BTCPay Server breach steals Bitcoin from Lightning nodes

A critical security vulnerability in the popular open-source payment processor BTCPay Server was actively exploited on August 7, 2026, leading to the theft of Bitcoin from Lightning Network nodes and prompting an urgent call for users to update their software or take systems offline. The flaw allowed attackers to steal authentication credentials and drain funds from affected nodes.

The vulnerability specifically impacted deployments using LND, the most widely used software for operating a Lightning node. It enabled unauthenticated remote attackers to obtain .macaroon credential files, which grant administrative control over an LND node. With these files, attackers could seize control of nodes, force-close payment channels, and move funds out. BTCPay Server confirmed that funds were stolen and that the vulnerability was being actively exploited.

In response, the project released version 2.4.2 to close the security hole and issued an emergency advisory. All users running LND were instructed to update to version 2.4.2 immediately. Those unable to patch were told to take their servers offline entirely to prevent further losses. The project clarified that standard on-chain wallets...