BTCPay Server Urges Upgrade After Hot-Wallet Theft Reports

Summary

BTCPay Server says Bitcoin and Litecoin theft reports involve instances running 2.4.1 or earlier and a vulnerability patched in 2.4.2. It urges affected users to move to a fresh server and wallet; a link to an earlier flaw remains unclear.

Key points

BTCPay Server says attacks targeted instances running version 2.4.1 or earlier, using a method to exploit a vulnerability patched in 2.4.2.
When the attacks began is unknown; reports surfaced around November 1, 2026.
The company said it had received no credible reports of hot-wallet drains from users running version 2.4.7.
Users on older versions are advised to move to a fresh server with a new wallet; in cases of theft or suspected unauthorized access, BTCPay says to treat the machine and stored secrets as compromised.
BTCPay recommends keeping only funds needed for daily operations on a server and holding the remaining funds in a wallet whose spending keys are kept off the server.
A separate August alert described an unauthenticated vulnerability that could expose LND .macaroon credentials; BTCPay said it is unclear whether the latest attacks are related.

Article Details

Vulnerability Types: Unauthenticated remote access to LND .macaroon credential files (previously disclosed vulnerability; its relationship to the latest attacks is unclear)
Severity: Critical for the previously disclosed vulnerability; whether it is the vulnerability used in the latest attacks is unclear.
Affected Versions: BTCPay Server 2.4.1 and earlier (targeted in the latest reported attacks)
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Move to a fresh server with a new wallet.
Keep wallet spending keys off the server and only keep funds needed for daily operations on it.