BTCPay Server warns of bots probing exposed Lightning nodes for admin keys

BTCPay Server, a Bitcoin payment processor, has issued a warning that bots are actively probing Lightning Network nodes that have been manually exposed. The bots repeatedly call an LND password‑change endpoint in an effort to capture master administrative credentials.

Background on recent BTCPay vulnerabilities

In August, a critical BTCPay vulnerability allowed unauthenticated attackers to retrieve LND macaroon files and move funds from merchant wallets. The flaw affected all BTCPay versions prior to 2.4.2 and prompted a bounty program and cooperation with exchanges, analytics firms, and law enforcement.

New probing technique

The current activity differs from the August exploit. Bots target a short window after an LND node restarts, while the wallet remains locked. During this interval, the password‑change endpoint does not require a macaroon, and older installations use a shared default password. An attacker who reaches the endpoint first could replace the password and request a new administrator macaroon, gaining control of the node.

Mitigations released

BTCPay released version 2.4.4 on September 7, which introduces several protections:

• New LND wallets receive unique random passwords.
• Older installations are migrated and have their passwords rotated.
• The standard reverse proxy blocks unauthenticated wallet setup and unlock methods, closing the restart‑time opening.
• A route‑control change merged on September 11 adds a supported remote‑access option while keeping LND and Core Lightning interfaces disabled by default.

Remaining risks for custom deployments

Administrators who have configured their own reverse proxies or otherwise exposed LND publicly can still bypass the built‑in protections. BTCPay urges such operators to audit proxy rules, migrate remote connections behind the managed controls, and upgrade to version 2.4.4.

Current status

BTCPay has not reported any successful takeovers resulting from the newly observed bot activity, nor has it linked the bots to the attackers responsible for the August thefts.