News · Security & Hacks
A critical flaw exposed Lightning Network credentials to remote attackers, leading to stolen funds before version 2.4.2 was deployed.
Key point 1 of 3
01
BTCPay Server patched an actively exploited vulnerability affecting all versions prior to 2.4.2.
Key point 2 of 3
02
Unauthenticated attackers extracted LND .macaroon credentials to gain node control and siphon funds.
Key point 3 of 3
03
The 2.4.2 release upgrades LND to 0.21.1, regenerates credentials, and temporarily blocks public LND API access.
Context
BTCPay Server is widely deployed by merchants, independent infrastructure operators, and self-custodial services to process bitcoin payments without third-party custodians.
Why it matters
Operators using LND who failed to patch or isolate their instances suffered compromised nodes and balance drains; external management apps like Zeus are temporarily disconnected.
What to watch
Release of the full incident postmortem detailing the exploit mechanics once operators have updated.
Sources
Built from 1 primary source, machine-checked before publication.
Keep reading
Read the full story
AI-generated, source-verified. Sources, citations and live prices on the article page.