Bitcoin’s Lightning Network is supposed to make small, fast payments practical by moving them off the base chain. That convenience depends on trusting the software that sits between a merchant’s payment page and their node. This week, that trust took a hit. CoinDesk and Decrypt both reported that BTCPay Server, one of the most widely used open-source Bitcoin payment processors, is under active attack, with attackers stealing credentials that can control connected Lightning wallets and move funds out of them.
BTCPay’s own advisory, as described in both outlets, is blunt: operators running LND should update immediately, and anyone who cannot patch right away should take the server offline until they do.
What is actually confirmed
Two points are established by current reporting:
- The exposure affects BTCPay Server deployments connected to LND, one of the most common Lightning Network node implementations.
- Attackers obtained credentials that can be used to control the connected Lightning wallet and move funds, and BTCPay has told affected users to replace any credentials that may have been exposed.
Neither report attaches a confirmed total loss figure to this incident as of publication, and this article will not guess at one. That distinguishes it, so far, from the Coldcard hardware-wallet exploit disclosed earlier in the month, where loss estimates were reported directly by multiple outlets.
Why credential theft on a payment processor is dangerous
BTCPay Server is designed to sit between a merchant’s storefront and their own self-hosted Bitcoin and Lightning node. Merchants run it specifically to avoid handing custody of funds to a third-party payment company. That design only protects funds if the credentials connecting BTCPay to the node stay private.
A Lightning node’s operational credentials are not like a lost password on a web account. They can grant direct control over a hot wallet that is, by design, kept online and ready to send and receive payments instantly. Where an on-chain wallet’s cold-storage keys are meant to be offline and rarely touched, Lightning liquidity has to stay accessible to route payments — which is exactly what makes credential theft against this layer more immediately damaging than a typical account compromise.
How this differs from a base-layer Bitcoin exploit
It’s worth being precise about what this incident does and does not touch. Bitcoin’s underlying protocol and consensus rules are not implicated by this report. Lightning is a second layer built on top of Bitcoin, and BTCPay Server is third-party software that merchants choose to run to interface with it. A flaw or credential leak at that layer says nothing about the security of Bitcoin itself, on-chain cold storage, or Lightning implementations other than the one named in this advisory.
That distinction matters for anyone trying to gauge how worried to be. A merchant running BTCPay with LND has a direct, time-sensitive action to take. A holder with coins in cold storage and no BTCPay deployment is not described as exposed by this specific advisory.
What to do if you run BTCPay with LND
Based on the guidance reported by CoinDesk and Decrypt, operators should treat this as urgent rather than routine maintenance:
- Update BTCPay Server to the latest version immediately.
- Rotate any credentials that connect BTCPay to the node, on the assumption they may already be exposed.
- If immediate patching isn’t possible, take the server offline rather than leave a known-vulnerable instance connected to a funded Lightning wallet.
- Monitor node channel balances closely in the days after patching, since credential theft that occurred before the update was applied could still be exploited afterward if not fully rotated.
Bottom line
This is an infrastructure-layer incident, not a Bitcoin protocol failure: attackers targeted the credentials linking BTCPay Server to LND nodes, not Bitcoin’s cryptography. For merchants running that specific combination, the advisory is unambiguous — patch now, rotate credentials, or take the server offline. For everyone else, it’s a reminder that self-hosted payment infrastructure carries the same operational-security burden as self-custody: the protocol can be sound while the software wired into it still needs urgent maintenance.
Advertisement
Sources and review
This article was checked against the primary or authoritative sources below .
Frequently asked questions
According to CoinDesk and Decrypt, BTCPay Server told users running LND (a common Lightning Network node implementation) to update their software immediately or take servers offline. Attackers stole credentials that can be used to control connected Lightning wallets and move funds.
Based on current reporting, the exposure is specific to BTCPay deployments connected to an LND node. Merchants using only on-chain Bitcoin payments, or a different Lightning implementation, are not described as directly affected by this advisory.
BTCPay's guidance, as reported, is to update to the latest server version immediately and replace any credentials that may have been exposed. Operators unable to patch immediately are advised to take the affected server offline until it is updated.
No. The Coldcard incident involved weak randomness in offline hardware wallet firmware. This is a separate exploit targeting BTCPay Server's connection to Lightning nodes, a different piece of Bitcoin payment infrastructure with a different attack path.
Advertisement