BTCPay Server warns of malicious bots targeting Lightning nodes

BTCPay Server has issued a warning regarding automated bots probing exposed Lightning nodes to gain administrative control. The bots are targeting servers where operators have manually restored external access to LND, attempting to exploit a password-change endpoint that remains vulnerable during node restarts. While no successful takeovers have been reported from this specific activity, it follows a critical vulnerability exploited in August that allowed attackers to drain merchant wallets.