Critical vulnerability in BTCPay Server exposed LND credentials, allowing attackers to drain merchant Lightning wallets. Immediate patching urged.