🚨 CRITICAL SECURITY ALERT: BTCPay Server Exploit Drains Merchant Funds 🚨
A critical vulnerability in BTCPay Server (versions prior to 2.4.2) is being actively exploited in the wild, leaving merchant funds drained.
Here is what you need to know immediately 👇
🔍 What Happened?
An unauthenticated remote code execution vulnerability allowed attackers to steal LND "macaroon" credentials—the administrative keys used to control Lightning Network nodes.
With these credentials, hackers took full control of affected nodes, forcibly closed channels, and swept funds.
📉 Who Was Hit?
Foundation and Citadel21 have both confirmed their Lightning nodes were completely emptied overnight.
The full scope of damages across affected merchants is still being calculated.
Important Note: The base Bitcoin blockchain is 100% secure. This exploit specifically targets third-party Lightning infrastructure, NOT the Bitcoin consensus layer.
🛡️ Immediate Action Required for Operators
BTCPay Server has released an emergency fix in Version 2.4.2. If you run a node, act NOW:
1️⃣ Upgrade Immediately: Update to BTCPay Server v2.4.2 (includes LND 0.21.1).
2️⃣ Rotate Credentials: If you run custom reverse proxies, Tor setups, or port forwarding, manually rotate your macaroons.
3️⃣ Audit Your Node: Check for unauthorized transactions, unexpected channel closures, or balance discrepancies.
⚠️ Takeaway: Non-custodial payment rails are only as strong as your operational security. Keep your infrastructure updated and stay vigilant!
#Bitcoin #LightningNetwork #CryptoSecurity #BTCPay #CryptoNews #Web3 Security
$BTC
A critical vulnerability in BTCPay Server (versions prior to 2.4.2) is being actively exploited in the wild, leaving merchant funds drained.
Here is what you need to know immediately 👇
🔍 What Happened?
An unauthenticated remote code execution vulnerability allowed attackers to steal LND "macaroon" credentials—the administrative keys used to control Lightning Network nodes.
With these credentials, hackers took full control of affected nodes, forcibly closed channels, and swept funds.
📉 Who Was Hit?
Foundation and Citadel21 have both confirmed their Lightning nodes were completely emptied overnight.
The full scope of damages across affected merchants is still being calculated.
Important Note: The base Bitcoin blockchain is 100% secure. This exploit specifically targets third-party Lightning infrastructure, NOT the Bitcoin consensus layer.
🛡️ Immediate Action Required for Operators
BTCPay Server has released an emergency fix in Version 2.4.2. If you run a node, act NOW:
1️⃣ Upgrade Immediately: Update to BTCPay Server v2.4.2 (includes LND 0.21.1).
2️⃣ Rotate Credentials: If you run custom reverse proxies, Tor setups, or port forwarding, manually rotate your macaroons.
3️⃣ Audit Your Node: Check for unauthorized transactions, unexpected channel closures, or balance discrepancies.
⚠️ Takeaway: Non-custodial payment rails are only as strong as your operational security. Keep your infrastructure updated and stay vigilant!
#Bitcoin #LightningNetwork #CryptoSecurity #BTCPay #CryptoNews #Web3 Security
$BTC