Bitcoin
Critical BTCPay Server Flaw Leads to Lightning Node Fund Thefts
A critical vulnerability in BTCPay Server was actively exploited, enabling attackers to steal Bitcoin from Lightning Network nodes by accessing authentication files without permission.
A severe security vulnerability in BTCPay Server was exploited on Friday evening, resulting in unauthorized theft of Bitcoin from Lightning Network nodes. The flaw enabled remote attackers to access ".macaroon" files without authentication. These files serve as authorization credentials that grant applications administrative access to LND Lightning nodes, the most popular Lightning Network implementation.
With these stolen credential files in hand, malicious actors gained full administrative access to nodes and initiated unauthorized fund transfers. BTCPay Server immediately issued directives for all users to install version 2.4.2 or power down their servers completely until the security patch could be applied. The organization acknowledged the ongoing exploitation but has not disclosed the number of compromised users or the total value of stolen Bitcoin.
At least two organizations confirmed being targeted. Foundation, a hardware wallet specialist, verified that its BTCPay Lightning node was completely drained during the attack. CEO Zach Herbert explained that attackers forcibly closed the company's payment channels and transferred all available funds, though the company's on-chain hot wallet remained secure. Bitcoin-focused media platform Citadel21, operated by pseudonymous figure hodlonaut, also reported having its Lightning node emptied, though noted that minimal funds were stored in the node at the time of the breach.
BTCPay Server emphasized that conventional on-chain wallets within the platform were unaffected by this credential vulnerability. However, any Bitcoin stored in LND's internal on-chain wallet remains vulnerable due to its connection to the compromised node infrastructure. Following the security patch installation, the platform recommended users regenerate all macaroon credential files and the macaroon database.
These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.
More on Bitcoin All pieces →
- Neutral Block Files for US National Trust Bank Charter to Consolidate Crypto Custody
- Neutral Tokenized Asset Holders Cross 3.5 Million as Institutional Inflows Rebound
- Neutral Iran Eases Currency Restrictions to Permit Cross-Border Crypto Settlements
- Neutral Block Seeks OCC Approval for Builders Bank & Trust to Manage Digital Assets
Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.
