Loading story…
BTCPay Server issued an emergency warning after confirming active exploitation of a critical flaw that allowed attackers to compromise self-hosted payment servers and steal funds from connected LND Lightning nodes. The project told operators to upgrade immediately to BTCPay Server 2.4.2 and NBXplorer 2.6.10, or shut systems down if patching was not possible. Public reports said affected users had channels closed and balances swept, and organizations including Foundation were identified among victims, while the total number of impacted deployments and losses remained unclear.
Reporting tied the issue to BTCPay Server’s Greenfield API authentication flow, where HTTP Basic authentication could bypass two-factor protections for accounts using TOTP without a FIDO2 credential. BTCPay said attackers were able to steal Lightning credentials, including LND macaroons, and warned that patching alone would not invalidate stolen secrets. Operators were instructed to rotate macaroons and related credentials and move funds from hot on-chain wallets created inside BTCPay, while the software was changed to enforce account-level 2FA checks and disable Greenfield Basic authentication by default shortly after account creation unless explicitly enabled.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
BTCPay Server released version 2.4.2 as an emergency fix for a critical vulnerability under active exploitation and told operators to upgrade immediately or shut servers down. The release also instructed integrators to update NBXplorer to version 2.6.10.
BTCPay fixed a Greenfield API bug that allowed HTTP Basic authentication to bypass two-factor authentication for some accounts protected by authenticator apps. The bug was distinct from the later-undisclosed flaw BTCPay said was being actively exploited.
A release-day commit marked nine controller methods across five files as non-routable, removing endpoints that had been accidentally reachable over HTTP. The change was part of the broader security response in version 2.4.2.
As part of its response, BTCPay introduced a breaking change that disables Greenfield Basic authentication by default five minutes after account creation unless explicitly enabled. The project described the change as a measure to reduce the blast radius of future authentication bugs.
BTCPay warned that patching alone was insufficient because stolen credentials could remain valid, and instructed users to rotate LND macaroons and other Lightning authentication strings. It also told users with hot on-chain wallets created inside BTCPay to move funds and recreate those wallets.
Craig Raw of Sparrow Wallet was reportedly affected and analyzed logs, helping identify what was happening during the exploitation campaign. Nicolas Dorier credited Raw with figuring out the issue after the attacks were underway.
Before BTCPay's public alert, attackers compromised vulnerable BTCPay Server instances using LND, stole Lightning credentials, and swept funds from affected nodes. Publicly identified victims included Foundation and Citadel21, with reports of channels being closed and balances drained.
BTCPay Server released a critical security patch for shared or multi-tenant deployments that shared internal Lightning nodes, and urged operators of shared instances to update. The changelog credits @yilakb with reporting the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcethecybersecguru.com
Open sourcethedefiant.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceblog.btcpayserver.org
Open sourceblog.btcpayserver.org
Open sourceblog.btcpayserver.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Alby disclosed a critical vulnerability in its self-hosted Lightning wallet, **Alby Hub**, that could allow an attacker to take over an internet-exposed wallet and transfer its bitcoin. The flaw affects versions `1.7.0` through `1.18.5`; exploitation requires the Hub management web interface to be reachable from the internet. Alby knows of one affected user but has not said whether funds were stolen, and it has not released technical details of the vulnerability. The issue was fixed in `v1.19.0`, while Alby recommends upgrading to `v1.24.0`. Organizations and users running affected exposed instances should immediately restrict external access, change the Hub unlock password, and contact Alby security. Alby also corrected documentation and Docker port-binding defaults after discovering they could imply localhost-only access even though the service listened on all network interfaces, increasing the chance of unintended internet exposure.
Sep 10, 2026
ReversingLabs disclosed a long-running npm supply chain campaign dubbed **PromptMink** that inserted malicious dependencies into software projects, including the open-source crypto trading agent `openpaw-graveyard`. In one highlighted case, a commit co-authored by Anthropic’s Claude Opus added `@solana-launchpad/sdk`, which pulled in the malicious `@validate-sdk/v2` payload. Researchers said the operation has run for more than seven months across over 60 malicious packages and 300 versions, using benign-looking first-stage packages to hide disposable second-stage malware. The payloads stole credentials, sensitive files, cryptocurrency-related data, and in some Linux cases installed attacker SSH keys for persistence; later Rust variants also exfiltrated full project directories and source code. ReversingLabs linked the activity to **Famous Chollima**, a North Korea-linked group associated with Contagious Interview. Separately, Socket reported that the widely used PyPI package **`lightning`** was compromised in versions `2.6.2` and `2.6.3`, while `2.6.1` remained clean. The malicious releases reportedly executed on import, unpacked a hidden `_runtime` directory, downloaded Bun from GitHub, and launched an obfuscated JavaScript payload aimed at stealing GitHub, npm, and cloud credentials, abusing GitHub APIs, poisoning repositories, and infecting developer npm package tarballs. Because `lightning` is heavily used in developer workstations, CI/CD pipelines, and cloud build environments, researchers warned that any system that installed and imported the affected versions should be treated as compromised, with exposed credentials rotated and repositories and build systems investigated for follow-on abuse.
Jun 29, 2026
CISA added **CVE-2026-42271** to its Known Exploited Vulnerabilities catalog after evidence emerged that attackers are exploiting a command injection flaw in BerriAI **LiteLLM**. The bug affects MCP server test endpoints in self-hosted LiteLLM deployments, where crafted `stdio` parameters can trigger arbitrary command execution on the proxy host. On its own, the flaw requires a valid proxy API key, but researchers reported it is being chained with **CVE-2026-48710** in **Starlette**—a Host header validation bypass known as **BadHost**—to bypass authentication and achieve unauthenticated remote code execution. The exposed attack path affects LiteLLM versions **1.74.2 through 1.83.6** when deployed with **Starlette 1.0.0 or earlier**, and researchers rated the combined chain as effectively **critical** with a CVSS score of **10.0**. Successful compromise can let attackers run OS commands, steal model provider credentials, API keys, secrets, and environment variables, and pivot into connected AI infrastructure. BerriAI patched the issue in **LiteLLM 1.83.7** by restricting the vulnerable test endpoints to the `PROXY_ADMIN` role, while defenders are being urged to upgrade LiteLLM and Starlette, limit network access to the affected endpoints, rotate stored credentials, and review logs for suspicious Host header and subprocess activity.
Jun 29, 2026