BTCPay Server Users Urged to Upgrade After Bitcoin and Litecoin Hot Wallet Thefts

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version after reports that Bitcoin and Litecoin were stolen from hot wallets on instances running older versions. The company said its investigation found the attacks targeted servers running version 2.4.1 or earlier, while attackers used a different method to exploit the vulnerability fixed in version 2.4.2. Users on affected versions are advised to move to a fresh server with a new wallet, even if no theft has been noticed.

Affected versions and recovery steps

BTCPay Server said the attacks targeted servers running version 2.4.1, released on 23 July 2026, or earlier. The vulnerability was fixed in version 2.4.2, released on 7 August 2026, but the attackers used a different method to exploit it. Users running version 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even when no theft has been noticed. If funds were stolen or unauthorized access is suspected, the entire machine and all secrets stored on it should be treated as compromised, with the same recovery procedures followed.

Latest release and reported incidents

BTCPay Server said no credible reports of hot wallet drains have been reported from users running the latest 2.4.7 release. That version addresses one critical and several medium-severity security vulnerabilities discovered via Anthropic's OSS scanner. Reports of the latest attacks began to surface around November 1, 2026, and it remains unknown when the attackers first began exploiting the vulnerability. BTCPay Server also shared two wallet addresses linked to the incidents: a Bitcoin address, bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7, and a Litecoin address, ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee.

August vulnerability and related context

In August 2026, BTCPay Server disclosed that a critical vulnerability had been weaponized by attackers to steal funds from some users. The issue affects all BTCPay Server versions and was patched in version 2.4.2. It could allow an unauthenticated remote attacker to obtain .macaroon credential files for LND, an implementation of the Lightning Network, and those credentials could be used to take control of an LND node and move funds. The attacks reviewed targeted only files with the .macaroon extension. BTCPay Server said it is unclear whether the latest set of attacks is related to the same vulnerability.

Precautions and hosting providers

BTCPay Server cautioned that if a hot wallet is needed for daily operations, only the funds needed for those operations should be kept on the server, with the rest moved to a wallet whose spending keys are held off the server. If BTCPay Server is run through a hosting provider, the instance may have been shut down automatically to keep older versions from being exploited. The development coincides with a string of security breaches and exploits across the cryptocurrency space, including the record theft of $6.43 billion from Binance by North Korean threat actors. That same day, prediction market giant Polymarket briefly halted trading after it was hit by a $2.65 million exploit following the compromise of software developed by DebugBear. Hardware wallet maker Trezor also warned that it received a responsible disclosure report alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis in August 2026, assessed to be part of a sophisticated supply chain attack in which some devices sold via third-party resellers are physically tampered with to steal the victim's seed phrase and use it to drain assets.

Sources: The Hacker News