Hook
Most self-custody incident reports open with a compromised seed phrase. This one opens with a file. Late last week, BTCPay Server confirmed an actively exploited vulnerability that lets an unauthenticated remote attacker read arbitrary files from a running instance — including the Lightning Network Daemon’s .macaroon credential directory. Days later, Galaxy Research confirmed a separate but thematically adjacent loss: 1,719 BTC, roughly $111 million at current prices, stolen from Coldcard users. Expected total losses are already being revised above $130 million.
The bitcoin protocol was never touched. The consensus layer is intact. What broke is the unglamorous middleware that self-custody operators stack around the chain: a self-hosted payment processor, a hot-wallet Lightning daemon, and the file-based bearer credentials that connect them. This is tracing the gas leak in the untested edge case — except the edge case is a web server in front of a hot wallet, and the gas leak has already ignited.
Context
BTCPay Server is the anti-BitPay. An open-source, self-hosted payment processor, it exists so merchants can accept bitcoin without surrendering KYC data to a custodian or paying the 1–3 percent processing fee that hosted gateways charge. It has no token, no treasury, no investor allocation, no protocol revenue. It is not a business; it is plumbing. In the self-custody stack, it handles invoices, address allocation, payment confirmation, and reconciliation.
Underneath sits LND, the Lightning Network Daemon, one of the core node implementations of Lightning. LND is a hot wallet by architectural necessity. To route payments and sign channel state updates quickly, its keys live on an online server. Access control is handled by macaroons — bearer credentials descended from Google’s macaroon research. They are not cryptographic keys; they are capability tokens. The admin.macaroon file is the master key: it grants full API authority, including the ability to close channels and sweep balances.
Coldcard, made by Coinkite, occupies the opposite pole: an air-gapped hardware wallet whose marketing promise is that funds remain safe even if the host computer is fully compromised. Its entire value proposition is that private keys never meet a network.
These two incidents appear unrelated. They are not. In the dominant self-custody workflow they are coupled: merchants run BTCPay on a VPS, connect it to an LND node, and keep long-term savings on a Coldcard, signing transactions through Specter, Electrum, or a multisig coordinator. Modularity isn’t a feature in this stack; it’s an entropy constraint. Every additional tool, every additional credential file, and every hot-wallet daemon multiplies the ways a determined attacker can do what the user does.
Core
The attack chain, step by step
Walk the BTCPay chain as code, not narrative.
Step one: the entry point. BTCPay Server exposes a web interface to the internet. The confirmed vulnerability lets an unauthenticated remote attacker read files from the host — including the directory where LND stores its macaroons. The bug class is mundane: a path traversal or arbitrary file read. The payload is not: a raw admin.macaroon, plus node connection details if the directory listing cooperates.
Step two: escalation. A macaroon is a bearer token. Whoever holds it is, for every API purpose, the node operator. The attacker does not need to break LND cryptography; the credential file IS the authorization boundary. With admin.macaroon, the attacker lists open channels, crafts a channel-closing transaction that routes balances to a node under their control, and broadcasts it. Payment channels are designed to close, and from the network’s perspective, this settlement is legitimate. No double-spend, no consensus violation, no anomaly for a monitoring dashboard to flag.
Step three: the blast radius. The vulnerability specifically impacts deployments where BTCPay connects to LND. Non-LND users are not directly exposed. The seam between an open-source web application and a hot-wallet daemon sharing a host is precisely where the attack lives.
This pattern is not new to me. In a 2025 cross-chain bridge review, I found a reentrancy flaw in an optimistic verification module that had passed multiple audits. The reason it survived: auditors read the smart contract, while the actual attack ran through a message-passing API nobody had modeled as a trust boundary. Same error here. Everyone audits the vault door; nobody audits the HVAC duct that runs into the vault.
What the fix does — and cannot do
The patch pair is technically competent. BTCPay Server 2.4.2 closes the file-disclosure bug. LND 0.21.1 goes further: it regenerates all macaroon credentials during upgrade. This is the right move precisely because bearer tokens cannot be individually revoked. If a token has leaked, the only practical remedy is to reissue everything at the source. After upgrade, even a successfully stolen admin.macaroon becomes a dead file. The disclosure strategy — confirm the incidents, advise immediate action, withhold technical details — is responsible and disciplined. Publishing the exploit path before the laggard population patches would hand the scanners a map.
But there are limits the release notes will not advertise. The upgrade invalidates stolen credentials; it does not replay history. Funds already routed out of channels are gone. And the upgrade only protects the population that actually runs it. A single web-layer bug cascades into total loss of every satoshi in open channels because the credential model has no defense in depth. There are no spending limits, no multi-factor approval for channel closes, no velocity checks on bulk fund movement. admin.macaroon is a skeleton key by design; the system’s security assumption is that the file never leaves the server. The moment a web endpoint can read it, the assumption collapses. There is no second gate.
The deeper design issue is that LND is a hot wallet, and the payment-processor layer must be internet-facing by definition. Latency is the tax we pay for decentralization. The upgrade chain — announcement, patched binary, operator action — is a race between vendors and scanners. The quiet phase before public disclosure is exactly when the exploit was being used in the wild. The public patch closes a door that may have been open for a long time. My expectation, based on how internet-wide scanning campaigns behave, is that the attacker audited the public BTCPay population, harvested credentials from a subset, and monetized them selectively to avoid triggering alarms. The reported number is almost certainly a floor.
The Coldcard unknown
The 1,719 BTC loss demands a different analytical frame. That is cold-storage-scale money, not hot-wallet change. The size alone suggests the funds were held in addresses managed by the hardware wallet workflow — and that the attacker touched the operational layer around the device, not the device itself.
A hardware failure mode would be a once-in-a-generation catastrophe for Coinkite, and no evidence currently points there. The realistic vectors are all software-adjacent: the SD card import flow that moves partially signed transactions between air-gapped device and computer; the desktop wallet that constructs and finalizes transactions; the multisig coordinator that holds xpubs and watches descriptors; a compromised machine with write access to a pending transaction. Coldcard is air-gapped, but the workflow around it is not. This is why Galaxy Research confirms the scale while remaining silent on the vector: 1,719 BTC is certain, the mechanism is not.
The barrel effect and the security island
Here is the uncomfortable synthesis. Self-custody security equals the weakest tool in the chain. A user can hold the finest cold-storage hardware on earth and still lose everything through an unpatched BTCPay node on the same logical estate, or through a desktop coordinator that signs what it is told to sign. The two events are not duplicate stories; they are two symptoms of the same structural condition: the bitcoin self-custody ecosystem is a collection of security islands. Each tool publishes its own advisories, patches on its own schedule, and assumes every other tool is already secure. There is no unified incident-correlation mechanism that helps a merchant answer the most basic question: “Is my stack in the blast radius?” The absence of such a mechanism converts every disclosure into a race between the slowest updater and the fastest scanner.
This also explains what happens next. The demand signal from these incidents will flow toward managed self-custody tooling: Docker deployments with automatic update watchers, appliance-style nodes with push patches, third-party monitoring services that watch channel states and unusual close patterns. The market will price what I call “self-custody with a maintenance contract.” That is a market signal worth more attention than the bitcoin price, which will not notice $130 million.
Contrarian: Four blind spots the price will ignore
First, the numbness. Historical analogs — Bitfinex’s 120,000 BTC in 2016, Ronin’s $625 million in 2022, Atomic Wallet’s $100 million in 2023 — all show the same signature: marginal price impact, fast decay, no structural damage. At this scale, news does not move bitcoin. But no price impact is not no consequence. The price cannot see the trust discount accumulating in the operating costs of every merchant who now budgets upgrade time, node monitoring, and insurance against their own stack.
Second, upgrade is not fixing. The patch creates two populations: the protected and the exposed. The exposed population is a honeypot. The code is a hypothesis waiting to break, and for every unpatched instance still running a pre-2.4.2 BTCPay with a remote LND, the hypothesis has already been confirmed by whoever is scanning the internet tonight.
Third, misattribution. If the Coldcard loss is eventually traced to workflow software rather than the hardware device, it will nevertheless be reported as a hardware-wallet failure. Misattribution pushes users toward custodial services exactly when the self-custody trust discount is widening, and it spares the real culprit — the unmanaged software perimeter — from scrutiny.
Fourth, the independence assumption. Public disclosure has confirmed two smoke stacks. The hidden assumption is that they are separate fires. The timing, the targeting of self-custody seams, and the operational sophistication all fit a coordinated campaign against toolchain middleware. Confirmed loss estimates are a lower bound, and they will be revised upward.
Takeaway
The next major bitcoin loss will not come from the protocol. It will come from the unpatched middleware between a cold wallet and a merchant dashboard. Self-custody was never free; its cost was just denominated in maintenance hours rather than dollars. The question for every operator running BTCPay, LND, or any credential-gated hot service is no longer whether the stack is sound in theory, but whether it can be patched in time — before a scanner finds it, before a macaroon leaks, before a channel closes in the wrong direction. Your Coldcard is cold. Is your server room on fire?