BTCPay supporters promise to provide up to 3 BTC to help recover stolen…

How does BTCPay vulnerability expose Lightning Internet Wallet?

Backers of BTCPay Server have promised a recovery bounty after a critical vulnerability allowed attackers to obtain administrator credentials for connected Lightning network wallets and nodes. The reward will be equivalent to 10% of the successful recovery of stolen funds, with a cap of 3 BTC if all affected funds are returned. BTCPay has not disclosed the total amount stolen or the number of users affected, so the full financial impact of the incident is unclear.

BTCPay Server disclosed on Friday that the vulnerability is being actively exploited and urged users to immediately upgrade to version 2.4.2. All versions before 2.4.2 (including candidates for this version) have vulnerabilities. "The vulnerability allows an attacker to obtain LND administrator macaroon credentials from affected instances and use these credentials to access connected LND wallets," the project said. LND administrator macaroon is equivalent to the advanced authentication certificate of Lightning node. Once an attacker obtains the credential, it can gain extensive control over connected nodes and wallets, including the ability to transfer funds.

Multiple users, including Foundation and Citadel21, reported that their Lightning nodes had been stolen. Sparrow Wallet developer Craig Raw, who helped discover the vulnerability, also said he was affected.

Which BTCPay users are at risk?

The vulnerability particularly affects users running BTCPay Server with LND, one of the main implementations of the Bitcoin Lightning Network. Users who rely on other Lightning Network implementations or do not use Lightning Network at all do not face the same risk of credential theft. Despite this, BTCPay encourages all users to install the latest version. The official release of version 2.4.2 has fixed the vulnerability.

BTCPay said its on-chain Bitcoin wallets, including hot wallets managed through the platform, were not affected. This difference limits the scope of exploitation of the vulnerability because attackers can target connected LND wallets rather than BTCPay's broader on-chain wallet infrastructure. The incident illustrates the different security assumptions in Bitcoin payment infrastructure. Merchants may use BTCPay to process both on-chain and Lightning network payments, but weaknesses involving Lightning network authentication credentials may expose one part of the setting while another part is unaffected.

Investor Revelation

The BTCPay vulnerability suggests that the risks to Bitcoin infrastructure may go beyond private keys. Management credentials associated with Lightning network nodes can provide attackers with extensive wallet access, making software updates and credential security critical to payment operators.

How did BTCPay respond to this safety failure?

The BTCPay Server Foundation donated 0.21 BTC each to Craig Raw and the Bitcoin Red Team Fund to thank them for discovering and privately reporting the vulnerability. Bitcoin Red Team is a volunteer security research group whose members include Rob Hamilton, Calle and Evan Kaloudis. BTCPay said it is preparing a more detailed post-mortem analysis report, and the project is leveraging the help of multiple external organizations to strengthen the code scanning and review process.

Recovery bounty provides an additional incentive to recover stolen funds. According to this arrangement, recovery work can earn 10% of the amount recovered. If all is recovered, the total reward limit is 3 BTC. Because BTCPay is open source software, its code can be reviewed by both defenders and attackers. This transparency helps researchers spot vulnerabilities before vulnerabilities are exploited, but also gives attackers the opportunity to examine old code for security flaws that may go unnoticed.

Does artificial intelligence make cryptocurrency vulnerabilities easier to detect?

BTCPay said artificial intelligence may be changing the economics of software vulnerability discovery, making it faster and cheaper to review large codebases. "Artificial intelligence is changing the balance between attackers and defenders. As models continue to improve, the speed and cost of checking large codebases and discovering weaknesses are decreasing,"BTCPay said." Bitcoin projects are particularly vulnerable because they are high-value targets. The entire software industry will face the same reality."

The warning came after another major security incident involving Coldcard's hardware wallet, which has confirmed losses of at least $116 million. Coldcard developer Coinkite believes the attacker may have used artificial intelligence to review older versions of public firmware and discover vulnerabilities. Blockchain analytics company Chainalysis also estimates that in the first half of 2026,$36.7 million was stolen from unverified closed-source smart contracts through attacks involving decompilation of bytecode. These activities may also have relied on artificial intelligence to assist analysis. The same tool can also strengthen defensive security by helping developers review code earlier and identify weaknesses. However, for bitcoin and cryptocurrency projects that hold high-value assets, the immediate problem is that attackers can leverage these capabilities at the same time, putting more pressure on developers to shorten the time difference between vulnerability discovery and patch deployment.