08/08 update below. This post was originally published on August 06
Bitcoin and crypto traders are still reeling from a massive $100 million bitcoin attack that sparked fears of a fresh bitcoin price crash.
Sign up now for CryptoCodex—A free crypto newsletter that will get you ahead of the market
The bitcoin price has rebounded since the attack on hardware wallet Coldcard was first reported but remains near its recent lows, leaving traders nervously braced for a dramatic shock.
Now, as Elon Musk issues a game-changing prediction, bitcoin developers have used AI tools to find almost 5,000 security vulnerabilities across almost 400 projects in just 24 hours.
Sign up now for the free CryptoCodex—A daily five-minute newsletter for traders, investors and the crypto-curious that will get you up to date and keep you ahead of the bitcoin price and crypto market swings
Bitcoin and crypto traders have been spooked by recent attacks on bitcoin—sparking fears of a bitcoin price crash.
Getty Images
A volunteer group of bitcoin developers is carrying out a coordinated security audit that’s already found the situation is “extremely bad,” identifying around 5,000 security vulnerabilities across almost 400 projects in 24 hours.
The findings include 85 critical and 635 high-severity bugs, most of which have already been verified by project owners.
08/08 update: Developers of the free, open-source bitcoin payment processor BTCPay have urged users to update their servers as a critical vulnerability is being “actively” exploited.
“We have confirmed that attackers exploited this vulnerability,” BTCPay’s X account posted. “Users were affected and funds were stolen. We are not publishing technical details yet because operators still need time to update.”
X was flooded with reports from users who have had their funds “drained” by attackers, many of whom are technically proficient and had believed their bitcoin was secure.
The attackers are thought to have gained access to BTCPay Server’s Lightning Network Daemon (LND) node, which facilitates faster and cheaper bitcoin transactions, via a security bug in versions before 2.4.2, allowing the hackers to steal the bitcoin in the LND node.
“Not a drill,” Francis Pouliot, the chief executive of Canada-based Bull Bitcoin, posted to X. “Tell everyone you know that is running BTCPay to turn it off right now.”
The team of volunteer bitcoin developers, styling themselves as the Bitcoin Red Team, have been credited with discovering the many of the recent bugs and exploits, spending a reported $40,000 in just the last week on AI tokens to audit around 400 open-source bitcoin projects.
Meanwhile, fears of further attacks on bitcoin projects, companies and infrastructure have spooked the market, weighing on the bitcoin price.
“Coldcard exploit and large exchange inflows drove selling,” analysts with 10X Research, led by Markus Thielen, warned in an emailed note to clients, highlighting the recent attacks as the reason for continued bitcoin price weakness.
The attacks on bitcoin over the last week have been roundly described as some of the worst to his the technology in its the last 15 years.
“Between the BTCPay Server and Coldcard critical exploits, the is the bitcoin puritan maxi 9/11,” bitcoin and crypto investor Dan Held posted to X.
“We’ve grown to 16 globally distributed people working 24/7,” Calle, the pseudonymous developer behind the Cashu ecash protocol, posted to X. “We’re running a large-scale ecosystem security audit across bitcoin code bases.”
The auditors are using Moonshot’s Kimi K3 model, an open-weight, China-based artificial intelligence tool, with Calle claiming to be spending $10,000 per day on compute, thanking OpenSats for footing the bill.
“We have been working around the clock,” one of the auditors, chief executive of bitcoin insurance company AnchorWatch, Rob Hamilton, posted to X, adding his team has found some “critical issues.”
Sign up now for CryptoCodex—A free crypto newsletter that will get you ahead of the market
The bitcoin price has crashed over the last year, with fears swirling that a further bitcoin price crash could be looming.
Forbes Digital Assets
Last week, the Coldcard bitcoin hardware wallet exploit saw almost 2,000 bitcoin, worth just over $100 million, being drained from more than 5,200 addresses in just a few days, sparking a debate around the safety of using technical, self-custody wallets.
The developers of the Coldcard wallet have urged users to move their funds, asking social media users to “help spread the word.”
“Please treat this as urgent,” Coldcard’s X account posted. “Migrate your funds. Follow the advisory for your model, upgrade your device, generate a new seed, and carefully move your funds … The threat is still ongoing.”
A wallet that’s been linked to a Coldcard hacker has received several deposits since last week, with some carrying messages attached via bitcoin’s OP_RETURN function.
The wallet currently holds $36 million worth of bitcoin, the vast majority of which is believed to have been stolen.
One message, reading: “I clean btc, do kyc and cashout. I take 10%,” appears to be a laundering pitch hoping to land the hacker as a client, it was reported by Coindesk.
Most of the other messages are pleas for the stolen bitcoin to be returned.