BTCPay Server Patches Flaw That Let Attackers Take Lightning Node Credentials From Merchants

BTCPay Server, the self-hosted payment processor used by bitcoin merchants who do not want a third party holding their funds, confirmed an actively exploited vulnerability and released version 2.4.2. The flaw allowed an unauthenticated remote attacker to retrieve the macaroon files that authorise commands to Lightning Network Daemon (LND), the most widely deployed Lightning implementation. Possession of those files is equivalent to control of the node.

Attackers used that control to force channels closed and move funds out. Hardware wallet maker Foundation and the bitcoin publication Citadel21 both reported that their nodes were emptied. The attack vector was credential theft rather than a cryptographic break, which matters for the remediation: patching the server closes the path used to steal the files, but any macaroon already copied remains valid until the operator deletes and regenerates it. BTCPay told operators who cannot patch immediately to take their servers offline.

The discovery route is the part practitioners are discussing. BTCPay founder Nicolas Dorier said the bug surfaced because Craig Raw, the developer of Sparrow Wallet, lost funds and then analysed his server logs. It was not caught by an audit or by automated code review. That sits awkwardly beside the argument, common through 2026, that machine-assisted analysis is now closing the gap between attackers and defenders on open-source infrastructure.

For a payment stack marketed on the premise that merchants should not rely on a custodian, the incident points at a different dependency. Self-hosting removes the custodian and replaces it with the merchant's own server administration. Anyone running a web-facing node inherits the full burden of patch discipline, credential rotation and log review, and the incident catalogue maintained by Rekt News has filled through 2026 with losses that originated at that layer rather than inside a smart contract.