BTCPay Server has officially restricted public remote connections to its Lightning Network nodes following a severe security breach. Cybercriminals recently exploited a critical vulnerability in the Lightning Network Daemon (LND) software, allowing them to steal administrative credentials and drain funds from unsuspecting node operators. While the exact number of victims and the total amount of stolen cryptocurrency remain unknown, prominent players in the Bitcoin space have already confirmed significant losses.
Both the hardware-wallet company Foundation and the popular Bitcoin publication Citadel21 have publicly reported that their Lightning nodes were completely drained overnight. Foundation’s CEO, Zach Herbert, clarified that while the company’s primary hot wallet remained untouched, attackers were able to forcibly close their Lightning channels and sweep the tied-up funds. This latest breach highlights a growing trend of attacks targeting the third-party infrastructure surrounding Bitcoin, rather than the core blockchain protocol itself, echoing a recent Coldcard hardware-wallet flaw that led to over $100 million in confirmed losses.
How the Attack Unfolded and BTCPay’s Immediate Response
The root of this exploit involves a vulnerability that allowed unauthenticated, remote attackers to quietly snatch “macaroon” credential files. In the Lightning Network ecosystem, these specific files essentially act as the master keys used to authenticate and control LND node implementations. Once the attackers captured these exposed credentials, they were able to fully hijack the affected LND nodes, take over administrative controls, and seamlessly route funds into their own wallets.
To stop the ongoing bleeding, BTCPay immediately stepped in to block external wallets, such as Zeus, from connecting via BTCPay Server domains or Tor onion addresses on standard Docker deployments. The development team emphasized that standard, day-to-day Lightning payments are still functioning normally on the network. However, the temporary remote-access block will remain strictly in place until the project’s security engineers consider the infrastructure safe enough to reopen.
What Node Operators Must Do to Protect Their Bitcoin
If you run a BTCPay Server, it is absolutely crucial to update your software without delay. BTCPay has released version 2.4.2, which directly patches the exploit by installing the secure LND version 0.21.1. For users running standard BTCPay installations, this critical update takes the extra step of automatically regenerating all macaroon credentials, instantly cutting off any lingering unauthorized access the attackers might have established.
Even with the patch applied, the project’s security advisory strongly advises all operators to conduct a thorough manual audit of their nodes. Users should actively check their transaction logs for unauthorized payments, monitor for sudden or unexpected channel closures, look out for unfamiliar peers connecting to their node, and verify that their Lightning balances perfectly match their on-chain records. Catching these discrepancies early is vital for assessing whether a node was quietly compromised before the update was applied.
Finally, operators who utilize custom network configurations need to take additional manual steps. If you expose your LND through a custom reverse proxy, a forwarded port, or a standalone Tor service outside of BTCPay’s native managed setup, the automated update will not secure those independent access routes. In these specific cases, operators must manually rotate their macaroon credentials to ensure their digital assets remain completely secure from future attacks.
