BTCPay Server issues emergency update after Lightning Network exploit

BTCPay Server, an open-source Bitcoin payment processor, has issued an urgent security advisory following a critical vulnerability in its Lightning Network Daemon (LND) integration. The flaw allowed unauthenticated remote attackers to obtain ‘macaroon’ credential files, enabling them to seize control of LND nodes and move funds.

As a response, BTCPay Server has temporarily restricted public remote connections to LND nodes to prevent further exploitation. The project has released version 2.4.2, which installs LND version 0.21.1 and automatically regenerates macaroon credentials for standard installations. However, operators using independent reverse proxies, Tor services, or forwarded ports must rotate their credentials manually.

At least two operators have reported losses. Zach Herbert, CEO of Foundation, stated that the company’s Lightning node was drained overnight via closed channels, though its on-chain hot wallet remained secure. The Bitcoin publication Citadel21 also reported its node was swept. The vulnerability affected all versions prior to 2.4.2. The incident follows a recent Coldcard hardware-wallet flaw, though both issues targeted surrounding software rather than the underlying Bitcoin protocol.