BTCPay Server 2.4.4: Why the Update Alone Is Not Enough

Straight to the point, because it is the question that brought you here: the update to BTCPay Server 2.4.4 closes the public default route to your Lightning node. It does not remove a route you built yourself. Anyone who at some point exposed their server's LND interface through their own reverse proxy therefore has two jobs: update, and take that access away again. The project behind BTCPay Server says exactly that in its announcement of September 8, 2026.

The trigger is not a fresh theft. The project is seeing automated programs probing servers on which this access has been reopened by hand. No successful takeover by this route has been reported so far, and the project draws no link to the people behind the August incident. That is the good news in this: there is a window in which the problem can be resolved without damage.

For you as a holder or a merchant, more hangs on this than a server detail. A self-hosted payment server is the point where incoming Bitcoin payments, the keys to your Lightning node and your working balance all come together. Lose access there and you lose real money, not configuration. Which puts a second question on the same desk: how much balance really needs to sit permanently on a node that hangs on the internet, and what belongs in cold storage? If you have not drawn that line yet, our hardware wallet comparison is a better starting point than any further proxy rule.