Skip to content
Hacker Posts

BTCPay Server hot wallets drained on 2.4.1 and earlier

BTCPay Server says Bitcoin and Litecoin were stolen from hot wallets on servers running 2.4.1 (23 July 2026) or earlier. No CVE yet; move to a fresh server on the latest release.

Published 3 min read
breachbtcpaybitcoinadvisory

BTCPay Server, the self-hosted open-source crypto payment processor, says attackers are draining hot wallets on outdated instances. In a security incident notice published 2 November, the project said it received reports on 1 November 2026 of Bitcoin and Litecoin being stolen from hot wallets — wallets that hold the keys to spend funds on the server itself. If you run BTCPay Server 2.4.1 (released 23 July 2026) or earlier, treat your instance as compromised and move to a fresh server now.

What's affected

Servers running 2.4.1 or earlier. BTCPay says instances already on 2.4.2 or later when the 1 November warning went out showed no impact. There is no CVE assigned, and the project has not published a technical root cause. It did say the attackers "used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026" — the critical flaw BTCPay disclosed and patched in August. In other words, the servers hit now are ones that never applied the August fix.

The latest release is 2.4.7. BTCPay told The Hacker News it has no credible reports of hot-wallet drains on 2.4.7, which also resolves one critical and several medium-severity bugs flagged by Anthropic's open-source scanner.

Indicators

BTCPay shared two addresses linked to the thefts, verbatim from its notice:

Bitcoin:  bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee

The project cautions that some activity at these addresses predates the reported thefts, so on-chain balances are not a confirmed loss total.

Action checklist

  1. Check your version at the bottom of the BTCPay Server page after logging in. If it is 2.4.1 or earlier, act even if you have seen no theft.
  2. Provision a fresh VM and install the latest supported release (2.4.7). Do not restore the old server image onto it.
  3. Create a new wallet with a new seed on a trusted device, then sweep remaining hot-wallet funds into it.
  4. Treat the old machine and all its secrets as compromised. Take it offline, preserve logs and transaction records, and from a trusted device revoke and replace hosting, SSH, application, API, and Lightning credentials.
  5. Report theft to local authorities and to security@btcpayserver.org with version history, incident time (with timezone), and transaction IDs — never seed phrases, private keys, or passwords.

Context

This is the second hot-wallet incident to hit BTCPay in three months, and both land on the same fault line: self-hosted payment infrastructure that lags upstream releases. The August flaw was patched in a day; the servers bleeding funds now are the ones still three-plus months behind. For an operator, the lesson is unglamorous — a payment server holding spendable keys is production infrastructure, and an unpatched one is a wallet with the lid off. Until BTCPay publishes a root cause and CVE, the only safe assumption for a pre-2.4.2 instance is that the keys are already gone.

Related stories