Updated Aug 9, 2026
/Ohio GOP locked out of replacing Rep. Max Miller after withdrawal deadline passes/BTCPay restricts remote Lightning node access after attackers drain funds/Colorado socialist ousts 15-term Democrat by 13 points, alarming party veterans/Wells Fargo economist Tom Porcelli says Fed rate hikes cannot fix supply-driven inflation/New York Times Posts 16% Profit Gain as Digital Subscriptions Push Toward 15 Million/Hunter Biden says father's prostate cancer has spread beyond bones/Ohio GOP locked out of replacing Rep. Max Miller after withdrawal deadline passes/BTCPay restricts remote Lightning node access after attackers drain funds/Colorado socialist ousts 15-term Democrat by 13 points, alarming party veterans/Wells Fargo economist Tom Porcelli says Fed rate hikes cannot fix supply-driven inflation/New York Times Posts 16% Profit Gain as Digital Subscriptions Push Toward 15 Million/Hunter Biden says father's prostate cancer has spread beyond bones
NewsSOS
← NewswireCrypto

BTCPay restricts remote Lightning node access after attackers drain funds

NEW YORK, Aug. 9. BTCPay moved to block remote access to Lightning nodes after attackers stole funds from operators, the company said. The BTCPay Foundation and Citadel21 both reported drained nodes. The total stolen and the number of affected operators remain unknown.

By Yuki Tanaka2 min read
Share

Key takeaways

  • BTCPay blocked remote access to Lightning nodes after attackers drained funds from operators, the company said on Aug. 9.
  • The BTCPay Foundation and Citadel21 both reported that their Lightning nodes were drained, but neither disclosed a bitcoin or dollar figure.
  • The total amount stolen and the number of affected operators remain unknown.
  • Because BTCPay is self-hosted and non-custodial, funds swept from open Lightning channels cannot be reversed.
  • No timeline for restoring remote access has been provided, and no arrests or law enforcement actions have been reported.

NEW YORK, Aug. 9. BTCPay moved to block remote access to Lightning nodes after attackers stole funds from operators, the company said. The BTCPay Foundation and Citadel21 both reported drained nodes. The total stolen and the number of affected operators remain unknown.

How the attack surface worked

BTCPay Server is an open-source, self-hosted payment processor. Merchants and node operators run it on their own hardware to accept Bitcoin without relying on a third-party custodian. Among its tools is a remote management interface for Lightning Network nodes.

Lightning nodes hold bitcoin in peer-to-peer payment channels. Each open channel carries a live balance. Funds in those channels, once swept, cannot be reversed by any custodian or platform because none exists in a self-hosted setup. If an attacker reaches the remote management interface, open channel balances are an immediate target.

BTCPay restricted that remote access following the reported thefts, the company said. Operators who had used the feature to administer nodes from offsite will need to manage nodes locally until access is restored. No timeline for restoration has been provided.

Named losses, unknown total

The BTCPay Foundation and Citadel21 each disclosed that their Lightning nodes were drained. Neither organization attached a bitcoin or dollar figure to the losses. The method attackers used to reach the remote interface has not been confirmed in available reporting.

The total amount stolen across all affected operators has not been stated. The number of operators hit beyond the two that self-reported is also unknown, according to the source. Whether the incident was confined to BTCPay's remote Lightning feature or involved a separate entry point has not been confirmed.

No arrests or law enforcement actions have been reported.

Related reading

Keep reading

All bulletins →
CryptoAugust 7, 2026

US Senate delays CLARITY Act vote to September, Thune confirms

WASHINGTON, Aug. 7. The U.S. Senate is deferring a vote on the CLARITY Act until September, Senate Majority Leader John Thune reportedly confirmed. Thune described the chamber's move in a single word: "punting."

2 min read
CryptoAugust 6, 2026

SpaceX Bitcoin stake sheds $539 million in value as $BTC slides 33%

HAWTHORNE, Calif., Aug. 5. SpaceX's 18,712 Bitcoin were worth $1.098 billion as of June 30, the company's second-quarter filing shows, a drop of $539 million from $1.637 billion at year-end 2025. Elon Musk's rocket and satellite firm sold…

2 min read
CryptoAugust 5, 2026

UFC 331 schedules 10 fights for Sept. 19 at Crypto.com Arena in Los Angeles

LOS ANGELES, Aug. 6. UFC 331 will carry 10 fights on September 19 at Crypto.com Arena in Los Angeles, according to the full card released by the promotion. The lineup includes Gable Steveson vs. Sean Sharaf and Robelis Despaigne vs. Tai…

2 min read

Frequently asked

What did BTCPay do in response to the attack?

BTCPay restricted remote access to Lightning nodes after operators reported drained funds, requiring operators to manage their nodes locally until access is restored.

How much was stolen and how many operators were affected?

The total amount stolen and the number of affected operators are unknown; only the BTCPay Foundation and Citadel21 self-reported that their nodes were drained.

Why can't the stolen funds be recovered?

BTCPay is an open-source, self-hosted, non-custodial payment processor, so funds swept from open Lightning channels cannot be reversed because no custodian or platform exists to reverse them.

How did attackers reach the remote management interface?

The method attackers used to reach the remote interface has not been confirmed in available reporting.

Have there been any arrests?

No arrests or law enforcement actions have been reported.