Version

Security

2026

Coin

<h3 id="key-points">Key Points</h3><ul><li>BTCPay Server has disabled external remote access to Lightning Network nodes following exploitation of a severe security vulnerability</li><li>Hackers acquired “macaroon” authentication files that control LND nodes, enabling unauthorized fund transfers</li><li>An emergency patch in version 2.4.2 fixes the vulnerability and automatically refreshes credentials for default configurations</li><li>Foundation’s CEO Zach Herbert verified that his organization’s Lightning node experienced a complete drainage</li><li>Citadel21, a Bitcoin-focused publication, similarly confirmed its Lightning node was compromised, with both parties withholding specific loss figures</li></ul><p>In response to a critical security breach that enabled fund theft from multiple operators, BTCPay Server has implemented a temporary suspension of public remote connections to Lightning Network nodes.</p><div class="embed-x"><blockquote class="twitter-tweet"><p><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/26a0.png" alt="⚠" class="wp-smiley" style="height: 1em; max-height: 1em;">ALERT: An actively exploited BTCPay Server flaw is draining merchant Lightning nodes.</p><p>Attackers can remotely grab credential files from BTCPay deployments running LND and empty the node, with hardware wallet maker Foundation among the confirmed victims, per CoinDesk.</p><p>BTCPay… <a href="https://t.co/558xdhTbjm" rel="noopener noreferrer nofollow">pic.twitter.com/558xdhTbjm</a></p><p>— Coin Bureau (@coinbureau) <a href="https://x.com/coinbureau/status/2086112701642571882?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">August 8, 2026</a></p></blockquote></div><p>The security incident specifically targeted infrastructure running Lightning Network Daemon software. Threat actors leveraged the security weakness to access “macaroon” authentication files—specialized credentials that grant operational control over LND nodes. With these credentials in hand, malicious actors gained unrestricted ability to transfer funds.</p><p>This protective measure blocks external wallet applications such as Zeus from establishing connections via BTCPay Server domains or Tor onion addresses on Docker-based deployments. Despite this restriction, BTCPay confirmed that Lightning payment functionality remains operational, with plans to reinstate remote access capabilities once security conditions permit.</p><h3 id="patch-details-and-functionality">Patch Details and Functionality</h3><p><a href="https://coincentral.com/bitcoin-lightning-nodes-drained-overnight-in-btcpay-server-attack/" rel="noopener noreferrer nofollow">BTCPay</a> deployed version 2.4.2 as an emergency response to the security incident. This release implements LND version 0.21.1 and executes automatic macaroon credential regeneration for standard deployment configurations.</p><p>Node operators who have configured LND routing through custom reverse proxies, independent Tor services, or port forwarding arrangements outside BTCPay’s standard setup must manually rotate their authentication credentials. The patch does not automatically secure access pathways that operators have configured independently.</p><p>BTCPay has issued guidance for all node operators to conduct thorough security audits, including examination of payment histories for suspicious transactions, verification of channel closure activity, identification of unknown network peers, and reconciliation of balance records across both onchain and Lightning accounts.</p><h3 id="confirmed-attack-victims">Confirmed Attack Victims</h3><p>Zach Herbert, CEO of Foundation, made a public statement confirming that his organization’s Lightning node suffered a complete drainage during overnight hours. He subsequently provided clarification that the company’s hot wallet infrastructure remained secure and unaffected. The attack methodology involved forced channel closures followed by systematic fund extraction.</p><p><a href="https://coincentral.com/bitcoin-btc-price-hacks-forks-and-1b-etf-inflows-a-lot-happened-this-week/" rel="noopener noreferrer nofollow">Bitcoin</a>-focused media outlet Citadel21 likewise confirmed becoming a victim of the attack, reporting that its Lightning node had been completely emptied. Both affected parties have declined to reveal the precise monetary value of their losses.</p><p>The complete scope of the breach, including the total count of compromised operators, has not been determined.</p><p>This security incident arrives on the heels of a distinct vulnerability discovered in Coldcard hardware wallets that resulted in documented losses exceeding $100 million. Both security breaches targeted Bitcoin ecosystem infrastructure and supporting software rather than compromising Bitcoin’s core protocol or blockchain network.</p><p>BTCPay has explicitly stated that these two security incidents bear no connection to one another. Nevertheless, the succession of infrastructure vulnerabilities has heightened security awareness and vigilance throughout the Bitcoin operator community.</p><p>BTCPay has committed to reactivating remote access features following comprehensive security verification, though no specific restoration timeline has been announced.</p><p>All operators running affected systems are strongly encouraged to deploy the security update without delay and conduct comprehensive reviews of node activity to identify potential indicators of unauthorized access or compromise.</p><p>The post <a href="https://blockonomi.com/btcpay-server-suspends-lightning-node-remote-access-following-security-breach/" rel="noopener noreferrer nofollow">BTCPay Server Suspends Lightning Node Remote Access Following Security Breach</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

BTCPay Server Suspends Lightning Node Remote Access Following Security Breach

Table of Contents

Blockonomi

Other articles published on Aug 9, 2026

Another Avenue for XRP’s Integration Into Federal Payment Systems

Bybit Sues North Korea and Lazarus Group, Secures Preliminary Injunction Freezing Stolen Assets i...

Spindex's Real-Time Data Pipeline Surpasses 150 Million Tracked Gaming Events

China adds 20 tonnes to gold reserves in July, Hong Kong to boost storage

Bitcoin Price Blasts Past $65K While Early Buyers Rush Pepeto Before Listing Day Locks the Door

Litecoin Price Targets $48 as Trendline Recovery Gains Strength

Join our free newsletter for daily crypto updates!