BTCPay warns bots probe exposed Lightning nodes for admin control

September 13, 2026 at 11:30 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

BTCPay Server warned that automated bots are probing manually exposed Lightning nodes for a restart-time weakness that could grant administrative control. The activity follows an August vulnerability that attackers exploited to steal credentials and drain merchant wallets. Version 2.4.4 addresses the path, but custom reverse proxies remain exposed until operators remove public LND routes.

Key Facts

BTCPay Server says bots are probing manually exposed Lightning nodes for a restart-time weakness that could enable administrative control.
Version 2.4.4, released Sept. 7, addresses the conditions behind the latest attack path.
On Aug. 7, BTCPay acknowledged attackers had exploited a vulnerability affecting all versions before 2.4.2 to obtain LND macaroon files and move funds.
BTCPay offered a bounty equal to 10% of recovered bitcoin, capped at 3 BTC, then worth about $190,000.

The Restart-Time Weakness

The latest mechanism differs from the vulnerability exploited in August but could lead to a similar outcome: an attacker obtaining credentials that can control an LND node. BTCPay said the opening appears during a short interval after LND restarts, while its wallet remains locked. During that period, the targeted password-change method does not require a macaroon, the credential LND normally uses to authorize administrative actions. Older BTCPay LND wallets compounded the risk by using a shared default password. An attacker who could reach the interface before BTCPay’s internal unlocker could potentially submit that password first, replace it, and request an administrator macaroon that gives control over the node.

August Theft and Response

The renewed probing extends a difficult security stretch for BTCPay, which acknowledged on Aug. 7 that attackers had exploited a vulnerability affecting all versions before 2.4.2. That flaw allowed unauthenticated attackers to obtain LND macaroon files and use them to move funds. BTCPay’s standard on-chain wallets were unaffected. Days later, the project and its supporters offered a bounty equal to 10% of recovered bitcoin, capped at 3 BTC, then worth about $190,000. BTCPay also enlisted exchanges, blockchain analytics firms, and law enforcement in efforts to trace the stolen funds.

Version 2.4.4 Mitigations

Version 2.4.4, released Sept. 7, now addresses the conditions behind the latest attack path. New LND wallets receive unique random passwords, while older installations using the shared credential are migrated and have their passwords rotated. Custom reverse proxies remain exposed until operators remove public LND routes and audit access. BTCPay has not reported a successful takeover through the newly observed activity or linked the bots to the attackers behind the August thefts.