Bitcoin Commerce: Update Your Stack
More disclosures are coming. Now is the time to audit and update what you're running, and some services aren't coming back.
Bitcoin Commerce, listen up: this is the time to keep those software stacks up to date.
BTCPay Server releases a critical vulnerability patch -- update to the newest version now
Speed WooCommerce plugin releases an important security patch -- update here now
Bitcoin red team is auditing projects fast -- watch this space and keep your tech stack up to date
Boltz, a popular swap service, pauses indefinitely amid security concerns. If you are connected via Boltz swap wallets like Aqua, it’s time to find a replacement now
Bitcoin Commerce Spotlight: spend some sats at VeraVerba books and book your next vacation with the newly redesigned Hodlstay
Even during tough times we need a laugh! Check out our Bitcoin meme of the week at the back of the Roundup!
Let’s get into it ↓
Update BTCPay Server Now
Popular open source payment processor BTCPay Server released an urgent patch this week.
If your stack includes BTCPay Server and LND, it’s time to update AND rotate your node’s macaroon files now.
Even for those not using LND or Lightning at all, updating is still strongly recommended.
Attackers were able to exploit a bug that forced BTCPay to release node macaroons, an authorization token that can allow for complete control over users’ built-in or external Lightning nodes.
Funds were lost in this exploit. Recommended immediately: update BTCPay, delete macaroons.db, and rotate your macaroons.
In a later post, BTCPay Server highlighted a new reality, noting that AI is changing the equation between attackers and defenders of open source software, and defending Bitcoin projects will require more effort than ever.
Stay vigilant and stay up to date.
More info here:
Speed Wallet Merchants: Update your WooCommerce Plugin
Speed emailed merchants this week to say they’ve released a new version of their Bitcoin Lightning plugin, which includes important security updates.
If the Speed Wallet Plugin is part of your tech stack, we recommend an immediate update.
Find the latest version here:
https://wordpress.org/plugins/speed-accept-bitcoin-payments/
Bitcoin Red Team is Auditing Fast -- Watch this Space
A team of Bitcoin Developers has come together to assess open-source Bitcoin codebases and notify maintainers of vulnerabilities.
The team is using the latest AI models and are making findings fast: reporting almost 5,000 findings in 27 hours, with 85 critical. Per the team, most of the critical reports they’ve sent to maintainers so far have been verified quickly.
Confirmed critical is the number to watch. Security audits, especially when using AI, often overstate concerns. But when findings are disclosed to code maintainers and they have been confirmed as critical, that’s another story.
If you are running a Bitcoin project, watch this space and be ready to update your stack.
More here:
Boltz Lightning Swap Service Pauses Indefinitely
Lightning exchange provider Boltz was forced to indefinitely pause operations, citing the increasing burden of keeping up with AI-augmented attackers as the reason to pull the pin. LNP2P bot, an open-source peer-to-peer Lightning exchange, just followed suit, citing similar issues.
For businesses, developers and wallets that relied on Boltz swaps, like Aqua Wallet, this represents a serious headache.
Alternative swap services like Loop, from Lightning Labs, can be used to fill the gap. Blockstream just announced a swap service, currently in beta, as a replacement to fill the Liquid <> Lightning swap gap.
Zeus’ Lightning channel service faced similar issues, shut down temporarily, but is now back online.
For small open source development teams the landscape appears to be getting even tougher.
For everyone building with these tools, stay vigilant and stay up to date.
Bitcoin Commerce Spotlight: VeraVerba Books and HODLStay
We’re featuring two very different Bitcoin Commerce sites in this edition.
Check out VeraVerba books, an independent bookseller, where you can find print books, e-books and audio books by Paul Rosenberg for sale. All can be bought with Bitcoin & Lightning. (Full disclosure: we helped build this one.)
Also, remember AirBTC? They just finished a big upgrade, now called HODLStay. Book your next holiday house or hotel with Bitcoin!
We did a quick search for availability over the weekend, and found listings available in Japan, Brazil, the USA and South Africa.
Happy vacationing!
Know a project we should be featuring?
Let us know here on Substack or email us at engineering@velascommerce.com.
And our Bitcoin Commerce meme of the week....🥁🥁🥁🥁🥁🥁
🤖 What money do AI Agents prefer?
Check out our founder’s most recent post on LinkedIn, breaking down recent data published by the Bitcoin Policy Institute. Spoiler alert, AI agents prefer Bitcoin.
🧊 What can you build with Bitcoin?
We just released our latest research - a guide that breaks down some of the awesome stuff that can be built with electronic peer to peer cash for the internet. There are some mainstays, but some emerging areas may surprise you!