BTCPay Restricts Remote Lightning Access After Credential Theft Exposes Nodes

BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software after attackers exploited a critical vulnerability to obtain credential files and access funds. The restriction prevents external wallets such as Zeus from connecting through BTCPay Server domains or Tor onion addresses on Docker deployments, though the project stated that Lightning payments can continue and expects to restore remote access once it deems the environment secure.

The vulnerability allowed unauthenticated remote attackers to obtain "macaroon" credential files used to control LND nodes. Those exposed credentials granted attackers the ability to take control of nodes and move their funds. BTCPay version 2.4.2 installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard installations. The project advised operators to monitor for unauthorized payments, unexpected channel closures, unfamiliar peers, and discrepancies in their onchain or Lightning balances.

Operators managing LND access through their own reverse proxy, Tor service, forwarded port, or other routes outside BTCPay must rotate credentials separately, as the update does not close independently managed access paths. At least two operators publicly reported losses, including Foundation CEO Zach Herbert, who said the company's Lightning node was drained overnight, though its hot wallet remained unaffected. The total amount stolen and number of affected operators remain unknown.

The breach is the latest security incident involving widely used Bitcoin infrastructure, following a Coldcard hardware-wallet flaw that generated more than $100 million in confirmed losses.