BTCPay Server Fixes Critical LND Credential Exposure Bug After Lightning Funds Stolen

BTCPay Server has released v2.4.2 to address a critical security flaw that enabled unauthenticated remote access to LND credential files. The issue was reportedly exploited to drain merchants' Lightning wallets on vulnerable deployments. According to the project's release notes, the problem involved LND ".macaroon" files, which govern access permissions. In practice, these credentials can function like keys: if an attacker obtains an exposed macaroon with sufficient privileges, they may be able to interact with a Lightning node beyond what the operator intended. Supporters of BTCPay have also announced a recovery bounty set at 10% of any returned funds, capped at 3 BTC. At current prices, the maximum payout is roughly $190,000. The project emphasized this was not a Bitcoin protocol exploit and not a native on-chain wallet failure. It is a server-side security issue affecting certain BTCPay Server configurations that use LND. More information is available via the official GitHub materials. Key points: - BTCPay Server v2.4.2 patches a critical exposure of LND credential files. - Attackers reportedly drained merchant Lightning wallets via vulnerable setups. - A recovery bounty offers 10% of returned funds, capped at 3 BTC. Why the LND credential exposure matters BTCPay Server is widely used by merchants who want to accept Bitcoin without relying on a centralized payment processor. That model increases sovereignty, but it also shifts operational responsibility to the operator. Keeping servers patched, properly configured, and hardened becomes part of running the payment stack. Because LND macaroons can authorize node actions, credential leakage can be as consequential in real-world terms as private key compromise, depending on the permissions embedded in the macaroon. Not an attack on Bitcoin itself Reports of drained Bitcoin payment servers can be misread as a failure in Bitcoin. This incident does not indicate a break in Bitcoin's base protocol or consensus. The event involves BTCPay Server deployments using LND, where credential files were exposed. For affected merchants, the impact is still tangible, but the remediation is different: no Bitcoin protocol patch is required; operators need to update BTCPay Server, verify configuration, and secure LND credentials. Lightning infrastructure carries different operational risks Lightning enables faster, lower-cost payments, but adds operational complexity: channels, liquidity management, backups, remote access, routing, credential storage, and internet-facing services. A merchant running Lightning infrastructure is operating live payment software online, which can be secure when maintained correctly but requires discipline. Updates, permissions, credential handling, and monitoring all matter. The bounty as a recovery effort The recovery bounty is designed to incentivize returns or actionable information. While bounties do not guarantee recovery, they can create a path for negotiation or disclosure, particularly in cases where stolen funds may be traceable and cash-out routes can be monitored. What operators should do BTCPay Server operators should treat v2.4.2 as an urgent update and review any LND exposure. A system that has run without incident for years is not automatically safe in a changing threat environment. Attackers routinely target outdated versions, misconfigurations, leaked credentials, weak permissions, and internet-exposed services. This report is based on BTCPay Server's v2.4.2 release materials and the project's recovery bounty details, as published on GitHub. It was written by the News Desk and edited by Samuel Rae.