BTCPay Server Users Urged to Update and Rebuild After Bitcoin and Litecoin Thefts From Hot Wallets

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install its latest software after reports of Bitcoin and Litecoin being stolen from hot wallets. Its investigation found the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier. The attackers used a different method to exploit the vulnerability fixed in version 2.4.2, released on 7 August 2026. It is not known when the attackers first began exploiting the flaw, although reports began to surface around 1 November 2026.

Users on version 2.4.1 or earlier are advised to move to a fresh server with a new wallet, even if no theft has been noticed. Anyone who has lost funds or suspects unauthorised access should treat the entire machine and every secret stored on it as compromised. BTCPay Server says it has seen no credible reports of hot wallet drains on the latest 2.4.7 release, which addresses one critical and several medium-severity vulnerabilities found via Anthropic's OSS scanner. Customers using a hosting provider may find their instance was shut down automatically to stop older versions being exploited.

In August 2026, BTCPay Server disclosed that a critical vulnerability had been used to steal funds. That issue could let an unauthenticated remote attacker obtain .macaroon credential files for LND, a Lightning Network implementation, and take control of a node. It is unclear whether the latest attacks are related. The project advises keeping only the funds needed for daily operations in a server hot wallet, with the rest held in a wallet whose spending keys are kept off the server.