BTCPay Server 2.4.1 and Earlier Permit Remote LND Macaroon Extraction for Lightning Hot Wallet Drains

The flaw, patched in version 2.4.2 released 7 August 2026, allows unauthenticated remote access to LND credential files. Attackers targeted only .macaroon extensions on self-hosted instances, moving funds via the Lightning Network. BTCPay Server identified two recipient addresses and advised full server replacement even without observed theft, treating all secrets as compromised. Reports indicate the campaign predates public disclosure and continued against unpatched hosts.

Evidence consists of wallet addresses bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 and ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee plus user reports surfacing in early November. The vendor stated no credible drains on 2.4.7 or later, which addressed issues flagged by Anthropic's scanner. Hosting providers auto-shut down older instances. This follows an August 2026 disclosure of the same class of issue.

The pattern matches supply-chain and payment-processor targeting seen in the $49 million Mercado Bitcoin breach and Trezor hardware claims. BTCPay instances often process retail payments including supermarkets; repeated hot-wallet exposure creates direct availability risks for food distribution chains. Official statements emphasize user error in wallet placement while procurement records show rising adoption of self-hosted Lightning nodes by merchants without corresponding isolation mandates.

Next steps include mandatory migration to air-gapped keys for any production node and independent audits of LND integrations. Regulators tracking critical infrastructure payments should require CVE-linked patch timelines rather than vendor self-reporting.