BTCPay Server Releases Emergency Patch Following Exploited LND Vulnerability

Open-source payment processor BTCPay Server released version 2.4.2 to address a critical security flaw that exposed Lightning Network credentials to remote unauthorized access ¹. The project confirmed that malicious actors exploited the vulnerability in active attacks, resulting in the theft of user funds from connected Lightning Network Daemon (LND) instances ¹. The issue impacts all BTCPay Server deployments prior to version 2.4.2, including all 2.4.2 release candidates ¹.

The vulnerability permitted unauthenticated remote attackers to retrieve .macaroon credential files designated for LND ¹. With these credentials, an attacker could assume control of an operator's LND node and withdraw balances ¹. The development team stated that analyzed exploits targeted only files bearing the .macaroon extension, leaving standard BTCPay Server on-chain wallets, including hot wallets, unaffected ¹. However, on-chain balances held directly inside an affected LND node's internal wallet remain at risk if the node's credentials were breached ¹. Security researcher Craig Raw was credited with disclosing the vulnerability, alongside analysis assistance from Team Red ¹.

Mitigation Steps and Mitigation Changes

BTCPay Server instructed all node operators running LND to update immediately to version 2.4.2, which simultaneously upgrades LND to version 0.21.1 and automatically regenerates credential files ¹. Administrators who cannot apply the update right away were instructed to take their instances completely offline ¹. Users running alternate Lightning implementations or operating on-chain payment deployments without Lightning are not vulnerable to the credential leakage, though the project still urged them to apply the release ¹.

To limit immediate exposure across Docker deployments, version 2.4.2 temporarily disables public access to the LND API ¹. Consequently, external mobile and desktop management wallets such as Zeus cannot establish connections via BTCPay Server domains or Tor onion endpoints until public access is safely restored ¹. Operators who route LND through custom reverse proxies, separate Tor configurations, or external forwarded ports must manually rotate their macaroons, as BTCPay Server updates cannot modify independently managed network paths ¹. A complete postmortem detailing the vulnerability will be published in the coming days once node operators have had sufficient time to patch their installations ¹.