BTCPay Server said all versions prior to 2.4.2 contain a critical vulnerability actively exploited by attackers to steal user funds via compromised LND macaroon credentials. It urged immediate upgrades to 2.4.2 and LND 0.21.1.
Matters because: widely self-hosted BTCPay instances remain at risk of fund theft until patched, underscoring ongoing security risk in Lightning/self-custody infrastructure.