BTCPay Server urges upgrade after Bitcoin and Litecoin stolen from hot wallets on versions 2.4.1 and older

TLDR

• BTCPay Server says Bitcoin and Litecoin were stolen from hot wallets on servers running version 2.4.1 or earlier.²
• Users on 2.4.1 or earlier are told to move to a fresh server and new wallet, even without a theft.²
• BTCPay has no credible drain reports on 2.4.7, which fixes one critical and several medium-severity flaws.¹⁴

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install its latest version after reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older releases.¹ BTCPay says it received reports on 1 November 2026 and that the attacks targeted servers running 2.4.1, released on 23 July 2026, or earlier.² It says the attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026, and that it has not established when attackers first began exploiting the vulnerability.² BTCPay defines a hot wallet as one that stores the keys needed to spend funds on the server itself.²

BTCPay says servers already running 2.4.2 or later when it issued its 1 November warning showed no impact from these attacks.² For anyone on 2.4.1 or earlier, it strongly recommends moving to a fresh server with a new wallet after sweeping any remaining hot-wallet funds, even if no theft has been noticed and even if the server was updated after the warning.² If funds were stolen or unauthorised access is suspected, it says to treat the entire machine and its secrets as compromised.² Its steps include creating a new seed on a trusted device, taking the old server offline while preserving logs, installing the latest release on a fresh virtual machine without restoring the old server, and replacing hosting, SSH, application, API and Lightning credentials.² It says funds in wallets whose spending keys are held off the server, including hardware wallets, were unaffected, and that it asked VPS providers including LunaNode to take instances offline as a precaution.²

The sources do not settle which vulnerability was used. The Hacker News says it is unclear whether the latest attacks are related to the flaw BTCPay disclosed in August.¹ That August advisory described a critical flaw in all versions before 2.4.2 that could let an unauthenticated remote attacker obtain .macaroon credential files for LND, a Lightning Network implementation, and said BTCPay's on-chain wallets, including hot wallets, were not affected.³ Decrypt reports that BTCPay founder Nicolas Dorier said the attacker had logged in to affected servers with administrator access.⁴ Decrypt also reports that 2.4.7, released on 29 October, fixed one critical and several medium-severity flaws brought to BTCPay's attention through Anthropic's open-source software scanner, and that BTCPay has not said whether the attacks used any of them.⁴ BTCPay said on X that it had no credible reports of hot wallet drains from users on 2.4.7.¹⁴

The scale of the losses is not confirmed. Decrypt reports that BTCPay has not said how many servers were affected or how much was taken.⁴ CryptoSlate reports that blockchain analytics firm Bitquery traced about $1.63 million in suspected thefts, involving 18.38 BTC and 3,405 LTC across 682 wallet sweeps between 30 October and 2 November, while noting BTCPay has not confirmed a total loss figure.⁵ BTCPay says some activity at the addresses named in the incident reports appears to predate the thefts and that their balances should not be treated as a confirmed total of losses.²

Why it matters: self-hosted payment servers that keep spending keys on the machine can be emptied through an old release, and BTCPay says updating alone cannot remove access an attacker may already have gained.²