{"id":13184,"date":"2026-09-13T18:57:26","date_gmt":"2026-09-13T18:57:26","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13184"},"modified":"2026-09-13T18:57:26","modified_gmt":"2026-09-13T18:57:26","slug":"bots-are-probing-bitcoin-lightning-nodes-for-a-takeover-route","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13184","title":{"rendered":"Bots are probing Bitcoin Lightning nodes for a takeover route"},"content":{"rendered":"

<\/p>\n

\n

Bitcoin payment processor BTCPay Server has warned that bots are probing exposed Lightning nodes for a potential route to administrative control.<\/p>\n

The activity follows a separate critical BTCPay vulnerability that attackers exploited a month ago to obtain credentials protecting LND nodes and drain merchant wallets.<\/p>\n

BTCPay subsequently disabled external access to LND, a widely used implementation of Bitcoin\u2019s Lightning Network, in its standard Docker deployment. The project now says automated systems are targeting servers where operators manually restored that access, repeatedly calling an LND password-change endpoint.<\/p>\n

\n

Related Reading<\/span><\/p>\n

Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version<\/h3>\n<\/p>\n

<\/span> <\/div>\n

The latest mechanism differs from the vulnerability exploited in August but could lead to a similar outcome: an attacker obtaining credentials that can control an LND node.<\/p>\n

BTCPay said the opening appears during a short interval after LND restarts, while its wallet remains locked. During that period, the targeted password-change method does not require a macaroon, the credential LND normally uses to authorize administrative actions.<\/p>\n

Older BTCPay LND wallets compounded the risk by using a shared default password. An attacker who could reach the interface before BTCPay\u2019s internal unlocker could potentially submit that password first, replace it, and request an administrator macaroon that gives control over the node.<\/p>\n

BTCPay has not reported a successful takeover through the newly observed activity or linked the bots to the attackers behind the August thefts.<\/p>\n

BTCPay hardens nodes after August theft<\/h2>\n

The renewed probing extends a difficult security stretch for BTCPay, which acknowledged on Aug. 7 that attackers had exploited a vulnerability affecting all versions before 2.4.2. That flaw allowed unauthenticated attackers to obtain LND macaroon files and use them to move funds. BTCPay\u2019s standard on-chain wallets were unaffected.<\/p>\n