low
Hack or exploit IVPN
Company funds taken through BTCPay Server flaw; no customer data or funds affected
IVPN reported that attackers used a BTCPay Server vulnerability disclosed on 7 August 2026 to extract its Lightning node credentials and move 0.6168 BTC of the company's operating funds. According to the company, its VPN systems were not involved, no customer data was accessed and no customer funds were lost. Lightning payments on its website were unavailable from 7 to 10 August and were then restored.
Funds lost Source: ivpn.net ↗