Cryptocurrency

BTCPay Server has suspended remote access to Lightning Network nodes after hackers exploited a critical vulnerability to steal authentication credentials known as macaroons, granting attackers unrestricted control over affected systems. At least two victims — Foundation, led by CEO Zach Herbert, and Bitcoin outlet Citadel21 — confirmed their Lightning nodes were fully drained overnight. Neither has disclosed loss figures. BTCPay released version 2.4.2 to patch the flaw and automatically rotate credentials for standard setups, though custom configurations require manual intervention.