BTCPay Temporarily Restricts Lightning Network Remote Access Due to LND Vulnerability

TechFlow news, August 09, according to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes due to attackers exploiting a critical vulnerability in LND (Lightning Network Daemon) to steal node credentials and transfer funds. Version 2.4.2 has been upgraded to LND 0.21.1, and automatically rotates macaroon credentials in standard installations. The project team reminds operators to check for abnormal payments, channel closures, and balance changes as soon as possible; if nodes are exposed via self-built reverse proxies, Tor services, or port forwarding, relevant credentials also need to be manually changed. Currently, Foundation and Citadel21 have reported node fund losses, but the specific scale of losses has not yet been disclosed.