Bots Target Exposed Lightning Nodes in Fresh BTCPay Security Threat

BTCPay Server has warned about malicious bots probing exposed Lightning nodes for potential administrative control. This follows a critical vulnerability exploited in August, where attackers obtained credentials protecting LND nodes and drained merchant wallets.

The project disabled external access to LND in its standard Docker deployment after the attack, but automated systems are now targeting servers that manually restored this access. BTCPay said these bots repeatedly call an LND password-change endpoint during a short interval after LND restarts when the wallet remains locked.

This new mechanism could lead to a similar outcome as the previous vulnerability: an attacker obtaining credentials for control of an LND node. An older issue with default passwords in BTCPay LND wallets also compounds the risk, allowing an attacker to submit the password first and request administrator access.

BTCPay has not reported any successful takeovers through this new activity but is urging administrators to install version 2.4.4 and remove manually exposed LND routes. The project has also implemented measures to harden nodes after the August theft, including unique random passwords for new LND wallets and password rotation for older installations.