Threat watch / Attack
BTCPay Server: attackers drain hot wallets on outdated self-hosted payment servers
On November 1, 2026, operators of BTCPay Server, an open-source payment processor that merchants host themselves, reported Bitcoin and Litecoin stolen from their hot wallets. BTCPay says the attacks targeted servers running version 2.4.1 or earlier and used a different method to exploit a vulnerability fixed in 2.4.2 in August. Blockchain analytics firm Bitquery traced at least $1.63 million taken in 682 sweeps.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- BTCPay Server
- How it happened
- BTCPay says the attacks targeted servers running BTCPay Server 2.4.1 (released July 23, 2026) or earlier, and that the attackers "used a different method to exploit the vulnerability fixed in 2.4.2", released on August 7. That August flaw let an unauthenticated remote attacker obtain .macaroon credential files for LND. BTCPay has not published technical details and says it has not established when exploitation began.[1][2] Checked 10 Nov 2026
- What was stolen
- Bitcoin and Litecoin from hot wallets on the affected servers: 18.38 BTC and 3,405 LTC traced by Bitquery. BTCPay says funds whose keys are held off the server, including hardware wallets, were reported unaffected.[1][3] Checked 10 Nov 2026
- Who was impacted
- Merchants and operators running BTCPay Server 2.4.1 or earlier with a hot wallet. No victim count is public; Bitquery says it counts transactions, "not servers or victims".[1][3] Checked 10 Nov 2026
- Threat actor
- Not attributed
Timeline
- BTCPay releases 2.4.2 and asks users to update immediately: a flaw let an unauthenticated attacker obtain LND .macaroon credential files, and BTCPay says it was exploited and funds were stolen. [2]
- First sweep Bitquery ties to the thief, at 08:22 UTC. [3]
- 87% of the money moves in one wave between 14:12 and 22:16 UTC, according to Bitquery. BTCPay receives the first theft report at 20:56 UTC, asks hosting providers including LunaNode to take instances offline, and warns the community at 22:25 UTC. [1][3]
- BTCPay names 2.4.1 and earlier as affected and tells those users to move to a fresh server with a new wallet and new seed, rather than restoring the old one. Bitquery traces $1.63 million in 682 sweeps, with 267 sweeps still arriving after BTCPay's alert. [1][3]