BTCPay Server Pledges Up to 3 Bitcoin to Recover Funds Drained From Merchant Lightning Nodes

BTCPay Server, the open-source payment processor that merchants self-host to accept bitcoin, is funding a recovery bounty worth 10% of any returned funds, capped at 3 bitcoin, after attackers drained Lightning nodes run by its users. The project has said it will prioritize security patches over new features.

The root cause was an access-control failure rather than a flaw in bitcoin itself. BTCPay installations expose access to the node through credential files known as macaroons, and a defect let a remote party obtain those credentials without authorization. With them, an attacker could force channels closed and move the coins out. The defect only affects setups running the most widely used Lightning node software (LND), and BTCPay's own on-chain and hot wallets were not affected. The project shipped version 2.4.2 on August 7 and paid 0.42 bitcoin to the researchers who reported the flaw. It has not published a total loss figure or a victim count, so the size of the theft remains unknown.

Four days earlier, Boltz, which ran the swap service that moved value between the main chain, Lightning and Liquid for several independent wallets, suspended operations indefinitely. Boltz attributed the decision to a pattern of automated probing of its infrastructure and said attackers now iterate faster than a team its size can find and patch defects. Because its design is self-custodial, it said user funds were never at risk. Aqua, Bull Bitcoin and Zeus lost swap functionality within hours, and Blockstream disabled swaps inside its own wallet.

Blockstream responded by building and launching a second implementation, Blockstream Swaps, which it describes as moving value between bitcoin's layers without a custodian in the middle. Its stated reason is the concentration problem the outage exposed. When one provider goes offline, swaps stop working across unrelated wallets at once.

Two conclusions follow from these events. Bitcoin's base layer held, and the failures occurred in the volunteer-maintained software and single-vendor services layered above it. And the discovery of defects in that layer is getting faster than the small teams maintaining it can respond, which is the specific claim both BTCPay and Boltz have made in public.