BTCPay Server Exploit Drains Lightning Nodes; Update to 2.4.2 Urged
Key Points
- Attackers exploited a critical vulnerability in BTCPay Server late Friday to steal credentials protecting LND Lightning nodes.
- Foundation and Citadel21 reported their Lightning nodes were drained after attackers obtained ".macaroon" credential files.
- BTCPay urged all LND users to update immediately to version 2.4.2 or take servers offline.
The vulnerability had been responsibly disclosed to BTCPay by members of the Bitcoin Red Team—a group of developers that began deploying AI tools against Bitcoin codebases this week and has filed thousands of findings across hundreds of projects. BTCPay credited Red Team members Craig Raw, Rob Hamilton, Calle and Evan Kaloudis with the disclosure and analysis. The Red Team's decision to publish findings quickly reflected concern that attackers operating independently would discover the same vulnerabilities, and by the time BTCPay's public warning circulated, exploitation was already underway against live servers.
BTCPay later clarified that its standard on-chain wallets, including hot wallets generated inside BTCPay, are not affected by the credential flaw. The exposure applies specifically to deployments using LND, though funds held in LND's own on-chain wallet remain at risk because they sit under the compromised Lightning node. The company has withheld technical details of the vulnerability to allow operators time to patch their systems, with a full postmortem scheduled for the coming days.
Read Next
XRP Ledger Confidential Transfers Target $530M in Tokenized Assets
11 hours ago
U.S. Treasury Sanctions Iran Crypto Exchanges Shelbit, Aban Tether
19 hours ago
This marks the second major Bitcoin infrastructure breach in a week, following the discovery of 85 critical bugs across Bitcoin projects identified by the Red Team's AI-assisted security scanning. The pattern reflects a broader vulnerability in Bitcoin's software ecosystem during a period of rapid infrastructure expansion around Lightning Network payments.
Related Guide: Read our complete guide →
Related coverage: XRP Ledger Confidential Transfers Target $530M in Tokenized Assets
Market Outlook
The incident will likely accelerate adoption of automated security scanning tools across Bitcoin projects, though the speed of patch deployment remains uncertain. Merchants relying on Lightning payments may temporarily increase on-chain transaction volumes while evaluating node security practices, potentially affecting network congestion metrics over the next 7-10 days.
Sources: CoinDesk and other international news outlets.
Disclaimer: This article was produced with AI assistance based on publicly available news sources. While we strive for accuracy, NewsOracle makes no warranty as to the completeness or accuracy of the information. Errors and omissions may occur. Readers should independently verify all information before acting on it. NewsOracle does not intend to defame any individual or organisation and accepts no liability for any loss or damage arising from reliance on this content. Content is for informational purposes only and does not constitute legal, financial, medical, or professional advice. All rights reserved. Unauthorised reproduction prohibited.
NewsOracle Editorial
The NewsOracle Markets Desk covers stock markets, cryptocurrency, economic policy and breaking financial news from Wall Street and global exchanges.
Latest coverage: Bitcoin
