BTCNaN
ETHNaN
BNBNaN
SOLNaN
XRPNaN
DOGENaN
BTCNaN
ETHNaN
BNBNaN
XRPNaN
SOLNaN
DOGENaN
Play Article AudioRead
Picture of the author
Shaurya Malwa
2 months, 1 week ago

BTC news: Bitcoin’s exploit week worsens as BTCPay flaw drains Lightning nodes

Play Article AudioRead
A rough week for bitcoin's software is getting worse, this time hitting merchants who accept bitcoin BTC $ 64,968.63 payments through Lightning, a separate network built on top of bitcoin for instant, low-cost transfers.

Attackers drained Lightning nodes running behind BTCPay Server late on Friday after exploiting a critical vulnerability that exposed the credentials protecting them, the team said in an X post.

BTCPay confirmed funds were stolen and told anyone running LND, the most widely used software for operating a Lightning node, to update immediately to version 2.4.2 or take the server offline.

The project has not disclosed how many users were hit or how much bitcoin was taken.

The flaw allowed an unauthenticated remote attacker to obtain “.macaroon” files, or credentials that give software permission to interact with an LND Lightning node. BTCPay said the attacks it reviewed targeted those files, which could then be used to take control of the node and move funds.

Hardware-wallet maker Foundation was among the victims. Chief Executive Zach Herbert said attackers drained the company's BTCPay Lightning node overnight, closing its channels and sweeping the funds. Its BTCPay on-chain hot wallet was untouched.
EDITOR’S CHOICE