BTCPay Server Restricts Lightning Access After Exploit Drains LND Nodes

BTCPay Server temporarily restricted public remote access to Lightning Network nodes running LND after confirming that attackers exploited a critical vulnerability to steal credentials and move funds.

The open-source Bitcoin payment processor said the flaw affects every BTCPay Server version before 2.4.2, including 2.4.2 release candidates. Attackers were able to obtain LND “macaroon” files, which are credentials that can authorize control over a Lightning node and its funds.

BTCPay has confirmed that users were affected and funds were stolen, but has not shared the total amount lost or the number of compromised operators. The project is also withholding full technical details while operators continue upgrading.

X post from BTCPay

Version 2.4.2 temporarily removes public access to the LND API on Docker deployments. That means external wallets like Zeus cannot currently connect to LND through a BTCPay Server domain or Tor onion address. Normal Lightning payments can continue, and BTCPay said remote access will return once it considers the setup safe.

BTCPay Server 2.4.2 upgrades standard deployments to LND 0.21.1 and automatically regenerates macaroon credentials. Operators should then review their nodes for unauthorized payments, unexpected channel closures, unfamiliar peers and unexplained differences in their on-chain or Lightning balances.

Users who expose LND through their own reverse proxy, Tor service, forwarded port or another route outside BTCPay must rotate credentials separately because the BTCPay update does not close independently managed access paths. Operators unable to update immediately have been told to take affected LND deployments offline.

The 2.4.2 GitHub release also tightens Greenfield API security, including a fix for a TOTP two-factor-authentication bypass through Basic authentication. Basic authentication is now disabled by default five minutes after account creation unless users opt back in. BTCPay has not yet published enough information to establish whether this was the precise route attackers used to obtain LND credentials.

At least two operators have publicly reported losses. Foundation CEO Zach Herbert said the hardware-wallet company's Lightning node was drained, with its channels closed and funds swept, while its BTCPay on-chain hot wallet remained unaffected. Bitcoin publication Citadel21 also reported that its Lightning node was swept. Neither disclosed how much was lost.

BTCPay stressed that its standard on-chain wallets, including hot wallets, are not affected by the LND credential issue, although funds in LND's own on-chain wallet can still be at risk.

The project promised a fuller postmortem in the next few days.