New Exploit Targets Bitcoin's Lightning Network, Compromising Payment Servers

BTCPay Server issues urgent warning as attackers exploit vulnerability

BTCPay Server has issued an urgent alert for users operating Lightning Network Daemon (LND) software to either update to version 2.4.2 or take their servers offline. This warning follows a significant security breach that allowed attackers to access Lightning wallets, resulting in the theft of funds from affected nodes.

The vulnerability was identified in BTCPay Server, enabling unauthorized access to critical credential files known as “.macaroon” files. These files are essential for the operation of LND nodes, and their compromise allowed attackers to take control of the nodes and deplete their channels. Fortunately, BTCPay's on-chain wallets remain unaffected by this exploit.

Among the notable victims of this attack were Foundation, a hardware wallet manufacturer, and the bitcoin publication Citadel21. Foundation's CEO, Zach Herbert, reported that the company's Lightning node was drained overnight, while Citadel21 indicated that its node was also compromised, although the funds involved were minimal.

BTCPay has not disclosed the total number of users impacted or the overall amount of bitcoin stolen during the incident. The organization has acknowledged the role of the Bitcoin Red Team, a group of developers that had previously flagged this vulnerability, in bringing the issue to light. They emphasized the importance of this disclosure to prevent further exploitation of the flaw.

BTCPay clarified that while standard on-chain wallets are unaffected, funds held in LND's on-chain wallet could still be at risk. The organization is expected to release a comprehensive report detailing the incident and its implications in the coming days.