BTCPay Server donates 0.42 BTC for responsible vulnerability disclosure and offers bounty for stolen fund recovery

BTCPay Server, the open-source Bitcoin payment processor that lets merchants skip the middlemen, just disclosed a critical vulnerability that allowed attackers to remotely hijack Lightning Network nodes and drain funds. The project has patched the issue in version 2.4.2, donated 0.42 BTC to the security researchers who flagged the flaw, and announced a bounty program aimed at recovering stolen funds. The vulnerability affected BTCPay Server deployments running LND Lightning nodes. And by the time the fix arrived, attackers had already started helping themselves. What went wrong The flaw centered on .macaroon credential files, which are essentially the authentication keys that control access to an LND Lightning node. In affected versions of BTCPay Server, these credential files were exposed to unauthenticated remote access. No login required. No special privileges needed. An attacker who knew where to look could grab the macaroon files and take full control of a victim’s Lightning node, opening the door to siphon funds from active payment channels. On-chain Bitcoin wallets were not affected. The vulnerability was isolated to the Lightning integration layer. Confirmed reports indicat...