BTCPAY MACAROONS COOKED — FOUNDATION, CITADEL21 NODES SWEPT BEFORE THE PATCH LANDED

The Maximalist read. Self-hosted Lightning infrastructure was the Max answer to custodial payment rails: run your own node, hold your own keys, don't hand your commercial payment flow to a hosted service that can freeze you. BTCPay Server — the reference open-source stack for that story — shipped a Greenfield API vulnerability that let an attacker bypass 2FA and mint a macaroon with withdrawal permissions. Nodes at Foundation Devices and Citadel21 were drained before the patch landed. Sovereignty stack breaks under its own weight.

This is the second self-custody-stack incident in a week. Last week's Coldcard silent-entropy postmortem drained an estimated nine-figure sum from wallets seeded on affected firmware. This week's BTCPay macaroon exploit is smaller in dollar terms but structurally identical: an open-source primitive that the operator class trusted got audited by a hostile actor before it got audited by a friendly one. In both cases the failure was in the audit trail, not in the doctrine. The doctrine is right. The implementation is what has to earn the trust.

The Maximalist doesn't respond to this by moving back to custodians. The Maximalist responds by hardening the discipline: (1) minimum-privilege macaroons scoped per operation, not blanket withdrawal rights, (2) hardware-signer requirements on any node holding meaningful float, (3) watchtowers running on separate infrastructure, (4) treating any self-hosted stack as a live system that needs continuous audit and staged upgrades, not a set-it-and-forget-it appliance. The wrapper class will point at this and say 'that's why you should use us.' The right answer is 'that's why the operator class runs a tighter audit cycle than you do.'

What K's readers should track. (1) BTCPay maintainer disclosure timeline — when the exploit was first reported vs when it was patched vs when it was communicated to node operators. (2) Whether Foundation Devices and Citadel21 publish incident postmortems — the Max ecosystem is stronger when the operator-class targets publish exactly what went wrong. (3) The systemic question: how many BTCPay nodes ran unpatched in the exploit window, and what fraction of Lightning commercial flow was exposed. The answer sizes the next attack surface.