BTCPay Server vulnerability lets attackers drain Lightning nodes overnight

Attackers spent Friday quietly emptying Lightning nodes tied to BTCPay Server, the self-hosted bitcoin payment processor, after the project confirmed a critical BTCPay Server vulnerability was being actively exploited. Hardware wallet maker Foundation and the bitcoin zine Citadel21 both reported drained nodes, some hours before BTCPay’s own public warning went out. The incident, disclosed August 7, 2026, has forced merchants, exchanges and wallet backends running the software to scramble for a fix while the thefts were still in progress.

Key takeaways

• BTCPay Server confirmed a critical, actively exploited vulnerability and released version 2.4.2 to patch it on August 7, 2026.
• Hardware wallet maker Foundation and bitcoin zine Citadel21 both had Lightning nodes swept, with channels force-closed and funds drained.
• Founder Nicolas Dorier said the bug was found only because a developer, Craig Raw of Sparrow Wallet, lost funds and analyzed the logs — not through AI-assisted audits.
• BTCPay is self-hosted, meaning there is no central operator to patch on users’ behalf; every server owner must update individually.
• Users are told to refresh macaroons and credential files after patching, since stolen credentials can still grant access even after the update.

Critical Vulnerability Exploited in BTCPay Server Lightning Nodes

The core problem is straightforward but severe: a flaw in BTCPay Server let attackers reach and empty Lightning nodes without needing to breach a user’s hot wallet separately. BTCPay posted an urgent notice at 11:51 a.m. ET saying, “There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.” The project told merchants to update immediately or shut their servers down if they couldn’t patch right away. That post reportedly passed 550,000 views within five hours, a sign of how fast the alarm spread across the bitcoin payments community.

Incident Overview and Patch Release

Dorier, BTCPay’s founder, published version 2.4.2 the same morning with a blunt warning at the top of the release notes: “This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can.” Integrators were also told to upgrade NBXplorer, BTCPay’s wallet-tracking backend, to version 2.6.10. The release additionally rate-limits public invoice creation on payment requests and marks nine controller methods across five files as non-routable, closing off endpoints that were reachable over HTTP by accident.

Affected Users and Impact Details

Secondo Zach Herbert, amministratore delegato di Foundation (società produttrice del portafoglio hardware Passport), il suo nodo era già scomparso prima che even saw the alert. “Our Foundation node was drained overnight by attackers,” he wrote, later clarifying that only the Lightning node used for payment processing was hit — the company’s hot wallet was untouched, but “all channels were closed and funds were swept.” hodlonaut, the pseudonymous commentator behind Citadel21, reported the same pattern, writing that the zine’s Lightning node “was just swept,” though he noted there weren’t significant funds at stake. At least one other operator described closed channels and drained balances in replies to BTCPay’s warning. Neither Herbert nor hodlonaut disclosed exact amounts, and no aggregate tally of affected nodes or total bitcoin lost has been published.

Discovery and Nature of the Vulnerability

This flaw wasn’t caught by automated scanning — it surfaced only after someone got robbed. That detail matters because it exposes a gap between how bitcoin’s security tooling is supposed to work and how this particular bug actually got found.

Developer-Led Discovery vs AI Audits

Dorier credited Craig Raw, the developer behind Sparrow Wallet, with piecing together what was happening after his own funds were affected. “We got extremely lucky that a dev was impacted who could analyze the logs to understand what was going on,” Dorier wrote. “Somehow, this wasn’t found AI scans, but by him losing money.” The admission is notable given that the Bitcoin Red Team — a volunteer group BTCPay thanked for the disclosure — had spent the prior week running AI-assisted audits across bitcoin’s open-source stack. Dorier confirmed the group’s scans missed this specific bug. “The AI report we got from red team didn’t include this one,” he said. “But this bug was really sneaky, I am not surprised a simple scan didn’t find it, or thought it was low risk.”

Clarification on Bug Differences

BTCPay has not detailed which flaw attackers exploited, but Dorier was explicit that it isn’t the two-factor authentication bypass already listed in the project’s changelog. After a user posted an AI-generated explanation pinning the attack on that disclosed bug, Dorier corrected the record: “This bug was found by the Red team, this isn’t the critical bug in question.” The disclosed 2FA bypass affected Greenfield, BTCPay’s API, and was fixed on Aug. 4 — it allowed accounts protected by an authenticator app to be reached with just an email and password, though the browser login screen enforced 2FA correctly throughout. A full technical writeup on the actively exploited vulnerability is still pending. Core contributor Uncle Rockstar said the team is “working with Bitcoin Red Team to fully process the details of vulnerability and will follow up with detail technical post shortly.”

Operational Challenges and Remediation Steps

Patching the software is only half the job — and that split responsibility is where this incident reveals a structural weakness in how self-hosted bitcoin infrastructure gets secured.

Self-Hosted Software Patch Responsibility

Because BTCPay is self-hosted, there’s no central operator who can push a fix across every deployment at once. Every merchant, exchange and wallet running the software has to apply the update on its own machine — and in this case, the thefts were already underway before most users even saw the warning. This is a defining trade-off of self-hosted infrastructure: it removes a single point of failure for censorship or shutdown, but it also means a critical patch only protects the operators who act fast enough to install it.

Credential Refresh and Continued Security Risks

Updating the software doesn’t automatically close the door behind an attacker who already got in. BTCPay ha invitato gli utenti a eseguire un aggiornamento completo dei macaroons e del file macaroons.db — i file di credenziali che permettono l’accesso a un nodo Lightning LND — nonché a rinnovare le stringhe di autenticazione per altri backend Lightning. Chiunque avesse generato un portafoglio hot on-chain all’interno di BTCPay was told to move those funds and recreate the wallet from scratch. Kaloudis, a representative of the LND-based ZEUS wallet, put the risk plainly: “Don’t assume you’re safe after upgrading.” Stolen macaroons survive a software update, meaning an attacker who copied credentials before the patch retains node access until those files are destroyed and reissued — which lines up with what victims described: channels force-closed and balances swept, rather than the server itself being breached a second time.

Context of Recent Bitcoin Infrastructure Security Failures

This alert didn’t land in isolation. It arrived nine days into what’s shaping up as one of the roughest stretches for bitcoin infrastructure security in recent memory, and that timing raises a bigger question about whether the tooling built to catch these bugs is keeping pace with the software shipping around it.

Parallel Incidents in Bitcoin Hardware and Services

A 2021 Coldcard firmware bug that routed seed generation through a weak software randomizer has drained roughly $114 million in BTC since July 30, hitting more than 5,200 addresses, with some victims reporting the loss of life savings. Then on Aug. 3, the swap bridge Boltz halted its service indefinitely, saying attackers “now iterate faster than a team our size can find and patch.” The BTCPay Server vulnerability is the third significant security failure to hit bitcoin-adjacent infrastructure in under two weeks.

Bitcoin Red Team Audit Limitations

The Bitcoin Red Team itself formed in direct response to the Coldcard incident, and its early output has been substantial: Calle, who helps run the group, said 16 researchers filed 4,962 findings across 390 projects in just 27.5 hours, including 85 critical and 635 high-severity issues. Yet the group’s own AI-assisted scans missed the exact bug now being exploited against BTCPay users — a gap Dorier acknowledged directly. That miss underscores a broader challenge for the industry: automated security tooling can surface volume, but sneaky, logic-level bugs may still require a human, sometimes one who’s already lost money, to catch what a scan overlooks.

Bitcoin itself showed no reaction to any of this. The asset traded near $64,800 on Friday afternoon, up 0.7% over 24 hours and 2.6% on the week, according to CoinGecko — a reminder that infrastructure-level security failures in the bitcoin ecosystem don’t necessarily move the price of the asset they’re built around, even when the losses are real and unresolved.

FAQ

What was the main issue with BTCPay Server on August 7, 2026?

A critical vulnerability was actively exploited, allowing attackers to drain users’ Lightning nodes, which led BTCPay to issue an urgent patch and tell operators to update immediately or shut down their servers.

Who were some of the specific victims affected by the BTCPay Server vulnerability?

Notable victims included hardware wallet maker Foundation, whose Passport-linked payment node was drained overnight, and the bitcoin zine Citadel21, whose Lightning node was swept with its channels force-closed.

Is the exploited vulnerability the same as the two-factor authentication bypass disclosed earlier?

No. BTCPay founder Nicolas Dorier clarified that the actively exploited bug is different from and unrelated to the two-factor authentication bypass already disclosed in the project’s changelog and fixed on Aug. 4.

What should BTCPay Server users do after applying the patch?

Users must refresh macaroons and credential files, since stolen credentials can survive a software update and continue to grant attackers unauthorized access to Lightning nodes even after patching.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.