-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0312
============================================================

Advisory-ID:  0xCERT-2026-0312
Severity:     High
Published:    2026-10-30T00:00:00.000Z
Updated:      2026-11-05T07:23:32.495Z
Chains:       Bitcoin, Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0312

Title: BTCPay Server Hot-Wallet Drains

Summary
- -------
Attackers abused a pre-2.4.2 vulnerability to gain admin access to outdated self-hosted BTCPay Server instances and swept roughly $1.6M in BTC and LTC from merchant hot wallets.

Details
- -------
Summary
Attackers abused a pre-2.4.2 vulnerability to gain admin access to outdated self-hosted BTCPay Server instances and swept roughly $1.6M in BTC and LTC from merchant hot wallets.

Incident
- - Victim: BTCPay Server merchants
- - Date (UTC): 2026-10-30
- - Estimated loss: $1.6M
- - Chain(s): Bitcoin, Litecoin
- - Attack type: other
- - Funds status: stolen
- - Attacker: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7

Recommended actions
- - Revoke token approvals granted to BTCPay Server merchants contracts until the project confirms they are safe
- - Integrators: pause or delist affected assets and monitor for attacker fund movements
- - Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/btcpay-server-2026. Primary sources: https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html ; https://bitquery.io/investigations/btcpay-server-hack ; https://www.infosecurity-magazine.com/news/btcpay-server-flaw-cryptocurrency/ ; https://www.ccn.com/news/crypto/btcpay-server-security-flaw-bitcoin-hot-wallet-thefts/.

References
- ----------
- - https://www.blockchainbreaches.com/en/breaches/btcpay-server-2026
- - https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html
- - https://bitquery.io/investigations/btcpay-server-hack
- - https://www.infosecurity-magazine.com/news/btcpay-server-flaw-cryptocurrency/
- - https://www.ccn.com/news/crypto/btcpay-server-security-flaw-bitcoin-hot-wallet-thefts/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrtEbUJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfI94Hl0E9bFxOdf3S77FqQuS2OdUGrZk/g06jy
MpQEshYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAB7+gD8C9cwNzOCb5cCW8si
zB2NhPoWJSN2nC1jXZ19vyq/STYBAMfTJY2r5SgRnM9+ciADD31WM4TR+CIq
k8QCMHLyUd0A
=7yiN
-----END PGP SIGNATURE-----