BTCPay Server Patches Critical LND Credential Bug After Lightning Wallet Drain

BTCPay Server has released version 2.4.2 to patch a critical vulnerability that allowed unauthenticated remote access to LND credential files, after attackers used the issue to drain merchant Lightning wallets. The project’s release notes describe a serious bug involving .macaroon files, which are used by LND to manage access permissions. In plain English, those files can act like keys. If an attacker gets hold of the wrong one, they may be able to interact with a Lightning node in ways the operator never intended. BTCPay supporters have also backed a recovery bounty equal to 10% of returned funds, capped at 3 BTC. At current prices, that puts the maximum reward around $190,000. This is not a Bitcoin protocol exploit. It is not a native on-chain wallet failure. It is a server-side security issue affecting certain BTCPay Server setups using LND. That distinction matters. For more details, visit the official Github platform. TL;DR BTCPay Server v2.4.2 patches a critical LND credential exposure issue. Attackers reportedly drained merchant Lightning wallets through vulnerable setups. A recovery bounty offers 10% of returned funds, capped at 3 BTC. Why The LND Credential Issue Matters B...