BTCPay Server is an open-source payment processor for bitcoin merchants. On Friday night, attackers exploited a flaw that let anyone remotely grab
.macaroon files — the master keys to an LND-based Lightning node — without authentication. Keys in hand, you close the channels and sweep the funds.Hardware-wallet maker Foundation and bitcoin publication Citadel21 were among the victims. BTCPay pushed an emergency update to
2.4.2: patch now or go offline. Standard on-chain wallets were not affected.The bug had already been reported by the Bitcoin Red Team, a group running AI models over bitcoin codebases. They published fast on the theory that others would find it anyway. Apparently, they did.
Too early to bury Lightning. Too late to sleep on your macaroons.
CoinDesk