The maintainers of BTCPay Server, the open-source software merchants use to accept Bitcoin and other crypto payments on their own servers, say attackers have been draining “hot wallets” on instances running older versions. A hot wallet keeps the keys needed to spend funds on the server itself. The project received its first theft report on the evening of 1 November (UTC), asked hosting providers such as LunaNode to take affected instances offline as a precaution, and warned operators on X to shut servers down while it investigated.
In its incident write-up, BTCPay says the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier. The attackers used a different method to exploit the same vulnerability that version 2.4.2 fixed on 7 August. The project says it has seen no impact on servers that were already on 2.4.2 or later when it issued the warning, and BleepingComputer reports there are no credible reports of drains on the latest 2.4.7 release. BTCPay says it has not established when attackers first began exploiting the flaw, and it lists two destination addresses from the incident reports but cautions that their balances should not be read as a confirmed loss total.
How to check if you’re affected
Affected versions are BTCPay Server 2.4.1 and earlier. To check your version, log in to your instance and look at the bottom of the page. If you run version 2.4.2 or later, BTCPay says it has seen no impact from these attacks.
If you are on 2.4.1 or earlier, BTCPay says updating alone cannot remove access an attacker may already have, and an unchanged wallet balance does not rule out an earlier attack. Its recommended steps are:
- Create a new wallet on a trusted device with a new seed, and sweep any remaining hot-wallet funds into it. Do not reuse the old seed.
- Take the old server offline, preserving logs and transaction records for the investigation.
- Provision a fresh virtual machine, install the latest supported release from trusted sources, and connect the new wallet. Do not restore the whole old server onto it.
- From a trusted device, revoke and replace credentials the old server could reach, including hosting, SSH, application, API and Lightning credentials.
BTCPay says wallets whose spending keys are held off the server, including hardware wallets, were unaffected by these thefts. If you use a hosting provider, contact them for help moving to a fresh VM. If you lost funds or see signs of unauthorized access, treat the whole machine and its secrets as compromised, email security@btcpayserver.org with your version, update history and the time you noticed, and report the loss to local authorities, as BleepingComputer advises.
BleepingComputer reports the update path as Server Settings, Maintenance, Update, or for Docker installs ./btcpay-update.sh from the btcpayserver-docker directory after logging in over SSH. BTCPay’s own guidance for 2.4.1 and earlier is the fresh-server rebuild above, so prefer that over an in-place update.
This is separate from the August 2.4.2 advisory, which concerned LND Lightning credential files (.macaroon) and which BTCPay said had already been exploited. BleepingComputer also notes a critical flaw disclosed on 29 October that led to the 2.4.7 emergency release.