According to BlockBeats, on August 8th, the Bitcoin payment processing project BBTCAy Server warned users that its servers have a serious vulnerability that is being actively attacked. Attackers could exploit this vulnerability to gain unauthorized access and cause financial losses.

BTCPay Server issued a notice on the social platform X, requesting administrators to immediately upgrade to version 2.4.2 and confirm that the server footer displays a completed update. If an immediate upgrade is not possible, the official recommendation is for users to temporarily disable BTCPay Server to prevent further attacks.

In addition, BBTCPay Server recommends that users replace any potentially exposed macaroons credentials, recreate the macaroons.db file, and refresh the authentication strings for other Lightning Network backends.

The official notice specifically reminds users that if they create a hot on-chain wallet in BBTCPay Server, they should immediately transfer the funds in it and recreate the wallet.

Currently, BBTCPay Server has not disclosed the specific mechanism of the vulnerability, the start time of the attack, the number of affected servers, or whether funds have been stolen. The vulnerability was reported by a member of the Bitcoin Red Team.

This incident comes at a time when AI-assisted vulnerability discovery is drawing attention within the crypto industry. In several recent security incidents involving crypto projects, researchers and companies have pointed out that AI tools are increasing the speed at which code vulnerabilities are discovered, and could also be used by attackers to automate the search for security flaws.

According to BlockBeats, on August 8, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions against two Iranian cryptocurrency exchanges, Shelbit and Aban Tether, further expanding the Trump administration's "Economic Fury" campaign against Iranian financial networks.

The U.S. Treasury Department alleges that the two exchanges were used for large-scale transfers of crypto assets, circumventing U.S. sanctions, and providing support to the Iranian Islamic Revolutionary Guard Corps (IRGC) and other entities designated as terrorist organizations by the United States.

OFAC also sanctioned Shelbit operator Siavash Kayvanpour, as well as several companies he controls in Georgia, Poland, and the UAE.

The U.S. Treasury Department stated that wallets linked to the Iranian Revolutionary Guard sent over $1 million in crypto assets to Shelbit and received over $2 million from the exchange. Furthermore, wallets linked to Kayvanpour allegedly transferred over $2 million to Nobitex, Iran's largest cryptocurrency exchange.

The U.S. Treasury Department said Shelbit also provided services to a network of more than 2,000 gambling websites that are suspected of laundering tens of millions of dollars through crypto assets.

Prior to these sanctions, a Reuters investigation found that Shelbit processed at least $4 billion in transactions over the past two years, involving Iranian gambling networks, the Central Bank of Iran, and entities linked to the Revolutionary Guard. Data shows that at least $676 million was transferred from Shelbit-linked wallets to Binance during this period, with approximately $540 million occurring after the Dubai Virtual Assets Regulatory Authority (VARA) penalized it for operating without a license.

In addition, OFAC also sanctioned the Iranian exchange Aban Tether, claiming that it handled millions of dollars in transactions involving Nobitex and other previously sanctioned platforms such as Wallex, Bitpin, and Ramzinex.