Background

BTCPay Server, an open‑source payment processor for Bitcoin, announced a swift restriction on public remote access to Lightning Network Daemon (LND) nodes. The move follows the discovery that a critical flaw permitted unauthenticated attackers to retrieve macaroon files – the authentication tokens that control LND – and move funds from compromised nodes.

Details of the Security Breach

The vulnerability centered on the way BTCPay generated and stored macaroon credentials. In the standard BTCPay installation, version 2.4.2 bundles LND 0.21.1 and automatically regenerates these macaroons. An attacker who could reach the node remotely could capture the credentials and gain full control over the Lightning node, enabling the transfer of any assets held therein.

The breach does not affect the underlying Bitcoin protocol; rather, it targets software built around the protocol. Similar recent incidents include a Coldcard hardware‑wallet flaw that resulted in confirmed losses exceeding $100 million and pushed July 2026 losses to $247 million, the second‑worst month of the year.

Immediate Response by BTCPay

To mitigate further damage, BTCPay has blocked external wallets—such as Zeus—from connecting via a BTCPay domain or Tor onion address on Docker deployments. Lightning payments that originate from within the local environment can still be processed, and the team intends to reinstate remote‑access capabilities once the risk is deemed acceptable.

Operators are urged to:

  • Review transaction histories for unauthorized payments.
  • Look for unexpected channel closures.
  • Identify unfamiliar peers.
  • Compare on‑chain and Lightning balances against their records.

For those who expose LND through custom reverse proxies, Tor services, forwarded ports, or any other independent route, BTCPay advises a manual rotation of macaroon credentials, as the update does not automatically secure externally managed access paths.

Reported Losses and Affected Operators

At least two operators have publicly confirmed that their Lightning nodes were drained:

  • Foundation – CEO Zach Herbert disclosed that the company's Lightning node was emptied overnight. While the hot wallet remained intact, all Lightning channels were closed and the funds were swept.
  • Citadel21 – The Bitcoin‑focused publication reported a similar sweep of its Lightning node, though it did not reveal the monetary value lost.

The total amount stolen across all affected nodes and the number of operators impacted remain undisclosed.

Broader Implications

The incident underscores the growing risk landscape for Bitcoin‑related infrastructure, where software vulnerabilities can lead to substantial financial losses despite the robustness of the base protocol. It also highlights the importance of diligent credential management and rapid response mechanisms for operators running Lightning nodes.

BTCPay’s temporary restriction aims to buy time for operators to secure their setups while the project works on a longer‑term solution to safely restore remote connectivity.