BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier
BTCPay Server (self-hosted) 2.4.1 and earlier
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Attackers stole Bitcoin and Litecoin from hot wallets on self-hosted BTCPay Server instances running 2.4.1 (released July 23, 2026) or earlier. BTCPay says they used a different method to exploit the vulnerability fixed in 2.4.2 (August 7) and logged in as an administrator on hit servers. It has seen no impact on servers already on 2.4.2 or later and no credible drain reports on the latest 2.4.7. Bitquery counted about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. Operators on 2.4.1 or earlier should sweep remaining hot-wallet funds to a new wallet with a new seed, move to a fresh server on the latest release, and rotate every credential the old server could reach, even if no theft was noticed. Wallets with spending keys held off the server were not affected.
Why this severity: Actively exploited to steal hot-wallet funds; attackers gained admin access on unpatched servers; fixed since 2.4.2
- Started
- Nov 1, 2026
Affected
- BTCPay Server 2.4.1 and earlier
Fixed in
- 2.4.2 (original fix)
- 2.4.7 (latest, recommended)
Timeline4
Bitquery counts about $1.62M (18.38 BTC and 3,405 LTC) stolen across 682 sweeps, 87% of it on November 1, as reported by The Hacker News.
BTCPay publishes its investigation: attacks targeted 2.4.1 and earlier; operators on those versions should move to a fresh server with a new wallet and rotate credentials.
First reported hot-wallet drain at 13:46 UTC; BTCPay asks hosting providers including LunaNode to take instances offline and, at 22:25 UTC, warns operators on X to shut down their servers.
BTCPay Server 2.4.2 is released, fixing the vulnerability later used in the November drains.
Advisories1
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
