There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds," the project posted at 11:51 a.m. ET on August 7. "If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.
By the time that warning went live, attackers had already swept Lightning nodes belonging to Foundation, the hardware wallet manufacturer, and Citadel21, the Bitcoin zine run by pseudonymous commentator hodlonaut.
Foundation chief executive Zach Herbert confirmed the breach at 2:01 p.m. ET: "How many BTCPay lightning nodes were swept? Our Foundation node was drained overnight by attackers." An hour later he narrowed the damage: "This was just our BTCPay server that we use for payment processing, the hot wallet was untouched — only the lightning node was drained. All channels were closed and funds were swept.
hodlonaut reported the same pattern: "This is an ongoing attack on BTCPayserver users. Citadel21's lightning node was just swept. Fortunately there were not much funds there." At least one other operator described identical channel closures and drained balances in reply threads.
The attack vector
The vulnerability centered on macaroons — credential files that function like API keys granting permission to perform actions on an LND Lightning node. BTCPay Server uses these to manage channels, route payments, and settle invoices on behalf of merchants.
The problem was that macaroons persisted even after operators applied software updates. Merchants who had dutifully upgraded their BTCPay installations remained exposed because the old credential files remained valid. Closing the gap required a manual credential refresh that was not automatic and not obvious.
Stolen macaroons survive a software update," a BTCPay maintainer noted in the advisory. "An attacker who copied them before the patch keeps node access until the credentials are destroyed and reissued, which matches what the victims describe: channels force-closed and balances swept rather than the server itself compromised again.
Where the funds went
Attackers used the compromised macaroons to force-close Lightning channels and sweep the on-chain outputs to addresses they controlled. The pattern was consistent across victims: Lightning balances moved, on-chain hot wallets generated inside BTCPay were not touched unless the operator had also reused credentials there.
BTCPay has not published a tally of compromised nodes or total bitcoin moved. Neither Herbert nor hodlonaut disclosed amounts. The project's X post passed 550,000 views within five hours, suggesting the installed base aware of the alert was substantial.
The vulnerability class and how it was exploited
The exploited flaw was distinct from a two-factor authentication bypass in BTCPay's Greenfield API that the project disclosed and patched on August 4. That bug allowed accounts protected by authenticator apps to be accessed with only an email and password, granting unrestricted permission claims. The browser login screen enforced 2FA correctly throughout.
After a user posted a Grok-generated analysis pinning the Lightning drain on the 2FA bug, founder Nicolas Dorier replied: "This bug was found by the Red team, this isn't the critical bug in question.
The active exploit targeted a separate, undisclosed vulnerability in how BTCPay managed macaroon lifecycle and rotation. The project has indicated a detailed technical postmortem will follow once operators have time to patch.
| Component | Version patched | Role |
|---|---|---|
| --- | --- | --- |
| BTCPay Server | 2.4.2 | Payment processor frontend |
| NBXplorer | 2.6.10 | Wallet-tracking backend |
| LND | Unchanged | Lightning node daemon |
| macaroons.db | Manual refresh | LND credential store |
Response and recovery
BTCPay released version 2.4.2 the morning of August 7 with a one-line warning at the top of the changelog: "This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can.
The advisory went further than a typical software update. Operators were instructed to: - Update BTCPay Server to 2.4.2 immediately or shut the server down - Upgrade NBXplorer to 2.6.10 - Completely refresh macaroons and macaroons.db - Rotate authentication strings for other Lightning backends (CLN, LDK, Eclair) - Move any funds from hot wallets generated inside BTCPay and recreate those wallets
Patching alone does not close the incident. Because macaroons are long-lived bearer credentials, an attacker who harvested them before the update retains full node access until the credential store is destroyed and reissued.
User impact and exposure
BTCPay Server is self-hosted open-source software. There is no central operator who can push patches on behalf of users. Every merchant, exchange, and wallet backend running the software must apply the fix on its own infrastructure.
The software sits behind bitcoin checkout for Namecheap, which processed $73 million in BTC revenue across 1.1 million transactions through BTCPay between May 2020 and October 2024. Hundreds of smaller merchants and several wallet backends also rely on it.
For operators who updated promptly but skipped the credential refresh, the window of exposure remains open. For those who have not updated at all, the project's recommendation to shut down entirely is unusually blunt for open-source maintainers.
Sector implication
The exploit arrives during heightened scrutiny of Bitcoin infrastructure. A recent Coldcard firmware flaw put hardware wallet security under the microscope. The Bitcoin Red Team has been conducting AI-assisted audits of critical Bitcoin tools.
That this BTCPay vulnerability was actively exploited before those auditing efforts could catch it raises questions about how well the current security review process is keeping pace with the attack surface.
The specific mechanics — credentials that survive software updates — point to a category of vulnerability that is easy to overlook. When the fix requires an additional manual step that is not immediately obvious, the gap between "updated" and "secure" becomes a hunting ground for attackers.
Both BTCPay Server and the Bitcoin Red Team have indicated detailed technical analyses of the exploit will be published in the coming days.