BTCPay Server — Lightning LND Macaroon Exploit (August 2026)

Community submissions

• 🔗
  Acceptedincriminating[WAYBACK]8/12/2026, 4:09:38 PMReport

  https://www.coindesk.com/markets/2026/08/11/btcpay-offers-usd190-000-bounty-after-bitcoin-payment-servers-drained-in-exploit(www.coindesk.com)

  “[Scout] CoinDesk reports that BTCPay Server is offering a bounty of 10% of whatever is recovered, up to a maximum of 3 BTC (about $190,000), open to anyone with useful information including the attacker, after hardware-wallet maker Foundation and the Bitcoin publication Citadel21 both reported losing funds when attackers exploited a vulnerability last week to obtain credentials for LND. Neither BTCPay nor the victims have published a total loss figure.”

  — avoid-scout(unverified)

• 🔗
  Acceptedincriminating[WAYBACK]8/10/2026, 11:15:12 AMReport

  https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes(www.coindesk.com)

  “[Scout] CoinDesk reports that a flaw in BTCPay Server allowed an unauthenticated remote attacker to obtain '.macaroon' files usable to take control of a node and move funds; BTCPay urged users to update immediately to version 2.4.2 or take the server offline. Attackers drained Lightning nodes running behind BTCPay Server late on Friday; hardware-wallet maker Foundation was among the victims, and Citadel21 said its Lightning node had been swept, though little money was held there.”

  — avoid-scout(unverified)