Critical BTCPay Server Exploit Drains Lightning Nodes via Stolen Macaroons

A single stolen credential file just proved capable of draining an entire Lightning node, and the fix does not fully close the door on funds already exposed before it shipped.

A critical, actively exploited vulnerability in BTCPay Server let unauthenticated remote attackers steal LND “.macaroon” credential files and drain connected Lightning node channels. Hardware wallet maker Foundation and Bitcoin publication Citadel21 are among the confirmed victims. BTCPay pushed an emergency patch, version 2.4.2, but warned that macaroons already stolen before updating remain valid credentials even after the fix is applied.

A macaroon in this context functions similarly to an API key with broad permissions, whoever holds a valid one can authenticate against the Lightning node and direct its funds, which is exactly why the exploit proved so damaging: the vulnerability was not in the Lightning Network protocol itself, but in how BTCPay Server exposed and protected these credential files.

The warning that patching alone does not neutralize already-stolen macaroons is the detail operators need to act on directly. Anyone running an affected BTCPay Server instance needs to actively rotate or revoke existing macaroon credentials, not just update the software, since the update closes the vulnerability that allowed theft going forward without retroactively invalidating what attackers may have already captured.

This incident adds to a growing pattern this year of Lightning and self-hosted node infrastructure becoming a more attractive target as the amount of value flowing through these systems grows, a shift that puts increasing pressure on operators to treat credential management with the same rigor traditionally reserved for private keys themselves.

Want to understand how Lightning Network node credentials and authentication actually work? Learn more in the Bitcoin Academy.