BTCPay Server 2.4.1 and earlier: attackers sweep Bitcoin and Litecoin hot wallets on self-hosted servers

Summary

On 1 November 2026 BTCPay Server received reports of Bitcoin and Litecoin being stolen from hot wallets (wallets whose spending keys are stored on the server). The project warned operators on X at 22:25 UTC to shut down their servers, hosting providers including LunaNode took instances offline as a precaution, and a 2 November investigation update identified BTCPay Server 2.4.1 and earlier as the affected versions. According to the project, attackers used a different method to exploit the vulnerability fixed in 2.4.2.

Affected

• BTCPay Server 2.4.1 (released 23 July 2026) and earlier, with a hot wallet configured
• Fixed in 2.4.2 (released 7 August 2026); later security releases include 2.4.4, 2.4.5 and 2.4.7
• Hardware-wallet (keys off-server) setups were not affected, per the project

Impact

Exploitation in the wild is confirmed for the reported thefts: hot-wallet funds on servers running 2.4.1 or earlier were swept to attacker-controlled destinations. The earliest drain described in the incident reports occurred at 13:46 UTC on 1 November. BTCPay states it has not established when attackers first began exploiting the issue, nor the full scope; no loss total has been published. Servers on 2.4.2 or later at the time of the warning showed no impact.

Recommended actions

• Check your version (shown at the bottom of the page after login).
• If you ran 2.4.1 or earlier at any point, assume compromise even if no theft was noticed and even if you have since upgraded: create a new wallet with a new seed on a trusted device, sweep remaining hot-wallet funds into it, and never reuse the old seed.
• Take the old server offline, preserve logs and transaction records, and provision a fresh VM with the latest supported release from trusted sources; do not restore the whole old server.
• From a trusted device, revoke and replace hosting, SSH, application, API and Lightning credentials that were on the old machine.
• Keep spending keys off the server (hardware wallet) and only operational funds in any hot wallet.
• Report incidents to security@btcpayserver.org (never send seeds, keys or passwords) and to local authorities.

Indicators

BTCPay lists the following as reported destination addresses identified in incident reports. The project notes some activity at these addresses predates the reported thefts, so their balances and histories are not a confirmed loss total. - Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 - Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee

Source & attribution

This 0xCERT advisory summarises a disclosure by the BTCPay Server project: https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/ (initial warning: https://x.com/BtcpayServer/status/2117020340815819262; corroborated by Bitcoin.com News). Details may change; refer to the original source for the authoritative record.