BTCPay Server Hot-Wallet Drains
Attackers abused a pre-2.4.2 vulnerability to gain admin access to outdated self-hosted BTCPay Server instances and swept roughly $1.6M in BTC and LTC from merchant hot wallets.
Vuln-watch · relayed from a public source; see Source & attribution below
Summary
Attackers abused a pre-2.4.2 vulnerability to gain admin access to outdated self-hosted BTCPay Server instances and swept roughly $1.6M in BTC and LTC from merchant hot wallets.
Incident
- Victim: BTCPay Server merchants
- Date (UTC): 2026-10-30
- Estimated loss: $1.6M
- Chain(s): Bitcoin, Litecoin
- Attack type: other
- Funds status: stolen
- Attacker: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
Recommended actions
- Revoke token approvals granted to BTCPay Server merchants contracts until the project confirms they are safe
- Integrators: pause or delist affected assets and monitor for attacker fund movements
- Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only
Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/btcpay-server-2026. Primary sources: https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html ; https://bitquery.io/investigations/btcpay-server-hack ; https://www.infosecurity-magazine.com/news/btcpay-server-flaw-cryptocurrency/ ; https://www.ccn.com/news/crypto/btcpay-server-security-flaw-bitcoin-hot-wallet-thefts/.
References
- https://www.blockchainbreaches.com/en/breaches/btcpay-server-2026
- https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html
- https://bitquery.io/investigations/btcpay-server-hack
- https://www.infosecurity-magazine.com/news/btcpay-server-flaw-cryptocurrency/
- https://www.ccn.com/news/crypto/btcpay-server-security-flaw-bitcoin-hot-wallet-thefts/
Indicators of compromise
All IOC feeds →- addressbc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7Reported destination address of stolen BTC in BTCPay hot-wallet thefts - per BTCPay Server · Bitcoin
- addressltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02wheeReported destination address of stolen LTC (Litecoin) in BTCPay hot-wallet thefts - per BTCPay Server · Other / Multi-chain
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-30 · last updated 2026-11-05
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0312/signed.txt | gpg --verify