BTCPay Server 2.4.2: The Lightning Credential Incident
If a BTCPay Server instance used LND and ran a version before 2.4.2, update to the final 2.4.2 release immediately. BTCPay Server is free software that lets a merchant accept bitcoin payments on their own server. Many installs include LND, a separate program that handles instant Lightning payments. LND's admin credential lives in a small file called a macaroon: whoever holds that file controls the node and can move its money. The flaw let a remote attacker copy those files. BTCPay confirmed attacks and stolen funds but did not publish a total loss.
The exposed path reached LND control. BTCPay Server versions before 2.4.2 exposed LND macaroons; 2.4.2 fixes the path and regenerates BTCPay-managed credentials.
Data behind this diagram
| Stage | Condition | Operator implication |
|---|---|---|
| Remote attacker | Unauthenticated access | Internet-facing entry path |
| BTCPay Server | Version before 2.4.2 | Affected, including release candidates |
| LND macaroon | Administrator credential obtained | LND node control |
| Exposed surfaces | Lightning channels and LND on-chain funds | Review node activity and reconcile funds |
| Patch boundary | Version 2.4.2 with LND 0.21.1 | Update and regenerate credentials |
| What the update cannot fix | LND routes exposed outside BTCPay stay open until the operator acts | Close routes and rotate credentials |
| What was not affected | BTCPay on-chain wallet and other Lightning implementations | Outside this specific LND exposure |
What happened and when
The BTCPay security advisory covers BTCPay Server versions before 2.4.2 when LND was enabled. Release candidates for 2.4.2 were also affected. An unauthenticated remote attacker could obtain LND .macaroon credential files, and with them control of the LND node, its Lightning channels and the funds in LND's own on-chain wallet.
BTCPay published the fixed 2.4.2 release and the advisory on 7 August 2026, and a fuller incident response on 10 August. The fixed release includes LND 0.21.1 and regenerates the macaroons managed by BTCPay.
BTCPay's separate on-chain wallet was not affected by this flaw. Instances using another Lightning implementation, or no Lightning implementation, were outside this incident.
What to do now
- Update to the final BTCPay Server 2.4.2 release. Do not stop on a release candidate.
- Review Lightning payments, channels, peers and LND on-chain activity for anything you do not recognize.
- If LND was also exposed through a reverse proxy, port, Tor service or copied credential outside BTCPay, close that route and rotate the affected credentials separately.
- If you cannot rule out that the server itself was compromised, rebuild it from a trusted base. Fresh credentials alone do not remove an attacker who has already installed persistence on the host.
The update regenerates the macaroons managed by BTCPay. It cannot close an LND route or replace a credential that was exposed outside BTCPay's own configuration. Docker deployments also temporarily lose public LND API access in 2.4.2, an incident-control measure the project applied deliberately, so check dependent integrations after updating.
What remains unknown
BTCPay's follow-up confirmed attacks, affected users and stolen funds, and says the project is offering recovery bounties and coordinating with exchanges and law enforcement. It did not publish the number of affected instances, a total loss, the attacker's identity or a full technical account of the root cause. For our ongoing assessment of BTCPay Server as a service, see the BTCPay Server provider page.