BTCPay Restricts Remote Access to Lightning Nodes After Attackers Exploit Vulnerability

BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software after attackers exploited a critical vulnerability.

The vulnerability allowed an unauthenticated remote attacker to obtain macaroon credential files used to control LND, allowing them to take control of an LND node and move its funds.

At least two operators publicly reported losses. Foundation CEO Zach Herbert said the hardware-wallet company's Lightning node was drained overnight, but clarified that its hot wallet was unaffected while its Lightning channels were closed and the funds swept.

BTCPay said installing version 2.4.2, which installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard BTCPay installations, does not close access routes managed independently by operators.