by Coinstrooper Crypto Articles
Quick Take
  • The self-hosted Bitcoin payment processor released version 2.4.2 to close the vulnerability.
  • The issue allowed an unauthenticated remote attacker to obtain .macaroon credential files for LND, a common Lightning Network implementation.
  • The stolen credentials could hand an attacker full control of an LND node.
  • From there, the attacker could move funds directly out of the node.

What Happened

BTCPay Server confirmed that attackers exploited a critical flaw to steal funds from users running any version prior to 2.4.2 and urged operators to update immediately.

The self-hosted Bitcoin payment processor released version 2.4.2 to close the vulnerability. The issue allowed an unauthenticated remote attacker to obtain .macaroon credential files for LND, a common Lightning Network implementation.

“We have confirmed that attackers exploited this vulnerability. Users were affected and funds were stolen. We are not publishing technical details yet because operators still need time to update,” the team said.

Market Context

What BTCPay Server Users Must Do

Follow us on X to get the latest news as it happens

Why It Matters

The stolen credentials could hand an attacker full control of an LND node. From there, the attacker could move funds directly out of the node.

The risk applies specifically to deployments using LND. Other Lightning setups and non-Lightning users face no credential exposure, though the project still urged them to update. BTCPay Server’s own on-chain and hot wallets remain unaffected.

The project also advised LND users to review node activity for unfamiliar peers, unexpected channel closures, and payments they did not make.

The disclosure follows another major security incident. Galaxy Research confirmed on Friday that 1,719 Bitcoin (BTC), worth roughly $111 million, has been stolen from Coldcard users so far. The firm expects total losses to exceed $130 million once outstanding cases are verified.

Details

Operators who use LND should update to version 2.4.2 and LND 0.21.1 through the maintenance dashboard. The update regenerates macaroons automatically. Those unable to patch immediately were told to take their servers offline.

A Second Blow to Bitcoin Self-Custody

Neither incident touched the Bitcoin protocol itself. Both instead exposed weaknesses in the tools built around it.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights

The post Bitcoin Payment Tool BTCPay Urges Update After Attackers Steal Funds appeared first on BeInCrypto.