BTCPay Server Warns of Bot Probing Exposed Lightning Nodes
Bitcoin payment processor BTCPay Server has warned that automated bots are actively probing exposed Lightning Network nodes for a potential path to administrative control. The activity follows a separate critical vulnerability exploited in August that allowed attackers to obtain credentials protecting LND nodes and drain merchant wallets.
New Attack Vector Targets LND Restart Window
The latest mechanism differs from the August vulnerability but could lead to a similar outcome: an attacker obtaining credentials that control an LND node. BTCPay said the opening appears during a short interval after LND restarts, while its wallet remains locked. During that period, the targeted password-change method does not require a macaroon, the credential LND normally uses to authorize administrative actions.
Older BTCPay LND wallets compounded the risk by using a shared default password. An attacker who could reach the interface before BTCPay’s internal unlocker could potentially submit that password first, replace it, and request an administrator macaroon that gives control over the node. BTCPay has not reported a successful takeover through the newly observed activity or linked the bots to the attackers behind the August thefts.
August Vulnerability and Response
The renewed probing extends a difficult security stretch for BTCPay. On Aug. 7, the project acknowledged that attackers had exploited a vulnerability affecting all versions before 2.4.2. That flaw allowed unauthenticated attackers to obtain LND macaroon files and use them to move funds. BTCPay’s standard on-chain wallets were unaffected.
Days later, the project and its supporters offered a bounty equal to 10% of recovered bitcoin, capped at 3 BTC, then worth about $190,000. BTCPay also enlisted exchanges, blockchain analytics firms, and law enforcement in efforts to trace the stolen funds.
Version 2.4.4 Mitigations
Version 2.4.4, released Sept. 7, now addresses the conditions behind the latest attack path. New LND wallets receive unique random passwords, while older installations using the shared credential are migrated and have their passwords rotated. BTCPay’s standard reverse proxy also blocks unauthenticated wallet setup and unlock methods, closing the restart-time opening through its managed public network path.
Custom Deployments Remain at Risk
Those controls cannot secure infrastructure operators configure independently. Administrators who created their own reverse proxy or otherwise exposed LND publicly can still bypass BTCPay’s protections. BTCPay has urged administrators to install version 2.4.4 and remove manually exposed LND routes. A route-control change merged Sept. 11 provides a supported option for remote access while keeping LND and Core Lightning interfaces disabled by default.
That leaves custom deployments as the immediate concern. Operators using them must audit their proxy rules and migrate remote connections behind BTCPay’s managed controls while automated systems continue searching for reachable nodes.
