A vulnerability in BTCPay Server, the open-source, self-hosted Bitcoin payment processor, has been actively exploited to drain funds from merchant Lightning Network nodes, prompting an urgent security warning from the platform's developers.

BTCPay Server, launched in 2017 as a censorship-resistant alternative to centralized payment processors, enables merchants to accept Bitcoin payments directly without intermediaries. It integrates with the Lightning Network, a Layer 2 scaling solution built on top of the Bitcoin blockchain that enables faster and cheaper transactions through off-chain payment channels. Lightning adoption has grown steadily since the network went live, with thousands of nodes routing payments globally, meaning that security flaws in widely used implementations can affect a broad set of merchants and users.

In a security advisory, BTCPay urged all users running the LND (Lightning Network Daemon) implementation to immediately update their servers to version 2.4.2 or take them offline entirely. According to the developers, attackers gained access to credentials that could be used to control connected Lightning wallets and move funds without authorization. The vulnerability is particularly significant because self-hosted setups like BTCPay are often chosen precisely for their self-custodial properties — merchants control their own private keys rather than relying on a third-party custodian — yet this flaw demonstrates that operational security at the application layer remains a critical risk even in non-custodial configurations.

LND, developed by Lightning Labs, is one of the three major Lightning Network implementations alongside Eclair and c-lightning. It is the most widely adopted implementation among BTCPay Server deployments, making the impact of any LND-specific vulnerability proportionally larger within that ecosystem.

The advisory instructed affected users to take several diagnostic steps:

• Check for payments they did not initiate.
• Look for unexpected channel closures or connections with unfamiliar peers.
• Compare on-chain and channel balances against their own records.
• Investigate any activity that cannot be accounted for.

The incident is the latest in a series of security issues affecting Bitcoin payment infrastructure, highlighting the risks that exist beyond the Bitcoin blockchain itself. As merchants increasingly depend on third-party software and Lightning nodes to process payments, vulnerabilities in these supporting layers can expose funds to theft even when the underlying Bitcoin protocol remains secure. Previous disclosures affecting LND and other Lightning implementations have prompted coordinated patching efforts, underscoring that the security of Lightning-based payments depends not only on the integrity of the Bitcoin base layer but also on the ongoing maintenance of the software that merchants and node operators choose to run.