Bitcoin Payment Tool BTCPay Urges Update After Attackers Steal Funds

BTCPay Server confirmed that attackers exploited a critical flaw to steal funds from users running any version prior to 2.4.2 and urged operators to update immediately.

The self-hosted Bitcoin payment processor released version 2.4.2 to close the vulnerability. The issue allowed an unauthenticated remote attacker to obtain .macaroon credential files for LND, a common Lightning Network implementation.

What BTCPay Server Users Must Do

The stolen credentials could hand an attacker full control of an LND node. From there, the attacker could move funds directly out of the node.

“We have confirmed that attackers exploited this vulnerability. Users were affected and funds were stolen. We are not publishing technical details yet because operators still need time to update,” the team said.

Follow us on X to get the latest news as it happens

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.If you…

— BTCPay Server (@BtcpayServer) August 7, 2026

The risk applies specifically to deployments using LND. Other Lightning setups and non-Lightning users face no credential exposure, though the project still urged them to update. BTCPay Server’s own on-chain and hot wallets remain unaffected.

Operators who use LND should update to version 2.4.2 and LND 0.21.1 through the maintenance dashboard. The update regenerates macaroons automatically. Those unable to patch immediately were told to take their servers offline.

The project also advised LND users to review node activity for unfamiliar peers, unexpected channel closures, and payments they did not make.

A Second Blow to Bitcoin Self-Custody

The disclosure follows another major security incident. Galaxy Research confirmed on Friday that 1,719 Bitcoin (BTC), worth roughly $111 million, has been stolen from Coldcard users so far. The firm expects total losses to exceed $130 million once outstanding cases are verified.

$111 MILLION CONFIRMED STOLEN SO FAR IN COLDCARD EXPLOITThanks to victim reports, we can confirm with high confidence that 1719 BTC has been stolen from Coldcard victims so farWe have many more coins we are vetting for confirmation – we think total losses likely exceed $130m pic.twitter.com/pLfiMQZFyX

— Galaxy Research (@glxyresearch) August 7, 2026

Neither incident touched the Bitcoin protocol itself. Both instead exposed weaknesses in the tools built around it. 

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights