A rough week for bitcoin's software is getting worse, this time hitting merchants who accept bitcoin BTC$64,944.98 payments through Lightning, a separate network built on top of bitcoin for instant, low-cost transfers.
Attackers drained Lightning nodes running behind BTCPay Server late on Friday after exploiting a critical vulnerability that exposed the credentials protecting them, the team said in an X post.
BTCPay confirmed funds were stolen and told anyone running LND, the most widely used software for operating a Lightning node, to update immediately to version 2.4.2 or take the server offline.
The project has not disclosed how many users were hit or how much bitcoin was taken.
The flaw allowed an unauthenticated remote attacker to obtain “.macaroon” files, or credentials that give software permission to interact with an LND Lightning node. BTCPay said the attacks it reviewed targeted those files, which could then be used to take control of the node and move funds.
