BTCPay Server has restricted remote access to Lightning nodes after attackers exploited a critical vulnerability to steal credential files and drain funds from connected nodes, according to Cointelegraph. Hardware-wallet company Foundation and the Bitcoin publication Citadel21 have both confirmed their Lightning nodes were affected, though the total amount stolen and the full number of impacted operators remain unknown.
In response, BTCPay shipped version 2.4.2, which installs LND 0.21.1 and automatically regenerates macaroon credentials on standard installations. As a stopgap, the project temporarily restricted remote Lightning access through BTCPay Server domains and Tor onion addresses on Docker deployments, which also blocks external wallet connections such as Zeus until the restriction lifts.
What a Macaroon Actually Controls
The vulnerability let an unauthenticated remote attacker obtain .macaroon credential files used by LND, the most widely used Lightning Network implementation. A macaroon functions much like an API key: whoever holds it can instruct a node to open or close payment channels and move the funds inside them. Getting hold of one effectively hands an attacker full remote control of the node's Lightning balance.
Known Victims, Unknown Scale
Foundation CEO Zach Herbert said the company's Lightning node was drained overnight, though he clarified the firm's hot wallet was unaffected — only the Lightning channels were force-closed and swept. Citadel21, the Bitcoin publication run by the pseudonymous figure hodlonaut, reported the same outcome on its own node. Neither party has disclosed a dollar figure, and BTCPay has not said how many operators in total were hit, leaving the true scale of the theft an open question.
Related: BIP-110 Fork Stalls at Two Blocks as Gap to Bitcoin Main Chain Hits 88
The Patch Doesn't Undo the Theft
Updating to 2.4.2 closes the vulnerability against new attackers, but it does nothing to invalidate credentials already stolen from a previously exposed server — a distinction BTCPay has stressed to operators. The project is advising anyone running an affected node to check for unauthorized payments, unexpected channel closures, unfamiliar peers, and balance discrepancies, and to manually rotate credentials if their setup uses an access route outside the standard automatic regeneration.
The incident adds to a rough stretch for Bitcoin infrastructure, with self-hosted Lightning operators now facing the same credential-hygiene questions long familiar to anyone running exchange or custodial hot wallets — a reminder that self-custody shifts the security burden rather than eliminating it.
