BTCPay Server warns of bots probing exposed Bitcoin payment servers

BTCPay Server has reported that bots are probing exposed Lightning nodes to gain administrative control. This follows a critical vulnerability exploited a month ago that allowed attackers to access credentials for LND nodes and drain merchant wallets. In response, BTCPay disabled external access to LND in its standard Docker deployment. However, automated systems are now targeting servers where operators manually restored access, repeatedly calling an LND password-change endpoint. This new probing method could lead to attackers obtaining credentials to control an LND node. The vulnerability appears during a brief interval after LND restarts, when the wallet is locked, and the password-change method does not require a macaroon. Older BTCPay LND wallets are at higher risk due to shared default passwords. BTCPay has not confirmed any successful takeovers from this activity. The renewed probing follows an August incident where attackers exploited a vulnerability affecting all versions before 2.4.2, allowing unauthorized access to LND macaroon files. BTCPay has since released version 2.4.4 to address these issues, implementing unique random passwords for new LND wallets and rotating passwords for older installations. Administrators are urged to upgrade to version 2.4.4 and remove manually exposed LND routes to enhance security.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.