Home
Cryptocurrency
Cryptocurrency News
BTCPay Server Blocks Remote Lightning Node Access After LND Vulnerability Exploited by Hackers

BTCPay Server Blocks Remote Lightning Node Access After LND Vulnerability Exploited by Hackers

LND users are urged to check nodes for unauthorised payments and suspicious channel activity.

Written by Rahul Dhingra, Edited by Rohan Pal | Updated: 10 August 2026 15:42 IST

BTCPay Server Blocks Remote Lightning Node Access After LND Vulnerability Exploited by Hackers

Photo Credit: Unsplash/Mariia Shalabaieva

BTCPay’s latest patch automatically generates fresh LND credentials for affected installations

Click Here to Add Gadgets360 As A Trusted Source

Highlights

Attackers exploited leaked LND credentials to access node funds
BTCPay says Lightning payments can continue during the restriction
Operators using external access must change credentials separately

The BTCPay Server has currently blocked remote access to nodes on the Lightning Network that use Lightning Network Daemon (LND) software due to a vulnerability being exploited by hackers to steal credentials and transfer funds. BTCPay says that this ban will prevent external wallets like Zeus from accessing the node via the BTCPay Server domain Tor onion URL on Docker deployments. According to BTCPay, Lightning payments could continue while the company planned to roll out remote access once it deemed it safe to do so. Project developers recommended that node operators conduct audits for unauthorised payments, unusual channel closures, unknown peers, and any other imbalances in their balances.

Developers Urge Node Operators to Rotate Credentials and Audit Funds

According to BTCPay, the vulnerability allowed an attacker from afar to obtain “macaroon” credential files used to access LND, a software implementation of the Lightning Network. BTCPay noted that the leaked credentials would enable attackers to control an LND node and steal its funds. As mentioned in the project's security advisory, the 2.4.2 version includes LND version 0.21.1, which automatically generates new macaroon credentials for all standard BTCPay installations.

Crypto Frauds Discussion

Crypto Frauds and Hacks: Can the Industry Ever Stay Ahead?

Explore More...

The security alerts suggested that operators should look for any unauthorised transactions, unexpected channel closures, suspicious peers, and differences in the on-chain or Lightning balance records.

Bitcoin Holds Near $65,000 as Weak US Jobs Data Revive Fed Rate-Cut Hopes

BTCPay further noted that operators who expose LND using their own reverse proxy, Tor service, forwarded port, or some other method apart from BTCPay need to change their credentials independently. The development team pointed out that the installation of the patch doesn't mean closing independent access paths for the operators.

The CEO of the Foundation, Zach Herbert, confirmed with a post on X that the hardware wallet startup's Lightning node had been emptied overnight. Later on, he clarified that only its Lightning channels had been drained and not its hot wallet.

Another publication on Bitcoin, Citadel21, reported that the Lightning node from their platform had been swept. The operators did not disclose the amount stolen and further stated, “This is an ongoing attack on BTCPayserver users. Citadel21's lightning node was just swept. Fortunately, there were not many funds there, due to cautionary steps before BIP-110 activation. Praying for all other affected users.”

Crypto Wrench Attack Losses Surpass $30 Million in 2026, Says Chainalysis

The BTCPay breach is the latest security incident involving widely used Bitcoin products, following a Coldcard hardware-wallet flaw reported last week. According to Galaxy Digital's chief researcher, Alex Thorn, at least 15 different hackers have used this Coldcard vulnerability, as per the reports received after the incident. It is estimated that the damage caused by this Coldcard exploit amounts to $100 million (roughly Rs. 952 crore).

Western Union Introduces Stablecoin Transfers Via Visa Network and Stablecard

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Cryptocurrency Prices across Indian exchanges

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Crypto Frauds, Crypto Scams, Crypto hacks, Bitcoin

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More