NewsBTC
Aug 11, 2026
5 0
Bearish

BTCPay Server patches LND credential flaw that drained Lightning wallets

2 min

BTCPay Server released v2.4.2 to fix a critical flaw that exposed LND .macaroon credentials to unauthenticated remote access. Attackers used the exposure to drain merchant Lightning wallets. The issue affects certain BTCPay Server deployments using LND and does not involve the Bitcoin protocol or on-chain wallets. A recovery bounty offers 10% of returned funds, capped at 3 BTC. Official details: Github.

Key Points

  • Patch: BTCPay Server v2.4.2 closes an unauthenticated access path to LND .macaroon files.
  • Impact: Reported thefts from Lightning wallets where vulnerable configurations exposed credentials.
  • Scope: Server-side application issue within BTCPay + LND setups. Bitcoin consensus and on-chain wallets unaffected.
  • Bounty: 10% of recovered funds, capped at 3 BTC, to incentivize returns or information.
  • Action: Update to v2.4.2, audit LND credential storage and permissions, review server exposure and logs.

Why It Matters

LND macaroons grant permissioned access to node functions. Exposure can enable unintended control over a Lightning node. For Lightning operators, protecting credentials is as critical as protecting private keys: a secure wallet cannot prevent loss if server-side credentials leak.

Context and Framing

This event reflects application and infrastructure risk in self-hosted payment systems. Lightning nodes manage channels, liquidity, backups, remote access, routing, and credentials. Operational discipline is required: updates, least-privilege permissions, secure storage, and monitoring.

Bounty Purpose and Limits

The recovery bounty seeks to improve the chance of fund return or disclosure by creating an incentive and a negotiation channel. It does not ensure recovery. Immediate priority for operators: patch to v2.4.2 and harden configurations.

Operator Takeaways

  • Upgrade BTCPay Server to v2.4.2.
  • Rotate and restrict LND macaroons; verify file permissions and access paths.
  • Audit network exposure for LND and BTCPay components; enforce authentication.
  • Review logs for anomalous access and channel movements; consider incident response and disclosure if affected.

Source: BTCPay Server v2.4.2 release materials and recovery-bounty details on Github.