BTCPay is self-hosted software, putting the shutdown instruction in the hands of individual server operators. Its wallet documentation explains that its hot-wallet feature uses a seed stored on the server to sign transactions, allowing funds to be spent without an external signing device.
An Earlier Lightning Credential Theft
The warning follows an August incident covered by The Defiant in which BTCPay confirmed that attackers had stolen funds from users of LND, software for running Lightning payments nodes.
The project’s advisory for that incident says a vulnerability in versions before 2.4.2, including its release candidates, let unauthenticated remote attackers obtain LND credential files. Those credentials could be used to control a node and move funds. Version 2.4.2 fixed the flaw.
BTCPay said its own onchain wallets, including hot wallets, were not affected by that earlier vulnerability, though funds in LND’s own onchain wallet could still be at risk. Sunday’s alert did not say whether the reported sweeps were connected to the August vulnerability.
Leave a Reply