BTCPay Server confirmed that attackers exploited a critical flaw to steal funds from users running any version prior to 2.4.2 and urged operators to update immediately.

The self-hosted Bitcoin payment processor released version 2.4.2 to close the vulnerability. The issue allowed an unauthenticated remote attacker to obtain .macaroon credential files for LND, a common Lightning Network implementation.

What BTCPay Server Users Must Do

The stolen credentials could hand an attacker full control of an LND node. From there, the attacker could move funds directly out of the node.

“We have confirmed that attackers exploited this vulnerability. Users were affected and funds were stolen. We are not publishing technical details yet because operators still need time to update,” the team said.

Follow us on X to get the latest news as it happens

The risk applies specifically to deployments using LND. Other Lightning setups and non-Lightning users face no credential exposure, though the project still urged them to update. BTCPay Server’s own on-chain and hot wallets remain unaffected.

Operators who use LND should update to version 2.4.2 and LND 0.21.1 through the maintenance dashboard. The update regenerates macaroons automatically. Those unable to patch immediately were told to take their servers offline.

The project also advised LND users to review node activity for unfamiliar peers, unexpected channel closures, and payments they did not make.

A Second Blow to Bitcoin Self-Custody

The disclosure follows another major security incident. Galaxy Research confirmed on Friday that 1,719 Bitcoin (BTC), worth roughly $111 million, has been stolen from Coldcard users so far. The firm expects total losses to exceed $130 million once outstanding cases are verified.

Neither incident touched the Bitcoin protocol itself. Both instead exposed weaknesses in the tools built around it. 

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

Source: BeInCrypto