Audit log

Every state-changing event for BTCPay Server — LND Macaroon Credential Exploit (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-22 23:03:57Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   EStCvXJvTwH5…fnVujXw6copysha256 → base58

   verifying row…

   canonical bytes (17393 B) ▸

   {"actor":"system:backfill","investigation_id":"81428e11-1d41-4a04-9369-d9826a55dfe9","kind":"publish","page_slug":"btcpay-server-lnd-macaroon-credential-exploit-august-2026","published_at":"2026-08-22T23:03:57.296Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"BTCPay Server — LND Macaroon Credential Exploit (August 2026)","sections":[{"content":"BTCPay Server is a free, open-source, self-hosted Bitcoin payment processor originally created by developer Nicolas Dorier in August 2017. Dorier launched the project as a censorship-resistant alternative to BitPay after BitPay's controversial stance on certain blockchain forks. The software enables merchants to accept Bitcoin and Lightning Network payments without relying on a third-party custodian, giving operators full control of their payment infrastructure. The project is maintained by a community of over 170 open-source contributors and is funded in part by OpenSats. It supports on-chain Bitcoin, Lightning Network (via LND, Core Lightning, and Eclair), and Liquid Network transactions, and is used by thousands of merchants globally.","heading":"Entity Background","severity":"low","sources":[{"credibility":1,"name":"BTCPay Server GitHub Repository","type":"official","url":"https://github.com/btcpayserver/btcpayserver"},{"credibility":2,"name":"Bitcoin Magazine: BTCPay Server — The Backbone of Bitcoin Commerce, 2025","type":"news_article","url":"https://bitcoinmagazine.com/business/btcpay-server-the-backbone-of-bitcoin-commerce-2025"},{"credibility":2,"name":"OpenSats: BTCPay Server project page","type":"official","url":"https://opensats.org/projects/btcpayserver"}]},{"content":"On August 7, 2026, BTCPay Server issued an emergency security advisory confirming that a critical vulnerability was being actively exploited against live installations. The flaw allowed an unauthenticated remote attacker to retrieve LND '.macaroon' credential files from any BTCPay Server instance configured to use the Lightning Network Daemon (LND). Macaroon files function as bearer-token API credentials for LND nodes; an attacker in possession of an admin macaroon gains unrestricted control over the associated Lightning node, including the ability to open and close payment channels and move funds. Every BTCPay Server release prior to 2.4.2 — including all 2.4.2 release candidates — is affected. Non-LND Lightning backends (Core Lightning, Eclair) and pure on-chain deployments face no credential exposure through this specific vulnerability. The official advisory stated that 'users were affected and funds were stolen,' though BTCPay did not disclose the aggregate amount lost or the total number of compromised operators as of mid-August 2026. A full technical postmortem was promised but had not been released at the time of writing. No CVE number was assigned in the available reporting.","heading":"Critical Vulnerability: Pre-Authentication LND Macaroon Exposure","severity":"critical","sources":[{"credibility":1,"name":"BTCPay Server Blog: Security Advisory — Update BTCPay Server to 2.4.2 Immediately","type":"official","url":"https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/"},{"credibility":1,"name":"CoinDesk: Another Bitcoin infrastructure exploit hits, this time draining merchant Lightning nodes (August 8, 2026)","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes"},{"credibility":2,"name":"Coinpaper: BTCPay Server restricts Lightning access after exploit drains LND nodes","type":"news_article","url":"https://coinpaper.com/34076/btcpay-server-restricts-lightning-access-after-exploit-drains-lnd-nodes"},{"credibility":2,"name":"TechTimes: BTCPay Server Breach — Patch Closes Flaw but Stolen Credentials Survive (August 8, 2026)","type":"news_article","url":"https://www.techtimes.com/articles/323615/20260808/btcpay-server-breach-patch-closes-flaw-stolen-credentials-survive.htm"}]},{"content":"Two named entities publicly confirmed their Lightning nodes were drained before BTCPay's public advisory went live on August 7, 2026. Foundation, the company behind the Passport hardware wallet, had its BTCPay-connected Lightning node emptied overnight; CEO Zach Herbert confirmed attackers closed the company's payment channels and swept the funds. Foundation stated that its primary on-chain hot wallet was not affected. Citadel21, a Bitcoin publication associated with pseudonymous commentator hodlonaut, also reported its Lightning node was swept, noting that minimal funds were held there. The total number of affected operators and the aggregate value of funds stolen have not been disclosed publicly by BTCPay Server as of mid-August 2026.","heading":"Confirmed Victims","severity":"critical","sources":[{"credibility":2,"name":"TFTC: BTCPay Server v2.4.2 Patches Live LND Macaroon Exploit Draining Lightning Nodes","type":"news_article","url":"https://www.tftc.io/btcpay-server-v2-4-2-lnd-macaroon-exploit-lightning-nodes-drained"},{"credibility":1,"name":"CoinDesk: Another Bitcoin infrastructure exploit hits, this time draining merchant Lightning nodes (August 8, 2026)","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes"},{"credibility":1,"name":"Cointelegraph: BTCPay Server Rotates Credentials After Lightning Exploit","type":"news_article","url":"https://cointelegraph.com/news/btcpay-restricts-remote-lightning-access-after-attackers-steal-funds"}]},{"content":"BTCPay Server released version 2.4.2 on August 7, 2026, addressing the macaroon exposure. The update upgrades LND to version 0.21.1 and, on standard Docker deployments, automatically regenerates macaroon credentials and temporarily disables public LND API access. However, the project explicitly warned that patching alone does not invalidate credentials already stolen: operators whose macaroon files were exfiltrated before updating must also manually revoke and regenerate LND macaroons at the node level (destroying the root signing key) and move funds from any BTCPay-generated on-chain hot wallets before recreating them. Version 2.4.2 also addressed a separate TOTP two-factor-authentication bypass through Basic authentication, and disabled Basic authentication by default after five minutes. Operators using independent reverse proxies or Tor access routes must rotate credentials manually regardless of the BTCPay update. BTCPay advised all operators who could not immediately update to take affected LND deployments offline and to review node activity for unauthorized payments, unexpected channel closures, unfamiliar peers, and balance discrepancies.","heading":"Patch and Remediation","severity":"high","sources":[{"credibility":1,"name":"BTCPay Server Blog: Security Advisory — Update BTCPay Server to 2.4.2 Immediately","type":"official","url":"https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/"},{"credibility":2,"name":"NewsBTC: BTCPay Server Patches Critical LND Credential Bug After Lightning Wallet Drain","type":"news_article","url":"https://www.newsbtc.com/news/btcpay-server-patches-critical-lnd-credential-bug-after-lightning-wallet-drain/"},{"credibility":2,"name":"Coinpaper: BTCPay Server restricts Lightning access after exploit drains LND nodes","type":"news_article","url":"https://coinpaper.com/34076/btcpay-server-restricts-lightning-access-after-exploit-drains-lnd-nodes"}]},{"content":"Following the exploit, BTCPay Server supporters collectively pledged a recovery bounty of 10% of any stolen funds returned, capped at a maximum of 3 BTC (approximately $190,000 at the time of reporting). The offer was extended to anyone providing actionable information leading to the return of funds, explicitly including the attacker. As of mid-August 2026, no recovery had been publicly announced and the attacker remained unidentified in all available reporting.","heading":"Recovery Bounty","severity":"high","sources":[{"credibility":1,"name":"CoinDesk: BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit (August 11, 2026)","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/11/btcpay-offers-usd190-000-bounty-after-bitcoin-payment-servers-drained-in-exploit"},{"credibility":1,"name":"The Block: BTCPay Server supporters offer up to 3 BTC for recovery bounty after critical exploit (August 10, 2026)","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-10-btcpay-server-supporters-offer-3-btc-recovery-bounty-critical-exploit-411353"},{"credibility":2,"name":"Crypto.news: BTCPay Server supporters back 10% bounty to recover stolen Bitcoin","type":"news_article","url":"https://crypto.news/btcpay-server-supporters-back-10-bounty-to-recover-stolen-bitcoin/"},{"credibility":2,"name":"Cryptopolitan: Bitcoin holds near $64,000 as BTCPay backers pledge 3 BTC exploit bounty","type":"news_article","url":"https://www.cryptopolitan.com/bitcoin-holds-near-64000-as-btcpay-backers-pledge-3-btc-exploit-bounty/"}]},{"content":"BTCPay Server is a widely deployed piece of open-source infrastructure used by thousands of Bitcoin merchants globally. The vulnerability specifically affected deployments using LND as their Lightning backend — an extremely common configuration. The exploit's pre-authentication nature means no user interaction or credentials were required for an attacker to exfiltrate macaroon files from an exposed instance. The incident represents a software vulnerability in BTCPay Server itself; it is not a flaw in the Bitcoin protocol or in LND's core design. BTCPay Server as a project is the software victim of the exploit insofar as the vulnerability was in its own code, but the financial victims were the merchant operators running affected instances. The project's open-source governance model, prompt disclosure, same-day patch release, and transparent communication are noted as positive indicators of responsible incident handling, even though the vulnerability had been present across an unspecified range of versions for an undisclosed period before active exploitation was discovered.","heading":"Scope and Risk Assessment","severity":"high","sources":[{"credibility":1,"name":"BTCPay Server Blog: Security Advisory — Update BTCPay Server to 2.4.2 Immediately","type":"official","url":"https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/"},{"credibility":2,"name":"BeInCrypto: Bitcoin Payment Tool BTCPay Urges Update After Attackers Steal Funds","type":"news_article","url":"https://beincrypto.com/bitcoin-btcpay-server-exploit-funds-stolen/"},{"credibility":3,"name":"Startup Fortune: BTCPay Server users lose Lightning funds to a bug hiding since before 2.4.2","type":"news_article","url":"https://startupfortune.com/btcpay-server-users-lose-lightning-funds-to-a-bug-hiding-since-before-242/"}]}],"sources_used":[{"credibility":1,"name":"BTCPay Server Blog: Security Advisory — Update BTCPay Server to 2.4.2 Immediately","type":"official","url":"https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/"},{"credibility":1,"name":"CoinDesk: Another Bitcoin infrastructure exploit hits, this time draining merchant Lightning nodes (August 8, 2026)","type":"news_article","url":"https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes"},{"credibility":1,"name":"CoinDesk: BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit (August 11, 2026)","type":"news_article","url":"https://www.coindesk.com/markets/2026/08/11/btcpay-offers-usd190-000-bounty-after-bitcoin-payment-servers-drained-in-exploit"},{"credibility":1,"name":"The Block: BTCPay Server supporters offer up to 3 BTC for recovery bounty after critical exploit (August 10, 2026)","type":"news_article","url":"https://www.theblock.co/news/ecosystems/2026-08-10-btcpay-server-supporters-offer-3-btc-recovery-bounty-critical-exploit-411353"},{"credibility":1,"name":"Cointelegraph: BTCPay Server Rotates Credentials After Lightning Exploit","type":"news_article","url":"https://cointelegraph.com/news/btcpay-restricts-remote-lightning-access-after-attackers-steal-funds"},{"credibility":2,"name":"NewsBTC: BTCPay Server Patches Critical LND Credential Bug After Lightning Wallet Drain","type":"news_article","url":"https://www.newsbtc.com/news/btcpay-server-patches-critical-lnd-credential-bug-after-lightning-wallet-drain/"},{"credibility":2,"name":"TFTC: BTCPay Server v2.4.2 Patches Live LND Macaroon Exploit Draining Lightning Nodes","type":"news_article","url":"https://www.tftc.io/btcpay-server-v2-4-2-lnd-macaroon-exploit-lightning-nodes-drained"},{"credibility":2,"name":"Coinpaper: BTCPay Server restricts Lightning access after exploit drains LND nodes","type":"news_article","url":"https://coinpaper.com/34076/btcpay-server-restricts-lightning-access-after-exploit-drains-lnd-nodes"},{"credibility":2,"name":"BeInCrypto: Bitcoin Payment Tool BTCPay Urges Update After Attackers Steal Funds","type":"news_article","url":"https://beincrypto.com/bitcoin-btcpay-server-exploit-funds-stolen/"},{"credibility":2,"name":"Crypto.news: BTCPay Server supporters back 10% bounty to recover stolen Bitcoin","type":"news_article","url":"https://crypto.news/btcpay-server-supporters-back-10-bounty-to-recover-stolen-bitcoin/"},{"credibility":2,"name":"Cryptopolitan: Bitcoin holds near $64,000 as BTCPay backers pledge 3 BTC exploit bounty","type":"news_article","url":"https://www.cryptopolitan.com/bitcoin-holds-near-64000-as-btcpay-backers-pledge-3-btc-exploit-bounty/"},{"credibility":2,"name":"TechTimes: BTCPay Server Breach — Patch Closes Flaw but Stolen Credentials Survive (August 8, 2026)","type":"news_article","url":"https://www.techtimes.com/articles/323615/20260808/btcpay-server-breach-patch-closes-flaw-stolen-credentials-survive.htm"},{"credibility":1,"name":"BTCPay Server GitHub Repository","type":"official","url":"https://github.com/btcpayserver/btcpayserver"},{"credibility":2,"name":"OpenSats: BTCPay Server project page","type":"official","url":"https://opensats.org/projects/btcpayserver"},{"credibility":3,"name":"Startup Fortune: BTCPay Server users lose Lightning funds to a bug hiding since before 2.4.2","type":"news_article","url":"https://startupfortune.com/btcpay-server-users-lose-lightning-funds-to-a-bug-hiding-since-before-242/"}],"summary":"BTCPay Server is a widely used open-source, self-hosted Bitcoin payment processor created in 2017. On August 7, 2026, the project disclosed and patched a critical pre-authentication vulnerability (present in all versions before 2.4.2) that allowed remote attackers to steal LND macaroon credential files and drain connected merchant Lightning nodes. The vulnerability was actively exploited before the public disclosure, with confirmed victims including hardware wallet maker Foundation and Bitcoin publication Citadel21; the attacker remained unidentified as of mid-August 2026.","timeline":[{"date":"2017-08-01","event":"Nicolas Dorier publicly announced BTCPay Server, an open-source self-hosted Bitcoin payment processor, as an alternative to BitPay.","source":"Bitcoin Magazine","source_url":"https://bitcoinmagazine.com/business/btcpay-server-the-backbone-of-bitcoin-commerce-2025"},{"date":"2026-08-07","event":"BTCPay Server issued an emergency security advisory confirming active exploitation of a critical pre-authentication vulnerability affecting all versions before 2.4.2 that allowed remote attackers to steal LND macaroon credential files. Version 2.4.2 was released the same day.","source":"BTCPay Server Blog (official security advisory)","source_url":"https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/"},{"date":"2026-08-07","event":"Foundation (maker of Passport hardware wallets) reported its BTCPay-connected Lightning node was drained overnight; CEO Zach Herbert confirmed attackers closed payment channels and swept funds. Citadel21 also reported its Lightning node was swept.","source":"CoinDesk (August 8, 2026)","source_url":"https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes"},{"date":"2026-08-08","event":"CoinDesk reported on the incident, noting victims were compromised before BTCPay's public warning went live.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes"},{"date":"2026-08-10","event":"BTCPay Server supporters publicly pledged a recovery bounty of 10% of any returned stolen funds, capped at 3 BTC (approximately $190,000), open to anyone including the attacker who provides information leading to fund recovery.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-08-10-btcpay-server-supporters-offer-3-btc-recovery-bounty-critical-exploit-411353"},{"date":"2026-08-11","event":"CoinDesk published a follow-up report on the $190,000 bounty offer. The attacker remained unidentified and no recovery had been announced.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/08/11/btcpay-offers-usd190-000-bounty-after-bitcoin-payment-servers-drained-in-exploit"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 99feaeaa-db87-4383-a386-49648a40f992copy