A vulnerability in BTCPay Server, an open-source Bitcoin payment processor, has been exploited to drain funds from merchant Lightning Network nodes prompting an urgent security warning from developers.
BTCPay urged users running the LND Lightning implementation to update their servers to version 2.4.2 or take them offline after attackers gained access to credentials that could control connected Lightning wallets and move funds.
-
Check for payments you did not make.
-
Look for unexpected channel closures or unfamiliar peers.
-
Compare your on-chain and channel balances with your own records.
-
Investigate any activity you do not recognize.
MILESTONE | The Bitcoin Lightning Network Surpasses $1 Billion in Monthly Transaction Volume in November 2025
The incident adds to a string of recent security problems affecting Bitcoin infrastructure highlighting risks beyond the Bitcoin blockchain itself as merchants increasingly rely on third-party software and Lightning nodes to process payments.
