Bots probe exposed Bitcoin payment servers for admin keys, BTCPay warns
Bots are probing exposed Bitcoin payment servers
BTCPay Server, a Bitcoin payment processor, has warned that automated bots are probing exposed Lightning nodes to find a way to take administrative control of servers.
LND is a widely used implementation of Bitcoin's Lightning Network.
Key facts from the warning
- Bots are repeatedly calling an LND password-change endpoint on servers where operators manually restored external access.
- A successful attack could let someone replace an LND password and request an administrator macaroon, the credential LND uses to approve administrative actions.
- BTCPay Server version 2.4.4 addresses the issue, but custom reverse proxies stay exposed until operators remove public LND routes.
- BTCPay has not reported a successful takeover from this new probing, nor has it linked the bots to the attackers behind the August thefts.
Attackers are targeting a restart-time gap
According to BTCPay, the weakness appears during a short interval after LND restarts while its wallet is still locked. During that window, the password-change method does not require a macaroon — the credential LND normally uses to authorize administrative actions.
Older BTCPay LND wallets made the risk worse by using a shared default password. An attacker who reached the interface before BTCPay's internal unlocker could submit that password first, replace it, and request an administrator macaroon with control over the node.
The warning follows an earlier theft
BTCPay acknowledged on Aug. 7 that attackers had exploited a separate vulnerability affecting all versions before 2.4.2. That flaw allowed unauthenticated attackers to obtain LND macaroon files and use them to move funds. Standard on-chain wallets were not affected.
After that incident, BTCPay and its supporters offered a bounty equal to 10% of recovered bitcoin, capped at 3 BTC (then worth about $190,000). The project also enlisted exchanges, blockchain analytics firms, and law enforcement to trace the funds.
Version 2.4.4 closes the standard path
Version 2.4.4, released Sept. 7, addresses the conditions behind the latest attack path. New LND wallets receive unique random passwords, and older installations using the shared credential are migrated with their passwords rotated.
BTCPay's standard reverse proxy also blocks unauthenticated wallet setup and unlock methods, which closes the restart-time opening on its managed public network path.
Those controls do not protect infrastructure that operators set up on their own. Administrators who created a custom reverse proxy or exposed LND publicly can still bypass BTCPay's protections.
No reported takeover yet
BTCPay has not reported a successful takeover through the newly observed activity, and it has not said whether the bots are linked to the attackers behind the August thefts.
Why this matters
The probing matters because a successful attack could let someone take over an LND node and control a merchant wallet, not just access the server software. After the August incident, BTCPay disabled external access to LND in its standard Docker deployment. Servers where operators manually restored that access are now the target.
What operators should do now
BTCPay has urged administrators to install version 2.4.4 and remove manually exposed LND routes. A route-control change merged Sept. 11 provides a supported option for remote access while keeping LND and Core Lightning interfaces disabled by default.
Custom deployments remain the immediate concern. Operators must audit their proxy rules and move remote connections behind BTCPay's managed controls while automated systems continue searching for reachable nodes.