Other08 August, 20262 min read
Attackers Exploit BTCPay Server Vulnerability, Drain Lightning Nodes and Force-Close Channels
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
A critical BTCPay Server vulnerability was actively exploited, draining Lightning Network nodes and funds. BTCPay temporarily restricts public remote Lightning access after attackers drained nodes.
BTCPay Lightning nodes hit
BTCPay Server said attackers were actively exploiting a critical vulnerability to obtain “.macaroon” files and empty Lightning Network nodes, prompting an emergency directive to update to version 2.4.2 or shut servers down.
“There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.”
The incident was disclosed on August 7, 2026, and BTCPay’s public warning at 11:51 a.m. ET said, “There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.”
Hardware wallet maker Foundation and the bitcoin zine Citadel21 reported that their Lightning nodes were swept, with channels force-closed and funds drained, before BTCPay’s advisory reached most operators.
Foundation CEO Zach Herbert wrote that “Our Foundation node was drained overnight by attackers,” and said the company’s hot wallet was untouched while “all channels were closed and funds were swept.”
Patch isn’t enough
BTCPay’s fix in v2.4.2 addressed a logic error in how Basic Authentication handled two-factor authentication, but Tech Times warned that stolen macaroon credential files survive a software update intact. Tech Times said, “Stolen macaroon credential files… survive a software update intact,” meaning an attacker who exfiltrated them during the exploitation window retains access until the operator explicitly deletes and regenerates them.
The same article quoted ZEUS wallet team Kaloudis: “Don't assume you're safe after upgrading,” tying the risk to macaroon files persisting on disk and requiring deletion of the root key database. BTCPay founder Nicolas Dorier also emphasized the actively exploited flaw was distinct from a separate two-factor authentication bypass disclosed and patched on August 4, after an AI-generated explanation pinned the attack on the earlier issue.
Remote access restricted
After the thefts, BTCPay temporarily restricted public remote connections to Lightning Network nodes running LND software, saying the restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments. Cointelegraph reported BTCPay said Lightning payments can continue and that it plans to restore the remote-access option when it considers it safe, while version 2.4.2 installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard installations.
Cointelegraph also said BTCPay advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers and discrepancies between their records and onchain or Lightning balances. Separately, BTCPay said operators exposing LND through their own reverse proxy, Tor service, forwarded port, or another route outside BTCPay must rotate their credentials separately, and it noted that installing the update does not close access routes managed independently by the operator.