BTCPay Server released version 2.4.2 on Tuesday to patch a critical vulnerability that let unauthenticated attackers remotely access LND credential files and drain merchant Lightning wallets. The open-source payment processor said the flaw involved .macaroon files, which LND uses to manage access permissions, and could grant unauthorized control over node functions if exposed. Merchants running self-hosted setups are being told to update immediately and review how their LND instances are exposed.
Inside the vulnerability
The problem was server-side, not a Bitcoin protocol exploit. Attackers who found an exposed BTCPay Server instance could pull down the .macaroon files without logging in, then use them to reach LND's interface and move funds out of Lightning channels. The files act like session tokens — anyone holding them gets the same powers as the node operator. In practice, that meant emptying whatever was sitting in a merchant's Lightning wallet.
It's not clear how many operators were hit before the patch landed. BTCPay didn't release a count, only a warning and a fix. But the fact that the vulnerability was actively exploited, not just discovered, suggests some wallets were drained before people had a chance to update.
A bounty for returning the loot
For those who lost funds, there's a recovery bounty. BTCPay Server is offering 10% of returned funds, capped at 3 BTC — roughly $190,000 at current prices. That's an odd but pragmatic move: an incentive for the attacker to give back what they took, rather than just walk away. Whether anyone takes it up is another matter, but it gives victims a sliver of leverage.
Not a Bitcoin bug
This wasn't a flaw in Bitcoin or the Lightning Network itself. It was a configuration and access-control gap in a specific self-hosted stack. That distinction matters because it changes the fix. Upgrading the protocol wouldn't have helped; the problem was in how BTCPay Server stored and served those credential files. A patched server closes the hole, but it also highlights a broader truth about self-custody infrastructure: you're on the hook for maintenance.
What operators should do now
The urgent step is to update BTCPay Server to 2.4.2 and check whether LND is exposed to the wider internet. If it is, locking that down matters as much as the patch itself. The .macaroon files are only safe if the server isn't handing them out to anyone who asks.
This is also a reminder that running your own payment processor isn't a set-it-and-forget-it job. Credentials need rotating, software needs updating, and the exposure surface needs regular review. The people who got hit likely skipped one of those steps. The next critical vulnerability may not be as forgiving.
