> ## Content Index > Fetch the complete content index at: https://blog.fizen.io/llms.txt > Use this file to discover other available public pages before exploring further. # A Live Exploit Is Draining BTCPay Merchants' Lightning Nodes - URL: https://blog.fizen.io/btcpay-server-exploit-lightning-nodes-2026/ - Published: 2026-08-11T12:00:00.000Z - Updated: 2026-08-11T11:59:59.000Z - Description: Attackers emptied Lightning nodes belonging to merchants running BTCPay Server, in some cases before the public warning went out. Update to 2.4.2 or take the node offline. - Author: Quinn Dao - Tags: Crypto News **Key takeaways** - BTCPay Server issued an emergency security alert on August 7, 2026 over a critical vulnerability that attackers were already exploiting. - Merchant Lightning nodes were drained, with hardware wallet maker Foundation and bitcoin zine Citadel21 among those reporting losses. - Some drains happened hours before the public warning, so waiting for confirmation was itself costly. - The fix is to update to version 2.4.2 immediately, or take the server offline until you can. - This is self-hosted payment infrastructure failing, not the Bitcoin or Lightning protocols themselves. If you run BTCPay Server, stop reading and go update it. Attackers have been actively exploiting a critical flaw and emptying Lightning nodes belonging to merchants, and in at least some cases the funds were gone before the public alert appeared. ## What happened - BTCPay Server published an emergency alert on August 7, 2026 warning of a critical vulnerability under active exploitation that can result in loss of funds, per [Crypto Briefing](https://cryptobriefing.com/btcpay-server-critical-vulnerability-update/?ref=blog.fizen.io). - Attackers quietly drained Lightning nodes tied to BTCPay instances; hardware wallet maker Foundation and bitcoin zine Citadel21 both reported drained nodes, some hours before the warning went public, per [CoinDesk](https://www.coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes?ref=blog.fizen.io). - The instruction is to update to **version 2.4.2** via Admin Dashboard, then Server, then Maintenance, then Update, or to take the instance offline until patched, per [crypto.news](https://crypto.news/btcpay-server-warns-active-exploit-may-drain-funds/?ref=blog.fizen.io). ## Who is affected This hits merchants and self-hosters, not ordinary wallet users. BTCPay Server is popular precisely because it is self-hosted and non-custodial: businesses run their own payment processor instead of trusting a third party. That independence is real, and so is the responsibility it carries. Running your own infrastructure means you are also your own security team, and patch timing is now part of your revenue risk. ## What to do right now - Update to 2.4.2 immediately, or shut the instance down until you can. - Check your Lightning channel balances and recent activity for movements you did not authorise. - Reduce hot channel balances to what you genuinely need for daily flow, and keep the rest in cold storage. - Subscribe to the project's security announcements so the next alert reaches you in minutes, not hours. ## The wider pattern This lands in a year where, according to Blockaid, crypto has already lost over $1 billion to exploits across more separate incidents than all of 2025\. The common thread is that the software around the chains is what breaks. If you accept crypto payments and do not want to run and patch your own node stack, the alternative is a payment path where the balance you hold stays in your own wallet and the plumbing is somebody else's full-time job. That is how [Fizen](https://fizen.io/?ref=blog.fizen.io) handles USDT payments by QR and Visa card. ## Frequently asked questions #### What is the BTCPay Server vulnerability? A critical flaw disclosed on August 7, 2026 that was already being actively exploited to drain Lightning nodes connected to BTCPay Server instances. The project urged an immediate update to version 2.4.2. #### How do I fix the BTCPay Server exploit? Update to version 2.4.2 through Admin Dashboard, Server, Maintenance, Update. If you cannot update right away, take the server offline until you can. #### Who lost funds in the BTCPay exploit? Merchants running affected BTCPay instances had Lightning nodes drained. Hardware wallet maker Foundation and bitcoin zine Citadel21 publicly reported drained nodes, some before the alert was issued. #### Does this mean Bitcoin or Lightning is broken? No. The flaw was in BTCPay Server, a self-hosted payment application, not in the Bitcoin protocol or the Lightning Network itself. ![](https://storage.ghost.io/c/04/ee/04eee3a6-7d95-474c-80a5-48f84338363b/content/images/2026/08/_b_btcpay-1.png) #### Take payments without running a server Accept and spend USDT by QR and Visa card from a self-custody wallet, with no node to patch. Backed by an investment from Tether. [Download the app](https://fizen.io/app?accessCode=VJBw&utm%5Fsource=blog&utm%5Fmedium=fizen&utm%5Fcampaign=app%5Fdownload&utm%5Fcontent=btcpay-server-exploit-lightning-nodes-2026&aid=6a7a90980298828c287c0b9f) This is news coverage, not financial advice. Fizen is a self-custody app, backed by an investment from [Tether](https://tether.io/news/tether-announces-strategic-investment-in-fizen-to-strengthen-global-stablecoin-utilization-and-self-custody-solutions/?ref=blog.fizen.io). ### Related reading - [Crypto lost over $1 billion to hacks in six months](https://blog.fizen.io/crypto-hacks-1-billion-first-half-2026/) - [Crypto card scams and how to avoid them](https://blog.fizen.io/crypto-card-scams-avoid-2026/) - [What is a crypto card and how does it work?](https://blog.fizen.io/what-is-a-crypto-card-2026/) - [Why 'no KYC' crypto cards carry platform risk](https://blog.fizen.io/no-kyc-crypto-cards-risks-alternative/) - [Stablecoins 101: a beginner's guide](https://blog.fizen.io/stablecoins-101-beginners-guide/)