BTCPay Pledges 3 BTC Bounty After Lightning Credential Theft

The attack vector

Attackers hit BTCPay Server deployments running LND late Friday, exploiting a vulnerability that exposed admin macaroon files — the high-level credentials that grant full control over a Lightning node. The flaw allowed unauthenticated remote access to those files, letting attackers seize nodes, force-close channels, and sweep balances. BTCPay founder Nicolas Dorier released version 2.4.2 the same morning with a one-line warning: update immediately or take servers offline. The project's X post at 11:51 a.m. ET passed 550,000 views within five hours.

Where the funds went

Foundation chief executive Zach Herbert confirmed the company's BTCPay Lightning node was drained overnight, with all channels closed and funds swept. Its on-chain hot wallet remained untouched. Citadel21, the publication run by pseudonymous commentator hodlonaut, reported the same pattern — its node swept, though it held minimal funds. Craig Raw, the Sparrow Wallet developer who helped identify the vulnerability, also said he was affected. No victim has disclosed amounts, and BTCPay has not published a tally of compromised nodes or total bitcoin moved.

The vulnerability class

The exploited flaw is distinct from the two-factor authentication bypass in BTCPay's Greenfield API that the 2.4.2 changelog discloses. Dorier explicitly ruled out that bug as the critical exploit. The project has withheld technical details, saying operators need time to patch before a full postmortem. The vulnerability specifically targets deployments using LND; users on CLN or other Lightning implementations, and those not using Lightning at all, were not exposed to the credential theft risk. Critically, installing the patch does not revoke stolen macaroons — operators must regenerate macaroon credentials and rotate authentication strings independently.

Response and recovery

The Bitcoin Red Team, a group of developers pointing AI models at Bitcoin codebases, discovered and reported the vulnerability before it was exploited in the wild. BTCPay credited Red Team members Raw, Rob Hamilton, Calle, and Evan Kaloudis. The BTCPay Server Foundation is donating 0.21 BTC each to Raw and the Bitcoin Red Team fund. On Monday, supporters announced a recovery bounty: 10% of any stolen funds returned, capped at 3 BTC if all funds are recovered. BTCPay also temporarily restricted public remote connections to LND nodes, preventing external wallets like Zeus from connecting through BTCPay domains or Tor addresses on Docker deployments.

Sector implication

This is the second major Bitcoin infrastructure exploit in days, following the Coldcard hardware-wallet flaw linked to over $100 million in confirmed losses. Both incidents targeted software surrounding Bitcoin rather than the protocol itself. BTCPay processes bitcoin payments for merchants including Namecheap, which ran $73 million in BTC revenue across 1.1 million transactions through BTCPay between May 2020 and October 2024. The self-hosted model means every operator must patch individually — there is no central operator to push fixes. Stolen macaroons survive a software update, leaving patched-but-unrotated nodes still exposed.