# BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier · pwn.watch > Attackers stole Bitcoin and Litecoin from hot wallets on self-hosted BTCPay Server instances running 2.4.1 (released July 23, 2026) or earlier. BTCPay says they used a different method to exploit the vulnerability fixed in 2.4.2 (August 7) and logged in as an administrator on hit servers. It has seen no impact on servers already on 2.4.2 or later and no credible drain reports on the latest 2.4.7. Bitquery counted about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. Operators on 2.4.1 or earlier should sweep remaining hot-wallet funds to a new wallet with a new seed, move to a fresh server on the latest release, and rotate every credential the old server could reach, even if no theft was noticed. Wallets with spending keys held off the server were not affected. Page: https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026 · generated 2026-11-04T22:27:47.875Z ## Status - Severity: critical · status: live · patch: patched - Product: BTCPay Server (self-hosted) 2.4.1 and earlier - Started: 2026-11-01 - Affected: BTCPay Server 2.4.1 and earlier - Fixed in: 2.4.2 (original fix); 2.4.7 (latest, recommended) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026.json - This file: https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026/llms.txt ## Updates (newest first) - 2026-11-03: Bitquery counts about $1.62M (18.38 BTC and 3,405 LTC) stolen across 682 sweeps, 87% of it on November 1, as reported by The Hacker News. (https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html) - 2026-11-02: BTCPay publishes its investigation: attacks targeted 2.4.1 and earlier; operators on those versions should move to a fresh server with a new wallet and rotate credentials. (https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/) - 2026-11-01: First reported hot-wallet drain at 13:46 UTC; BTCPay asks hosting providers including LunaNode to take instances offline and, at 22:25 UTC, warns operators on X to shut down their servers. (https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/) - 2026-08-07: BTCPay Server 2.4.2 is released, fixing the vulnerability later used in the November drains. (https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/) ## Fix brief # Security brief: BTCPay Server: hot wallets drained on self-hosted instances running 2.4.1 and earlier Source: https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026 · status: live · severity: critical · updated Nov 4, 2026, 20:12 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Attackers stole Bitcoin and Litecoin from hot wallets on self-hosted BTCPay Server instances running 2.4.1 (released July 23, 2026) or earlier. BTCPay says they used a different method to exploit the vulnerability fixed in 2.4.2 (August 7) and logged in as an administrator on hit servers. It has seen no impact on servers already on 2.4.2 or later and no credible drain reports on the latest 2.4.7. Bitquery counted about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. Operators on 2.4.1 or earlier should sweep remaining hot-wallet funds to a new wallet with a new seed, move to a fresh server on the latest release, and rotate every credential the old server could reach, even if no theft was noticed. Wallets with spending keys held off the server were not affected. Severity detail: Actively exploited to steal hot-wallet funds; attackers gained admin access on unpatched servers; fixed since 2.4.2 - Product: BTCPay Server (self-hosted) 2.4.1 and earlier ## Affected versions - BTCPay Server 2.4.1 and earlier ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 2.4.2 (original fix) - 2.4.7 (latest, recommended) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Added late (Nov 4 sweep) after an X news summary surfaced it; the leads matcher never flagged it. BTCPay has not published the exploit method, a CVE id or a loss total; the August advisory for the 2.4.2 fix described unauthenticated theft of LND .macaroon files. Re-check the BTCPay blog for a post-mortem or CVE, and close once quiet. ## Latest updates - Nov 3, 2026: Bitquery counts about $1.62M (18.38 BTC and 3,405 LTC) stolen across 682 sweeps, 87% of it on November 1, as reported by The Hacker News. - Nov 2, 2026: BTCPay publishes its investigation: attacks targeted 2.4.1 and earlier; operators on those versions should move to a fresh server with a new wallet and rotate credentials. - Nov 1, 2026: First reported hot-wallet drain at 13:46 UTC; BTCPay asks hosting providers including LunaNode to take instances offline and, at 22:25 UTC, warns operators on X to shut down their servers. - Aug 7, 2026: BTCPay Server 2.4.2 is released, fixing the vulnerability later used in the November drains. ## Advisories - [Security Incident Affecting BTCPay Server 2.4.1 and Earlier](https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/) (BTCPay Server) ## Write-ups & news - [Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets](https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html) - [BTCPay tells users to turn off their servers after reports of drained wallets](https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets) --- Machine-readable: https://pwn.watch/i/btcpay-server-hot-wallet-drains-2-4-1-and-earlier-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.