BTCPay Restricts LND Access After Critical Vulnerability Exploit

BTCPay Server has temporarily restricted public remote access to Lightning Network nodes running LND due to a critical vulnerability that allows attackers to steal credentials and move funds.

The flaw affects every BTCPay Server version before 2.4.2, including release candidates, according to the project. Attackers were able to obtain 'macaroon' files, which are credentials that can authorize control over a Lightning node and its funds.

BTCPay has confirmed that users were affected and funds were stolen, but it's not sharing the total amount lost or the number of compromised operators. The project is withholding full technical details while operators continue upgrading.

BTCPay urges LND users to update immediately to version 2.4.2, which upgrades standard deployments to LND 0.21.1 and automatically regenerates macaroon credentials. Operators should review their nodes for unauthorized payments, unexpected channel closures, unfamiliar peers, and unexplained differences in their on-chain or Lightning balances.