- Published on
BTCPay restricts remote Lightning access after attackers steal funds
- Authors
- Name
- DeepHorus
BTCPay Server has temporarily restricted remote connections to Lightning Network nodes running LND after attackers exploited a critical vulnerability to steal funds. The restriction prevents external wallets such as Zeus from connecting through BTCPay Server domains or Tor onion addresses on Docker deployments. Lightning payments remain available, and remote access will return once safe.
The vulnerability allowed an unauthenticated attacker to obtain "macaroon" credential files used to control LND. This could let attackers take over a node and move its funds. BTCPay called the issue critical and moved quickly to limit exposure.
Version 2.4.2 installs LND 0.21.1 and automatically regenerates macaroon credentials on standard installations. Operators using their own reverse proxies, Tor services, or forwarded ports must rotate credentials manually. The update does not close independently managed access routes.
Operators should check for unauthorized payments, unexpected channel closures, unfamiliar peers, and balance discrepancies. At least two entities reported losses. Foundation CEO Zach Herbert said its Lightning node was drained overnight, though its hot wallet remained safe and channels were swept.
Bitcoin publication Citadel21 also reported its node was swept, but neither disclosed amounts. The total stolen and number of affected operators remain unknown. This incident adds to a series of Bitcoin product security issues.
Earlier, a Coldcard hardware-wallet flaw was linked to over $100 million in confirmed losses. Both cases affected software around Bitcoin, not the protocol itself. Third-party infrastructure continues to be a weak point.
BTCPay plans to restore remote access when it is safe. The project recommends vigilance and credential rotation. The broader Lightning ecosystem will need stronger security practices to protect user funds.
