BTCPay Server issued an urgent advisory Friday telling every merchant running Lightning Network Daemon to update immediately or pull their nodes offline. Attackers extracted credentials that grant full control over Lightning wallets, letting them move funds without on-chain signatures.
The compromise surfaced when operators noticed unauthorized channel operations on nodes that had not been restarted in weeks. BTCPay's security team traced the vector to a credential-handling flaw in LND versions prior to the current release. The stolen material — macaroons and TLS certificates — acts as a master key: anyone holding it can open channels, route payments, and sweep wallet balances.
The attack vector
The vulnerability sits in how LND stores and validates authentication tokens for its gRPC and REST interfaces. When a node operator configures BTCPay to manage invoices and settlements, the server receives a macaroon with admin permissions. If that macaroon leaks — via log exposure, backup misconfiguration, or a compromised host — the attacker gains persistent wallet access. No private key extraction is required.
BTCPay's advisory did not name the specific LND versions affected, only stating that "all operators on outdated releases" must upgrade. The project maintainers pushed a patch to the 0.18 branch Thursday night; the fixed binaries carry a rebuilt credential store and mandatory macaroon rotation on restart.
Where the funds went
No public blockchain analytics firm has published a fund-flow trace as of filing. The Lightning Network's off-chain nature means stolen bitcoin moves through channel updates, not on-chain transactions, until a cooperative or force-close settles to the base layer. Several operators reported channels force-closed to unfamiliar addresses within hours of the advisory.
One operator, speaking on condition of anonymity, said their node lost 0.43 BTC — roughly $28,000 at Friday's price — across three channels that were force-closed to a single destination address. The address has no prior exchange tags in open databases. Other reports on the LND GitHub discussions page describe similar patterns: rapid channel closures to fresh addresses, then on-chain sweeps to mixers.
| BTC Price | $64,958 |
|---|---|
| 24h Change | +1.10% |
| 7d Change | +3.20% |
|---|---|
| 24h Volume | $21.0B |
| Market Cap | $1.30T |
|---|---|
| BTC Dominance | 56.8% |
Response and recovery
LND maintainers released 0.18.4-beta within twelve hours of the first report. The release notes cite "credential isolation improvements" and "mandatory macaroon rotation on startup." BTCPay bundled the patched LND into its 1.14.3 Docker image and urged operators to rebuild containers rather than attempt in-place upgrades.
Operators who cannot update immediately were told to stop their LND process, revoke all macaroons via the `lncli bakemacaroon` command with a new root key, and regenerate TLS certificates. BTCPay's documentation now includes a credential-rotation checklist that takes roughly twenty minutes per node.
No ransom demands or negotiator contacts have surfaced. The attacker appears to be sweeping funds silently, consistent with a credential-harvesting campaign rather than a targeted extortion.
Sector implication
Every merchant stack that embeds LND — BTCPay, Voltage, Strike's merchant tools, and self-hosted implementations — runs the same daemon code. The vulnerability is not in BTCPay itself but in the upstream LND credential model that all these platforms inherit. Voltage confirmed Friday afternoon that its managed-node fleet was patched before the advisory went public; Strike said its custodial merchant product does not expose LND macaroons to tenants.
The incident revives a debate from 2023 about whether merchant Lightning infrastructure should run on dedicated hardware with hardware security modules for macaroon storage, rather than on general-purpose cloud instances where credential files sit on shared disks.