General btcpay-server seguridad lightning-network

BTCPay Server: confirmed critical vulnerability, update to 2.4.2 now if you run LND

BTCPay Server confirmed active exploitation and stolen funds on installations running LND. What happened, who is affected, and what to do now if you self-host.

Satoshi Team ·

Executive summary

On August 7, 2026, BTCPay Server confirmed a critical vulnerability affecting every version prior to 2.4.2, including the 2.4.2 release candidates. An unauthenticated remote attacker could obtain .macaroon credential files on installations using LND as their Lightning backend. BTCPay confirmed the flaw was actively exploited and that funds were stolen. If you run BTCPay Server with LND, the action is to update now.

What happened (timeline)

  • August 7, 15:51 UTC — BTCPay Server posts an alert on X warning of active exploitation and asking operators to update to 2.4.2 immediately.
  • Same day, 23:02 UTC — BTCPay publishes the full security advisory on its official blog, with scope and remediation details.
  • 23:07 UTC — BTCPay shares an update to the advisory on X.

BTCPay has not published the full technical detail of the exploit yet. They say a post-mortem will follow, giving operators time to update before the exact technique becomes public.

Who is affected, and who isn't

Affected: BTCPay Server installations prior to 2.4.2 (including release candidates) that use LND. With a stolen .macaroon file, an attacker can control the LND node and move its funds.

Not affected by this specific risk: installations using other Lightning implementations (CLN, Eclair) or no Lightning at all. BTCPay Server's own on-chain wallets, including its hot wallets, are not affected either.

One important nuance: LND's own on-chain wallet is part of the affected node, so it should be treated as at risk if the node was compromised.

What to do now

  1. Update to BTCPay Server 2.4.2 and LND 0.21.1: Server Settings → Maintenance → Update.
  2. If you can't update immediately, take the instance offline or disconnect it until you can.
  3. On a standard installation, the update automatically regenerates LND's macaroons — you don't need to rotate them by hand in that case.
  4. Important exception: if you expose your LND node yourself (your own reverse proxy, Tor, a forwarded port), updating BTCPay Server does not close that access path — rotate those credentials manually.
  5. On Docker deployments, 2.4.2 temporarily removes public access to the LND API, which may disconnect external wallets like Zeus until you adjust your setup.
  6. Confirm the version: BTCPay Server 2.4.2 in the admin footer, and LND 0.21.1 on your node.

Watch out for phishing

After an incident like this, fake "BTCPay support" or "urgent update" messages tend to show up, asking you to paste your seed, your macaroon, or run a third-party script. BTCPay Server will never ask for your seed or credentials over a DM or email. Update only from your own admin panel or the official repository — never from a link sent to you in a message.

What's next

BTCPay Server hasn't published the technical detail of the exploit yet — they say a formal post-mortem will follow once most installations have had a chance to update. They credited Craig Raw (@craigraw) for responsibly disclosing the issue, and Team Red for collaborating on the analysis.

One thing worth separating clearly: don't confuse this incident with the Coldcard hardware wallet issue from late July/early August 2026. They happened around the same time, but they are unrelated technical flaws with no direct connection to each other.

Sources