Late Friday night, attackers started quietly draining Lightning wallets on BTCPay Server, the open-source bitcoin payment processor thousands of merchants rely on. Nobody caught it right away — the intruders slipped in through a flaw the team only patched hours later.
The problem sat in something called macaroon files: digital passes that let software control a Lightning node running LND, the most widely used node software around. A bug in BTCPay Server let anyone request one of these passes remotely, no password required. Whoever holds that file effectively owns the node — they can drain it, close channels, move funds exactly like the real operator.
At least two well-known names in the bitcoin world got hit. Hardware-wallet maker Foundation had its Lightning node swept clean, though its cold storage stayed untouched. Bitcoin zine Citadel21 lost its node's contents too, though it wasn't holding much. BTCPay hasn't said how much bitcoin disappeared or how many users were affected — a full writeup is supposedly coming in the next few days.
The fix landed as version 2.4.2, and BTCPay is telling every LND operator behind its software to update now or pull their server offline. There's a catch most people will miss: patching alone won't help. Stolen macaroon files keep working even after the software update, so an attacker who already grabbed one can walk right back in unless the credentials themselves get rotated.
Bitcoin Red Team — a volunteer group that includes Craig Raw, Rob Hamilton, Calle and Evan Kaloudis — reported the bug. The same crew made headlines days earlier for using AI to hunt down thousands of minor bugs in Bitcoin's own codebase. This time the stakes weren't theoretical: real coins left real wallets, and bitcoin's payment layer got its second reminder this month that its plumbing is expanding faster than anyone can harden it.
