-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0302 ============================================================ Advisory-ID: 0xCERT-2026-0302 Severity: Critical Published: 2026-11-01T22:25:00.000Z Updated: 2026-11-02T17:51:24.680Z Chains: Bitcoin, Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0302 Title: BTCPay Server 2.4.1 and earlier: attackers sweep Bitcoin and Litecoin hot wallets on self-hosted servers Summary - ------- BTCPay Server reports Bitcoin and Litecoin stolen from hot wallets on servers running 2.4.1 or earlier, via the vulnerability fixed in 2.4.2. Operators on affected versions should sweep funds to a new seed and migrate to a fresh server; losses are undisclosed. Details - ------- Summary On 1 November 2026 BTCPay Server received reports of Bitcoin and Litecoin being stolen from hot wallets (wallets whose spending keys are stored on the server). The project warned operators on X at 22:25 UTC to shut down their servers, hosting providers including LunaNode took instances offline as a precaution, and a 2 November investigation update identified BTCPay Server 2.4.1 and earlier as the affected versions. According to the project, attackers used a different method to exploit the vulnerability fixed in 2.4.2. Affected - - BTCPay Server 2.4.1 (released 23 July 2026) and earlier, with a hot wallet configured - - Fixed in 2.4.2 (released 7 August 2026); later security releases include 2.4.4, 2.4.5 and 2.4.7 - - Hardware-wallet (keys off-server) setups were not affected, per the project Impact Exploitation in the wild is confirmed for the reported thefts: hot-wallet funds on servers running 2.4.1 or earlier were swept to attacker-controlled destinations. The earliest drain described in the incident reports occurred at 13:46 UTC on 1 November. BTCPay states it has not established when attackers first began exploiting the issue, nor the full scope; no loss total has been published. Servers on 2.4.2 or later at the time of the warning showed no impact. Recommended actions - - Check your version (shown at the bottom of the page after login). - - If you ran 2.4.1 or earlier at any point, assume compromise even if no theft was noticed and even if you have since upgraded: create a new wallet with a new seed on a trusted device, sweep remaining hot-wallet funds into it, and never reuse the old seed. - - Take the old server offline, preserve logs and transaction records, and provision a fresh VM with the latest supported release from trusted sources; do not restore the whole old server. - - From a trusted device, revoke and replace hosting, SSH, application, API and Lightning credentials that were on the old machine. - - Keep spending keys off the server (hardware wallet) and only operational funds in any hot wallet. - - Report incidents to security@btcpayserver.org (never send seeds, keys or passwords) and to local authorities. Indicators BTCPay lists the following as reported destination addresses identified in incident reports. The project notes some activity at these addresses predates the reported thefts, so their balances and histories are not a confirmed loss total. - - Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 - - Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee Source & attribution This 0xCERT advisory summarises a disclosure by the BTCPay Server project: https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/ (initial warning: https://x.com/BtcpayServer/status/2117020340815819262; corroborated by Bitcoin.com News). Details may change; refer to the original source for the authoritative record. References - ---------- - - https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/ - - https://x.com/BtcpayServer/status/2117020340815819262 - - https://x.com/NicolasDorier/status/2117051298633900041 - - https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/ - - https://news.bitcoin.com/security/bitcoin-payment-processor-btcpay-hit-by-hot-wallet-theft-reports/ Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0Fgmro+yUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmcG2hDm4fK2ShkAaMhmERAW6fnFHskEO/pOmTHs bXSlDRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAmZAEAiRW51LQ/DzqfB8AE lS6h5umR5r69AX+A5Dn/EXQ9LxABAIbV4OxG5zozbUTOtWhUrzJRcbdX49d0 xiVnYR1KU9sA =0Xgn -----END PGP SIGNATURE-----