BTCPay Server Hacked, Funds Drained from Lightning Nodes

On August 7, 2026, an attack on BTCPay Server exploited a critical vulnerability in the system. The attackers stole funds from Lightning nodes running LND software by obtaining '.macaroon' credential files.

The 'Bitcoin Red Team', a group of developers that began running AI models against Bitcoin codebases this week, privately reported the vulnerability to BTCPay. However, outside attackers were already exploiting it by the time the public warning went out.

BTCPay Server is an open-source Bitcoin payment processor used by merchants and businesses. The company urged all users to update immediately to version 2.4.2 or take servers offline to prevent further losses.