BTCPay Server vulnerability lets attackers drain Lightning nodes overnight
Attackers spent Friday quietly emptying Lightning nodes tied to BTCPay Server, the self-hosted bitcoin payment processor, after the project confirmed a critical BTCPay Server vulnerability was being actively exploited. Hardware wallet maker Foundation and the bitcoin zine Citadel21 both reported drained nodes, some hours before BTCPay’s own public warning went out. The incident, disclosed August 7, 2026, has forced merchants, exchanges and wallet backends running the software to scramble for a fix while the thefts were still in progress.
Key takeaways
- BTCPay Server confirmed a critical, actively exploited vulnerability and released version 2.4.2 to patch it on August 7, 2026.
- Hardware wallet maker Foundation and bitcoin zine Citadel21 both had Lightning nodes swept, with channels force-closed and funds drained.
- Founder Nicolas Dorier said the bug was found only because a developer, Craig Raw of Sparrow Wallet, lost funds and analyzed the logs — not through AI-assisted audits.
- BTCPay is self-hosted, meaning there is no central operator to patch on users’ behalf; every server owner must update individually.
- Users are told to refresh macaroons and credential files after patching, since stolen credentials can still grant access even after the update.
Critical Vulnerability Exploited in BTCPay Server Lightning Nodes
The core problem is straightforward but severe: a flaw in BTCPay Server let attackers reach and empty Lightning nodes without needing to breach a user’s hot wallet separately. BTCPay posted an urgent notice at 11:51 a.m. ET saying, “There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.” The project told merchants to update immediately or shut their servers down if they couldn’t patch right away. That post reportedly passed 550,000 views within five hours, a sign of how fast the alarm spread across the bitcoin payments community.
… Continue reading the full article at the original source below.
