Home›Crypto›Market Structure›BTCPay Server users report Lightning nodes drained ami…

BTCPay Server users report Lightning nodes drained amid active exploit

BTCPay said merchants needed to update to version 2.4.2 or shut servers down, but some nodes were already drained before the warning went out.

Reported · Written up by our desk · Market Structure

Attackers drained Lightning nodes tied to BTCPay Server users on Friday, after BTCPay warned that a critical vulnerability was being actively exploited and told merchants to update to version 2.4.2 or shut their servers down, The Defiant reported.

The self-hosted nature of BTCPay means there is no single operator who can patch for everyone, so each merchant, exchange, and wallet running the software needed to apply the fix on its own machine. BTCPay noted in a post at 11:51 a.m. ET that the flaw could result in loss of funds, adding that servers should be turned off if the update could not be completed immediately.

Hardware wallet maker Foundation said its own Lightning node was swept overnight, with its chief executive saying the Passport hardware wallet hot wallet was untouched and that only Lightning node channels were closed and funds were swept. A separate bitcoin commentator cited similar outcomes, and at least one other operator described closed channels and drained funds, though no tally of how many nodes were hit or how much bitcoin moved has been published.

Namecheap is one of the merchants using BTCPay for bitcoin checkout, and The Defiant reported it generated $73 million in BTC revenue across 1.1 million transactions through BTCPay between May 2020 and October 2024. BTCPay also released version 2.4.2 the same morning and directed integrators to upgrade NBXplorer to version 2.6.10, according to the outlet.

Latest closeBitcoin $64,906.59 ▲1.0%

More like this

Sources