BTCPay Server, the open-source Bitcoin payment processor that lets merchants skip the middlemen, just disclosed a critical vulnerability that allowed attackers to remotely hijack Lightning Network nodes and drain funds. The project has patched the issue in version 2.4.2, donated 0.42 BTC to the security researchers who flagged the flaw, and announced a bounty program aimed at recovering stolen funds.
The vulnerability affected BTCPay Server deployments running LND Lightning nodes. And by the time the fix arrived, attackers had already started helping themselves.
What went wrong
The flaw centered on .macaroon credential files, which are essentially the authentication keys that control access to an LND Lightning node. In affected versions of BTCPay Server, these credential files were exposed to unauthenticated remote access. No login required. No special privileges needed. An attacker who knew where to look could grab the macaroon files and take full control of a victim’s Lightning node, opening the door to siphon funds from active payment channels.
On-chain Bitcoin wallets were not affected. The vulnerability was isolated to the Lightning integration layer. Confirmed reports indicate that thefts were already in motion before the patch dropped, though the total amount stolen has not been publicly disclosed. BTCPay Server’s initial communications deliberately omitted specific technical details to avoid giving attackers a roadmap while users scrambled to update.
