BTCPay Server Vulnerability Drains Bitcoin Lightning Payment Nodes

Attackers have exploited a critical vulnerability in BTCPay Server, draining funds from Lightning nodes running LND software, prompting urgent warnings for merchants to update immediately or take servers offline.

Credential Theft Enabled the Attacks

BTCPay confirmed late Friday that funds were stolen after attackers exploited a flaw allowing unauthenticated remote access to “.macaroon” files, credentials that grant control over LND Lightning nodes. Once obtained, these files let attackers take over nodes and move funds directly. The project urged anyone running LND, the most widely used Lightning node software, to update to version 2.4.2 immediately or disconnect their servers.

Known Victims Emerge

Hardware wallet maker Foundation confirmed it was hit, with CEO Zach Herbert saying attackers drained the company’s BTCPay Lightning node overnight and closed its channels, though its separate on-chain hot wallet remained untouched. Bitcoin publication Citadel21 also reported its Lightning node was swept, though with minimal funds held there. BTCPay has not disclosed the total number of affected users or amount stolen.

Vulnerability Was Already Flagged

The flaw had been reported to BTCPay by members of the Bitcoin Red Team, a group that recently began systematically applying AI models to bitcoin codebases and has filed thousands of findings across various projects this week. By the time BTCPay issued its public warning, attackers were already exploiting the bug against live servers. BTCPay clarified that standard on-chain wallets remain unaffected, with exposure limited specifically to LND-based deployments. A full technical postmortem is expected in the coming days.