Bitcoin Lightning Nodes Drained via BTCPay Server Flaw

Hackers have exploited a critical vulnerability in the open-source payment processor BTCPay Server, successfully draining Bitcoin from Lightning Network nodes. The attack, discovered on August 8, 2026, allowed unauthorized access to LND (Lightning Network Daemon) macaroon files—digital credentials used to control Lightning nodes—without any authentication. At least two confirmed victims, hardware wallet maker Foundation and bitcoin publication Citadel21, had their Lightning channels force-closed and funds swept. BTCPay immediately released version 2.4.2 as an emergency patch and urged all node operators to update or shut down their servers. The breach marks the second major infrastructure exploit in a week, following the Coldcard hack that reportedly led to over 1,700 BTC stolen, raising urgent questions about the security of the Bitcoin Lightning Network ecosystem.

What Happened?

The exploit targeted BTCPay Server installations that integrate with LND, the most popular Lightning Network node software. BTCPay Server is widely used by merchants and individuals to accept Bitcoin payments directly, without intermediaries. The vulnerability allowed attackers to retrieve macaroon files—bearer tokens that grant full read, send, and invoice permissions—without logging in. With these credentials, an attacker could connect to the victim's LND node remotely and initiate fund transfers to external wallets. The flaw was initially disclosed by the Bitcoin Red Team, a volunteer security group that uses AI models to scan for vulnerabilities in Bitcoin-related software. However, additional reports indicate that the actual discovery was made independently by Craig Raw, developer of Sparrow Wallet, who traced the loss of his own funds through server logs. The bug resided in the Greenfield API's two-factor authentication layer: if an account had TOTP 2FA enabled, the code erroneously checked for FIDO2 keys instead of verifying 2FA status, allowing access with just an email and password. This bypass made it possible to retrieve macaroon files from the API without proper authentication.

How the Attack Unfolded

BTCPay Server's architecture is designed to give merchants full control over their funds, but the same openness can become a liability if credentials leak. The macaroon files are normally protected behind BTCPay's authentication wall. In the compromised versions, the API endpoint responsible for serving these files did not enforce login checks correctly. An attacker could craft a simple HTTP request to /api/v1/server/lnd/credentials and receive the macaroon data in plaintext. Once obtained, the attacker would import the file into their own LND instance, effectively cloning the victim's node. From there, they could close Lightning channels, forcing on-chain settlement of the channel balances to addresses they controlled. Because Lightning channels operate off-chain, the theft was not immediately visible on the Bitcoin blockchain—only the final settlement transaction would appear. This delayed detection and gave the attackers a head start. The cryptocurrency payment processor vulnerabilities highlight the risks of self-custody solutions when software dependencies are not promptly patched.

Victims and Stolen Funds

Foundation, known for its Passport hardware wallet, confirmed that its corporate Lightning node was emptied overnight. CEO Zach Herbert stated that the attackers closed all active channels and withdrew the funds, though the company's BTCPay-generated hot wallet (which uses a separate on-chain key) remained untouched. Citadel21, a bitcoin-focused publication, also reported a drained Lightning node, though the amount lost was described as small. BTCPay has not disclosed the total number of affected users or the aggregate value stolen, but the project has acknowledged that multiple nodes were compromised before the public warning. The incident is particularly damaging because many affected operators are small merchants and bitcoin enthusiasts who run BTCPay to avoid custodial risk—ironically, a feature that exposed them to this novel attack vector. The decentralized finance security breaches underscore the need for more robust auditing of open-source financial infrastructure.

Emergency Response and Mitigation

BTCPay's response was swift. Within hours of the initial report, version 2.4.2 was published, closing the authentication bypass. However, the patch alone is insufficient: stolen macaroon files are static credentials that survive software updates. Affected operators must manually delete the compromised macaroon files and generate new ones via the BTCPay interface. Additionally, they are advised to refresh all authentication tokens, including the BTCPay "auth string," and to move any remaining funds from LND on-chain wallets to fresh addresses. The project promised a full technical post-mortem once administrators have had time to secure their systems. The Bitcoin Red Team, which had already flagged thousands of potential issues across hundreds of projects that week, emphasized that their AI-driven scanning tools are not a substitute for manual code review. This incident has reignited the debate over the security of self-custodial Bitcoin solutions and whether the Lightning Network's complexity is outpacing its security maturity.

FAQ

What is BTCPay Server?

BTCPay Server is a free, self-hosted Bitcoin payment processor launched in 2017. It allows merchants to accept Bitcoin directly, bypassing third-party processors, and supports both on-chain and Lightning Network payments.

How did the hack work?

Attackers exploited a logic flaw in the Greenfield API that bypassed two-factor authentication, allowing them to download LND macaroon files without logging in. These files grant full control over a Lightning node, enabling fund transfers.

Who was affected?

Confirmed victims include hardware wallet maker Foundation and bitcoin publication Citadel21. The total number of affected users is unknown, but any BTCPay Server instance running LND with the vulnerable API exposed is at risk.

How can I protect my BTCPay Server?

Update to version 2.4.2 immediately. Then, delete and regenerate all LND macaroon files, refresh BTCPay auth strings, and transfer any remaining funds to new on-chain addresses. Consider taking your server offline until these steps are completed.

Are on-chain BTCPay wallets safe?

Yes. The vulnerability only exposed LND Lightning node credentials. Hot wallets generated directly within BTCPay (using on-chain keys) were not affected, as confirmed by Foundation's experience.