Uk.Finance.Yahoo Critical BTCPay Server Vulnerability Leads to Theft of Lightning Node Funds
Article Content
- •A critical vulnerability in BTCPay Server allowed unauthorized access to Lightning nodes.
- •Attackers exploited macaroon credential files, draining funds from affected nodes.
- •Operators must update to version 2.4.2 and regenerate credentials to secure their systems.
A critical vulnerability in BTCPay Server was exploited late on August 7, 2026, allowing attackers to drain funds from Lightning Network nodes by stealing macaroon credential files. The flaw, which affected versions prior to 2.4.2, enabled unauthorized access to nodes without needing to break Bitcoin's cryptography. Hardware wallet maker Foundation and Bitcoin publication Citadel21 confirmed their nodes were compromised. BTCPay issued an emergency patch (v2.4.2) and advised operators to update immediately or take their servers offline. The exact amount of Bitcoin stolen and the total number of affected users remain undisclosed. The vulnerability persisted even after software updates, requiring operators to manually regenerate credentials to fully secure their nodes. This incident highlights ongoing security risks within cryptocurrency infrastructure, particularly for self-hosted solutions.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (18)
Following this threat?
Track BTCPay in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects… 
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…