BTCPay Server warns of hot-wallet thefts on older installations
BTCPay Server has urged operators to update after attackers stole Bitcoin and Litecoin from hot wallets hosted on instances running version 2.4.1 or earlier. The self-hosted, open-source cryptocurrency payment processor said its investigation found that the attacks targeted releases up to 2.4.1, which was issued on 23 July 2026.
The company said the attackers used a different method to exploit the vulnerability fixed in BTCPay Server 2.4.2, released on 7 August 2026. Reports of the latest thefts began to surface around 1 November 2026, although it is not known when exploitation began.
Latest release has no credible drain reports
BTCPay Server said it had received no credible reports of hot-wallet drains from users running version 2.4.7. That release addresses one critical and several medium-severity vulnerabilities identified through Anthropic's OSS scanner.
The company has published a Bitcoin address and a Litecoin address associated with the incidents. Publishing these indicators may help affected organizations review transactions and investigate potential exposure, but BTCPay Server's principal guidance is to upgrade and follow the stated recovery process.
Recovery requires a fresh server and wallet
Operators running BTCPay Server 2.4.1 or older are advised to move to a fresh server with a new wallet, including where they have not identified missing funds. For a suspected theft or unauthorized access, the organization said the entire machine and all secrets stored on it should be considered compromised.
The warning follows BTCPay Server's August disclosure that attackers had weaponized a critical issue affecting all versions of the software. The flaw was patched in 2.4.2. BTCPay Server said the August issue could let an unauthenticated remote attacker obtain .macaroon credential files for LND, a Lightning Network implementation.
Those credentials could be used to take control of an LND node and move funds. The attacks reviewed in the August alert targeted files with the .macaroon extension. BTCPay Server has not established whether the newly reported incidents are connected to that earlier exploitation.
Limit hot-wallet exposure
BTCPay Server advised organizations that require hot wallets for daily operations to retain only the funds needed on the server. Remaining funds should be held in a wallet whose spending keys are not stored on the server. Customers using a hosting provider may also find that an instance has been shut down automatically to prevent exploitation of older versions.
The practical implication is clear: teams operating BTCPay Server should verify their deployed version, migrate rather than merely patch when they are on 2.4.1 or older, rotate secrets as part of a full compromise response, and limit online wallet balances to operational needs.