BTCPay Server has urged users operating Lightning Network Daemon (LND) nodes to update immediately or take their servers offline, following a security incident in which attackers stole credentials capable of controlling Lightning wallets and moving funds.
Urgent guidance for LND users
The open-source Bitcoin payments platform warned that compromised credentials could give attackers the ability to manage Lightning nodes and initiate transactions. BTCPay recommended that affected operators prioritize updating their LND software without delay or temporarily shut down servers to mitigate risk.
Potential impact on Lightning funds
LND is a widely used implementation of the Bitcoin Lightning Network, a layer-2 protocol designed for faster and cheaper payments. BTCPay Server supports LND integrations for merchants and node operators. Stolen credentials associated with these setups could enable unauthorized access to Lightning wallets and movement of funds.
Who is affected
The advisory targets BTCPay Server users running LND. The scope of the incident and the number of affected systems were not immediately clear. Users relying on LND integrations should treat the situation as high risk until systems are updated and secured.
Recommended actions
- Update LND to the latest secure release as soon as possible.
- Consider taking BTCPay servers offline until updates are applied.
- Review node activity for signs of unauthorized access or transactions.