BTCPay Server has moved to restrict remote access to Lightning nodes after attackers exploited the setup to drain funds from cryptocurrency operators, according to reports from those affected.
## What Happened The self-hosted payment processor BTCPay Server has tightened controls on how Lightning Network nodes can be accessed remotely, a change prompted by attackers siphoning funds from vulnerable configurations. Bitcoin-focused organizations including Foundation and Citadel21 disclosed that their Lightning nodes had been drained, raising alarm across the community that relies on the open-source software to accept Bitcoin payments.
The Lightning Network is a second-layer protocol built on top of Bitcoin, designed to enable faster and cheaper transactions. Because it requires funds to be locked into payment channels, compromised nodes can expose those balances to theft if remote access is not properly secured.
When node access falls into the wrong hands, the money can vanish before anyone notices.
## The Scale Remains Unclear As of the reports, key details about the incident remain unknown, leaving the broader impact difficult to assess. It is not yet clear how much was stolen in total or how many operators were affected by the exploit.
Both Foundation and Citadel21 confirmed losses, but a full accounting of the damage has not been made public. The uncertainty underscores a persistent challenge in the self-hosted payments space, where individual operators bear responsibility for securing their own infrastructure.
- The total value of stolen funds has not been disclosed.
- The number of impacted node operators is unknown.
- Foundation and Citadel21 are among those confirming losses.
## Why It Matters BTCPay Server is widely used by merchants and Bitcoin advocates who prefer to avoid third-party payment processors, giving them greater control over their transactions. The decision to restrict remote Lightning access reflects a defensive response aimed at closing off the attack vector before further losses occur.
For operators who value self-custody and independence, the episode is a reminder that convenience features like remote access can introduce serious risks if not carefully managed. Users running affected setups are advised to review their security configurations and apply any updates the project releases.