Security advisory: flaw exposing LND credentials exploited before version 2.4.2
The BTCPay Server project published an advisory on 7 August 2026 urging operators to update to version 2.4.2 immediately or take servers offline. According to the advisory, the flaw could let an unauthenticated remote attacker obtain LND credential files and move funds from the connected Lightning node; on-chain wallets were not affected. Several merchants publicly confirmed losses. The project has not published a total, and said a full post-mortem would follow.
This entry summarises a public report and links to it. It is a record of what was reported, not a finding of wrongdoing. If you represent BTCPay Server, you can
claim the listing and respond here. To correct an error, send a correction.
