BTCPay Server Issues Urgent Warning Over Lightning Node Probing

BTCPay Server has alerted its community to a new wave of automated bot attacks designed to seize control of exposed Lightning Network (LND) nodes. This warning comes in the wake of a separate, devastating exploit from August that allowed attackers to drain merchant wallets, signaling a persistent threat to users who maintain manual or outdated configurations.

Exploiting the Restart Window

The latest security threat involves bots that repeatedly probe LND password-change endpoints during a specific vulnerability window. When an LND node restarts, there is a brief period while the wallet remains locked where administrative credentials—known as macaroons—are not required to access certain functions. Attackers aim to exploit this gap by submitting a new password before the system’s internal unlocker can act, a risk that was particularly high for older installations using shared default passwords.

Strengthening Defenses and Custom Risks

In response to these threats, BTCPay has released version 2.4.4, which introduces unique random passwords and forced rotation for older, vulnerable credentials. The update also implements a hardened reverse proxy that blocks unauthenticated access to setup and unlock methods by default. However, the project warns that administrators who manually exposed their LND routes or use custom reverse proxies remain at risk, as these independent configurations can bypass the new built-in protections. Operators are urged to upgrade immediately and migrate remote connections behind BTCPay’s managed controls to prevent further unauthorized takeovers.