BTCPay Server Blocks Remote Lightning Access After Credential-Theft Attack Drains Nodes

Quick Take

BTCPay Server temporarily disabled public remote connections to Lightning nodes running LND after attackers stole macaroon credentials and moved funds
Version 2.4.2 automatically installs LND 0.21.1 and regenerates credentials; operators advised to check for unauthorized payments and channel closures
Foundation and Citadel21 confirmed drained Lightning nodes, but total losses and number of affected operators remain unknown
The breach marks the latest security incident in widely-used Bitcoin infrastructure, following the Coldcard hardware wallet flaw linked to over $100 million in losses

What Happened

BTCPay Server, an open-source Bitcoin payment processor, has temporarily restricted public remote connections to Lightning Network nodes after attackers exploited a critical vulnerability in Lightning Network Daemon (LND) software to steal credentials and drain funds from multiple operators.

The vulnerability allowed unauthenticated remote attackers to obtain "macaroon" credential files—the authentication tokens that control LND node operations. With these stolen credentials, attackers gained complete control over Lightning nodes and moved funds without authorization.

The restriction specifically blocks external wallet applications such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments. BTCPay emphasized that Lightning payments can continue to function despite the restriction, and the team plans to restore remote-access functionality once they determine it is safe to do so.

At least two prominent operators have publicly confirmed losses. Foundation, a Bitcoin hardware wallet company, reported that its Lightning node was drained overnight. CEO Zach Herbert later clarified that while the company's hot wallet remained unaffected, all Lightning channels were forcibly closed and the funds swept by attackers. Bitcoin publication Citadel21 also disclosed that its Lightning node had been completely swept.

Neither organization has disclosed the specific amounts stolen, and the total scope of the attack—including the number of affected operators and aggregate losses—remains unknown at this time.

Why It Matters

Infrastructure Security Risk: This incident exposes critical vulnerabilities in widely-deployed Bitcoin infrastructure components, not the Bitcoin protocol itself. BTCPay Server is used by thousands of merchants and operators worldwide for Bitcoin and Lightning payments, making this a significant security event for the broader Bitcoin ecosystem.

The breach represents the latest in a concerning series of security incidents affecting Bitcoin-adjacent software and hardware. It follows closely on the heels of the Coldcard hardware wallet vulnerability, which has been linked to confirmed losses exceeding $100 million. Importantly, both incidents affected software and hardware surrounding Bitcoin rather than the network's underlying protocol—a distinction that underscores the layered nature of Bitcoin security.

For Lightning Network operators, the attack demonstrates that remote access convenience comes with substantial security trade-offs. The ability to manage Lightning nodes remotely through mobile wallets like Zeus has been a key usability feature, but this incident reveals how credential exposure can lead to complete node compromise.

The speed at which operators reported drained nodes—Foundation noted overnight drainage—suggests attackers moved quickly once they obtained credentials, leaving little time for detection or response. This highlights the need for proactive monitoring systems and security best practices among Lightning operators.

The Numbers

2.4.2 BTCPay Server patch version

0.21.1 Updated LND version

2+ Confirmed affected operators

$100M+ Coldcard-related losses (separate incident)

⚠️ Unverified: The total amount stolen in the BTCPay/LND attack and the complete number of affected operators have not been disclosed. Only Foundation and Citadel21 have publicly confirmed losses, with neither organization revealing specific dollar amounts.

Technical Details: The Vulnerability

The vulnerability centered on the exposure of macaroon credential files used by LND to authenticate and authorize operations. Macaroons function as bearer tokens in the Lightning Network—possession of a valid macaroon grants the holder the ability to perform actions on an LND node without further authentication.

According to BTCPay's security advisory, the flaw allowed remote attackers to access these credential files without any prior authentication. Once obtained, the macaroons provided attackers with the capability to:

Issue unauthorized Lightning payments
Force channel closures
Connect to unfamiliar peers
Move both Lightning and on-chain funds controlled by the node

The attack vector specifically affected BTCPay Server Docker deployments where LND was exposed through BTCPay's domain or Tor infrastructure. Operators who exposed LND through their own reverse proxy, custom Tor service, forwarded port, or other independent routing mechanisms face additional risk, as the automatic credential rotation in version 2.4.2 does not close access routes managed outside BTCPay's control.

Technical Background: What are Macaroons?

Macaroons are authorization credentials used in LND that work similarly to cookies or API keys but with added flexibility. Unlike traditional bearer tokens, macaroons can be attenuated (restricted) to limit what actions they authorize. In this attack, however, attackers appear to have obtained admin-level macaroons with full node control permissions.

LND uses several types of macaroons with different permission levels: admin.macaroon (full control), invoice.macaroon (invoice operations), readonly.macaroon (query only), and others. The ability to steal admin macaroons represents a complete compromise of node security.

BTCPay's Response and User Actions

Automatic Security Update

BTCPay Server version 2.4.2 includes several critical security measures:

Automatic installation of LND version 0.21.1, which presumably patches the underlying vulnerability
Automatic regeneration of macaroon credentials on standard BTCPay installations, invalidating any previously stolen credentials
Temporary blocking of remote access through BTCPay domains and Tor addresses to prevent further exploitation

Recommended Operator Actions

BTCPay has advised all operators running Lightning nodes to immediately:

Update to version 2.4.2 to install the patched LND version and trigger credential rotation
Review transaction history for any unauthorized payments or suspicious activity
Check for unexpected channel closures that may indicate attacker activity
Audit peer connections to identify unfamiliar nodes that shouldn't be connected
Verify balances across both on-chain and Lightning Network channels to identify any discrepancies

Important: Operators who expose LND through their own reverse proxy, Tor service, forwarded port, or any route outside BTCPay's management must manually rotate their credentials. The automatic update only secures access routes managed directly by BTCPay Server.

What's Next

BTCPay Server plans to restore remote access functionality for external wallets once the team determines it is safe to do so. The timeline for this restoration has not been specified and will likely depend on thorough security audits and confirmation that the vulnerability has been fully addressed across the Lightning Network ecosystem.

Operators should watch for:

Official announcements from BTCPay regarding when remote access will be safely restored
Disclosure of attack scope including total losses and number of affected nodes, if this information becomes available
Post-mortem analysis detailing how the vulnerability was discovered and exploited
LND security updates from Lightning Labs regarding any additional recommended actions
Industry-wide security reviews of other Lightning implementations and BTCPay alternatives

Given the pattern of recent high-profile security incidents in Bitcoin infrastructure—particularly the Coldcard vulnerability mentioned alongside this breach—the broader Bitcoin development community may initiate more comprehensive security audits of widely-deployed tools and hardware.

Context: July 2026 Security Landscape

The BTCPay/LND incident occurred in the context of what has been reported as the second-worst month for cryptocurrency losses in 2026. According to information referenced in the source material, July 2026 saw losses reach $247 million, with the Coldcard hardware wallet exploit contributing to a significant portion of that total. This concentration of high-impact vulnerabilities in trusted infrastructure has raised concerns about the security posture of the broader Bitcoin ecosystem.

Frequently Asked Questions

Is the Bitcoin network itself affected by this vulnerability?

No. This vulnerability affected BTCPay Server software and the Lightning Network Daemon (LND) implementation—tools that interact with Bitcoin—not the Bitcoin protocol itself. The underlying Bitcoin network continues to operate normally and securely.

Can I still accept Lightning payments if I use BTCPay Server?

Yes. BTCPay Server explicitly stated that Lightning payments can continue to function. The restriction only affects remote access through external wallet applications like Zeus; the core payment processing capability remains operational.

How do I know if my Lightning node was compromised?

Check your node for: (1) unauthorized outgoing payments you didn't initiate, (2) channels that were closed without your action, (3) unfamiliar peer connections you didn't establish, and (4) discrepancies between your recorded balances and actual on-chain or Lightning balances. If you find any of these signs, update immediately to version 2.4.2 and consider your previous credentials compromised.

What are macaroon credentials and why are they important?

Macaroons are authentication tokens used by LND to control access to node operations. They function as bearer credentials—anyone possessing a valid macaroon can perform authorized actions on the node. Admin-level macaroons grant complete control, which is why their theft allowed attackers to drain funds entirely.

Will updating to version 2.4.2 protect me if I exposed LND through my own custom setup?

Not automatically. If you exposed LND through your own reverse proxy, Tor service, forwarded port, or other infrastructure outside BTCPay's management, you must manually rotate your macaroon credentials. The automatic credential rotation in version 2.4.2 only secures routes managed directly by BTCPay Server.