BTCPay Flaw Lets Attackers Steal Lightning Node Credentials

BTCPay Server has blocked public remote connections to Lightning nodes running Lightning Network Daemon, or LND, after attackers exploited a vulnerability that exposed the credentials controlling those nodes.

The project released version 2.4.2, which installs LND 0.21.1 and automatically regenerates those credentials, called macaroons, on standard BTCPay deployments. Rotating the files invalidates stolen copies once operators update.

The flaw let an unauthenticated remote attacker obtain macaroons, which grant access to LND functions, according to BTCPay. With those credentials, an attacker could take control of a node and transfer funds without the operator's authorization.

Two operators have publicly reported losses. Zach Herbert, CEO of hardware-wallet maker Foundation, said its Lightning node was drained overnight. He later said the hot wallet was not affected, while Lightning channels were closed and the funds swept. Bitcoin publication Citadel21 also said its Lightning node had been swept. Neither disclosed how much was taken.

The temporary restriction stops external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker setups. BTCPay said Lightning payments can continue, so the measure targets remote administrative access rather than the payment layer itself.

The automatic credential rotation does not cover every configuration. Operators who exposed LND through their own reverse proxy, Tor service, forwarded port, or another access route outside BTCPay have to rotate credentials separately. Installing version 2.4.2 does not close remote connections that an administrator created independently of BTCPay's standard setup.