BTCPay Server exploit drains Lightning merchant nodes after credential compromise of LND wallets

Multiple reports say an exploit tied to BTCPay Server has been used to drain funds from merchant Lightning nodes running LND. Coverage indicates attackers obtained credentials that allowed them to control Lightning wallets, including access to sensitive LND authentication material such as “.macaroon” files ^{[1] [2]}.

BTCPay users running the affected setup were advised to update and, in some cases, take servers offline. One report frames the exposure as specific to vulnerable BTCPay Server installations using LND, rather than all BTCPay users broadly ^{[3] [4]}.

The incidents underscore a need for prompt patching of BTCPay Server deployments that integrate LND for Lightning payments, with advisories urging immediate action to prevent further wallet control from compromised credentials ^{[1] [2]}.