Attackers emptied Lightning nodes belonging to BTCPay Server users on Friday, including one run by hardware wallet maker Foundation, after the self-hosted bitcoin payment processor warned that a critical vulnerability was being actively exploited and told merchants to update to version 2.4.2 or shut their servers down.
Because BTCPay is self-hosted, there is no operator who can patch on behalf of its users. Every merchant, exchange and wallet running the software has to apply the fix on its own machine, and the thefts were already underway before the warning went out. The software sits behind bitcoin checkout for Namecheap, which ran $73 million in BTC revenue across 1.1 million transactions through BTCPay between May 2020 and October 2024, along with hundreds of smaller merchants and several wallet backends.
"There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds," the project wrote at 11:51 a.m. ET. "If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update." The post passed 550,000 views within five hours.
Founder Nicolas Dorier published release 2.4.2 the same morning with a one-line warning at the top: "This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can." The notes also tell integrators to upgrade NBXplorer, BTCPay's wallet-tracking backend, to version 2.6.10.
Zach Herbert, chief executive of Foundation, the company behind the Passport hardware wallet, said his node was gone before he read the alert. "How many BTCPay lightning nodes were swept? Our Foundation node was drained overnight by attackers," he wrote at 2:01 p.m. ET. He later narrowed the damage: "This was just our BTCPay server that we use for payment processing, the hot wallet was untouched – only the lightning node was drained. All channels were closed and funds were swept."
hodlonaut, the pseudonymous bitcoin commentator behind the zine Citadel21, reported the same pattern. "This is an ongoing attack on BTCPayserver users. Citadel21's lightning node was just swept," he wrote. "Fortunately there were not much funds there." At least one other operator described closed channels and drained funds in the replies to BTCPay's warning. Neither Herbert nor hodlonaut disclosed amounts, and no one has published a tally of how many nodes were hit or how much bitcoin moved.
