Machankura Fully Restores Bitcoin On-Chain and Lightning Functionality After Critical BTCPay Server Vulnerability
Machankura, the popular USSD-based Bitcoin service that lets users across Africa send and receive sats on basic feature phones, has fully restored both on-chain and Lightning Network spending and receiving.
The service confirmed the complete return of functionality on August 10, 2026, just days after temporarily limiting operations in response to a critical vulnerability in BTCPay Server.
Quick Timeline of Events
On August 7, 2026, BTCPay Server issued an urgent security advisory. A critical flaw in all versions prior to 2.4.2 (including release candidates). Allowed unauthenticated remote attackers to obtain LND “.macaroon” credential files. These credentials could give full control of connected Lightning nodes. Enabling attackers to close channels and drain funds.
The vulnerability specifically affected deployments using LND, the most common Lightning Network implementation. BTCPay Server’s standard on-chain wallets were not impacted. Confirmed cases included hardware wallet maker Foundation and Bitcoin publication Citadel21, whose Lightning nodes were swept.
BTCPay urged operators to update immediately to version 2.4.2 via the Admin Dashboard (Server → Maintenance → Update). And verify the version in the footer. The patch upgrades LND to 0.21.1 on standard deployments and regenerates macaroons automatically. Those unable to update were advised to take servers offline.
Machankura’s Rapid Response
Machankura, which powers USSD Bitcoin access in Côte d’Ivoire, Ghana. Kenya, Malawi, Namibia, Nigeria, South Africa, Uganda, and Zambia, reacted quickly. The team quoted the BTCPay alert and temporarily disabled Lightning spending along with all receiving (both on-chain and Lightning). While applying the fix. On-chain spending remained available throughout.
Later the same day, Machankura restored Lightning spending and confirmed both on-chain and Lightning spending were fully operational again. The team stated it would continue monitoring before re-enabling receiving.
On August 10, Machankura announced complete restoration: “Functionality to receive and spend Bitcoin via onchain or Lightning on 8333.mobi is now fully restored. Thank you very much for the patience.”
This careful, phased approach protected user funds while the team patched systems and verified security.
Why Machankura Matters in Africa?
Machankura has become a key Bitcoin on-ramp across the continent by removing the need for smartphones or internet connectivity. Users simply dial short USSD codes, such as 4838333# in Kenya or 3478333# in Nigeria, to check balances, send sats, or spend through partners.
The service maintains its own Lightning nodes to provide liquidity and enable fast, low-cost transactions. By restoring full functionality so quickly after applying the BTCPay Server 2.4.2 update. Machankura minimized disruption for its users while prioritizing security.
BTCPay Server’s Follow-Up Actions
As of August 10, 2026, BTCPay Server published a full security advisory, thanked researchers including Craig Raw and the Bitcoin Red Team, and donated 0.21 BTC to each.
Supporters also offered a recovery bounty of 10% of recovered funds (capped at 3 BTC) for information leading to the return of stolen assets.
Advice for Users and Operators
Machankura users: On-chain and Lightning spending and receiving are now fully operational. Dial your country’s USSD code or follow @Machankura8333 on X for the latest status.
BTCPay Server operators using LND: Update to 2.4.2 immediately if you have not already done so. Rotate macaroons, review node activity for any unauthorized payments or channel closures, and check balances carefully.
General advice: Keep self-hosted software updated, limit exposure of sensitive credentials, and monitor accounts regularly.
Machankura’s transparent updates and rapid restoration demonstrate strong operational security. The incident serves as a clear reminder of the importance of timely patching across Bitcoin infrastructure.
For official details, visit the BTCPay Server security advisory and follow the latest X posts from @BtcpayServer and @Machankura8333.