A critical BTCPay Server vulnerability allowed attackers to retrieve LND .macaroon credentials on versions prior to 2.4.2 and steal funds from Lightning nodes, prompting an urgent patch to BTCPay Server 2.4.2 and LND 0.21.1 which regenerates macaroons or requires taking servers offline. The incident, separate from the Bitcoin protocol, follows the Coldcard exploit that confirmed 1,719 BTC (~$111M) stolen with total losses likely above $130M, highlighting widening crypto security and self-custody risks.

Bearish

Predictions Markets

See what traders are focused on

View analytics →

In Brief

A BTCPay Server flaw exposed LND credentials, letting attackers steal user funds.
Version 2.4.2 patches the bug and regenerates macaroons.
The exploit lands after the Coldcard hack losses topped $130 million.

BTCPay Server confirmed that attackers exploited a critical flaw to steal funds from users running any version prior to 2.4.2 and urged operators to update immediately.

The self-hosted Bitcoin payment processor released version 2.4.2 to close the vulnerability. The issue allowed an unauthenticated remote attacker to obtain .macaroon credential files for LND, a common Lightning Network implementation.

What BTCPay Server Users Must Do

The stolen credentials could hand an attacker full control of an LND node. From there, the attacker could move funds directly out of the node.

“We have confirmed that attackers exploited this vulnerability. Users were affected and funds were stolen. We are not publishing technical details yet because operators still need time to update,” the team said.

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.If you…
— BTCPay Server (@BtcpayServer) August 7, 2026

The risk applies specifically to deployments using LND. Other Lightning setups and non-Lightning users face no credential exposure, though the project still urged them to update. BTCPay Server’s own on-chain and hot wallets remain unaffected.

Operators who use LND should update to version 2.4.2 and LND 0.21.1 through the maintenance dashboard. The update regenerates macaroons automatically. Those unable to patch immediately were told to take their servers offline.

The project also advised LND users to review node activity for unfamiliar peers, unexpected channel closures, and payments they did not make.

A Second Blow to Bitcoin Self-Custody

The disclosure follows another major security incident. Galaxy Research confirmed on Friday that 1,719 Bitcoin (BTC), worth roughly $111 million, has been stolen from Coldcard users so far. The firm expects total losses to exceed $130 million once outstanding cases are verified.

$111 MILLION CONFIRMED STOLEN SO FAR IN COLDCARD EXPLOITThanks to victim reports, we can confirm with high confidence that 1719 BTC has been stolen from Coldcard victims so farWe have many more coins we are vetting for confirmation – we think total losses likely exceed $130m pic.twitter.com/pLfiMQZFyX
— Galaxy Research (@glxyresearch) August 7, 2026