A critical vulnerability affecting Bitcoin Lightning infrastructure is being actively exploited, with attackers draining funds from Lightning nodes operated through BTCPay Server.
The vulnerability affects deployments using LND, one of the most widely used implementations for running Bitcoin Lightning nodes. BTCPay Server has urged affected operators to update to LND version 2.4.2 immediately or take their servers offline until they can be secured.
The incident adds to growing security concerns surrounding Bitcoin infrastructure and highlights the risks faced by businesses relying on Lightning for BTC payments.
Attackers Exploit LND Credentials to Access Lightning Nodes
According to BTCPay Server, the vulnerability allowed an unauthenticated remote attacker to access .macaroon files.
Macaroons are credential files that authorize applications to interact with an LND Lightning node. If an attacker obtains these credentials, they may be able to gain control over the node and initiate transactions or move funds.
BTCPay said attackers were already exploiting the vulnerability against live servers when its public warning was issued. The project has not yet disclosed the total number of affected users or the amount of Bitcoin stolen.
For readers interested in how Lightning infrastructure works, BTCPay's documentation explains how merchants can connect and operate Bitcoin Lightning Network nodes through BTCPay Server.
BTCPay Urges LND Operators to Update Immediately
BTCPay has advised users running LND to upgrade to version 2.4.2 as soon as possible.
Operators unable to update immediately have been advised to take affected servers offline to prevent unauthorized access.
The vulnerability specifically affects BTCPay deployments using LND. BTCPay clarified that its standard on-chain wallets, including hot wallets generated directly within BTCPay Server, are not affected by the credential exposure itself.
However, funds held inside the on-chain wallet controlled by an affected LND node may still be at risk.
Users running their own payment infrastructure can also review BTCPay Server's official documentation for information about deployment, wallets and Lightning integrations.
Bitcoin Companies Report Lightning Node Losses
Several Bitcoin-related organizations have reported incidents involving compromised Lightning infrastructure.
Hardware-wallet manufacturer Foundation said attackers drained its BTCPay Lightning node, closed its channels and swept the funds. Its separate BTCPay on-chain hot wallet was not affected.
Bitcoin publication Citadel21 also reported that its Lightning node had been swept, although it said the amount of Bitcoin held on the node was relatively small.
The incidents demonstrate how a vulnerability affecting node credentials can have direct financial consequences for businesses using Lightning.
Bitcoin Red Team Discovered the Vulnerability
The vulnerability had previously been reported to BTCPay by members of the Bitcoin Red Team, a group of developers investigating security weaknesses across Bitcoin-related software.
BTCPay credited Craig Raw, Rob Hamilton, Calle and Evan Kaloudis with responsibly reporting the issue and assisting with its investigation.
The vulnerability was disclosed during a broader security effort in which developers have been investigating weaknesses across Bitcoin codebases and related projects.
The rapid exploitation of the BTCPay vulnerability illustrates the difficult balance between quickly disclosing security flaws and giving developers enough time to patch affected systems.
Technical Details Remain Limited
BTCPay has not yet released a complete technical explanation of the vulnerability.
The project said operators need time to apply the necessary fixes before additional details are published. A more comprehensive postmortem is expected in the coming days.
For now, Bitcoin Lightning operators using LND should prioritize updating their infrastructure and reviewing their systems for signs of unauthorized access.
How Bitcoin Lightning Nodes Are Affected
The Lightning Network operates as a second-layer payment system built on top of Bitcoin, allowing users to make faster and lower-cost transactions through payment channels.
BTCPay Server supports several Lightning implementations, including LND, Core Lightning and Eclair. Its documentation also warns that running a Lightning node involves managing both on-chain and off-chain funds.
This distinction is important in the latest incident because the reported vulnerability specifically involves LND-based deployments, rather than representing a compromise of the Bitcoin blockchain itself.
What Bitcoin Lightning Operators Should Know
The incident does not mean that Bitcoin itself has been compromised.
The vulnerability affects specific software infrastructure used to operate Lightning nodes and BTCPay Server deployments. Bitcoin's underlying blockchain network remains separate from the affected software.
Operators running affected LND installations should:
Upgrade to LND 2.4.2 immediately
Take vulnerable servers offline if they cannot be patched
Review Lightning node credentials for unauthorized access
Check channel and wallet activity for unexpected transactions
Monitor affected infrastructure for signs of compromise
Review BTCPay's Lightning Network security and setup guidance
Wait for BTCPay's full postmortem for additional mitigation guidance
BTCPay's documentation specifically recommends maintaining appropriate backups and understanding the risks associated with Lightning nodes and their on-chain wallets.
Conclusion
The latest BTCPay Server incident highlights a critical security risk within the Bitcoin Lightning ecosystem rather than a vulnerability in Bitcoin's underlying protocol.
Attackers have already exploited the flaw to access LND credentials and drain funds from some Lightning nodes. With the scale of the incident still being assessed, operators running LND should treat the warning as urgent and update to version 2.4.2 or take vulnerable servers offline.
As Lightning adoption grows among merchants and payment providers, securing the software and infrastructure supporting Bitcoin payments will remain an important part of the network's broader development.
