A difficult week for Bitcoin infrastructure became even worse after a new critical vulnerability in the popular BTCPay Server payment processor allowed attackers to steal funds from merchants’ Lightning nodes. The attack affected companies using LND (Lightning Network Daemon), including hardware wallet manufacturer Foundation and Bitcoin publication Citadel21.
BTCPay Server issued an emergency warning urging all LND users to immediately upgrade to version 2.4.2 or completely shut down their servers until the patch is installed.
BTCPay Server is a popular open-source payment processor that allows merchants to accept Bitcoin and Lightning payments without intermediaries. Unlike custodial solutions, BTCPay gives merchants full control over their funds by operating as a self-hosted node.
The platform is widely used throughout the Bitcoin ecosystem because of:
BTCPay’s popularity among merchants is precisely what makes this vulnerability especially dangerous, as thousands of businesses accepting Bitcoin payments may have been exposed.
The vulnerability allowed an unauthenticated remote attacker to access critical credential files known as .macaroon files. These files are authorization tokens that grant software permission to interact with an LND Lightning node.
Macaroon files in LND are cryptographic tokens that define levels of access to a node. Compromising these files is effectively equivalent to handing full control of the Lightning node to an attacker.
LND uses macaroon files to separate access privileges:
The attackers gained access to admin macaroon files, allowing them to fully control compromised nodes and withdraw funds.
Although BTCPay Server has not disclosed the exact number of affected users or the total amount stolen, several well-known companies have publicly confirmed that they were victims of the attack.
Foundation, the company behind the popular Passport hardware wallet, became one of the most notable victims. CEO Zach Herbert confirmed that attackers drained the company’s Lightning node through BTCPay Server.
“Attackers drained our company’s BTCPay Lightning node overnight, closing channels and withdrawing the funds,” Herbert stated. He also noted that BTCPay’s on-chain hot wallet remained untouched.
The incident is particularly ironic given that Foundation specializes in Bitcoin storage security. The company uses BTCPay to accept Lightning payments from customers.
Citadel21, a popular Bitcoin publication operated by pseudonymous commentator hodlonaut, also reported that its Lightning node had been compromised. However, the publication noted that only a small amount of funds had been stored on the node.
Hodlonaut, known throughout the Bitcoin community for his advocacy and activity, publicly confirmed the incident, drawing additional attention to the security issue.
Analysis of the incident reveals a clear sequence of actions by the attackers:
It is important to note that the vulnerability was being actively exploited. This was not a theoretical security flaw, but a real threat that had already resulted in financial losses.
BTCPay Server clearly defined the scope of the vulnerability to prevent unnecessary panic among users:
Key clarification: the vulnerability is specific to LND. Users of other Lightning implementations, or those who do not use Lightning at all, are not exposed to this particular risk.
BTCPay Server issued clear instructions for all users:
Although these users are not affected by this specific vulnerability, BTCPay still recommends upgrading to version 2.4.2 to receive other security improvements.
BTCPay Server thanked members of Bitcoin Red Team for responsibly disclosing the vulnerability and assisting with the investigation. The team included:
Bitcoin Red Team is an initiative formed by security researchers that recently conducted a large-scale audit of the Bitcoin ecosystem, discovering thousands of vulnerabilities. Their work demonstrates the importance of a proactive security approach in a decentralized ecosystem.
Responsible vulnerability disclosure is a critically important practice in open-source development. Researchers give developers time to create and deploy a patch before the technical details of a vulnerability are made public.
This incident became part of a worrying series of security problems affecting the Bitcoin ecosystem over the previous week:
This series of incidents raises important questions about the maturity of Bitcoin infrastructure security and the need for more rigorous auditing of critical components.
The BTCPay Server incident provides important lessons for anyone accepting Bitcoin payments or operating Lightning nodes:
Open-source software requires continuous maintenance. Establish a process for regular updates and monitor security advisories closely.
Do not keep large balances in hot wallets. Use cold storage for primary reserves and leave only the operational balance required for day-to-day activity in hot wallets.
Configure alerts for suspicious activity on your nodes. Early detection of an attack can significantly reduce potential losses.
Do not rely on a single point of failure. Consider using multiple payment processors or different Lightning implementations.
This incident is likely to accelerate development in several areas:
Critical infrastructure such as BTCPay Server will likely undergo more rigorous and frequent security reviews by independent researchers.
Developers will work to simplify the update process, potentially introducing automatic updates for critical security patches.
More sophisticated tools will likely emerge for monitoring Lightning nodes and detecting anomalous activity in real time.
The community is likely to invest more resources in educating merchants and node operators about security best practices.
In addition to immediately applying the update, merchants should consider the following long-term measures:
The BTCPay Server incident is another reminder that security in the cryptocurrency ecosystem is never a finished task. It is a continuous process requiring vigilance, rapid response, and constant improvement.
Positive aspects of the situation include:
For merchants, this incident is a harsh reminder of the importance of a proactive approach to security. Simple measures such as regular updates and monitoring can prevent significant losses.
For the ecosystem as a whole, it is an opportunity to strengthen security practices and build more resilient infrastructure for the years ahead. Every vulnerability that is discovered and fixed makes Bitcoin stronger.
In the world of open-source development, security is a collective responsibility. Every participant in the ecosystem, from developers to end users, plays an important role in creating a safer environment for everyone.
While BTCPay Server prepares a full postmortem of the incident, expected to be published in the coming days, users should remain vigilant and follow official recommendations. Transparency and openness in security matters are essential to trust and the sustainable development of the Bitcoin ecosystem.
“Security is not a product you can buy once, but a process that must be maintained continuously. In the open-source world, every one of us is part of that process.”
— Bruce Schneier, renowned cryptographer and security expert
