Another Bitcoin infrastructure exploit hits, this time draining Lightning payment servers
BTCPay told users running LND to update immediately or take servers offline after attackers stole credentials that can control Lightning wallets and move funds.
The Bitcoin software landscape faced another challenge this week, this time targeting merchants accepting BTC payments through the Lightning network. Attackers exploited a critical vulnerability in BTCPay Server, draining Lightning nodes after obtaining sensitive credentials. BTCPay confirmed funds were stolen and urged users to update to the latest software version immediately or shut down their servers.
The exact number of affected users and the total amount stolen remains undisclosed by BTCPay. The flaw allowed unauthenticated remote attackers to obtain crucial "macaroon" files, enabling them to control Lightning nodes and transfer funds. Notable victims included hardware-wallet maker Foundation and bitcoin publication Citadel21.
Bitcoin developers had previously reported this vulnerability to BTCPay, with members of the Bitcoin Red Team responsible for responsibly disclosing the issue. BTCPay clarified that while standard on-chain wallets are not affected, funds within the Lightning network's wallet remain at risk. The company has not yet disclosed technical details of the vulnerability, but expects to release a full postmortem in the near future.
Written by urgent.news from CoinDesk's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
