Security notice

Running BTCPay Server with LND? Attackers stole Lightning credentials and moved funds. Update to 2.4.2, and rebuild if you were on 2.4.1 or earlier.

Last updated: Friday, November 6, 2026, 9:07 AM ETStatus: Vendor confirmed thefts. Update to 2.4.2+ now.

BTCPay Server is self-hosted software many online stores use to accept Bitcoin payments. A critical flaw, CVE-2026-119757, lets someone with no login pull LND .macaroon credential files from versions before 2.4.2 (including 2.4.2 release candidates). Those credentials can control a Lightning node and move funds. The vendor has confirmed attackers exploited it and that funds were stolen. Update to BTCPay Server 2.4.2 or later today (standard installs also move LND to 0.21.1). If you ran 2.4.1 or earlier, even if you patched after November 1, 2026, treat that server as compromised and rebuild. (BTCPay Server advisory, November 2 incident post)

What happened

The flaw. Every BTCPay Server version before 2.4.2, including the 2.4.2 release candidates, could let an unauthenticated remote attacker obtain LND .macaroon credential files. Those files can take control of an LND Lightning node and move funds. (BTCPay Server advisory, CVE-2026-119757)
Real thefts. The vendor confirmed attackers exploited the flaw and that users were affected and funds were stolen. The August 2026 advisory covered the original issue fixed in 2.4.2. (BTCPay Server advisory, incident response post)
November 1 to 2 wave. On November 1, 2026 the project received reports of Bitcoin and Litecoin stolen from hot wallets on servers still running 2.4.1 (released July 23, 2026) or earlier. Attackers used a different method against the same underlying issue that 2.4.2 had already fixed on August 7, 2026. (November 2 incident post)
Who faces the credential risk. The LND credential and fund-theft risk applies to deployments that use LND. Users of other Lightning implementations, and users who do not use Lightning, are not exposed to that LND credential risk, though the project still strongly encourages updating. (BTCPay Server advisory)
On-chain wallets. BTCPay Server's own on-chain wallets, including hot wallets whose keys stay in BTCPay, were not the path used in the LND credential thefts described in the August advisory. In the November wave, funds in wallets whose spending keys are held off the server, including hardware wallets, were unaffected. Funds held in LND's own on-chain wallet are part of the affected LND node and may still be at risk. (BTCPay Server advisory, November 2 incident post)
What we could not confirm. Flare's brief said CISA added CVE-2026-119757 to its Known Exploited Vulnerabilities catalog on November 5, 2026. When we checked CISA's KEV catalog JSON on November 6, 2026, that CVE ID was not listed. Vendor confirmation of thefts stands on its own.

Who should worry

Anyone who runs BTCPay Server, or has a host or agency running it for their store checkout.

You accept Bitcoin or Lightning payments through a self-hosted BTCPay Server.
Your store, nonprofit or agency uses BTCPay with LND (highest urgency).
You are still on 2.4.1 or earlier, or you updated from those versions after the November 1 warning.

If you do not run BTCPay Server, this notice does not apply to you.

What to do now

Update to BTCPay Server 2.4.2 or later. On a standard install: Server Settings, Maintenance, Update. Confirm the admin footer shows BTCPay Server 2.4.2 or newer and, if you use LND, that LND is on 0.21.1. The update regenerates LND macaroons. (BTCPay Server advisory)
If you use LND and cannot update right away, take the server offline until you can. Do not leave an affected LND deployment reachable from the internet. (BTCPay Server advisory)
Review LND activity. Check for payments you did not make, unexpected channel closures or unfamiliar peers, and balances that do not match your records. (BTCPay Server advisory)
If you ran 2.4.1 or earlier (even if you patched after November 1): treat the box as compromised. Sweep remaining hot-wallet funds to a new wallet and seed on a trusted device. Take the old server offline. Preserve logs and transaction records you need. Stand up a fresh virtual machine, install the latest BTCPay Server from trusted sources, and connect the new wallet. Do not restore the whole old server. From a trusted device, rotate hosting, SSH, application, API and Lightning credentials the old server could access. Do not type new secrets on the old machine. (November 2 incident post)
If you already ran 2.4.2 or later on November 1: the project reported no impact from that November wave on those servers, but keep current and still review LND activity if you use LND. (November 2 incident post)

What to send your developer, agency or host

Please check every BTCPay Server we run. CVE-2026-119757 in versions before 2.4.2 (including 2.4.2 release candidates) let unauthenticated attackers obtain LND .macaroon credentials; the vendor confirmed real thefts, and a November 1 to 2, 2026 wave hit servers still on 2.4.1 or earlier. Update to 2.4.2 or later and confirm LND 0.21.1 on standard installs. If any instance ran 2.4.1 or earlier, even if updated after November 1: sweep hot-wallet funds to a new wallet/seed, take the old server offline, build a fresh VM with latest BTCPay, rotate hosting/SSH/API/Lightning credentials, and do not restore the old server image. Please confirm versions and what you found. Sources: BTCPay Server advisory, November 2 incident post, CVE-2026-119757.

Common questions

Has my store been drained?

This notice does not mean your funds are gone. It means the vendor confirmed thefts against vulnerable BTCPay/LND setups and you should check your version, balances and LND activity today.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We cannot see whether you run BTCPay Server, which version it is on, or what Lightning implementation you use. A scan without a warning about this does not mean your payment server is safe.

I only use on-chain payments, not Lightning. Am I safe?

The LND credential theft path targets LND. The vendor still strongly encourages updating BTCPay Server. In the November wave, wallets whose spending keys stay off the server were not drained in the reported thefts, but an old server can still be compromised in other ways, so the rebuild guidance for 2.4.1 and earlier still applies. (BTCPay Server advisory, November 2 incident post)

Is updating enough if I was on 2.4.1?

No. The project says updating alone cannot remove access an attacker may already have. Rebuild on a fresh VM with a new wallet seed. (November 2 incident post)

Where can I follow updates?

Follow the BTCPay Server advisory, the November 2 incident post and the incident response post. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

BTCPay Server advisory: "Security Advisory: Update BTCPay Server to 2.4.2 Immediately", posted August 7, 2026 (page last checked November 6, 2026); LND .macaroon disclosure; confirmed exploitation and thefts; fixed in 2.4.2; LND 0.21.1 on standard installs.
November 2 incident post: "Security Incident Affecting BTCPay Server 2.4.1 and Earlier", November 2, 2026; November 1 reports; rebuild guidance for 2.4.1 and earlier.
incident response post: "BTCPay Server Security Incident: Our Response and Next Steps", August 10, 2026.
CVE Program: CVE-2026-119757 (VulnCheck), checked November 6, 2026.
CISA KEV catalog JSON (feed), checked November 6, 2026: CVE-2026-119757 not present in that snapshot.