An active exploit in August 2026 targeted BTCPay Server installations, exposing administrator credentials and allowing attackers to drain funds from some connected Lightning nodes.

From the articleCore Lightning Warns Bitcoin Node Operators to Upgrade After Attack ReportsAlso in Is Your Bitcoin on Lightning at Risk? Depends on Who Runs the Node, Bitcoin Lightning security alert issued as attackers target older Core Lightning nodes