BTCPay Server has temporarily restricted public remote access to certain Lightning Network nodes after attackers exploited a critical vulnerability that exposed credentials and allowed funds to be moved from affected nodes.
The total amount stolen and the number of affected operators remain unclear, although at least two organizations have publicly reported that their Lightning nodes were drained.
BTCPay Temporarily Limits Remote Lightning Connections
BTCPay Server has temporarily disabled public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) on Docker deployments.
The restriction prevents external wallets, including Zeus, from connecting to LND through a BTCPay Server domain or Tor onion address.
BTCPay said Lightning payments can continue to operate normally and that remote access will be restored once the project determines that it is safe to do so.
The incident stems from a vulnerability that allowed unauthenticated remote attackers to obtain macaroon credential files, which are authentication credentials used to control LND nodes.
Once obtained, the credentials could potentially give attackers control over an affected node and allow them to move Lightning funds.
BTCPay Update Automatically Rotates Credentials
BTCPay has released version 2.4.2, which installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard BTCPay installations.
The project is urging node operators to update their installations and carefully review their activity for signs of compromise.
Operators should specifically look for:
- Unauthorized Lightning payments
- Unexpected channel closures
- Unknown or unfamiliar peers
- Differences between recorded and actual on-chain balances
- Discrepancies in Lightning channel balances
However, operators using their own infrastructure to expose LND need to take additional steps.
BTCPay said users who expose LND through an independent reverse proxy, Tor service, forwarded port, or another access mechanism outside BTCPay must rotate their credentials separately. Updating BTCPay alone does not automatically close externally managed access routes.
Foundation Reports Lightning Node Drain
At least two operators have publicly confirmed losses linked to the incident.
Foundation CEO Zach Herbert reported that the company’s Lightning node was drained overnight. He later clarified that the company’s hot wallet was not affected, while its Lightning channels were closed and the funds swept.
The company has not publicly disclosed the amount lost.
Bitcoin publication Citadel21 also reported that its Lightning node had been swept. The publication likewise did not disclose the value of the stolen funds.
With the number of affected operators and total losses still unknown, the full scope of the incident remains under investigation.
Another Security Incident for Bitcoin Infrastructure
The BTCPay incident comes shortly after a separate security issue involving the Coldcard hardware wallet, which has been linked to more than $100 million in confirmed losses.
Although the incidents involve different products and vulnerabilities, both highlight a broader security challenge facing Bitcoin users: the underlying Bitcoin protocol may remain secure while applications, wallets, infrastructure, and services built around it can still contain exploitable weaknesses.
For Lightning node operators, the BTCPay vulnerability reinforces the importance of regularly updating node software, rotating exposed credentials, reviewing network access configurations, and monitoring balances and channel activity for unusual transactions.
The incident also demonstrates why remote access to Lightning infrastructure can become a significant security risk when authentication credentials are exposed.
