According to CoinMeta, Bitcoin encountered a serious vulnerability over the past week. A flaw in the BTCPay servers allowed attackers to steal funds from multiple Lightning nodes. The attackers exploited this critical vulnerability to obtain credentials that protected the nodes. BTCPay confirmed that funds had been stolen and advised all users running LND to immediately update to version 2.4.2 or take their servers offline. The project has not yet disclosed the number of affected users or the amount of Bitcoin that was stolen. BTCPay stated that the files targeted by the attackers could be used to control nodes and transfer funds. Hardware wallet manufacturer Foundation was also one of the victims; its BTCPay Lightning nodes were emptied by attackers at night. BTCPay's online hot wallets were not affected. Meanwhile, BTCPay narrowed down the scope of the vulnerability after an initial alert, stating that its standard online wallets were not affected by the credential vulnerability. BTCPay has not yet released technical details about the vulnerability, stating that operators need time to fix it.