udarknet
Telegram
EN

BTCPay Server reports hot-wallet thefts on older installs

Topic: Security incidents
Published:
Share
Electronic components on a computer circuit board
Contents

At a glance

BTCPay Server says it received reports on 1 November 2026. How the releases fit the timeline.

BTCPay Server reports hot-wallet thefts on older installs

BTCPay Server says it received reports on 1 November 2026 that bitcoin and litecoin had been stolen from hot wallets. These wallets keep the keys needed to spend funds on the server. The project says the attacks targeted installations running 2.4.1 or earlier and used a different way to exploit a vulnerability fixed in 2.4.2. Maintainers say they have seen no impact from these attacks on servers already running 2.4.2 or later when they issued their warning. That observation concerns the reports reviewed by the project and the versions in use when the warning went out. [1]

How the releases fit the timeline

Version 2.4.2 was released on 7 August 2026. The later 2.4.7 release addresses security findings from a separate scan. The release notes describe that hardening work, while the incident notice identifies the vulnerability fixed in 2.4.2. The project lists destination addresses reported in connection with the thefts and says some activity there appears to predate the reports it has received. It has yet to establish the full timeline or which transfers belong to this incident. The activity at those addresses therefore cannot be used as a confirmed loss total. The project also distinguishes wallets whose spending keys are held off the server, which it says were unaffected by these thefts. [2]

What maintainers advise affected operators

The project advises operators who were still running 2.4.1 or earlier to move to a fresh server with a new wallet, even if they have since updated or have seen no theft. Use a trusted device to create a wallet with a new seed and move any remaining hot-wallet funds to it. Take the old server offline and preserve relevant logs and transaction records. Install the latest supported release on a fresh machine and replace credentials that the old server could access. The project warns that updating an existing installation cannot remove access an attacker may already have gained. Operators can check their current version at the bottom of the administration page. [3]

Evidence & sources

Source record: · Checked:

Record limits · The project has not established a confirmed loss total.

  1. [1]Source reported

    BTCPay Server reports hot-wallet thefts on older installs

    Supporting excerpt: Security Incident Affecting BTCPay Server 2.4.1 and Earlier

    Original quotation

    The attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026.
    Security Incident Affecting BTCPay Server 2.4.1 and Earlier ↗

    Source language: EN · Captured Nov 3, 2026

  2. [2]Source reported

    How the releases fit the timeline

    Supporting excerpt: BTCPay Server 2.4.7

    Original quotation

    This release fixes 85 security findings from the scan, using the report's original severity ratings:
    BTCPay Server 2.4.7 ↗

    Source language: EN · Captured Nov 3, 2026

  3. [3]Source reported

    What maintainers advise affected operators

    Supporting excerpt: Security Incident Affecting BTCPay Server 2.4.1 and Earlier

    Original quotation

    updating alone cannot remove access an attacker may already have gained.
    Security Incident Affecting BTCPay Server 2.4.1 and Earlier ↗

    Source language: EN · Captured Nov 3, 2026