Btcpayserver exploit explained:
The old check only refused Basic auth if the user had FIDO2 credentials (a hardware security key). If you secured your account with TOTP (Google Authenticator etc.), ...
I don't understand though... My lightning node got drained but the hot on chain wallet wasn't touched. Do you think they must have gained access from the front door? My password was securely generated from a password manager so couldn't be reuse or brute force...
1