Bitcoin wallet ZEUS is facing two newly disclosed security issues involving Lightning swaps and iCloud-synchronized wallet credentials, while payment infrastructure projects Hyperswitch and x402 have identified separate weaknesses affecting hosted payment pages and smart-wallet transaction verification.
The findings, published on October 27–28, 2026, expose potential risks ranging from cryptocurrency losses and irreversible wallet-data deletion to malicious script execution and payment settlement failures. All four reports concern identifiable software behaviors, but none establishes a confirmed theft or successful production attack resulting from the reported defects.
Hyperswitch has already merged corrective changes into its main development branch and a release hotfix branch. The ZEUS and x402 reports remained open in the GitHub records reviewed, with the latter demonstrating a discrepancy between transactions accepted during verification and those that can actually settle.
ZEUS Swap Bug Could Expose Bitcoin Funds to Malicious Hosts
ZEUS, a self-custodial Bitcoin and Lightning wallet, faces a potentially serious reverse-swap vulnerability involving its fallback transaction-broadcasting process.
According to GitHub issue #5501, opened October 28 at 00:51 UTC, the wallet can incorrectly record a swap claim as successfully broadcast even when the transaction has only been accepted by the swap service provider.
The application initially attempts to broadcast Bitcoin claim or refund transactions through the user’s configured mempool endpoint. If that request fails, ZEUS submits the transaction to the swap host as a fallback.
The reported weakness arises because the application treats an HTTP 200 or 201 response from the host as evidence of successful broadcasting without confirming that the transaction has reached a publicly accessible Bitcoin mempool.
In a reverse swap, where a Lightning payment is exchanged for on-chain Bitcoin, the claim transaction reveals a payment preimage through the Bitcoin script path.
A malicious or malfunctioning swap host could acknowledge receiving the claim without broadcasting it. Because the transaction contains the preimage, the host could potentially use that information to settle the Lightning hold invoice.
If the Bitcoin claim never reaches the network, the host could subsequently refund the Bitcoin lockup to itself after the timeout. Meanwhile, ZEUS may already display the transaction as claimed and stop attempting to rebroadcast it.
The report identifies the potential for financial loss under those specific conditions. It does not demonstrate an actual theft or establish that a swap provider has deliberately exploited the behavior.
A related problem affects refunds. ZEUS can mark a refund as completed after receiving a successful HTTP response from the host, even if the transaction has not entered a mempool. The funds remain potentially recoverable, but the application’s normal refund interface may no longer offer the necessary action.
The finding was made during a review of ZEUS version 13.2.4. The reporter said the specific claim exposure was absent from version 13.2.3, when claims were broadcast through mempool.space rather than using the same host fallback.
ZEUS iCloud Keychain Issue Threatens Cross-Device Wallet Data
A second ZEUS vulnerability, reported just five seconds after the first, concerns how the wallet clears sensitive information from Apple’s Keychain storage system.
In issue #5503, researchers identified that the application’s data-clearing function can delete both local Keychain entries and iCloud-synchronizable records belonging to other devices using the same Apple ID.
The affected function runs when users select Clear All Data, activate a duress PIN or trigger a security wipe following failed PIN attempts.
The problem arises because the clearing process searches both local and synchronizable Keychain partitions rather than limiting deletion to information associated with the current device.
Under the scenario described, an iPhone running ZEUS 13.2.4 could delete a Cashu wallet seed stored in iCloud Keychain for another device running an older ZEUS version, even though the wiping device never contained that wallet.
The exposure is particularly relevant to version 13.2.1 and earlier, which stored wallet information in synchronizable Keychain records, and newer installations that have not completed the keychain desynchronization migration.
Potentially affected information includes Cashu seed phrases and credentials associated with payment services.
If a deleted seed phrase represents the only remaining recovery method for a wallet, the consequences could be irreversible. However, the public report identifies the risk through source-code review and does not document an actual customer losing funds.
The suggested correction would limit broad deletion to local Keychain records or require confirmation that a corresponding local entry exists before removing a synchronized record.
Hyperswitch Fixes Hosted Payment-Page Injection Weakness
Payment infrastructure provider Hyperswitch has addressed a separate vulnerability involving how merchant-configurable information is embedded in hosted payment-method collection and payout pages.
The defect was described in GitHub issue #15003, opened October 27 at 12:54 UTC.
According to the report, certain hosted pages serialized merchant-supplied configuration data directly into inline JavaScript without applying the escaping required for an HTML script context.
Fields such as merchant names and visual themes could therefore contain specially constructed markup capable of terminating the surrounding script element and injecting executable content into the page.
The affected fields were also outside an existing validator used to identify potentially malicious input. Normal payment links followed a different encoding method that avoided the same script-context problem.
Successful exploitation could have allowed malicious JavaScript to run within an affected hosted page. The consequences would depend on the page’s privileges, available information and browser security controls. The report does not establish that customers were attacked or that payment information was stolen.
Hyperswitch moved quickly to address the finding. Pull request #15002 was merged on October 27, introducing safer encoding of embedded data and validation of merchant-controlled configuration fields.
A separate hotfix backport, #15013, was also merged on October 28, extending the correction to the October 26 release branch.
Those merges establish that corrective code was accepted into the relevant branches. They do not independently confirm that every production deployment has received the update.
x402 Verification Gap Raises Questions About Payment Finality
The fourth finding affects the TypeScript implementation of x402, a protocol designed to support cryptocurrency payments for digital services and automated applications.
In issue #4009, opened October 27, a researcher demonstrated that certain ERC-6492 smart-wallet signatures can pass payment verification even though the subsequent settlement operation fails.
The issue concerns counterfactual wallets, which can generate signatures before their smart contracts have been deployed on-chain.
In the affected TypeScript implementation, empty factory deployment calldata represented by the string “0x” is treated as valid deployment information because the string evaluates as true in the language’s conditional checks.
When a permitted wallet factory is supplied, the verification simulation can accept a payment even though the factory deployment operation fails. The simulated USDC transfer may still succeed through the underlying externally owned account’s signature.
Settlement follows a different execution path. It attempts the factory operation, encounters a gas-estimation failure and returns an error without broadcasting the intended transaction.
The researcher reproduced the inconsistency using Base mainnet reads and simulations, with transaction broadcasting deliberately disabled. An additional offline regression test demonstrated the same classification problem.
The issue is conditional: the default empty factory allowlist rejects the problematic deployment path. The report therefore does not establish that every x402 implementation or payment is affected.
Unlike a payment-acceptance bypass, the immediate problem is a false indication of settlement readiness. A resource server or automated payment application may be told that a payment is valid even though the facilitator cannot successfully complete it.
The reporter also identified a broader verification weakness involving non-empty deployment calldata that fails to deploy the expected wallet. Proposed corrections include rejecting empty deployment data and confirming that the intended smart-wallet contract actually exists following simulation.
For businesses using automated cryptocurrency payments, such discrepancies can complicate service delivery, reconciliation and transaction-failure handling. The problem is particularly relevant when applications rely on verification results to decide whether to proceed with paid operations.
These four findings expose different failure points within cryptocurrency payment infrastructure, but their wider significance is similar: cryptographic authorization alone cannot guarantee safe custody, successful settlement or reliable application behavior.
ZEUS’s reverse-swap issue illustrates the danger of treating a service provider’s acknowledgment as proof of blockchain inclusion. Its iCloud problem demonstrates how security-related deletion functions can create unintended consequences across devices.
Hyperswitch’s vulnerability shows why merchant-controlled data requires careful handling even inside payment interfaces that appear routine. The x402 finding reinforces the need for verification procedures that accurately predict what will happen during final settlement.
For investors and payment-service operators, these weaknesses are relevant even without confirmed financial losses. They can introduce support costs, interrupt legitimate transactions, create disputes and weaken customer confidence if they reach production environments.
The next developments to watch include corrective releases from ZEUS, any resolution of x402’s verification and settlement inconsistency, and confirmation that Hyperswitch’s merged fixes have reached deployed services.
Ultimately, the incidents demonstrate that cryptocurrency payment security depends on more than preventing unauthorized signatures. Wallet recovery, transaction broadcasting, hosted-page integrity and settlement verification must all work correctly for customers to receive the protections that financial applications promise.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574