BTCPay Server Restricts Remote Lightning Access After Critical Credential Exploit
Key Takeaways
- •BTCPay Server temporarily disabled remote connections to LND nodes after a vulnerability allowed attackers to steal authentication credentials and drain funds.
- •The security flaw exposed "macaroon" files, which are tokens used to control Lightning Network nodes, allowing unauthorized access.
- •The newly released version 2.4.2 automatically rotates credentials on standard BTCPay installations, though operators using custom setups must manually secure their connections.
- •At least two entities, hardware manufacturer Foundation and publication Citadel21, reported having their Lightning channels closed and funds stolen.
BTCPay Server, the open-source, self-hosted Bitcoin payment processor, has temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software after attackers exploited a critical vulnerability to obtain credentials and move funds.
The restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments. Lightning payments continue to function normally, and BTCPay stated it plans to restore the remote-access option once it determines the risk has been sufficiently mitigated.
The incident is the latest in a series of security breaches affecting widely used Bitcoin products, coming shortly after a Coldcard hardware-wallet flaw was linked to more than $100 million in confirmed losses. Both cases involved software and infrastructure surrounding Bitcoin rather than vulnerabilities in the network's underlying protocol — a distinction that underscores how the growing ecosystem of Lightning-enabled services, wallet integrations, and self-hosted node deployments has expanded the attack surface beyond Bitcoin's base layer.
Vulnerability and Automatic Credential Rotation
BTCPay explained that the vulnerability allowed an unauthenticated remote attacker to obtain "macaroon" credential files — the authentication tokens used to control LND, a major implementation of the Lightning Network. With these credentials exposed, attackers could potentially seize control of an LND node and move its funds.
BTCPay's official security advisory states that version 2.4.2 installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard BTCPay installations.
The project advised all operators to check for signs of compromise, including unauthorized payments, unexpected channel closures, unfamiliar peers, and discrepancies between their records and their on-chain or Lightning balances.
Operators who expose LND through their own reverse proxy, Tor service, forwarded port, or any other route outside of BTCPay must rotate their credentials separately. Installing the BTCPay update alone does not close access routes managed independently by the operator, the project noted.
Operators Report Losses
At least two operators publicly reported losses stemming from the exploit.
Zach Herbert, CEO of hardware-wallet manufacturer Foundation, disclosed that the company's Lightning node was drained overnight. He later clarified that its hot wallet was unaffected, but its Lightning channels had been closed and the funds swept.
Bitcoin publication Citadel21 separately reported that its Lightning node had also been swept. Neither operator disclosed the specific amount lost.
Related: Coldcard exploit pushes July losses to $247M as second-worst month of 2026