BTCPay Server Patches Critical Vulnerability in Lightning Wallets

BTCPay Server has released version 2.4.2 to patch a critical vulnerability that allowed unauthenticated remote access to LND credential files, after attackers used the issue to drain merchant Lightning wallets.

The project's release notes describe a serious bug involving .macaroon files, which are used by LND to manage access permissions. In plain English, those files can act like keys.

If an attacker gets hold of the wrong one, they may be able to interact with a Lightning node in ways the operator never intended.

BTCPay supporters have also backed a recovery bounty equal to 10% of returned funds, capped at 3 BTC ($63,574.00 · Live).

The vulnerability patched in v2.4.2 is serious because LND macaroons can grant access to node functions.