BTCPay Halts Remote Lightning Node Access After Hackers Drain Funds

Security Flaw Exposed Login Credentials

BTCPay Server has blocked outside wallet apps from remotely connecting to Lightning nodes running LND software after hackers exploited a bug to steal access credentials and withdraw funds. The company says regular Lightning payments still work normally, and remote access will return once the risk is cleared.

Fix Rolls Out Automatically

The newest update, version 2.4.2, upgrades the Lightning software and resets access credentials on standard setups automatically. Operators using outside connection methods must reset theirs manually. Users are advised to check for odd payments, closed channels, or balance mismatches.

Foundation and Citadel21 both reported drained nodes, though neither shared exact loss figures. The breach follows a separate hardware wallet exploit tied to over $100 million in stolen bitcoin.