Lightning wallet security: five warnings since August

A Lightning wallet is only as secure as the server its keys sit on. If you hold bitcoin on Lightning only in a widely used mobile app, the security warnings of the past three months did not affect you directly. If, on the other hand, you run your own Lightning node, a BTCPay Server, Alby Hub or LNbits, you have received five warnings since early August, and in at least two cases money was actually drained. The lesson from all five is the same: an update closes the hole, but only new credentials and a small balance on the server make Lightning safe again.

Lightning is to bitcoin what a debit card is to a savings account: a fast payment route for small amounts. That is precisely why keys sit on machines that are permanently connected to the internet. This article brings the individual cases together, explains the common pattern and shows how much balance should actually be kept on a Lightning node. How the network works technically is explained in our introductory guide to the Bitcoin Lightning Network.

Lightning security flaws since August: five warnings in three months

The series begins on August 7, 2026. BTCPay Server, widely used free software that lets merchants accept bitcoin payments themselves, released version 2.4.2 as an emergency update. According to the project's security advisory, an attacker could grab the permission files of a connected LND node without logging in. The project confirms that attackers exploited the flaw and stole funds.