Citadel21 is an organization tracked by ThreatCluster, appearing in 1 threat cluster built from 2 intelligence report mentions.
Citadel21 is a organization tracked across 1 threat cluster and 2 intelligence report mentions on ThreatCluster. First observed August 8, 2026; most recent activity August 8, 2026.
On August 7, 2026, a critical vulnerability in BTCPay Server was exploited, allowing attackers to drain funds from Lightning nodes. The flaw involved unauthorized access to Lightning node credentials, specifically…
Citadel21 is an organization tracked by ThreatCluster, appearing in 1 threat cluster built from 2 intelligence report mentions.
The most recent intelligence report mentioning Citadel21 on ThreatCluster is dated August 8, 2026.
Across ThreatCluster reporting, Citadel21 most frequently co-occurs with Data Breach, BTCPay, BTCPay Server, Foundation, CWE-287 - Improper Authentication, among 9 tracked related entities.
The most significant recent cluster is “Critical BTCPay Server Vulnerability Exploited, Draining Lightning Node Funds” (2 articles · Updated August 8, 2026). Citadel21 appears across 1 threat cluster in total, listed above with sources.
Citadel21 appears in 2 intelligence report mentions across 1 deduplicated threat cluster, aggregated from 17,000+ monitored sources.