Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [ACTIVE] · [TECHNOLOGY]
2 clusters · 9 sources · 3 days · First seen · Last updated
BTCPay Server Lightning Network exploit
Overview
BTCPay Server, an open-source Bitcoin payment processor, issued an emergency security advisory following a critical vulnerability in its Lightning Network Daemon (LND) integration. The flaw allowed unauthenticated remote attackers to obtain ‘macaroon’ credential files, enabling them to seize control of LND nodes and move funds.
Initial reports indicated that at least two operators, including Foundation and Citadel21, suffered losses as their Lightning nodes were drained. In response, the project released version 2.4.2 to patch the vulnerability and advised users to rotate credentials manually if using independent proxies or Tor services.
Following the exploit, supporters announced a recovery bounty of 10% of any retrieved funds, capped at 3 BTC. The BTCPay Server Foundation also issued donations to security researchers Craig Raw and the Bitcoin Red Team fund for reporting the flaw. The project is currently preparing a postmortem and noted that artificial intelligence may have been involved in uncovering the vulnerability.
Entities
Bitcoin Red Team · BTCPay Server · Lightning Network · LND · Citadel21
Timeline
-
6 days ago
[TECHNOLOGY] 3 sourcesBTCPay Server offers Bitcoin bounty following wallet exploitBTCPay Server has offered a bounty of up to 3 BTC to recover funds stolen during a Lightning Network wallet exploit caused by a critical credential vulnerability.
-
8 days ago
[TECHNOLOGY] 6 sourcesBTCPay Server issues emergency update after Lightning Network exploitAttackers exploited a critical vulnerability in BTCPay Server to steal Lightning Network funds, prompting an urgent update and credential rotation for LND node operators.
Sources
birdwatchers.com · bitcoinethereumnews.com · coincu.com · cointelegraph.com · crypto.news · cryptopolitan.com · decrypt.co · it-boltwise.de · unchainedpodcast.com