BTC news: Bitcoin’s exploit week worsens as BTCPay flaw drains Lightning nodes
BTCPay told users running LND to update immediately or take servers offline after attackers stole credentials that can control Lightning wallets and move funds.
YayaNews contributes financial news and market context through the YayaNews editorial workflow.
BTC news: Bitcoin’s exploit week worsens as BTCPay flaw drains Lightning nodes
Tech
Another Bitcoin infrastructure exploit hits, this time draining Lightning payment servers
BTCPay told users running LND to update immediately or take servers offline after attackers stole credentials that can control Lightning wallets and move funds.
By
Shaurya Malwa
Updated
1 hr ago
Published
1 hr ago
2
min read
Make
preferred on
Share
Share this article
Copy link
X icon
X (Twitter)
Make
preferred on
Another bitcoin infrastructure exploit hits, this time draining merchant Lightning nodes. (Max Bender/Unsplash)
Summary
Show
Attackers exploited a critical vulnerability in BTCPay Server to steal funds from Lightning nodes running LND, prompting urgent calls to update to version 2.4.2 or take servers offline.
The flaw allowed unauthenticated access to LND “.macaroon” credential files, enabling attackers to seize control of affected Lightning nodes and drain their channels, though BTCPay’s standard on-chain wallets were not impacted.
Victims including hardware-wallet maker Foundation and bitcoin publication Citadel21 reported their Lightning nodes were swept, as BTCPay and the Bitcoin Red Team investigate and prepare a full postmortem on the incident.
A rough week for bitcoin's software is getting worse, this time hitting merchants who accept bitcoin
BTC
$
64,963.20
payments through Lightning, a separate network built on top of bitcoin for instant, low-cost transfers.
Attackers drained Lightning nodes running behind BTCPay Server late on Friday after exploiting a critical vulnerability that exposed the credentials protecting them, the team
said in an X post
.
BTCPay confirmed funds were stolen and told anyone running LND, the most widely used software for operating a Lightning node, to update immediately to version 2.4.2 or take the server offline.
The project has not disclosed how many users were hit or how much bitcoin was taken.
The flaw allowed an unauthenticated remote attacker to obtain “.macaroon” files, or credentials that give software permission to interact with an LND Lightning node. BTCPay said the attacks it reviewed targeted those files, which could then be used to take control of the node and move funds.
Hardware-wallet maker Foundation was among the victims. Chief Executive Zach Herbert
said attackers
drained the company's BTCPay Lightning node overnight, closing its channels and sweeping the funds. Its BTCPay on-chain hot wallet was untouched.
Citadel21, the bitcoin publication run by pseudonymous commentator hodlonaut,
also reported
that its Lightning node had been swept, though it said little money was held there.
The vulnerability had already been reported to BTCPay by members of the Bitcoin Red Team — a group of developers that
began pointing AI models
at bitcoin codebases this week and has filed thousands of findings across hundreds of projects since.
Read More:
Bitcoin developers flag 85 critical bugs in an "extremely bad" situation
.
BTCPay credited Red Team members Craig Raw, Rob Hamilton, Calle and Evan Kaloudis with responsibly disclosing the issue and helping analyze it.
The group's stated reason for publishing findings quickly was that people outside it would arrive at the same bugs, and by the time BTCPay's public warning went out, attackers were already exploiting this one against live servers.
Meanwhile, BTCPay narrowed the scope after its initial alert, saying its standard on-chain wallets, including hot wallets generated inside BTCPay, are not affected by the credential flaw.
The exposure applies specifically to deployments using LND, and funds held inside LND's own on-chain wallet can still be at risk because they sit under the compromised Lightning node.
BTCPay has not yet published technical details of the vulnerability, saying operators need time to patch. A full postmortem is due in the coming days.
Related Assets
Bitcoin
$
64,956.16
0.62
%
Latest Crypto News
1
New XRP Ledger amendments target $530 million in tokenized Wall Street assets
5 hrs ago
2
Bitcoin holders risk losing real BTC if they sell coins from BIP-110 fork, says developer
6 hrs ago
3
Trump Media pulls back from crypto, scraps Crypto.com's CRO token treasury deal
11 hrs ago
4
Trump-Backed American Bitcoin director Justin Mateen buys nearly $2 million of ABTC stock
12 hrs ago
5
U.S. widens Iran crypto crackdown with sanctions on two exchanges
14 hrs ago
6
BitMEX sale collapsed as buyers balked at founder ownership and shrinking business
16 hrs ago
7
Bybit sues North Korea and Lazarus Group over $1.5 billion hack, secures asset freeze
16 hrs ago
8
OKX's Rafique doubts Clarity Act will pass, warns optimism is already priced into bitcoin
17 hrs ago
9
How a five-second trick let traders drain millions from Polymarket
17 hrs ago
10
A part of FTX survived, and it’s the case for the CLARITY Act
18 hrs ago
Latest Research
Building the Zcash Machine: Tachyon and Quantum Readiness
Building the Zcash Machine: Tachyon and Quantum Readiness
Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.
By
CoinDesk Research
Jun 30, 2026
Commissioned by
GenZcash
Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.
Why it matters
:
Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.
View Full Report
More From
Tech
New XRP Ledger amendments target $530 million in tokenized Wall Street assets
Bitcoin holders risk losing real BTC if they sell coins from BIP-110 fork, says developer
Why Bitcoin's BIP-110 refuses to die despite near-zero miner support
More From
Bitcoin
New XRP Ledger amendments target $530 million in tokenized Wall Street assets
Bitcoin holders risk losing real BTC if they sell coins from BIP-110 fork, says developer
Trump Media pulls back from crypto, scraps Crypto.com's CRO token treasury deal
Crypto
CD20
$1,756.77
CD20 up 0.75 percent
0.75%
BTC
$64,963.48
BTC up 0.63 percent
0.63%
ETH
$1,916.36
ETH up 0.38 percent
0.38%
XRP
$1.03
XRP up 0.43 percent
0.43%
SOL
$74.77
SOL up 2.23 percent
2.23%
Original YayaNews editorial coverage, published for informational purposes.
This article is sourced from CoinDesk. It is for informational purposes only and does not constitute investment advice.
Topics & Symbols
Continue Reading
Related Reading
Upbit Lists PROM with KRW and USDT Trading Pairs, Opening New Opportunities for Mid-Cap Tokens
Upbit announced the addition of PROM KRW and USDT trading pairs, with a market cap of approximately $43.5 million. This article analyzes the significance, project background, and market impact for investors.
SEC Prepares Major Crypto Plan as Clarity Act Stalls: What It Means for Markets
As the Clarity Act remains gridlocked, the SEC is reportedly preparing a significant crypto regulatory plan. This article analyzes potential new rules covering DeFi, stablecoins, and exchanges, market reactions, and the global competitive pressures shaping U.S. oversight.
Binance Launches DOSUSDT Perpetual Contract: Market Impact and Investment Strategy Analysis
Binance announced the listing of the USDⓈ-M DOSUSDT perpetual contract on August 11, 2026. This article analyzes the announcement background, market reactions, and investment risks to help investors seize opportunities.
Ireland Plans Industry Standards for Illicit Crypto Use
The strategy prepared by the Irish government’s finance department included industry standards on crypto used for gambling and strengthening AML/CFT measures in certain cases.
