BTCPay Server Flaw Exposes User Credentials, Leads to Significant Losses

A critical flaw in BTCPay Server has led to significant losses for several prominent users. The vulnerability, which exposed persistent macaroons (API keys) that remained valid after updates unless manually refreshed, allowed attackers to access Lightning node credentials and steal funds from connected nodes.

Foundation, a hardware wallet maker, and Citadel21, a Bitcoin publication, were among the notable victims of this flaw. BTCPay Server has released version 2.4.2 and advised immediate upgrades or server shutdowns to prevent further losses.

This incident highlights challenges in securing self-hosted Bitcoin infrastructure. The security patch was issued to mitigate ongoing attacks, but users are urged to take action to protect their funds.