high
Hack or exploit BTCPay Server
Security advisory: flaw exposing LND credentials exploited before version 2.4.2
The BTCPay Server project published an advisory on 7 August 2026 urging operators to update to version 2.4.2 immediately or take servers offline. According to the advisory, the flaw could let an unauthenticated remote attacker obtain LND credential files and move funds from the connected Lightning node; on-chain wallets were not affected. Several merchants publicly confirmed losses. The project has not published a total, and said a full post-mortem would follow.
Outcome unknown Source: blog.btcpayserver.org ↗