Another Bitcoin infrastructure exploit hits, this time draining Lightning payment servers

TechAnother Bitcoin infrastructure exploit hits, this time draining Lightning payment serversBTCPay told users running LND to update immediately or take servers offline after attackers stole credentials that can control Lightning wallets and move funds.By Shaurya MalwaUpdated 2 hrs agoPublished 2 hrs ago2 min readMake preferred on ShareShare this articleCopy linkX iconX (Twitter)LinkedInFacebookEmailMake preferred on SummaryShowAttackers exploited a critical vulnerability in BTCPay Server to steal funds from Lightning nodes running LND, prompting urgent calls to update to version 2.4.2 or take servers offline.The flaw allowed unauthenticated access to LND “.macaroon” credential files, enabling attackers to seize control of affected Lightning nodes and drain their channels, though BTCPay’s standard on-chain wallets were not impacted.Victims including hardware-wallet maker Foundation and bitcoin publication Citadel21 reported their Lightning nodes were swept, as BTCPay and the Bitcoin Red Team investigate and prepare a full postmortem on the incident.A rough week for bitcoin's software is getting worse, this time hitting merchants who accept bitcoin BTC$64,959.65 payments through Lightning, a separate network built on top of bitcoin for instant, low-cost transfers.Attackers drained Lightning nodes running behind BTCPay Server late on Friday after exploiting a critical vulnerability that exposed the credentials protecting them, the team said in an X post.BTCPay confirmed funds were stolen and told anyone running LND, the most widely used software for operating a Lightning node, to update immediately to version 2.4.2 or take the server offline. The project has not disclosed how many users were hit or how much bitcoin was taken. The flaw allowed an unauthenticated remote attacker to obtain “.macaroon” files, or credentials that give software permission to interact with an LND Lightning node. BTCPay said the attacks it reviewed targeted those files, which could then be…

Another Bitcoin infrastructure exploit hits, this time draining Lightning payment servers

Coins in this story

Discussion

Related stories

New XRP Ledger amendments target $530 million in tokenized Wall Street assets

Bitcoin holders risk losing real BTC if they sell coins from BIP-110 fork, says developer

U.S. Senate opens first stage of crypto Clarity Act voting to give bill a chance next month