BTCPay Server users urged to patch after hot wallet thefts

Self-hosted cryptocurrency payment processor BTCPay Server has issued an urgent warning to its user base following confirmed reports of fund thefts. The incidents involve attackers draining Bitcoin and Litecoin from hot wallets on servers running outdated software versions. Reports of these exploits began surfacing around November 1, 2026, prompting the project maintainers to advise immediate remediation for all affected instances.

What happened

The security team at BTCPay Server identified that the attacks specifically targeted instances running version 2.4.1 or earlier. This version was released on July 23, 2026. The vulnerability in question was patched in version 2.4.2, which became available on August 7, 2026. According to the investigation, the attackers employed a method distinct from previous exploits to compromise these older installations. While the exact start date of the campaign remains unknown, the recent surge in reports indicates active exploitation in the wild.

Users currently operating on versions 2.4.1 or older are advised to take drastic measures. The recommendation is not merely to update the software, but to migrate to a completely fresh server with a new wallet. This advice applies even if the user has not yet detected any missing funds. The logic behind this strict guidance is that once an attacker gains access, they may have established persistent backdoors or extracted secret keys that remain valid even after a software patch. Consequently, any machine suspected of unauthorized access must be treated as fully compromised, requiring a total reset of secrets and credentials.

The project confirmed that there are no credible reports of thefts from users running the latest release, version 2.4.7. This latest update addresses one critical and several medium-severity vulnerabilities discovered through Anthropic's OSS scanner. To aid in tracking the stolen assets, BTCPay Server published two specific wallet addresses linked to the incidents: a Bitcoin address starting with bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 and a Litecoin address starting with ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee.

Key details

• Affected versions: BTCPay Server 2.4.1 (released July 23, 2026) and all earlier versions.
• Patched version: Version 2.4.2, released on August 7, 2026, fixed the exploited vulnerability.
• Current safe version: Version 2.4.7 shows no credible reports of hot wallet drains.
• Recommended action: Users on vulnerable versions should move to a fresh server with a new wallet, regardless of whether theft is visible.
• Compromise scope: Any suspected breach requires treating the entire machine and all stored secrets as compromised.
• Stolen assets: Confirmed thefts involve Bitcoin and Litecoin from hot wallets.

Background

BTCPay Server is a popular open-source solution for merchants who wish to accept cryptocurrency payments without relying on third-party processors. It is typically self-hosted, meaning the user manages the server infrastructure, security updates, and wallet keys. A "hot wallet" in this context refers to a cryptocurrency wallet that is connected to the internet and stored on the server itself. This setup allows for automated payment processing but carries higher risk than "cold storage," where keys are kept offline.

The vulnerability exploited in these recent attacks allowed unauthorized access to credential files, specifically .macaroon files used by LND (Lightning Network Daemon). LND is an implementation of the Lightning Network, a layer-2 protocol designed to make Bitcoin transactions faster and cheaper. In a previous disclosure in August 2026, the team noted that attackers could use these credentials to take control of an LND node and move funds. While it is unclear if the current campaign uses the exact same vector, the focus on older, unpatched versions suggests a similar reliance on known, unaddressed security gaps.

Why it matters

For teams and individuals who self-host financial software, this incident underscores the critical importance of timely patch management. Unlike centralized services where the provider handles security updates transparently, self-hosted environments place the entire burden of maintenance on the operator. Falling behind on updates, even by a few months, can leave systems exposed to active exploitation campaigns. The fact that attackers are targeting versions from July 2026 suggests they are scanning for known vulnerabilities that many operators may have neglected.

Furthermore, the recommendation to rebuild the server entirely highlights the severity of potential compromises. In traditional IT security, patching a vulnerability is often seen as sufficient. However, in cryptocurrency contexts, the theft of private keys or authentication tokens means the attacker retains access even after the hole is plugged. This necessitates a more rigorous incident response protocol, including key rotation and infrastructure replacement, which can be operationally expensive and complex for small teams.

This event also occurs against a backdrop of broader instability in the crypto sector. Recent months have seen significant breaches, including a $6.43 billion theft from Binance attributed to North Korean actors, a $2.65 million exploit at Polymarket, and supply chain attacks involving hardware wallets like Trezor. For sysadmins managing self-hosted crypto tools, the threat landscape is increasingly sophisticated, requiring vigilance not just in software updates but in holistic security hygiene.

What you can do

• Check your version: Immediately verify if your BTCPay Server instance is running version 2.4.1 or earlier.
• Upgrade or migrate: If vulnerable, upgrade to version 2.4.7 or later. If you suspect any prior compromise, migrate to a new server with new wallet keys.
• Minimize hot wallet funds: Keep only the minimum necessary funds in online hot wallets for daily operations. Store the majority of assets in cold storage with keys held off-server.
• Monitor for anomalies: Review server logs and wallet transaction histories for any unauthorized activity, even if no funds appear missing initially.
• Isolate secrets: Ensure that sensitive credential files, such as .macaroon files, are properly permissioned and not accessible to unauthenticated users.
• Stay informed: Follow official BTCPay Server channels for future security advisories and consider automating update checks where possible.