BTCPay Server Patches Critical Lightning Node Exploit After Funds Drained

A critical vulnerability in BTCPay Server has allowed attackers to gain unauthenticated access to Lightning Network nodes, resulting in the theft of funds from several merchants. The exploit targeted the software's integration with Lightning Network Daemon (LND), exposing sensitive credential files that granted full control over affected nodes.

The attack centered on the exposure of .macaroon credential files, which serve as the primary authentication mechanism for LND. By accessing these files, attackers bypassed security protocols to drain funds directly from the nodes. Among the victims, the Foundation and Citadel21 reported that their Lightning nodes were swept during the breach. In response, the BTCPay team released version 2.4.2, a critical patch designed to close the vulnerability and restrict remote Lightning access to prevent further losses.

AI-Driven Discovery

BTCPay Server is a widely utilized open-source payment processor that enables merchants to accept Bitcoin payments while maintaining self-custody. While standard on-chain wallets remained secure during this incident, the LND integration proved to be a weak point. The vulnerability was brought to the attention of the BTCPay team by the Bitcoin Red Team.

According to reports, the Bitcoin Red Team utilized AI models to analyze Bitcoin project codebases, identifying the flaw through automated vulnerability research. This event is part of a broader trend of infrastructure-level attacks targeting the Bitcoin ecosystem. The transition toward using artificial intelligence to hunt for bugs in open-source financial software marks a shift in the threat landscape, as both attackers and researchers move toward automated analysis to find zero-day exploits.

Industry Implications and Recovery

The exploit underscores a systemic risk within the Lightning Network's self-custody model: the reliance on a single credential file. Because the .macaroon file acts as a master key, its exposure leads to a total loss of funds without requiring a private key compromise. This highlights the precarious nature of managing node credentials on internet-facing servers and the necessity for rigorous file-system permissions.

In an effort to recoup the losses, supporters of the open-source project have pledged a recovery bounty of 3 BTC. This incentive is aimed at encouraging the return of the stolen funds by the attackers or the assistance of third-party recovery specialists.

Next Steps for Users

Users of BTCPay Server are urged to update to version 2.4.2 immediately to secure their infrastructure. The community is now monitoring whether the 3 BTC bounty will successfully incentivize the return of the assets. Furthermore, the industry is watching how other Bitcoin infrastructure projects will adapt their security audits in response to the Bitcoin Red Team's use of AI-driven analysis to uncover critical flaws.