A rough week for bitcoin's software is getting worse, this time hitting merchants who accept bitcoin BTC $ 65,252.85 payments through Lightning, a separate network built on top of bitcoin for instant, low-cost transfers. Attackers drained Lightning nodes running behind BTCPay Server late on Friday after exploiting a critical vulnerability that exposed the credentials protecting them, the team said in an X post. BTCPay confirmed funds were stolen and told anyone running LND, the most widely used software for operating a Lightning node, to update immediately to version 2.4.2 or take the server offline. The flaw allowed an unauthenticated remote attacker to obtain “.macaroon” files, or credentials that give software permission to interact with an LND Lightning node. Chief Executive Zach Herbert said attackers drained the company's BTCPay Lightning node overnight, closing its channels and sweeping the funds.