BTCPay restricts remote Lightning access after attackers steal funds

cointelegraphPublicado em 2026-08-09Última atualização em 2026-08-09

Resumo

BTCPay Server has temporarily restricted public remote connections to its integrated Lightning Network nodes after attackers exploited a vulnerability to steal funds. The flaw allowed unauthorized access to the credential files ("macaroons") controlling the Lightning Network Daemon (LND), enabling attackers to take control of nodes and drain funds. The update to version 2.4.2 automatically regenerates these credentials for standard installations. BTCPay advises node operators to check for unauthorized transactions, unexpected channel closures, and balance discrepancies. At least two operators, including Foundation CEO Zach Herbert and Citadel21, have publicly reported losses from their Lightning nodes being swept. This incident follows other recent security issues in the Bitcoin ecosystem, such as a Coldcard hardware wallet flaw.

BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software after attackers exploited a critical vulnerability to obtain credentials and move funds.

BTCPay said the restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments. BTCPay said Lightning payments can continue and that it plans to restore the remote-access option when it considers it safe.

Version 2.4.2 installs LND version 0.21.1 and automatically regenerates the macaroon credentials on standard BTCPay installations. The project advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers and discrepancies in their onchain or Lightning balances.

The BTCPay breach is the latest security incident involving widely used Bitcoin products, following a Coldcard hardware-wallet flaw linked to more than $100 million in confirmed losses. The separate incidents affected software surrounding Bitcoin rather than the network’s underlying protocol.

Update automatically rotates Lightning credentials

BTCPay said the vulnerability allowed an unauthenticated remote attacker to obtain “macaroon” credential files used to control LND, an implementation of the Lightning Network. The project said the exposed credentials could allow attackers to take control of an LND node and move its funds.

According to the project’s security advisory, version 2.4.2 installs LND version 0.21.1 and automatically regenerates macaroon credentials on standard BTCPay installations. It advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers and discrepancies between their records and onchain or Lightning balances.

Related: Coldcard exploit pushes July losses to $247M as second-worst month of 2026

BTCPay also said operators exposing LND through their own reverse proxy, Tor service, forwarded port, or another route outside BTCPay must rotate their credentials separately. The project said installing the update does not close access routes managed independently by the operator.

At least two operators publicly reported losses. Foundation CEO Zach Herbert said the hardware-wallet company’s Lightning node was drained overnight. He later clarified that its hot wallet was unaffected, while its Lightning channels were closed and the funds swept.

Bitcoin publication Citadel21 also reported that its Lightning node had been swept. Neither operator disclosed the amount lost.

Magazine: 10 weirdest things ever tokenized... including farts

Perguntas relacionadas

QWhat action did BTCPay take in response to the attackers exploiting the critical vulnerability?

ABTCPay temporarily restricted public remote connections to Lightning Network nodes running Lightning Network Daemon (LND) software.

QWhat specific items did the security advisory tell operators to check for?

AThe advisory advised operators to check for unauthorized payments, unexpected channel closures, unfamiliar peers, and discrepancies in their onchain or Lightning balances.

QWhat vulnerability did the attackers exploit, and what did it allow them to obtain?

AThe vulnerability allowed an unauthenticated remote attacker to obtain 'macaroon' credential files used to control LND, which is an implementation of the Lightning Network.

QWhat does installing version 2.4.2 of BTCPay Server do automatically for standard installations?

AVersion 2.4.2 installs LND version 0.21.1 and automatically regenerates the macaroon credentials on standard BTCPay installations.

QWhich specific external wallet was mentioned as being prevented from connecting through BTCPay Server?

AThe restriction prevents external wallets such as Zeus from connecting through a BTCPay Server domain or Tor onion address on Docker deployments.

Leituras Relacionadas

Musk, Ready to Disrupt EUV Lithography Machines?

Musk may challenge EUV lithography with FEL technology. The article discusses the potential of Free Electron Lasers (FELs) to disrupt the traditional EUV lithography market, currently dominated by ASML's Laser-Produced Plasma (LPP) technology. It notes that Musk's company, Terafab, appears to be exploring an FEL-based approach, which involves using particle accelerators to generate tunable, high-power EUV light. While FELs offer theoretical advantages like higher power, greater efficiency, and wavelength flexibility compared to fixed-wavelength LPP sources, the article emphasizes the significant engineering hurdles for making FELs viable for high-volume semiconductor manufacturing. These challenges include system size, cost, stability, and integration with existing lithography tools. The piece concludes that while FEL presents a promising alternative pathway for future, shorter-wavelength lithography, it is not an immediate replacement for the mature and production-proven LPP technology.

marsbitHá 1h

Musk, Ready to Disrupt EUV Lithography Machines?

marsbitHá 1h

Weekly Token Unlock: Major YZY Unlock Valued at $35.7 Million

This week's token unlocks feature two major events. The YZY token, created by Kanye West, will unlock 120 million tokens valued at approximately $35.73 million. The release schedule is illustrated in the provided chart. Additionally, the Starknet (STRK) token will unlock 130 million tokens worth around $3.19 million. Starknet is an Ethereum Layer 2 scaling solution developed by StarkWare, utilizing zk-STARKs technology to enable faster and cheaper transactions. Its token release curve is also detailed in an accompanying chart.

marsbitHá 2h

Weekly Token Unlock: Major YZY Unlock Valued at $35.7 Million

marsbitHá 2h

Google's Decade-Long AI Power Struggle Concludes, Pichai Gracefully Consolidates Control

A decade of internal AI rivalry at Google has concluded with CEO Sundar Pichai consolidating power through a masterful, bloodless reorganization. The key moves saw Demis Hassabis, DeepMind's visionary founder, step down as CEO of Google DeepMind to become Alphabet's Chief Scientist, focusing on long-term AGI. Concurrently, Google's legendary technical leader Jeff Dean departed with his team to start a new venture, in which Google invested. This restructuring marks the end of a long-standing divide between the research-focused DeepMind and the product-oriented Google Brain. Pichai's strategy, beginning with their 2023 merger under Hassabis, gradually centralized control. While Hassabis gained public acclaim for Gemini's progress and a Nobel Prize, Pichai quietly elevated Koray Kavukcuoglu, a pragmatic engineering veteran, to oversee daily operations. The catalyst was mounting pressure in 2026 as Gemini's development timelines slipped, causing stock declines. Hassabis, more passionate about pure research and his AI drug discovery company Isomorphic Labs, grew weary of the commercial grind. His graceful "promotion" effectively removed him from operational control. Pichai handled both transitions with characteristic finesse: granting Hassabis a prestigious, future-focused role to prevent a defection to rivals (as happened with former DeepMind co-founder Mustafa Suleyman), and investing in Dean's new company to keep his pioneering work within Google's orbit. The outcome is a fundamental shift: control of Google's AI future has passed from brilliant scientist-visionaries to professional managers and engineers like Kavukcuoglu and Pichai himself. It signals Pichai's bet that the AI race has entered an industrial phase won by systemic execution, organizational efficiency, and stable delivery, rather than lone genius. The era of scientists directly managing core AI is over at Google, replaced by a machine-like division of labor where the CEO decides who decides.

marsbitHá 2h

Google's Decade-Long AI Power Struggle Concludes, Pichai Gracefully Consolidates Control

marsbitHá 2h

OpenAI Executive: Tools Like Codex, Only Two Months Left to Shine

In a candid statement, OpenAI's product and platform lead, Thibault Sottiaux, predicts that tools like Codex will become "primitive" within 2-3 months. He highlights that the current paradigm of running AI agents (Harness frameworks) locally on laptops is hitting fundamental limits as next-generation models demand more from their environments. The core limitations are threefold: 1) Local hardware constraints on compute and memory when agents handle concurrent subtasks; 2) The impracticality of requiring machines to stay online for long-duration tasks; and 3) The inability of lightweight local setups to manage the massive parallel context and toolchains of advanced models. The solution, Sottiaux suggests, is a shift towards "cloud-native infrastructure." The future lies in "light local command, heavy cloud execution," where developers use their devices as control panels. Complex tasks like code refactoring, testing, and automation will be offloaded to dynamic, parallel cloud clusters (e.g., isolated sandbox containers), with results streamed back. This evolution is already underway, with examples like Anthropic orchestrating 16 Claude instances across 2000 cloud sessions to build a C compiler. The competition will thus move from raw model capability to which platform can most effectively unlock a model's full potential through sophisticated, system-level Harness engineering.

marsbitHá 3h

OpenAI Executive: Tools Like Codex, Only Two Months Left to Shine

marsbitHá 3h

Conversation with Blockchain Capital Partners: The Next Bull Market May Be Right in Front of Us

In a recent Bankless podcast, Blockchain Capital partners Aleks Larsen and Spencer Bogart discussed the crypto market's evolution from infrastructure to applications. They noted that widespread stablecoin adoption has built significant on-chain liquidity, boosting revenues for lending and trading protocols. The partners defended the "buyback and burn" token model, explaining its current effectiveness in aligning incentives and establishing credibility with holders, despite past debates on capital efficiency. Addressing the sentiment divide in crypto, they highlighted positive catalysts like regulatory clarity and institutional entry, even during the bear market. Aleks compared the industry's current state to the 2003-2004 internet era—post-"broadband transition" with cheap block space, awaiting mainstream adoption through applications like stablecoins and prediction markets. They observed a shift from "fat protocol" to "fat application," where value now accrues more at the application layer than the base infrastructure, a sign of a maturing ecosystem. Drawing parallels to AI, they noted similarities in early hype cycles but emphasized crypto's transparent, token-driven market corrections versus AI's private market adjustments. On Real World Assets (RWA), Spencer projected stablecoin market cap to reach trillions by 2030, detailing its multiplier effect on on-chain economic activity. For stock tokenization, he outlined two approaches: permissionless but legally indirect models and compliant, direct ownership channels, suggesting they can coexist in "sidecar" models alongside pure DeFi. The conversation concluded that while the industry's ethos evolves with institutional adoption, crypto's core promise of upgrading global financial infrastructure for greater efficiency remains intact and is steadily progressing.

marsbitHá 4h

Conversation with Blockchain Capital Partners: The Next Bull Market May Be Right in Front of Us

marsbitHá 4h

Trading

Spot
活动图片

Categorias popularesright-arrow

Etiquetas Popularesright-arrow