Bitcoin Lightning Nodes Hit as BTCPay Signals Emergency 2.4.2 Fix

The self-hosted crypto payment processor BTCPay Server has alerted users to a critical vulnerability being actively exploited by threat actors, which can lead to the loss of funds. The Bitcoin Red Team, a voluntary security group, discovered and disclosed the vulnerability.

The BTCPay Server team strongly recommended that all users update to version 2.4.2 immediately via the Admin Dashboard. If unable to update, they advised turning off the server to prevent unauthorized access. Additionally, users should refresh macaroons and macaroons.db, refresh auth strings, and move any funds stored in hot wallets generated using BTCPay.

While the full extent of the exploit is not yet known, at least two instances of fund drainage have been reported. Zack Herbert, co-founder and CEO of Foundation (makers of the Passport Prime device), stated that their node was drained overnight. Hodlonaut also reported that the Citadel 21 lightning node had its funds stolen, although the amount was limited due to precautions related to the potential activation of BIP-110.

Hodlonaut emphasized that the attack appeared targeted, striking at the very heart of the Bitcoin social layer. He noted that the recent Coldcard exploit, which resulted in the theft of over 1,700 BTC according to Galaxy Research, and the BTCPay attack seem to be part of a coordinated effort against core Bitcoin infrastructure tools used by enthusiasts and professionals.

The Bitcoin Red Team, which has found thousands of vulnerabilities across hundreds of open-source projects, including the Coldcard flaw, continues to play a key role in identifying security issues. Users are urged to act promptly to secure their servers and funds.

Source: https://news.bitcoin.com/security/bitcoin-lightning-nodes-hit-as-btcpay-signals-emergency-2-4-2-fix/