BTCPay Server has confirmed that attackers exploited a critical vulnerability and successfully stole funds from users running outdated versions of the software.
The open-source, self-hosted Bitcoin payment processor pushed an emergency update to version 2.4.2 to close the hole. It urged every operator to update immediately.
The flaw allowed an unauthenticated remote attacker to obtain macaroon credential files tied to LND, a widely used Lightning Network implementation.
Stolen macaroon files can hand an attacker effective control of an LND node. From there, funds can be moved directly out of the node without the owner’s involvement.
BTCPay Server said the vulnerability affects every version released before 2.4.2, including release candidates for that version.
The team confirmed plainly that users were affected and that funds were stolen. It said technical details would remain withheld temporarily so operators have time to patch before attackers can study the writeup.
Hardware wallet maker Foundation and bitcoin publication Citadel21 both reported Lightning nodes swept clean, with channels force-closed before the public warning went out.
Operators unable to update right away were told to take their BTCPay Server offline entirely. That step is meant to block unauthorized access until the patch can be applied.
The vulnerability was disclosed to BTCPay by the Bitcoin Red Team, a volunteer security group that has been auditing open-source Bitcoin infrastructure.
BTCPay Server’s own on-chain and hot wallets are not affected by this specific issue. The exposure is isolated to LND-based Lightning deployments.
Updating alone does not fully close the door for affected operators. The team also advised revoking LND macaroons and moving any funds sitting in a BTCPay-generated on-chain hot wallet as an added precaution.
The incident lands amid a broader wave of scrutiny across Bitcoin infrastructure. It follows a separate Coldcard exploit that Galaxy Research says has cost users roughly 1,719 BTC, worth close to $111 million.
