Bitcoin Payment Tool BTCPay Urges Update After Attackers Steal Funds
BTCPay Server confirmed that attackers exploited a vital flaw to steal funds from customers operating any model previous to 2.4.2 and urged operators to replace instantly.
The self-hosted Bitcoin cost processor launched model 2.4.2 to shut the vulnerability. The concern allowed an unauthenticated distant attacker to acquire .macaroon credential recordsdata for LND, a typical Lightning Network implementation.
What BTCPay Server Users Must Do
The stolen credentials may hand an attacker full management of an LND node. From there, the attacker may transfer funds immediately out of the node.
“We have confirmed that attackers exploited this vulnerability. Users have been affected and funds have been stolen. We should not publishing technical particulars but as a result of operators nonetheless want time to replace,” the team stated.
Follow us on X to get the most recent information because it occurs
The threat applies particularly to deployments utilizing LND. Other Lightning setups and non-Lightning customers face no credential publicity, although the challenge nonetheless urged them to replace. BTCPay Server’s personal on-chain and sizzling wallets remain unaffected.
Operators who use LND ought to replace to model 2.4.2 and LND 0.21.1 by way of the upkeep dashboard. The replace regenerates macaroons robotically. Those unable to patch instantly have been advised to take their servers offline.
The challenge additionally suggested LND customers to evaluate node exercise for unfamiliar friends, surprising channel closures, and funds they didn’t make.
A Second Blow to Bitcoin Self-Custody
The disclosure follows one other major security incident. Galaxy Research confirmed on Friday that 1,719 Bitcoin (BTC), price roughly $111 million, has been stolen from Coldcard customers to this point. The agency expects complete losses to exceed $130 million as soon as excellent cases are verified.
Neither incident touched the Bitcoin protocol itself. Both as an alternative uncovered weaknesses within the instruments constructed round it.
Subscribe to our YouTube channel to observe leaders and journalists present knowledgeable insights
The publish Bitcoin Payment Tool BTCPay Urges Update After Attackers Steal Funds appeared first on BeInCrypto.