
Stolen macaroons drained BTCPay Lightning nodes
BTCPay Server 2.4.2, released 7 August 2026, closed a hole that let an unauthenticated remote attacker read LND credential files off a merchant's server. Anyone holding the admin one can move the node's money, which is what happened.