BTCPay Server has quickly restricted public distant connections to Lightning Community nodes working Lightning Community Daemon (LND) software program after attackers exploited a important vulnerability to acquire credentials and transfer funds.
BTCPay mentioned the restriction prevents exterior wallets resembling Zeus from connecting by a BTCPay Server area or Tor onion tackle on Docker deployments. BTCPay mentioned Lightning funds can proceed and that it plans to revive the remote-access choice when it considers it secure.
Model 2.4.2 installs LND model 0.21.1 and routinely regenerates the macaroon credentials on customary BTCPay installations. The venture suggested operators to test for unauthorized funds, surprising channel closures, unfamiliar friends and discrepancies of their onchain or Lightning balances.
The BTCPay breach is the most recent safety incident involving broadly used Bitcoin merchandise, following a Coldcard hardware-wallet flaw linked to greater than $100 million in confirmed losses. The separate incidents affected software program surrounding Bitcoin somewhat than the community’s underlying protocol.
Replace routinely rotates Lightning credentials
BTCPay mentioned the vulnerability allowed an unauthenticated distant attacker to acquire “macaroon” credential information used to manage LND, an implementation of the Lightning Community. The venture mentioned the uncovered credentials may enable attackers to take management of an LND node and transfer its funds.
In line with the venture’s safety advisory, model 2.4.2 installs LND model 0.21.1 and routinely regenerates macaroon credentials on customary BTCPay installations. It suggested operators to test for unauthorized funds, surprising channel closures, unfamiliar friends and discrepancies between their data and onchain or Lightning balances.
Associated: Coldcard exploit pushes July losses to $247M as second-worst month of 2026
BTCPay additionally mentioned operators exposing LND by their very own reverse proxy, Tor service, forwarded port, or one other route outdoors BTCPay should rotate their credentials individually. The venture mentioned putting in the replace doesn’t shut entry routes managed independently by the operator.
A minimum of two operators publicly reported losses. Basis CEO Zach Herbert mentioned the hardware-wallet firm’s Lightning node was drained in a single day. He later clarified that its sizzling pockets was unaffected, whereas its Lightning channels had been closed and the funds swept.
Bitcoin publication Citadel21 additionally reported that its Lightning node had been swept. Neither operator disclosed the quantity misplaced.
Journal: 10 weirdest issues ever tokenized… together with farts
