Bots Target BTCPay LND Restart to Steal Admin Keys

Automated bots have been probing manually exposed BTCPay Lightning (LND) nodes for a restart-time weakness that can allow attackers to replace node passwords and request administrator macaroons, potentially giving them control of merchant wallets.

The activity targets a short interval after an LND process restarts while its wallet remains locked. During that window the password-change endpoint does not require a macaroon, the credential LND normally uses to authorize administrative actions. Older BTCPay installations used a shared default password, which lets an attacker who reaches the interface first submit the default, replace it, and then request an administrator macaroon.

The behavior follows an exploited vulnerability disclosed in August that affected BTCPay versions before 2.4.2. That earlier flaw allowed unauthenticated attackers to obtain LND macaroon files and move funds from merchant wallets. After those thefts, BTCPay disabled external LND access in its standard Docker deployment and worked with exchanges, analytics firms and law enforcement to trace stolen funds; the project also offered a bounty for recovered bitcoin.

BTCPay released version 2.4.4 on Sept. 7 to address the restart-time path and apply other hardening measures. New LND wallets created by the update receive unique random passwords, while older wallets using the shared credential are migrated and have their passwords rotated. The project’s standard reverse proxy was updated to block unauthenticated wallet setup and unlock methods, which closes the restart-time opening when the service is accessed through BTCPay’s managed public network path.

A route-control change merged on Sept. 11 provides a supported option for remote access while keeping LND and Core Lightning interfaces disabled by default. BTCPay warned that custom deployments remain exposed: administrators who manually configured their own reverse proxy or otherwise published LND routes can bypass the managed protections and must remove public LND routes and audit proxy rules.

The project has not reported any successful takeovers tied to the newly observed probing activity and has not linked the current bots to the actors behind the August exploit. BTCPay has urged operators to install version 2.4.4, migrate remote connections behind its managed controls, ensure unique passwords for LND wallets and monitor for unexpected calls to password-change endpoints while following its security advisories.