BTCPay Server Processing Urgently Updated After Fund Theft

BTCPay Server processing has become the center of a security incident: developers confirmed the exploitation of a critical vulnerability that allowed attackers to access data from some users and steal funds.

The project team released version 2.4.2 and closed the breach. All earlier releases with LND builds were at risk. Developers urged operators not to delay the update, especially if their infrastructure uses the Lightning Network.

The vulnerability allowed a remote attacker to obtain .macaroon credential files for LND without authorization. This implementation of the Lightning Network is often used in services that process Bitcoin payments and help scale transactions on top of the main network.

Who Needs to Update BTCPay Server First

The stolen credentials give the attacker full control over the LND node. After that, they can directly withdraw funds from such a node, which happened to some users.

"We confirmed that attackers exploited this vulnerability. Some users were affected, and funds were stolen. We are not disclosing details yet to allow operators to install the update in time," said the BTCPay Server team.

The risk only concerns configurations with LND. BTCPay Server can accept payments on the main Bitcoin network and supports the Lightning Network, but users without Lightning, as well as other Lightning Network configurations, according to developers, did not experience a leak. Nevertheless, the team still advises all operators to update. Official on-chain wallets and hot wallets of BTCPay Server were not affected.

Operators using LND need to switch to BTCPay Server 2.4.2 and LND 0.21.1 via the admin panel. During the update, macaroon files are automatically regenerated. If it is not possible to quickly install the patch, developers recommend temporarily disabling the servers.

"For LND operators, the main thing now is to quickly switch to BTCPay Server 2.4.2 and LND 0.21.1: old builds leave macaroon credentials and funds on the node at risk."

What LND Users Should Pay Attention To

After installing the update, node owners should check the activity history. Especially important are unfamiliar connections, unexpected channel closures, and payments that the user did not initiate.

How BTCPay Server Works

BTCPay Server is an open-source payment processor for accepting Bitcoin payments. It connects a store, POS point, or direct payment link with the operator's wallet: it creates invoices, tracks payments on the Bitcoin network or via the Lightning Network, and transmits payment status to the store through integrations, plugins, or APIs.

BTCPay Server is used by:

• online stores;
• e-commerce projects;
• crowdfunding services;
• POS points.

The service can also be used without an online store - for example, to accept payments directly or through POS. Setting up and using BTCPay Server does not require KYC, and the basic setup usually involves downloading the code from GitHub, running it on a personal server, and connecting the wallet and store.

Key Features of BTCPay Server:

• invoice generation;
• integration with stores;
• API support;
• payment reports;
• accepting payments via POS.

This infrastructure typically involves:

• APIs;
• plugins;
• cryptocurrency wallets;
• accounting modules;
• BTCPay Server source code on GitHub.

BTCPay Server is chosen over centralized processors when decentralization, control over funds, no processing fees, and open code are important. Automatic conversion of cryptocurrency to fiat is not included in the basic functions, so such scenarios are usually built separately.

Support and educational materials can be found in the official BTCPay Server documentation, on GitHub, in forums, and in project communities.

Therefore, the incident is significant not only for individual operators but also for teams building cryptocurrency payment infrastructure on open-source solutions and deploying their own servers.

Developers also emphasized: the problem is not related to the Central Processing Unit and does not affect the Bitcoin protocol itself. It concerns a vulnerability in tools built around the payment infrastructure.

Another Blow to Bitcoin Tool Security

The report of the issue in BTCPay Server coincided with another major incident. Galaxy Research confirmed that users of Coldcard had 1719 Bitcoin stolen, estimated at around $111 million. Analysts estimate that after reviewing all attack episodes, the total damage could exceed $130 million.

Both cases did not affect the underlying Bitcoin protocol. Vulnerabilities were found in services and devices that operate on top of it. This once again shows that the security of crypto infrastructure depends not only on the blockchain but also on the quality of wallets, nodes, payment modules, and server software.