VULNpocalypse
HighVulnerabilityActive

BTCPay Server hot wallets drained on outdated self-hosted instances

Attackers drained hot wallets on internet-exposed BTCPay Server instances running 2.4.1 or older; update to 2.4.7 and move funds to a new wallet.

Published
Updated
Fixed in
BTCPay Server 2.4.7
Exploitation
Yes. BTCPay received theft reports and Bitquery traced 682 on-chain sweeps worth about $1.62 million

What happened

BTCPay Server, a self-hosted open-source cryptocurrency payment processor, warned that attackers are draining hot wallets on outdated instances that are exposed to the internet (BleepingComputer). BTCPay said it identified an attack vector targeting instances running versions 2.4.1 (released 23 July 2026) or older, and founder Nicolas Dorier said the investigation focused on how the attacker logged in as administrator to instances running versions older than 2.4.2 (BleepingComputer).

No CVE identifier has been named for these attacks (BleepingComputer). BTCPay says the attackers used a different method to exploit the vulnerability that was fixed in version 2.4.2, and it is unclear whether the latest attacks are related to that same vulnerability (The Hacker News). Version 2.4.2, released on 7 August 2026, had addressed an August flaw that could allow an unauthenticated remote attacker to obtain .macaroon credential files for LND, a Lightning Network implementation, which could let attackers control an LND node and move funds (The Hacker News). At that time BTCPay said on-chain wallets, including hot wallets, were not affected (Infosecurity Magazine).

The latest release, 2.4.7, was shipped as an emergency security update after a 29 October disclosure and addresses one critical and several medium-severity vulnerabilities discovered via Anthropic’s OSS scanner (The Hacker News). BTCPay has not stated that any of those specific flaws was the one used in these thefts (BleepingComputer).

How instances are being drained. According to Bitquery, the thief signed in to the servers as an administrator and swept their hot wallets (Infosecurity Magazine). Dorier said the attacks did not target public servers (BleepingComputer).

Scale. Bitquery recorded 682 separate sweeps between 30 October and the morning of 2 November, and traced 18.38 BTC and 3,405 LTC, about $1.62 million in total, to two addresses named by BTCPay (The Hacker News), (Infosecurity Magazine). The first sweep came on 30 October, less than a day after 2.4.7 shipped, and emptied a 42-address wallet (The Hacker News). About 87% of the traced funds moved in a single wave on 1 November between 14:12 and 22:16 UTC (The Hacker News). BTCPay told operators to shut down their instances at 22:25 UTC on 1 November, after which Bitquery counted 267 more sweeps worth about $150,000 (Infosecurity Magazine). BTCPay has not published a loss total, and notes that some activity at those addresses may predate the thefts, so the figures are a floor rather than a confirmed total (Infosecurity Magazine).

No threat actor has been identified; the only detail is that the thief logged in as an administrator (Infosecurity Magazine). BTCPay reported no credible reports of hot wallet drains from users on 2.4.7 (BleepingComputer).

Am I affected?

You are at risk if you self-host BTCPay Server, your instance runs version 2.4.1 (released 23 July 2026) or older, and it is reachable from the internet (BleepingComputer). The number of servers hit is unknown, because the blockchain records wallets rather than systems (Infosecurity Magazine).

  • Check your version. Instances on 2.4.1 or older are the target; update to 2.4.7 (BleepingComputer). Some hosting providers automatically shut down instances running older versions (The Hacker News).
  • Check where your spending keys live. Wallets whose spending keys are held off the server, including hardware wallets, were unaffected (Infosecurity Magazine).
  • Treat an outdated server as compromised even after updating. BTCPay warns that updating alone cannot remove access an attacker may already have gained (Infosecurity Magazine).

What to do now

  1. Take instances running 2.4.1 or older offline as soon as possible (BleepingComputer).
  2. Update to 2.4.7. Use Server Settings, then Maintenance, then Update, or run ./btcpay-update.sh for Docker installs (BleepingComputer).
  3. Move to a fresh server with a new wallet and a new seed phrase, even if you have updated, and do not restore the old server onto the new one (Infosecurity Magazine).
  4. Rotate credentials: enable two-factor authentication, change admin passwords, and rotate API keys (The Hacker News).
  5. Keep only operational funds on the server (The Hacker News).
  6. Preserve logs and transaction records before rebuilding (Infosecurity Magazine).
  7. If you were hit, email security@btcpayserver.org and report your losses to local authorities (BleepingComputer).

Sources