Bitcoin Payment Servers Were Drained Live: BTCPay's $130M-Style Lightning Flaw Explained

BTCPay Server faced an actively exploited flaw while attackers drained Lightning nodes

BTCPay Server warned of a critical vulnerability being actively exploited, and reports showed attackers were already emptying Lightning nodes. Because BTCPay is self-hosted, there is no central operator who can patch things for users; every server owner has to update individually. That turns what should be a routine release into an urgent operational problem for anyone still running an unpatched instance.

Why the response time mattered

The urgency is not just about downtime. It is about preventing direct fund loss through payment workflows that rely on BTCPay. In a separate but related warning shot, Coinkite-related losses reached an estimated $130 million. That does not mean every self-hosted Bitcoin setup is equally exposed, but it does show how quickly security incidents can hit trust in off-chain payment rails.

The attack targeted LND credentials, not Bitcoin itself

What broke, in plain English

BTCPay did not fail because Bitcoin failed. The flaw let an unauthenticated remote attacker steal .macaroon credential files for LND. Once those credentials were obtained, they could be used to take control of an LND node and move funds. That fits the broader exploit pattern: attackers either trigger a flaw in the code or obtain the credentials that authorize transfers.

The important limit is scope. BTCPay later confirmed that only LND deployments were exposed. Its on-chain wallets, including hot wallets, are not affected, and users of other Lightning implementations or users who do not use Lightning were not exposed to this credential risk. The attack was serious, but the blast radius was narrower than the first wave of fear suggested.

Where the risk is concentrated

Some operators may now treat every BTCPay instance as if it were wide open. That is too broad. The live damage path was specific: stolen credentials, not drained on-chain hot wallets.

Credential theft is still worth watching because it is a common and costly attack pattern in crypto. In the first half of 2026, hackers stole $1.1 billion across 212 incidents. But for this event, the direct exposure is any Lightning channel flowing through an exposed LND instance. If that link is patched and credentials refreshed, the immediate fund-loss path is closed.

Bitcoin may hold up even if payment-rail confidence takes a hit

BTC still looks driven by broader market flows

The bullish case for Bitcoin itself remains tied more to price and liquidity than to merchant infrastructure drama. BTC has still managed to move higher even while the market remained in "extreme fear". That suggests the broader market has treated recent security headlines as noise rather than a fundamental break in Bitcoin's thesis.

Scope also matters here. BTCPay confirmed the exploit path was tied to .macaroon credential files for LND, while on-chain wallets, including hot wallets, are not affected. Unless the exposure spreads beyond vulnerable LND nodes, this looks more like a payment-rail failure than a failure of Bitcoin's base settlement layer.

The real discount sits in self-hosted payment workflows

The bearish read is not that Bitcoin itself is broken. It is that self-hosted payment infrastructure can look less attractive when a flaw is actively exploited and the safest immediate response is to shut the server down. That pushes more of the security burden back onto merchants and operators, which could slow adoption or weigh on how the market values open-source, self-custody payment tooling.

What to watch next

• A full post-mortem will be published in the coming days; if it confirms narrow scope, the trust hit is more likely to stay contained.
• If operators are still being told to take servers offline because they cannot patch, adoption friction is real.
• Only LND is impacted; if other implementations remain clean, the market can more easily compartmentalize the damage.
• The main invalidation for the "BTC only" view would be broader exposure beyond LND credentials, especially into on-chain wallets or other payment paths.

For now, the cleaner read is to respect Bitcoin's broader market bid while treating self-custody payment infrastructure as higher-risk until the full scope and response are clear.