ARTFEED — Contemporary Art Intelligence

BTCPay Server Vulnerability Exploited, Draining Merchant Lightning Nodes

digital · 2026-08-09

A significant security flaw in BTCPay Server, an open-source Bitcoin payment processor, is currently being exploited, enabling attackers to siphon Bitcoin from Lightning Network nodes. On Friday, BTCPay acknowledged the attacks and advised operators utilizing LND to either update to version 2.4.2 or take their vulnerable servers offline. While the number of affected users and the amount of stolen Bitcoin remain undisclosed, both Foundation and Citadel21 have reported losses. This vulnerability permitted remote access to .macaroon files, allowing attackers to control channels and transfer funds without server authentication. Discovered by the Bitcoin Red Team, the flaw is attributed to Craig Raw, Rob Hamilton, Calle, and Evan Kaloudis. BTCPay emphasized the urgency of updates or server shutdowns, with a postmortem analysis forthcoming.

Key facts

  • Critical vulnerability in BTCPay Server exploited, draining Bitcoin from Lightning Network nodes.
  • BTCPay Server confirmed attacks late Friday, urging LND operators to update to version 2.4.2 or take servers offline.
  • Attackers remotely accessed .macaroon files containing credentials to control LND Lightning nodes.
  • Foundation, a Bitcoin hardware-wallet manufacturer, had its Lightning node drained; CEO Zach Herbert confirmed.
  • Citadel21, a Bitcoin publication, also reported its Lightning node was swept.
  • Vulnerability does not affect standard on-chain wallets generated within BTCPay.
  • Flaw discovered by Bitcoin Red Team members Craig Raw, Rob Hamilton, Calle, and Evan Kaloudis.
  • Discovery part of AI-assisted code review initiative generating thousands of findings.
  • BTCPay has not disclosed number of affected servers or total stolen Bitcoin.
  • Operators advised to patch immediately or take servers offline.
  • Full impact expected after postmortem.

Entities

Artists

  • Zach Herbert
  • hodlonaut
  • Craig Raw
  • Rob Hamilton
  • Calle
  • Evan Kaloudis

Institutions

  • BTCPay Server
  • Foundation
  • Citadel21
  • Bitcoin Red Team

Sources