BTCPay is cutting off remote access to Lightning nodes after attackers drained funds from operators running the payment software. The Foundation and Citadel21 both reported compromised nodes in recent days. The total amount stolen and the number of affected operators remain unknown.
Why remote access is being locked down
BTCPay moved to restrict remote Lightning connections following the theft reports. The change means operators can no longer reach their nodes from outside a local network the way they could before.
The decision is a direct response to the drained nodes. BTCPay has not detailed the exact vulnerability or attack method, only that remote access posed enough risk to warrant the restriction. For operators who relied on checking balances or routing payments from another machine, that workflow is now gone.
Who reported the drained nodes
The Foundation and Citadel21 both said their Lightning nodes were emptied. Their reports were the trigger for BTCPay's broader action.
Neither has published a dollar figure for what was taken. The lack of numbers makes it harder for other operators to gauge whether they were hit too. A node can be drained and the operator might not notice until they check their channels.
What's still unclear
Investigators have not said whether the two attacks shared a method, a common operator, or a single point of failure. BTCPay has not confirmed whether the thefts came through a flaw in its own software or through misconfigured setups on the operators' side.
The scope is the open question. A handful of nodes could be affected, or the number could be larger. Until BTCPay or the affected operators release more detail, everyone running a Lightning node on the platform is left to audit their own channels.
BTCPay has not said when remote access might be restored, or whether it will return in a more limited form. Operators with exposed nodes are watching their balances closely.
