Attackers silently stole Lightning Network credentials from BTCPay Server instances last week, draining merchant wallets before most victims even knew they'd been hit.
BTCPay Server, the open-source Bitcoin payment processor trusted by thousands of merchants worldwide, has confirmed the exploit and is now offering a bounty of up to 3 BTC (approximately $190,000) for the recovery of stolen funds. The reward structure pays 10% of whatever is recovered, capped at that 3 BTC ceiling.
What Actually Happened
The attackers targeted LND (Lightning Network Daemon) credentials, the authentication keys that give a node operator full control over a Lightning wallet. Once those credentials are compromised, draining a wallet is trivial and nearly instant. Lightning transactions are final. There are no chargebacks, no frozen funds, no appeals process.
This wasn't a slow bleed. Merchants woke up to empty wallets.
BTCPay has not disclosed the exact number of affected merchants or the total volume stolen, but the decision to post a 3 BTC maximum bounty signals the team is treating this as a serious, active threat, not a minor edge case.
Why This Hits Different
BTCPay Server is not a custodial service. That's the whole point. Merchants run their own nodes, hold their own keys, and skip the middleman entirely. The exploit didn't hit a centralized honeypot. It hit individual operators who thought self-custody was protecting them.
This is the uncomfortable paradox of sovereign Bitcoin infrastructure: when you own your keys, you also own the risk. And Lightning, for all its speed and low fees, has an attack surface that most merchants never fully audit.
The exploit also lands at a sensitive moment. Lightning Network adoption has been accelerating, with major wallets, exchanges, and payment apps integrating it as the default Bitcoin payment rail. Any high-profile drain event creates friction for that narrative.
What You Should Do Right Now
If you run a BTCPay Server instance with LND, treat your credentials as compromised until proven otherwise. Rotate your macaroons (LND's authentication tokens), audit your access logs immediately, and move any remaining Lightning funds to cold storage while you investigate.
For merchants not yet affected: this is the moment to review your node security posture. Check who has API access, ensure your server is not publicly exposed without authentication, and monitor BTCPay's official channels for a full post-mortem, which the team has signaled is coming.
The bounty window is open. The attacker may still be active. If you have any information on the stolen funds, BTCPay's recovery program is the only path to getting money back on a network designed to make transactions irreversible.
Watch this story closely. The post-mortem will reveal exactly how credentials were stolen and could expose a vulnerability pattern affecting far more nodes than currently known.