BTCPay warns bots are scanning exposed Lightning servers in bid to seize admin keys

BTCPay Server has issued a security warning after detecting automated bots probing publicly exposed Lightning Network (LND) endpoints that could be leveraged to gain administrative control. According to the project, the bots are repeatedly hitting LND's "passwordchange" API on servers where operators manually re-enabled external access to LND. BTCPay previously turned off external LND access by default in its standard Docker setup following a separate critical issue exploited about a month earlier to obtain credentials and drain merchant Lightning wallets. BTCPay said the newly observed behavior is not the same vulnerability used in August, but it could still enable a similar outcome: theft of credentials that allow control of an LND node. The risk arises during a brief window after LND restarts while the wallet remains locked. In that interval, BTCPay says the targeted password-change method may accept requests without a macaroon—the credential LND typically requires for administrative authorization. The danger is amplified on older BTCPay LND wallets that used a shared default password. If an attacker can reach the interface before BTCPay's internal unlocker does, they may be able to submit the default password first, change it, and then request an administrator macaroon that grants control over the node. BTCPay said it has not confirmed any successful takeovers tied to this activity and has not connected the bots to the attackers behind the August thefts. The alert extends a challenging security period for BTCPay. On Aug. 7, the project disclosed attackers had exploited a vulnerability affecting versions prior to 2.4.2, enabling unauthenticated access to LND macaroon files and allowing funds to be moved from Lightning wallets. BTCPay said its standard on-chain wallets were not impacted. In the days after the incident, BTCPay and supporters offered a bounty worth 10% of recovered bitcoin, capped at 3 BTC (about $190,000 at the time), and engaged exchanges, blockchain analytics firms, and law enforcement to help trace the stolen funds. BTCPay said version 2.4.4, released Sept. 7, mitigates the conditions behind the newly identified attack path. New LND wallets now receive unique random passwords, and older installations using the shared credential are migrated with passwords rotated. BTCPay's standard reverse proxy also blocks unauthenticated wallet setup and unlock endpoints, closing the restart-time exposure through its managed public network path. The project noted these safeguards do not automatically protect independently configured infrastructure. Administrators who run their own reverse proxy or otherwise expose LND publicly can still bypass BTCPay's protections. BTCPay is urging operators to upgrade to 2.4.4 and remove any manually exposed LND routes. A route-control change merged on Sept. 11 adds a supported option for remote access while keeping LND and Core Lightning interfaces disabled by default. For now, BTCPay said custom deployments remain the primary concern and should audit proxy rules and move remote connections behind BTCPay-managed controls as automated scanning continues.