Operators should verify that BTCPay Server is on version 2.4.4 or newer, remove any self-made forwarding rules, rotate macaroons if the node was reachable via a self-managed path, and enable remote access only through BTCPay’s official options with restricted rights.

A practical checklist for operators emphasizes identifying the current version, updating to 2.4.4, auditing and removing arbitrary forwardings, rotating exposed credentials, and re-establishing remote access solely through official settings with restricted macaroons.

Automated probing bots have targeted unprotected LND endpoints since August, attempting to exploit the restart unlock window, though no damage from September probing has been reported yet.

Older BTCPay wallets that used a shared default password increased risk by allowing attackers to submit a password change and request an administrator macaroon during a vulnerable restart window.

BTCPay disables external access to LND in its standard Docker deployment and has implemented hardening measures to mitigate restart-time password-change windows.

BTCPay is actively monitoring threats, coordinating with exchanges, blockchain analytics firms, and law enforcement in past incidents and ongoing responses.

The September 2026 update closes unauthenticated paths at the reverse proxy and removes the shared default password, while leaving user-managed reverse proxy rules intact.

Version 2.4.4, released in early September, introduces unique random passwords for new LND wallets and rotates passwords for older installations to address credential exposure.

The 2.4.4 release brings broader updates (Bitcoin Core 31.1, LND 0.21.3-beta), removes Knots support, and tightens container security by limiting maintenance access to a defined command set.

BTCPay Server 2.4.4 closes the public default route to a Lightning node but does not remove self-created routes, so users must both update and purge self-managed access.

For German merchants using a non-custodial BTCPay Node, security and updates are user responsibilities, with custodial providers offering lower maintenance risk.

The standard reverse proxy now blocks unauthenticated wallet setup and unlock methods, preventing restart-time exposure via the public path, though protections do not cover operators using their own LND configurations.