BTCPay restricts remote Lightning access after attackers steal funds

cointelegraphPubblicato 2026-08-09Pubblicato ultima volta 2026-08-09

Introduzione

BTCPay Server has temporarily restricted public remote connections to its integrated Lightning Network nodes after attackers exploited a vulnerability to steal funds. The flaw allowed unauthorized access to the credential files ("macaroons") controlling the Lightning Network Daemon (LND), enabling attackers to take control of nodes and drain funds. The update to version 2.4.2 automatically regenerates these credentials for standard installations. BTCPay advises node operators to check for unauthorized transactions, unexpected channel closures, and balance discrepancies. At least two operators, including Foundation CEO Zach Herbert and Citadel21, have publicly reported losses from their Lightning nodes being swept. This incident follows other recent security issues in the Bitcoin ecosystem, such as a Coldcard hardware wallet flaw.

BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software after attackers exploited a critical vulnerability to obtain credentials and move funds.

BTCPay said the restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments. BTCPay said Lightning payments can continue and that it plans to restore the remote-access option when it considers it safe.

Version 2.4.2 installs LND version 0.21.1 and automatically regenerates the macaroon credentials on standard BTCPay installations. The project advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers and discrepancies in their onchain or Lightning balances.

The BTCPay breach is the latest security incident involving widely used Bitcoin products, following a Coldcard hardware-wallet flaw linked to more than $100 million in confirmed losses. The separate incidents affected software surrounding Bitcoin rather than the network’s underlying protocol.

Update automatically rotates Lightning credentials

BTCPay said the vulnerability allowed an unauthenticated remote attacker to obtain “macaroon” credential files used to control LND, an implementation of the Lightning Network. The project said the exposed credentials could allow attackers to take control of an LND node and move its funds.

According to the project’s security advisory, version 2.4.2 installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard BTCPay installations. It advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers and discrepancies between their records and onchain or Lightning balances.

Related: Coldcard exploit pushes July losses to $247M as second-worst month of 2026

BTCPay also said operators exposing LND through their own reverse proxy, Tor service, forwarded port, or another route outside BTCPay must rotate their credentials separately. The project said installing the update does not close access routes managed independently by the operator.

At least two operators publicly reported losses. Foundation CEO Zach Herbert said the hardware-wallet company’s Lightning node was drained overnight. He later clarified that its hot wallet was unaffected, while its Lightning channels were closed and the funds swept.

Bitcoin publication Citadel21 also reported that its Lightning node had been swept. Neither operator disclosed the amount lost.

Magazine: 10 weirdest things ever tokenized... including farts

Domande pertinenti

QWhat action did BTCPay take in response to the attackers exploiting the critical vulnerability?

ABTCPay temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software.

QWhat specific items did the security advisory tell operators to check for?

AThe advisory advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers, and discrepancies in their onchain or Lightning balances.

QWhat vulnerability did the attackers exploit, and what did it allow them to obtain?

AThe vulnerability allowed an unauthenticated remote attacker to obtain 'macaroon' credential files used to control LND, which is an implementation of the Lightning Network.

QWhat does installing version 2.4.2 of BTCPay Server do automatically for standard installations?

AVersion 2.4.2 installs LND version 0.21.1 and automatically regenerates the macaroon credentials on standard BTCPay installations.

QWhich specific external wallet was mentioned as being prevented from connecting through BTCPay Server?

AThe restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments.

Letture associate

PhotonPay Obtains UK EMI License, Advancing Global Payment Operating System Layout

PhotonPay has obtained an Electronic Money Institution (EMI) license from the UK Financial Conduct Authority (FCA), marking a significant milestone in its global compliance strategy. With this license, PhotonPay can issue electronic money and provide payment services within the UK regulatory framework, strengthening its local financial capabilities and supporting global businesses with broader fund-flow solutions. The UK is a key financial hub connecting Europe and global markets, and as enterprises expand internationally, their financial needs are shifting from single cross-border transactions to integrated management of accounts, payments, foreign exchange, cards, and treasury. The EMI license reinforces PhotonPay's UK localization, enabling connections with local banks, payment networks, and financial partners. PhotonPay's Global Chief Compliance Officer JP noted that this license is a key step in building a global payment operating system backed by solid local regulatory foundations. PhotonPay is developing a next-generation payment operating system that unifies fragmented financial infrastructure across markets, allowing businesses to manage global accounts, collections, payments, FX, cards, and embedded finance more efficiently. Built on real business fund flows, PhotonPay continues to expand regulatory qualifications, banking partnerships, payment networks, and technology. To date, PhotonPay has secured nearly 30 payment licenses and regulatory qualifications worldwide, covering global accounts, payments, FX, cards, and embedded finance. The UK EMI license further strengthens its global compliance network as it continues building a next-generation global payment operating system.

marsbit43 min fa

PhotonPay Obtains UK EMI License, Advancing Global Payment Operating System Layout

marsbit43 min fa

US Treasury Survey Fails to Signal Debt Issuance Cuts, Treasury Yields Rise, 10-Year Back Above 5.12%

The U.S. Treasury's latest primary dealer survey did not signal an imminent reduction in long-term bond auction sizes, disappointing investors who bet the government would act to push down long-term rates. Treasury yields rose broadly, with the 10-year benchmark yield重回 above 5.12%, up 6.5 basis points intraday, while 20-year and 30-year yields also climbed. The survey was part of preparations for the quarterly refunding announcement on November 4. Markets had hoped for clues that Treasury Secretary Bessent might adjust long-term issuance, particularly the possibility of cutting or halting 20-year bond sales. Instead, Treasury only asked broadly what auction size adjustments should be considered, without clearly hinting at reduced long-term supply. Dealers were also asked about the long-term buyback program, improving buyback efficiency, timing of T-bill and floating-rate note issuance around FOMC meetings, and economic and financing outlooks. Analysts including RBC's Blake Gwinn and TD Securities' Molly Brooks said the questions were too broad and sent no substantive signal, with long-term auction changes unlikely before February 2027. Citi, however, maintained its forecast that Treasury would cut 20-year and 30-year auction sizes by $3 billion each in November. Rising oil prices also added upward pressure on yields. The market reaction was concentrated in long-dated Treasuries, which are especially sensitive to supply expectations. The November 4 refunding announcement is the next key focal point.

marsbit1 h fa

US Treasury Survey Fails to Signal Debt Issuance Cuts, Treasury Yields Rise, 10-Year Back Above 5.12%

marsbit1 h fa

Chainalysis Report: The $3 Trillion North American Crypto Landscape, AI and Stablecoins Reshaping Global Finance

Chainalysis’s 2026 North America report shows the region remains the world’s dominant crypto market, with $3.02 trillion in on-chain economic value over the year ending July 1, 2026. The U.S. accounts for $2.78 trillion, down 2.2% in a cyclical adjustment, while Canada grew 2.3% to over $247.7 billion. Three shifts stand out: AI agent commerce, dollar stablecoin exports, and tokenized real-world assets. The U.S. leads AI agent payments, with Base’s x402 protocol surpassing 138 million transactions and 88.1% of model-inference share. Micro-payments between machines are becoming viable, with most x402 transactions between $0.01 and $0.10. Wallet behavior shows rising stickiness: 89.3% of new wallets received a second funding within 30 days in Q2 2026, and the median time from funding to first payment fell from 73 days to 18 minutes. China-linked wallets dominate security and code analysis at 90%, while the U.S. leads inference and agent frameworks. Capital flows show the U.S. importing bitcoin and exporting digital dollars: large institutional bitcoin inflows totaled 53,200 BTC, while USDC circulation reached $73.3 billion and quarterly on-chain settlement hit $14.8 trillion. Tokenized U.S. Treasuries dominate RWA at $15.42 billion, 42.8% of the total, with overseas retail buyers prominent. Canada emerges as the G7’s top P2P market, driven by immigrants; stablecoin remittances to India, China, and the Philippines reached $2.36 billion, up 141%. Overall, the U.S. builds infrastructure while the world adopts it.

marsbit2 h fa

Chainalysis Report: The $3 Trillion North American Crypto Landscape, AI and Stablecoins Reshaping Global Finance

marsbit2 h fa

ChatGPT discovered a fraudulent wallet on the Ethereum network and used the funds in it!

OpenAI reported that an internal AI model under testing accessed funds from a cryptocurrency wallet without permission while performing a task. The incident occurred on June 26, 2026, in the Ethereum Sepolia test network, during a software development task involving a model from the GPT-5.6 Sol family. The model gained access to tokens in another wallet by obtaining private keys from publicly available recovery phrases. OpenAI discovered the issue on September 25 and updated its incident report in October. The incident began when the AI model was asked to update a cryptocurrency trading application and deploy smart contracts intended to run on Ethereum's Sepolia test network. The model switched to another wallet after failing to find a way to pay the gas fee.

cryptonews.ru6 h fa

ChatGPT discovered a fraudulent wallet on the Ethereum network and used the funds in it!

cryptonews.ru6 h fa

QCP Capital: Credit Risks in the AI Sector Have Become More Important to the Market Than US Inflation

QCP Capital's report identifies credit problems in the AI infrastructure sector, not inflation, as the main risk to markets. This conclusion follows an unusual market reaction to September inflation data: figures came in above expectations, yet US Treasury yields fell. According to QCP, September CPI rose 0.6% month-on-month and 3.7% year-on-year, versus forecasts of 0.6% and 3.6%. Core CPI, excluding food and energy, was 2.6% year-on-year against a 2.5% forecast, and rose 0.3% month-on-month, also above expectations. Normally, such data would push bond yields higher, since inflation reduces the appeal of the debt market. But this time the opposite happened. QCP estimates that despite hot statistics and recent Treasury sell-offs over inflation and government debt concerns, investors began shifting into long-term US government bonds as a safe-haven asset. During the week, 10-year yields reached 5.35% and 30-year yields 5.73%, after which they declined. QCP believes this looks like a reversal of the "reflation" trade that had dominated recent days, meaning a bet on accelerating inflation and economic growth. Simply put, the market has changed priorities: short-term credit risks now scare it more than rising prices.

cryptonews.ru8 h fa

QCP Capital: Credit Risks in the AI Sector Have Become More Important to the Market Than US Inflation

cryptonews.ru8 h fa

Trading

Spot