Lightning Wallets Are Being Drained Right Now: BTCPay Tells Users to Pull Servers Offline
Attackers are actively stealing credentials from Lightning Network payment servers and using them to move real funds, right now, while you read this.
BTCPay Server, one of the most widely used open-source Bitcoin payment processors in crypto, issued an emergency alert telling anyone running LND (Lightning Network Daemon) to either update their software immediately or take their servers completely offline. Not tomorrow. Not after the weekend. Now.
What Actually Happened
This is not a theoretical vulnerability sitting in a bug report. Exploits have already hit live servers. Attackers found a way to steal credentials that give them direct control over Lightning wallets, meaning they can authorize and move funds without the wallet owner doing anything at all.
LND is the most popular implementation of the Lightning Network, the Layer 2 protocol built on top of Bitcoin that enables fast, low-cost payments. Merchants, payment processors, and crypto businesses worldwide run LND nodes to accept and route Bitcoin. If your BTCPay store is one of them, your exposure is not hypothetical.
BTCPay has not disclosed the full technical details of the exploit publicly, which is standard practice to avoid handing attackers a wider playbook. But the severity of the warning, going offline entirely rather than simply patching, signals this is serious.
This Is Part of a Bigger Pattern
This is not the first time Bitcoin infrastructure has taken a hit recently. The phrase "another Bitcoin infrastructure exploit" in BTCPay's own communication tells you everything about the current threat environment. Lightning is maturing fast, with more merchants, more liquidity, and more real money flowing through nodes than ever before. That makes it a target.
As Lightning adoption accelerates, the attack surface grows with it. Sophisticated attackers are no longer just chasing DeFi protocols and Ethereum bridges. They are showing up on Bitcoin's payment layer.
What Crypto Holders and Operators Should Do Right Now
If you run a BTCPay Server with LND: Stop reading and update or go offline immediately. Check BTCPay's official channels for the patched version.
If you use BTCPay as a customer: Pause any transactions until the merchant confirms they have patched their node.
If you hold Bitcoin on Lightning wallets connected to third-party nodes: Verify with your provider that their infrastructure has been updated and is unaffected.
The broader takeaway for the market is uncomfortable but important. Bitcoin's payment infrastructure is growing up fast, and security is not keeping pace cleanly. Every Lightning exploit that lands headlines is a speed bump on the road to mainstream adoption. Watch whether BTCPay releases a full post-mortem, because the details will matter for how seriously institutions take Lightning as a payment rail going forward.