{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier · updates",
  "home_page_url": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026",
  "feed_url": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026/feed.json",
  "description": "Attackers stole Bitcoin and Litecoin from hot wallets on self-hosted BTCPay Server instances running 2.4.1 (released July 23, 2026) or earlier. BTCPay says they used a different method to exploit the vulnerability fixed in 2.4.2 (August 7) and logged in as an administrator on hit servers. It has seen no impact on servers already on 2.4.2 or later and no credible drain reports on the latest 2.4.7. Bitquery counted about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. Operators on 2.4.1 or earlier should sweep remaining hot-wallet funds to a new wallet with a new seed, move to a fresh server on the latest release, and rotate every credential the old server could reach, even if no theft was noticed. Wallets with spending keys held off the server were not affected.",
  "language": "en",
  "_pwn": {
    "slug": "btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-11-03-27f88577",
      "url": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-11-03-27f88577",
      "title": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: Bitquery counts about $1.62M (18.38 BTC and 3,405 LTC) stolen across 682 sweeps, 87% of it on November 1, as reported by The Hacker News.",
      "content_text": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: Bitquery counts about $1.62M (18.38 BTC and 3,405 LTC) stolen across 682 sweeps, 87% of it on November 1, as reported by The Hacker News.\n\nSource: https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-11-02-9bf1852a",
      "url": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-11-02-9bf1852a",
      "title": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: BTCPay publishes its investigation: attacks targeted 2.4.1 and earlier; operators on those versions should move to a fresh server with a new wallet and rotate credentials.",
      "content_text": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: BTCPay publishes its investigation: attacks targeted 2.4.1 and earlier; operators on those versions should move to a fresh server with a new wallet and rotate credentials.\n\nSource: https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/",
      "date_published": "2026-11-02T00:00:00.000Z",
      "external_url": "https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-11-01-7c2fbf5e",
      "url": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-11-01-7c2fbf5e",
      "title": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: First reported hot-wallet drain at 13:46 UTC; BTCPay asks hosting providers including LunaNode to take instances offline and, at 22:25 UTC, warns operators on X to shut down their servers.",
      "content_text": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: First reported hot-wallet drain at 13:46 UTC; BTCPay asks hosting providers including LunaNode to take instances offline and, at 22:25 UTC, warns operators on X to shut down their servers.\n\nSource: https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/",
      "date_published": "2026-11-01T00:00:00.000Z",
      "external_url": "https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-08-07-3e66fdef",
      "url": "https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026#2026-08-07-3e66fdef",
      "title": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: BTCPay Server 2.4.2 is released, fixing the vulnerability later used in the November drains.",
      "content_text": "BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier: BTCPay Server 2.4.2 is released, fixing the vulnerability later used in the November drains.\n\nSource: https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/",
      "date_published": "2026-08-07T00:00:00.000Z",
      "external_url": "https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/",
      "tags": [
        "critical"
      ]
    }
  ]
}