Attackers drained bitcoin from merchant Lightning nodes on the night of August 7 after exploiting a flaw in BTCPay Server, the open-source software businesses run to accept bitcoin payments without a payment processor. The Lightning Network is a separate payment network built on top of bitcoin that settles small transfers instantly and cheaply before recording the net result on the main chain. BTCPay confirmed in a security advisory that an unauthenticated remote attacker could pull .macaroon credential files from affected servers, then use them to seize a node, force its channels closed and sweep the balance. Hardware wallet maker Foundation and the bitcoin publication Citadel21 both reported their nodes were emptied. BTCPay has not said how many operators were hit or how much bitcoin was taken.
Key takeaways
- BTCPay Server released version 2.4.2 on August 7 to patch a flaw that let unauthenticated attackers read LND
.macarooncredential files and take control of Lightning nodes. - Every BTCPay version before 2.4.2 is affected, including the 2.4.2 release candidates. BTCPay’s own on-chain wallets, including hot wallets, are not.
- Patching does not undo the breach on its own. Credentials copied before the update stay valid until an operator rotates them.
- The bug was reported through the Bitcoin Red Team, an AI-assisted audit sprint that filed 4,962 findings across 390 repositories on August 4 and 5.
Published: August 10, 2026, 09:30 UTC. Bitcoin traded at $65,173 at time of writing, up 0.6% over 24 hours.
What the flaw exposed
A macaroon is a credential file that grants software permission to operate a Lightning node, roughly an API key that can spend money. BTCPay stores these files so it can talk to LND, the most widely deployed Lightning node software, and settle merchant invoices.
The vulnerability let a remote attacker request those files without authenticating first. Anyone holding a valid admin macaroon can open channels, close them and move the resulting on-chain funds. In its August 7 advisory, BTCPay said the attacks it reviewed targeted only files carrying the .macaroon extension, and confirmed funds were stolen.
The blast radius is narrower than the first warnings suggested. BTCPay initially told users to empty their on-chain wallets, then narrowed that guidance: standard BTCPay on-chain wallets, hot wallets included, were never exposed. Bitcoin sitting in LND’s own on-chain wallet stays at risk, because that balance belongs to the compromised node.
Foundation chief executive Zach Herbert said attackers drained the company’s Lightning node overnight and closed its channels, while its on-chain hot wallet went untouched. Citadel21, run by the pseudonymous commentator hodlonaut, reported the same pattern on a node holding little.
Why patching alone does not close the hole
Operators who install 2.4.2 and stop there may still be exposed. A stolen macaroon is a bearer credential, so it keeps working until it is invalidated, regardless of which BTCPay version is running.
BTCPay handled part of this automatically. The 2.4.2 update also upgrades LND to version 0.21.1 and regenerates the node’s macaroons, voiding anything an attacker copied through BTCPay itself. The gap sits with operators who expose their LND node through a separate route, such as a self-managed reverse proxy, a Tor hidden service or a forwarded port. BTCPay cannot rotate credentials on paths it does not control, and told those users to rotate manually.
Version 2.4.2 also pulls public LND API access on Docker deployments while the incident is live, breaking external wallet connections through a BTCPay domain or onion address. Zeus users are among those affected. BTCPay plans to restore the option once it is safe.
The AI audit that found it first
The flaw did not surface through exploitation. It came from the Bitcoin Red Team, a volunteer group that spent 27.5 hours on August 4 and 5 pointing AI models at open-source bitcoin codebases. Sixteen contributors filed 4,962 findings across 390 repositories, including 85 rated critical and 635 rated high severity, on roughly $40,000 of compute funded by the nonprofit OpenSats. BTCPay credited Craig Raw with the disclosure and thanked Rob Hamilton, Calle and Evan Kaloudis for the analysis.
That sequence is the uncomfortable part. The bug was reported responsibly, and attackers were still exploiting live servers by the time the public warning went out. The group argues that publishing fast beats sitting on findings, because outsiders running similar tooling reach the same bugs anyway. This incident tests that reasoning both ways: disclosure worked, and the patch window was measured in days.
The sprint itself was a response to the Coldcard firmware flaw exploited on July 31, which drained 594.48 BTC, worth about $38.2 million, from roughly 500 hardware wallets.
What comes next
BTCPay is withholding technical details until more operators update, and has promised a postmortem. Two numbers will define the damage: nodes swept and total bitcoin lost. The project has released neither.
For merchants, the exposure is smaller than a wallet breach and more disruptive operationally. Lightning nodes hold working capital, not treasury reserves, so individual losses are likely modest. Force-closed channels are the real cost, because rebuilding liquidity takes on-chain fees and time during which payments fail.
The open question is whether self-hosted payment infrastructure can absorb the volume of findings AI auditing now produces. Businesses running their own bitcoin stack trade processor fees for patch responsibility, and that cycle just got much faster. A custodian carried the burden in the Triple-A wallet hack. Here it falls on operators who often run a server as a side concern.
Frequently asked questions
Is my BTCPay Server affected if I do not use Lightning?
No. The credential risk applies specifically to deployments running LND. Other Lightning implementations and setups without Lightning are not exposed to this flaw. BTCPay still recommends updating to 2.4.2, and confirmed that standard on-chain wallets, including hot wallets, were never at risk.
Does updating to 2.4.2 make my node safe?
Mostly. The update patches the flaw, upgrades LND to 0.21.1 and regenerates macaroons automatically. If you expose LND through your own reverse proxy, Tor service or forwarded port, rotate those credentials manually. BTCPay cannot close access routes you manage yourself.
How much bitcoin was stolen in the BTCPay exploit?
BTCPay has not published a figure. Two victims have identified themselves publicly: hardware wallet maker Foundation, whose node was drained overnight, and Citadel21, which said its node held little. A full postmortem with incident details is expected in the coming days.
