Attackers exploited a critical vulnerability in Bitcoin’s Lightning Network, draining funds from Lightning nodes operated via BTCPay Server. The flaw allowed unauthorized access to credential files, enabling attackers to control nodes and move funds. BTCPay urged users running LND software to update or take servers offline, though it has not disclosed the number of affected users or the amount stolen.
A critical vulnerability exposed “.macaroon” files, allowing attackers to control Lightning nodes and move funds. The breach targeted nodes operated through BTCPay Server, a widely used tool for merchants accepting Bitcoin payments. Foundation, a hardware-wallet maker, confirmed its BTCPay Lightning node was compromised, with channels closed and funds swept.
The vulnerability was identified by the Bitcoin Red Team, which responsibly disclosed the issue to BTCPay. The group credited its members for alerting the software provider, though details of how the flaw was discovered remain unspecified. Citadel21, a Bitcoin publication, reported its Lightning node was also affected, though it noted little money was held there at the time.
BTCPay confirmed funds were stolen but has not disclosed the scale of the breach. The company advised users of its LND software to upgrade to version 2.4.2 or disconnect nodes to mitigate risks. Standard on-chain wallets managed by BTCPay are unaffected, but funds stored in LND’s on-chain wallets under compromised nodes remain exposed.
The exact timeline of the attack and the extent of its impact on BTCPay users remain unclear. While the Bitcoin Red Team’s disclosure helped address the flaw, uncertainty persists over how many users were affected and the total value of stolen funds. The incident highlights ongoing security challenges in decentralized financial infrastructure.
Written by Daniel Brooks
Security Desk
