Crypto Fraud Watch: A BTCPay Flaw Drains Lightning Nodes, Bybit Sues North Korea Under RICO, and Trump Media Walks Away From CRO

Bitcoin's software had a rough weekend. Attackers emptied merchant Lightning nodes through a flaw in a widely used payment server, one of the world's largest exchanges took the government of North Korea to federal court, and a $6.4 billion corporate crypto venture came apart. Here is what happened, and what each development means legally.

A BTCPay Server Flaw Drained Merchant Lightning Nodes

Late on Friday, August 7, attackers began draining Lightning nodes running behind BTCPay Server, the open-source processor many merchants use to accept bitcoin. The flaw let an unauthenticated remote attacker pull ".macaroon" files, the credentials that authorize software to control an LND node, then close its channels and sweep the funds. Hardware-wallet maker Foundation said its node was drained overnight, and the publication Citadel21 reported the same. BTCPay told operators to update to version 2.4.2 or take servers offline, and has not yet disclosed how many were hit.

The exposure does not sit where people assume. Open-source licenses disclaim warranties almost without exception, so a merchant who lost customer funds through a self-hosted node will struggle to push that loss onto the project. It stays with the operator, who is usually the custodian. Preserve server logs now: BTCPay's promised postmortem will fix the timeline every later claim gets measured against.

Bybit Sues North Korea Under RICO

On August 7, Bybit filed a civil complaint in the U.S. District Court for the District of Columbia against the DPRK, its Reconnaissance General Bureau, and the Lazarus Group over the February 2025 theft of roughly $1.5 billion. The suit pleads RICO, the Computer Fraud and Abuse Act, and the Alien Tort Statute. On July 30 the court partially granted a preliminary injunction barring transfer of identified assets held by unnamed defendants. Bybit reports recovering about $48.4 million and freezing $30.5 million more across 28-plus exchanges and custodians.

Collecting from Pyongyang is not a realistic outcome, and sovereign immunity will be litigated hard before anyone reaches the merits. The injunction is the real asset. An exchange asked to freeze an address acts far more readily on a court order than on a private request, and an order running against unnamed defendants turns a favor into something closer to an obligation.

Trump Media Terminates Its $6.4 Billion CRO Venture

The same day, Trump Media and Technology Group terminated its planned Cronos treasury venture with Crypto.com and Yorkville Acquisition Corp, valued at roughly $6.42 billion when announced in August 2025, along with a related services agreement. Interim chief executive Kevin McGurn cited saturation in the digital asset treasury sector. CRO fell about 8 percent. Trump Media keeps the 684.4 million CRO it bought for $105 million and still reports 9,542 BTC.

Token holders who bought on the announcement and are now underwater will find disclosure claims difficult. What was announced was a plan, and the risk disclosures almost certainly warned it might not close. That is the pattern with treasury deals: the announcement moves the token, the unwind moves it back, and the paperwork was drafted to permit both.

The CFTC Tells Prediction Markets to Drop Betting-Style Odds

Also on August 7, the CFTC directed registered exchanges and brokers to stop displaying sports event contracts in American-style odds rather than the implied-probability pricing between $0 and $1 that swaps normally use, citing research that the format encourages more risk-taking. Kalshi said it would comply by the letter's deadline. For regulated venues, the interface is now a compliance surface. Platforms arguing that federal derivatives law preempts state gambling regulation are better served by products that do not look like sportsbooks.

How to Protect Yourself

If you run BTCPay Server with an LND backend, update to 2.4.2 or take it offline now, then rotate every macaroon file and the macaroon database and move funds out of any wallet that sat under the node. Patching does not help if stolen credentials remain valid. The broader lesson from this week is that the software between you and your keys is the attack surface, not the keys. Keep always-online balances small and sweep to cold storage on a schedule.

If you have already lost funds, save transaction IDs, logs, timestamps, and screenshots before anything is overwritten. Report to the FBI's IC3 and to any exchange where the funds surface, since exchanges can freeze deposits while a trace is live. Civil recovery is realistic more often than people expect, especially where stolen funds sit unlaundered or pass through a regulated custodian, but the window for freezing assets is measured in days.

At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud, whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.

Disclaimer

This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.