BTCPay Server warns of bots probing exposed Lightning nodes
In brief
- BTCPay Server warns of bots targeting exposed Lightning nodes for administrative access
- August vulnerability allowed attackers to extract LND macaroon files protecting merchant wallets
- Version 2.4.4 closes attack path via randomized wallet passwords and blocked unauthenticated methods
The attack vector
Automated systems are targeting servers where operators manually restored LND access, repeatedly calling a password-change endpoint. The method exploits a narrow opening: during the period after LND restarts while its wallet remains locked, the password-change function does not require a macaroon — the credential LND normally uses for authentication.
Older BTCPay LND wallets compounded the risk by using a shared default password. This combination of factors created an exposed attack surface for any server where an administrator had manually exposed the Lightning implementation to the internet.
Prior vulnerability and response
The renewed probing extends a difficult security stretch for BTCPay. A vulnerability affecting all versions before 2.4.2 was exploited on August 7, allowing unauthenticated attackers to obtain LND macaroon files. BTCPay subsequently disabled external access to LND in its standard Docker deployment, a protective measure that should have closed the standard public path.
Days later, the project and its supporters offered a bounty equal to 10% of recovered bitcoin, capped at 3 BTC, signaling the severity of potential losses.
The fix and remaining risks
Version 2.4.4, released September 7, addresses the conditions behind the latest attack path. New LND wallets now receive unique random passwords, while older installations using the shared credential are migrated with passwords rotated. BTCPay's standard reverse proxy also blocks unauthenticated wallet setup and unlock methods, closing the restart-time opening through its managed public network path.
The risk remains limited to manually exposed deployments. Administrators who created their own reverse proxy or otherwise exposed LND publicly can still bypass BTCPay's protections. BTCPay has urged administrators to install version 2.4.4 and remove manually exposed LND routes. A route-control change merged September 11 provides a supported option for remote access while keeping LND and Core Lightning interfaces disabled by default.
BTCPay has not reported a successful takeover through the bot activity observed so far.
