BTCPay Server Warns Bots Are Probing Exposed Lightning Nodes for Admin Control

Automated scans target a restart-time opening that could hand over admin control of merchant nodes

BTCPay Server, the open-source Bitcoin payment processor used by thousands of merchants worldwide, has warned that automated bots are actively probing exposed Lightning Network nodes for a pathway to administrative control. The project disclosed that the scanning campaign targets servers where operators manually restored public access to LND, the most widely used implementation of Bitcoin’s Lightning Network, after BTCPay locked down external LND routes in its standard deployment following a critical incident in August.

According to the project’s security blog post accompanying the release of version 2.4.4, the bots repeatedly call an LND password-change endpoint on any server where that interface remains reachable. The renewed activity is the latest chapter in a difficult security stretch for one of the Bitcoin ecosystem’s most trusted self-custody merchant tools, and it puts operators of custom deployments on notice that automated systems are continuing to sweep the internet for reachable nodes.

How the restart-time weakness works

The mechanism behind the newly observed probing differs from the vulnerability exploited in August, but the potential outcome is similar: an attacker obtaining credentials capable of controlling an LND node. BTCPay explained that the opening appears during a short interval after LND restarts, while the node’s wallet remains locked. During that window, the targeted password-change method does not require a macaroon, the credential LND normally uses to authorize administrative actions.

Older BTCPay LND wallets compounded the risk because they used a shared default password. An attacker able to reach the interface before BTCPay’s internal unlocker could potentially submit that password first, replace it with one of their own, and then request an administrator macaroon, effectively gaining full control over the node and any Lightning channels and funds attached to it.

Notably, BTCPay has not reported a successful takeover through the newly observed activity, and the project has not linked the bots to the attackers behind the August thefts. The campaign appears to be opportunistic scanning rather than a confirmed breach, but the company’s decision to publicize it reflects how narrow the margin between probing and compromise can be for misconfigured deployments.

Context: the August incident that started the lockdown

The renewed probing extends the fallout from a critical vulnerability BTCPay acknowledged on August 7, which affected all versions before 2.4.2. That flaw allowed unauthenticated attackers to obtain LND macaroon files and use them to move funds out of merchant Lightning wallets. On-chain wallets in the standard BTCPay deployment were unaffected, but the incident prompted an emergency response.

Days after the disclosure, BTCPay and its supporters offered a bounty equal to 10 percent of any recovered bitcoin, capped at 3 BTC, which was worth roughly 190,000 US dollars at the time. The project also enlisted cryptocurrency exchanges, blockchain analytics firms, and law enforcement in an effort to trace the stolen funds. As part of the remediation, BTCPay disabled external access to LND entirely in its standard Docker deployment, forcing operators who needed remote access to find supported alternatives.

What version 2.4.4 changes

Version 2.4.4, released on September 7, addresses the conditions behind the latest attack path. New LND wallets created by the platform now receive unique random passwords rather than a shared default, while older installations that still relied on the shared credential are migrated automatically and have their passwords rotated as part of the update.

Beyond the password changes, BTCPay’s standard reverse proxy now blocks unauthenticated wallet setup and unlock methods, closing the restart-time opening through its managed public network path. A route-control change merged on September 11 goes further, providing a supported option for remote access while keeping both LND and Core Lightning interfaces disabled by default.

The catch is that these controls only protect infrastructure managed through BTCPay’s own tooling. Administrators who built their own reverse proxy configuration or otherwise exposed LND publicly can still bypass the project’s protections entirely, and those custom deployments are where the bots are now concentrating their scans.

What operators should do now

BTCPay has urged all administrators to install version 2.4.4 and remove any manually exposed LND routes from their public-facing infrastructure. For operators who require remote access, the newly merged route-control functionality offers a supported path that does not require punching a hole through the proxy for the LND interface itself.

Operators running custom reverse proxies are advised to audit their proxy rules, confirm that no unauthenticated wallet setup or unlock methods are reachable from the public internet, and migrate remote connections behind BTCPay’s managed controls. Given that automated systems continue searching for reachable nodes, the project treats exposed LND routes as an active rather than theoretical risk.

For merchants, the episode is a reminder of a broader trade-off in self-custody payments infrastructure. BTCPay Server’s value proposition has always been that merchants hold their own keys and answer to no intermediary, but that sovereignty shifts the burden of operational security onto the operator. When the project ships fixes, deployment speed matters as much as the fix itself.

Broader pattern of Lightning security scrutiny

The BTCPay warnings arrive amid a wider season of Lightning Network security attention. Earlier in September, developers shipped LDK version 0.2.6 to fix bugs that exposed Lightning nodes to fund theft through malicious peers and restart failures, and the Liquid Network’s recent 320 million US dollar exploit showed how quickly sidechain and second-layer infrastructure can move from niche to headline when custody assumptions break.

None of these incidents share a root cause, but together they underscore that Bitcoin’s layered payment stack is now large enough, and holds enough value, to attract both opportunistic bot operators and determined attackers. Bitcoin traded near 77,200 US dollars as the BTCPay advisory circulated, little changed on the day, suggesting the market views the issue as an operational concern for merchants rather than a systemic risk to the network itself.

Still, for the thousands of merchants who rely on BTCPay to accept Bitcoin payments without a third-party processor, the message from the project is unambiguous: update to 2.4.4, close exposed LND routes, and assume the bots are already at the door.

Disclaimer: This article is for informational purposes only and does not constitute financial advice.