BTCPay Fixes Critical LND Credential Bug After Lightning Wallet Drain
BTCPay Server Patches Critical LND Credential Bug After Lightning Wallet Drain
BTCPay Server has patched a critical bug that could expose Lightning Network Daemon (LND) credentials, following a reported incident in which a Lightning wallet was drained.
According to the project, the issue involved how BTCPay Server handled or stored connection details used to communicate with an LND node. Those credentials can include sensitive information that effectively grants access to a Lightning wallet, enabling an attacker to move funds if obtained.
Why it matters: BTCPay Server is widely used by merchants and self-hosters to accept Bitcoin payments without relying on third-party processors. Many deployments connect BTCPay Server to an LND node to support Lightning payments. When that integration is misconfigured or credentials are leaked through software flaws, the Lightning funds controlled by that node can be at risk.
The patch addresses the credential exposure risk and is intended to prevent similar incidents where unauthorized parties could retrieve LND access data and use it to spend from a Lightning wallet.
In the broader context, the incident highlights a recurring security challenge in self-hosted crypto infrastructure: while users retain control of their payment stack, they also inherit operational responsibility for protecting keys, API tokens, and service credentials that can be as sensitive as private keys in practice.
- BTCPay Server is an open-source payment processor for Bitcoin that enables direct, non-custodial payments.
- LND is a popular Lightning implementation used to manage Lightning channels and payments.
- LND credentials can grant administrative or spending-level access, making secure handling essential.
BTCPay Server’s fix closes a high-impact avenue for credential exposure, underscoring the importance of keeping payment infrastructure up to date, especially when it interfaces with wallets and Lightning nodes.
