BTCPay Server LND Credential Leak Leads to Fund Theft

Severe vulnerabilities in BTCPay Server LND nodes caused credential leaks and fund theft. Public remote connections are temporarily restricted while security patches are deployed.

Woofun AI reports that BTCPay Server has suspended public remote connections for Lightning Network Daemon (LND) nodes following a security breach. Attackers exploited severe vulnerabilities to steal credentials and transfer funds, impacting providers such as Foundation and Citadel21. While external wallet connectivity via domain or Tor addresses is blocked, Lightning Network transactions continue to operate. The service provider confirmed that Version 2.4.2 will integrate LND 0.21.1 and automatically regenerate macaroon credentials to resolve the issue.