lahat na ata kayang kaya na nila pasukin.

Unfortunately, tama ka at isa ito sa mga disadvantages ng mga AI-assisted tools ^{[e.g., kahit hindi talaga hacker ang isang tao, pwede niyang mahanap ang mga vulnerabilities sa pamamagitan ng AI-assisted tools]}.
^{- Sa madaling salita, it's a race between hackers and coders/developers at sa tingin ko, hindi magbabago ang sitwasyon for the next few years (sana mali ako).}

BTW, base sa mga source na ito ^{[#1 and #2]}, almost 1.75BTC ang nawala so far: 19jSfadPiKa4aCefj4F7uEYbhMEt2L8SCH

[julerz12]

Ano opinyon nyo sa recent exploit na ito?

Alarming. 9 years silang operational, but even sa haba ng experience nila in that field, they still got exploited. Makes you think, papaano na 'lang yung mga bagong platforms and app na nagsusulputan ngayon, how safe are they to use?
Take note na open source pa 'yan sila and fully decentralized. I guess that's one caveat of having the source code open to the public: puwede din ang bad actors na tumingin dito ang check for vulnerabilities to exploit.

almost 1.75BTC ang nawala so far: 19jSfadPiKa4aCefj4F7uEYbhMEt2L8SCH

Looks like may recovery effort naman 'tong BTCPay (unlike the recently hacked hardware wallet na puro 'lang rason pinopost sa X *cough coldwallet).
They are now offering up to 3 BTC sa makaka-recover ng funds. Hopefully, marecover nila 'eto agad, or at least, would be able to freeze it, in case it gets funneled into some CEX.