Open-source payment platform BTCPay Server has deployed software update version 2.4.2 to patch a critical system vulnerability that permitted unauthenticated remote access to sensitive LND credential files. According to a report by NewsBTC, malicious actors leveraged the flaw to access self-hosted merchant setups and drain funds directly from connected Lightning Network wallets.

Unauthenticated Access to Macaroon Credential Files

The security vulnerability compromised access control files known as .macaroon files, which are utilized by the Lightning Network Daemon (LND) software to manage user authorizations and control node functions. As detailed by NewsBTC, these credential files effectively operate as cryptographic access keys. When unauthenticated remote parties gain access to unencrypted or exposed .macaroon files, they acquire administrative power over the node, enabling them to execute unauthorized commands and drain funds from the operator's balance.

Community Backs Bounty for Returned Funds

In response to the exploit, community members and supporters of BTCPay launched a recovery bounty initiative to incentivize the return of stolen assets. The program promises a payout equivalent to 10% of any returned funds, with a hard cap set at 3 BTC. According to NewsBTC, the maximum reward is valued at approximately $190,000 based on price figures reported at the time of the incident. While bounties are designed to establish negotiation channels and encourage cooperation from attackers or intermediaries, the report noted that such measures do not guarantee the eventual recovery of lost funds.

Server-Side Exploit Does Not Affect Bitcoin Layer One

Industry analysts and the project's release documentation emphasized that the incident was an application-level server vulnerability rather than a failure of the Bitcoin protocol itself. NewsBTC highlighted that neither the underlying Bitcoin blockchain nor native on-chain wallet cryptography suffered any breach. Instead, the problem was isolated to server-side software deployments where exposed LND credentials allowed external actors to breach specific node setups.

Operational Demands of Self-Hosted Infrastructure

The exploit underscores the unique operational risks associated with running active payment infrastructure on layer-two networks. Unlike offline cold storage solutions used for holding static Bitcoin, maintaining a live Lightning node involves managing liquidity, open payment channels, active network connections, and continuous remote server access. NewsBTC noted that self-hosted payment systems require active management, including prompt patching, strict permission configurations, and careful auditing of exposed server ports.

To secure their setups, BTCPay Server administrators operating LND setups are urged to upgrade to version 2.4.2 immediately. Security recommendations highlighted in the reporting emphasize that operators should review all active LND credential permissions, verify network firewall rules, and ensure that sensitive control files remain completely isolated from public access.