Critical Vulnerability in BTCPay Server Exploited
BTCPay Server has issued an emergency security announcement stating that all versions prior to 2.4.2 (including candidate versions) contain a critical vulnerability that has been confirmed to have been exploited, resulting in user funds being stolen.
This vulnerability allows unauthenticated remote attackers to obtain the .macaroon credential file of LND, thereby gaining control over LND nodes and transferring funds; the official team urges users of LND to upgrade immediately to BTCPay Server 2.4.2 and LND 0.21.1. On-chain wallets are not affected, and the specific amount stolen has not been disclosed.
As a result of the incident, funds related to LND nodes were transferred after the attacker gained access to the credentials, directly controlling and siphoning off funds, putting self-hosted Lightning Network users under pressure, while the official fix version benefits.
Source: Public Information
ABAB AI Insight
BTCPay Server, as an open-source self-hosted Bitcoin payment processor, previously attracted sovereign users and merchants with its features of no intermediaries and no fees. Core contributors estimated that there are hundreds of thousands of running instances globally, with over a million downloads from the main GitHub repository; this vulnerability exposes its long-standing weaknesses in API permissions and credential file management.
Funds were directly transferred from Lightning node channels using the stolen LND macaroon credentials, motivated by exploiting unauthenticated remote access to bypass protections and quickly empty channel balances; similar pathways have been observed in previous incidents where funds were lost due to credential leaks or configuration errors in Lightning Network nodes.
Comparing with other self-hosted Bitcoin tools like Electrum or various node software regarding historical security incidents in credential and permission design, the current phase is a transition from functional expansion to mandatory security reinforcement in open-source payment infrastructure.
This essentially represents a regulatory change at the edge of technological substitution: the self-hosted model completely shifts security responsibility to users, and once a vulnerability is exploited, it directly leads to financial losses. The mechanism involves credential files being persistent and remotely accessible, forcing the entire network to urgently migrate to the fixed version to cut off attack pathways.
ABAB News · Cognitive Laws
The security responsibility of self-hosting always lies with the user
Credential leaks equal opening the door to funds
Open-source and free does not equal zero risk