Bitcoin Payment Tool Exploit Lets Attackers Drain Merchant Wallets

Businesses that accept bitcoin payments via Lightning Network infrastructure are being urged to act immediately after attackers began exploiting a vulnerability in LND, a widely used piece of software for running Lightning nodes. The flaw allows attackers to steal credentials that grant control over Lightning wallets, potentially enabling them to move and drain merchant funds.

BTCPay Server, a popular open-source payment processor used by many small merchants to accept cryptocurrency, has told all users running LND to update their software immediately. For businesses unable to patch right away, BTCPay recommends taking affected servers offline entirely until the update can be applied, to prevent further exposure.

While cryptocurrency payments remain a niche option for most Australian small businesses, those that do accept bitcoin or run related infrastructure should treat this as a high-priority security issue. Payment infrastructure of any kind is an attractive target for cybercriminals, and delays in patching known vulnerabilities are one of the most common ways attackers gain access to financial systems.