BTCPay restricts remote Lightning access after attackers steal funds

cointelegraphPublicado a 2026-08-09Actualizado a 2026-08-09

Resumen

BTCPay Server has temporarily restricted public remote connections to its integrated Lightning Network nodes after attackers exploited a vulnerability to steal funds. The flaw allowed unauthorized access to the credential files ("macaroons") controlling the Lightning Network Daemon (LND), enabling attackers to take control of nodes and drain funds. The update to version 2.4.2 automatically regenerates these credentials for standard installations. BTCPay advises node operators to check for unauthorized transactions, unexpected channel closures, and balance discrepancies. At least two operators, including Foundation CEO Zach Herbert and Citadel21, have publicly reported losses from their Lightning nodes being swept. This incident follows other recent security issues in the Bitcoin ecosystem, such as a Coldcard hardware wallet flaw.

BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software after attackers exploited a critical vulnerability to obtain credentials and move funds.

BTCPay said the restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments. BTCPay said Lightning payments can continue and that it plans to restore the remote-access option when it considers it safe.

Version 2.4.2 installs LND version 0.21.1 and automatically regenerates the macaroon credentials on standard BTCPay installations. The project advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers and discrepancies in their onchain or Lightning balances.

The BTCPay breach is the latest security incident involving widely used Bitcoin products, following a Coldcard hardware-wallet flaw linked to more than $100 million in confirmed losses. The separate incidents affected software surrounding Bitcoin rather than the network’s underlying protocol.

Update automatically rotates Lightning credentials

BTCPay said the vulnerability allowed an unauthenticated remote attacker to obtain “macaroon” credential files used to control LND, an implementation of the Lightning Network. The project said the exposed credentials could allow attackers to take control of an LND node and move its funds.

According to the project’s security advisory, version 2.4.2 installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard BTCPay installations. It advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers and discrepancies between their records and onchain or Lightning balances.

Related: Coldcard exploit pushes July losses to $247M as second-worst month of 2026

BTCPay also said operators exposing LND through their own reverse proxy, Tor service, forwarded port, or another route outside BTCPay must rotate their credentials separately. The project said installing the update does not close access routes managed independently by the operator.

At least two operators publicly reported losses. Foundation CEO Zach Herbert said the hardware-wallet company’s Lightning node was drained overnight. He later clarified that its hot wallet was unaffected, while its Lightning channels were closed and the funds swept.

Bitcoin publication Citadel21 also reported that its Lightning node had been swept. Neither operator disclosed the amount lost.

Magazine: 10 weirdest things ever tokenized... including farts

Preguntas relacionadas

QWhat action did BTCPay take in response to the attackers exploiting the critical vulnerability?

ABTCPay temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software.

QWhat specific items did the security advisory tell operators to check for?

AThe advisory advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers, and discrepancies in their onchain or Lightning balances.

QWhat vulnerability did the attackers exploit, and what did it allow them to obtain?

AThe vulnerability allowed an unauthenticated remote attacker to obtain 'macaroon' credential files used to control LND, which is an implementation of the Lightning Network.

QWhat does installing version 2.4.2 of BTCPay Server do automatically for standard installations?

AVersion 2.4.2 installs LND version 0.21.1 and automatically regenerates the macaroon credentials on standard BTCPay installations.

QWhich specific external wallet was mentioned as being prevented from connecting through BTCPay Server?

AThe restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments.

Lecturas Relacionadas

After a Year of Farming Points, Why Am I Still Losing Money? — The Complete Guide to Avoiding Getting Rekt in Crypto Points Programs

**Title: Why Do You Still Lose Money After Grinding Points for a Year? A Complete Guide to Avoiding "Rug Pulls" in Crypto Points Programs** This article systematically analyzes crypto points farming programs and outlines a framework to assess their true profitability and avoid losses. It argues that while points offer new yield opportunities, their growing complexity often hides significant costs and risks. The author first examines the incentives from a project's perspective: points allow projects to attract liquidity and activity while deferring actual reward payouts. Ten common points-earning models are then detailed, each with its hidden "traps": 1. **Interaction Tasks:** Low capital but high gas/time costs and disqualification risks. 2. **TVL Deposits:** Easy but overlooks high opportunity costs vs. alternative yields. 3. **Lending Points:** Looping strategies amplify points but also risk and debt costs. 4. **LP Providing:** Attractive APRs can still underperform simply holding the assets due to impermanent loss. 5. **Pendle YT:** Offers high points leverage but carries time decay; the purchase price must be justified by future rewards. 6. **Perp Trading Volume:** High volumes generate large fees/slippage, often exceeding potential rewards. 7. **Spot Trading:** Costs hide in spreads, fees, and required token holdings that may depreciate. 8. **Social/Content:** Efficient for creators but time/effort should be valued. 9. **Referral/Community:** Rewards need separation from real income; carries reputational risk. 10. **Staking/Locking:** High multipliers come with lost liquidity and inability to exit during downturns. A core section explains how to value points. The theoretical value depends on Fully Diluted Valuation (FDV), the reward pool's token allocation, the user's share of total points, and vesting/listing conditions. Models should run optimistic, baseline, pessimistic, and zero-airdrop scenarios. The true cost of farming includes direct costs (gas, fees), opportunity costs (forgone yield), strategy P&L (e.g., IL, YT decay), liquidity costs, and tail risks (hacks, depegs). The article stresses calculating both absolute net profit and relative excess return versus a comparable baseline strategy. Five case studies illustrate break-even analyses for deposit, YT, lending loop, perp trading, and LP strategies, showing how easily costs can outweigh rewards. Seven red flags indicate higher "rug pull" risk: 1) Promising high multipliers without clear reward pool size, 2) Repeatedly extending seasons inflating total points, 3) Frequently changing rules, 4) Growth solely reliant on subsidies, 5) Large incentive disparities between user groups, 6) Valuations overly dependent on hype, 7) Complex/illiquid exit mechanisms. The guide concludes with a framework for prudent participation: categorize projects by risk, set clear exit conditions before entering, manage points strategies within a broader portfolio context, and use a scoring system for quick evaluation. A final 10-question checklist helps vet any new points program. The key insight is that as capital scales, securing reliable baseline yield becomes more valuable than chasing uncertain points rewards. Mature players must learn to pass on high-cost, high-risk opportunities, focusing instead on strategies with clear costs, controllable risks, and manageable exits.

marsbitHace 48 min(s)

After a Year of Farming Points, Why Am I Still Losing Money? — The Complete Guide to Avoiding Getting Rekt in Crypto Points Programs

marsbitHace 48 min(s)

Just Now, Opus 5.5 Fast Mode Fully Released

Claude Opus 5.5 "Fast Mode" is now officially out of research preview and available to all developers. This is not a simplified model but uses the same architecture as the standard version, offering intelligence parity with output speeds up to 2.5 times faster. It currently supports Opus 5.5, Opus 5, and Opus 4.8 models. Access is straightforward: developers simply add `speed: "fast"` to their API calls. Despite the performance boost, the new Opus 5.5 Fast Mode is priced lower than its predecessors. Key features include independent rate limiting (with graceful fallback to standard speed if limits are hit) and prompt caching that is not shared with the standard mode, requiring users to enable Fast Mode at the start of a session to avoid extra costs. For Pro/Max subscribers, Fast Mode consumes separate "usage credits," not their standard monthly allotment. Enterprise controls allow administrators to disable Fast Mode by default to prevent unexpected costs. The article also mentions a new "idle compaction" feature that automatically compresses long, inactive conversations to save on token costs when resuming work. Finally, it notes rumors that the more advanced "Fable 5.5" model has entered early access for select users, though it is expected to be significantly more expensive.

marsbitHace 52 min(s)

Just Now, Opus 5.5 Fast Mode Fully Released

marsbitHace 52 min(s)

Breaking News: Claude Fable 5.5 Appears on Azure, Directly Challenging Google's New Model

Claude Fable 5.5, a highly anticipated AI model from Anthropic, has reportedly appeared as "Generally Available" in Microsoft Azure's model directory, signaling an imminent public release. This launch is seen as a strategic move to challenge Google's newly released Gemini 4 Argon. Leaked specifications suggest Fable 5.5 boasts a massive 1 million token context window and a 128k token output length, with API pricing at $10 per million tokens for input and $50 for output. Early tests hint at extraordinary capabilities. The model allegedly generated a playable MMORPG in 5 hours, created 3D animations to explain complex mathematical proofs, and autonomously produced a stylized animated short film, raising questions about the future of dedicated video generation models. Some evidence suggests it might be powering certain high-complexity queries currently routed through Claude Opus 5.5. A key revelation comes from an Anthropic engineering blog, which indicates the company's development pace has accelerated dramatically, with daily code merges increasing from 2,500 to over 30,000. This suggests Fable 5.5 may have been significantly developed through AI-driven, autonomous iteration—essentially, AI building AI. While enthusiasts hail it as a potential market leader, others note its premium pricing. The model's impending release intensifies the competition among major AI labs, with OpenAI also rumored to be preparing a new model. The industry awaits to see if Fable 5.5 can deliver a breakthrough significant enough to justify its cost and hype.

marsbitHace 56 min(s)

Breaking News: Claude Fable 5.5 Appears on Azure, Directly Challenging Google's New Model

marsbitHace 56 min(s)

How to Efficiently Farm $PAPER on Paper Trade

How to Efficiently Farm $PAPER on Paper Trade Paper Trade features a unique token emission model where $PAPER tokens are minted solely from trading losses, credited directly to user accounts. The current emission rate is 16.6 PAPER per $1 lost. No fees or funding rates are charged on positions; instead, a progressive fee (haircut) is applied to profitable trades. To farm efficiently, the goal is to minimize the net cost basis by ensuring profits incur the smallest possible haircut. The optimal strategy involves delta-neutral farming: simultaneously opening high-leverage (up to 100x or 200x) long and short positions. When the loss side accumulates sufficiently, close the losing position first to mint $PAPER, then close the profitable position. This cycle repeats. It’s crucial to avoid liquidation, as it incurs extra fees and can cause mismatched closing prices due to transaction ordering. While manual execution is possible, using an automated farming bot is recommended. The bot charges only 10% of the farming cost, which is typically lower than the slippage incurred from manual trading. Additionally, the $PAPER emission rate decays over time, so balancing speed and cost efficiency is key.

marsbitHace 57 min(s)

Understanding WorkBuddy's Integration with WeCom: Context is Just the Starter

The article discusses a significant industry shift where AI Agents are moving from standalone applications into core collaborative work platforms. This is exemplified by Tencent's recent integration of its AI assistant WorkBuddy into the internal contact list of its enterprise messaging app, WeChat Work (Enterprise WeChat), enabling direct user interaction. This mirrors broader global trends, such as Google integrating Gemini into Workspace. The core argument is that for AI to be truly effective in business, it needs access to a "full-context" work environment—not just isolated tasks but the entire flow of internal communications, documents, meetings, and crucially, external customer interactions (a unique advantage of WeChat Work's connection to the consumer WeChat ecosystem). This context is more critical than raw model capabilities for relevant business output. As AI Agents scale within organizations, governance becomes paramount. The article highlights WorkBuddy's new enterprise observability features, allowing administrators to monitor AI activity, control costs, and ensure security. This governance is a prerequisite for trustworthy, large-scale deployment. The piece frames this as part of a strategic play by Tencent, leveraging its ecosystem of enterprise and consumer products. However, it concludes that while platform integration provides the necessary "entrance," the real test is whether these AI Agents can reliably translate that access into tangible, governed business outcomes. Ultimately, AI's entry into enterprises forces a re-evaluation of how work itself is organized.

marsbitHace 1 hora(s)

Understanding WorkBuddy's Integration with WeCom: Context is Just the Starter

marsbitHace 1 hora(s)

Trading

Spot