BTCPay disables remote Lightning access after $280K theft

BTCPay Server has temporarily disabled remote access to Lightning Network nodes after attackers exploited a vulnerability to drain funds from several operators. The open-source payment processor announced the restriction on its GitHub page late Sunday, warning users to avoid exposing their Lightning nodes to the internet until a fix is implemented. The move follows reports of unauthorized withdrawals from multiple Lightning wallets, though the total amount stolen and the number of affected operators remain unclear.

The vulnerability stems from a flaw in how BTCPay Server handles Lightning Network connections, allowing attackers to bypass authentication and initiate withdrawals without approval. Lightning Network, a layer built on top of Bitcoin for fast and low-cost transactions, has grown in popularity among businesses and individuals using BTCPay for self-custodial payments. The issue highlights the risks of running Lightning nodes, which require constant uptime and careful security management. Earlier this year, similar attacks on Lightning Network daemons like LND and c-lightning prompted developers to issue urgent patches, underscoring the ongoing challenge of securing decentralized payment systems.

Security researchers at Foundation and Citadel21 confirmed the attacks, though they declined to provide specific details about the stolen amounts or affected users. BTCPay Server’s lead developer, Nicolas Dorier, stated that a patch is being developed but did not give a timeline for its release. In the meantime, the team advises users to either shut down their Lightning nodes or restrict access to trusted networks. The incident adds to a growing list of security breaches in the Lightning Network ecosystem, where small implementation flaws can lead to significant financial losses.

For businesses and individuals relying on Lightning Network for payments, the temporary shutdown of remote access could disrupt operations, especially for those who depend on instant transactions. The broader implication is a reminder of the trade-offs between convenience and security in decentralized finance. As Lightning Network adoption increases, so does the need for robust security practices and rapid response to vulnerabilities. The next few days will be critical as developers race to roll out a fix and users assess the impact on their operations.