Bitcoin security explained through private keys, seed phrases, phishing, cold storage, exchanges, multisig, 51% attacks, scams and safe BTC storage.

https://www.osintinvestigate.com Trezor warns that 347,000 customers received phishing emails after a cyberattack on Brevo, the marketing platform used for newsletters. Learn how attackers exploited SSO, how many users clicked the malicious link, and why crypto wallet users should remain alert.

Attackers who pulled 4,000 BTC from the Liquid sidechain sent 3,400 back to the federation, but about 598.5 BTC worth roughly $47 million is still in their hands.

 The attacker who stole 4,000 bitcoin (BTC) from Liquid Network’s federation wallet on the weekend has returned 85% of the funds after Blockstream announced that its bridge nodes had been patched. The abovementioned white-hat hacker communicated with the exchange via Bitcoin OP_RETURN and PGP encrypted text. On block 965,875, the criminal warned Blockstream to “fix the bug first” and patch all bridge nodes before asking for the funds to be returned.  The Blockstream representatives, led by Adam Back, informed the hacker that their bridge nodes have been patched and it was safe to return the money. The message, signed with their key, was attached to a PGP-signed on-chain note. This key was verified against the security key, published on the blockchain by Blockstream. Consequently, the hacker transferred 3,400 BTC to the federation address on block 965,950. Thus, about 598.5 BTC (or $47.3 million at the time of writing) remained in the hands of the attacker.  In the previous message, on block 965,822, the hacker proposed to return most of the bitcoin to the federation address. Earlier, Blockstream contacted the unknown party initiating the security team. The conversation began after Liquid announced on September 6 that 4,000 BTC (about $320 million at the time) was stolen from its treasury. Notably, the SideSwap Peg-out Authorization Key was used to initiate the withdrawal, but it was not hacked. On X, SideSwap announced that the attack involved 4,000 LBTC, which the company’s peg-out service burned.  The Liquid Federation transferred 3,996 BTC to the customer’s bitcoin address as payment for the 4,000 LBTC. According to SideSwap, the error occurred because of an “elements software issue or bug,” resulting in the creation of the 4,000 LBTC. Nevertheless, the trading platform claimed that its servers were not breached, and its peg-out authorization key was secure. Liquid Network advised to stop all blockchain activities, including the bridge, and suspended LBTC deposits and withdrawals at exchanges.  Meanwhile, SideSwap stated that it would pause swaps, peg-ins, and peg-outs of its proof-of-reserve token until the network resumes operations. White-hat hackers are common in the cryptocurrency industry, especially when large sums of money are at risk. In most cases, crypto heists end with the attackers disappearing with a small portion of the stolen funds. However, dealing with “white hats” can be challenging for projects in many ways.  Notably, in the past years, several projects have seen an increase in attacks, followed by negotiations about returning the majority of the hijacked crypto. Some projects even offer rewards to cryptos, threatening to take legal action if they do not provide evidence of cracking their systems. It remains unclear when Liquid Network and Blockstream will resume operations. However, until the resumption of operations, the attacker can enjoy a tidy sum of money – about $47.3 million.

https://www.osintinvestigate.com Liquid Network has suffered a major security incident involving approximately 4,000 BTC worth $320 million. Alleged white-hat hackers say they will return most of the Bitcoin after the network fixes its vulnerability. Here is what happened and why the incident raises major questions about crypto security.

Liquid Network pauses after purported 'white-hat' hackers withdraw $320 million in bitcoin Liquid Network said Sunday that purported white-hat hackers withdrew approximately 4,000 bitcoin, worth abou...

There has been another security breach of Bitcoin payment infrastructure as attackers exploited critical vulnerabilities in BTCPay Server deployments to steal funds from Lightning nodes. Transactions via Lightning Network are faster and more cost-effective than traditional bitcoin transactions, affecting merchants and other operators.  An attack was observed late Friday involving LND nodes connected to BTCPay Server. Using the vulnerability, an unauthenticated remote attacker may be able to access .macaroon credentials related to Lightning Nodes, according to BTCPay. These credentials grant access to Lightning nodes and, once compromised, could enable the node to be controlled and its funds moved.  According to BTCPay, real funds were stolen, and operators of LND were advised to upgrade immediately to version 2.4.2. A system that cannot be updated should be taken offline until the vulnerability is addressed. No details have yet been provided about how many installations were affected or how much bitcoin was lost. Foundation's CEO Zach Herbert stated that attackers drained the company's BTCPay Lightning node, shut down its payment channels, and transferred the funds available. In contrast, the company's separate hot wallet for BTCPay on-chain was unaffected by the attack. A Bitcoin publication, Citadel21, announced that its Lightning node had also been compromised and swept. Citadel21 stated that only a small amount of funds were stored on the affected node.  A vulnerability was previously reported to BTCPay by members of the Bitcoin Red Team, which is a group that investigates security flaws in Bitcoin-related software. Craig Raw, Rob Hamilton, Calle and Evan Kaloudis were credited with reporting the issue and assisting with its analysis, according to BTCPay.  A key concern of the incident is the risk posed when vulnerabilities are discovered while affected systems remain vulnerable. By the time the public warning was issued, attackers had already exploited the flaw against live servers. After its initial alert, BTCPay clarified that the vulnerability does not affect its standard on-chain wallets, including hot wallets created within the company.  Initially, LND deployments were exposed, however funds stored in LND's own on-chain wallet, which is also under the affected node, may also be vulnerable. While operators attempt to secure affected systems, BTCPay has not provided technical details regarding the flaw. A detailed postmortem is expected to be released within the next few days.  LND Deployments Remain the Primary Exposure BTCPay Server installations configured to use Lightning payments can be affected by the vulnerability. If hackers have compromised macaroon credentials, they can gain access to the affected node, making exposed Lightning funds a direct target. The credential exposure has not affected BTCPay's standard on-chain wallets.  A LND node's on-chain wallet does not receive protection from that security breach, and funds in the wallet may continue to be accessible if the node is compromised. Researchers are taking a close look at widely used codebases following a series of security concerns pertaining to Bitcoin-related software.  The Bitcoin Red Team identified the issue before attackers began exploiting exposed installations, giving operators limited time to implement the available fix. So far, BitcoinPay has not provided detailed technical information regarding this vulnerability while affected operators have begun to secure their systems. It is expected that the project will publish a comprehensive postmortem in the coming days that will provide additional information regarding the flaw, the attack path, and the extent of the breach.  Operators using LND behind BTCPay Server should use version 2.4.2 as their current mitigation plan. Until the vulnerability has been addressed, systems which cannot be patched should remain offline. This incident illustrates the security risks associated with cryptocurrency payment infrastructure as well as the importance of patching exposed Lightning nodes as soon as possible.

https://www.osintinvestigate.com A deep-dive into the latest crypto security threats as of August 22, 2026: hardware-wallet exploits, blockchain attacks, phishing campaigns, fake crypto apps, impersonation scams and major data breaches putting investors at risk.

BTCPay Server has temporarily blocked public remote access to Lightning Network nodes after attackers exploited a critical vulnerability to steal macaroon credentials and drain funds. At least two operators — Foundation and Citadel21 — reported losses, though the total stolen amount remains unknown.

A Canadian-based cryptocurrency company, Coinkite Inc., has disclosed that a sophisticated cyberattack exploited a previously undetected software vulnerability in its Coldcard wallets, resulting in an estimated $130 million loss for users. The breach highlights critical flaws in AI-driven security systems used to monitor open-source code, as the hackers identified a flaw at the intersection of two software components rather than in cryptographic logic. Coinkite emphasized that existing AI tools failed to detect this vulnerability despite being employed for security reviews weeks before the incident. This incident has raised significant concerns within the cryptocurrency community, particularly regarding self-custody practices, which are foundational to blockchain technology. Experts warn that such breaches could erode trust in the decentralized model, potentially leading to long-term shifts in investor behavior. Market reactions included a surge of over 728,000 Bitcoin wallets moving funds within a single day, indicating heightened risk aversion. The company now urges other firms relying on AI for security audits to conduct thorough reviews of their codebases, especially around build and sub-module boundaries. This event underscores the evolving challenges in securing digital assets and the limitations of current AI-based threat detection systems.

Bitcoin has accumulated enough economic value that its security has effectively become a public good with a funding problem.

A collection of crypto and finance companies have launched a bitcoin-focused security initiative. The Bitcoin Security Consortium, announced in a news

July 23, 2026

Galaxy Digital has launched a $5 million initiative to fund Bitcoin developers building quantum resistant security tools and preparing the network for future risks.

Bitcoin s quantum security debate explained: what BIP-361 proposes, why it s controversial, and what UK holders should know under the new FCA crypto rules.