Attackers drain Bitcoin and Litecoin from outdated BTCPay Server hot wallets

attackers drained Bitcoin and Litecoin from hot wallets, which store seed phrases on a merchant’s server to sign transactions automatically, on outdated, self-hosted BTCPay Server instances on Nov. 1, 2026, reusing a known August 2026 vulnerability in a new way.

BTCPay Server confirmed that the November attacks targeted instances running version 2.4.1 or earlier, released July 23, 2026, and that no credible reports of drains exist for the latest release, version 2.4.7. Version 2.4.2 and later mitigate the risk. The project traced the attack vector to vulnerabilities fixed in version 2.4.2, released Aug. 7, 2026, so servers not updated since then remain exposed.

BTCPay Server founder Nicolas Dorier said attackers gained admin access to compromised instances, though the method remains undisclosed. That design means an attacker with admin access can drain funds without detection because the credentials needed to move money sit on the merchant’s own server.

BTCPay Server urged operators to shut down affected instances immediately after detecting the attacks on Nov. 1, 2026, and later asked VPS hosting providers, including LunaNode, to take older instances offline as a precaution. LunaNode shut down older customer instances without prompting, meaning merchants on hosted plans may already find their stores offline.

BTCPay Server recommends operators rebuild wallets on a fresh server, rotate all exposed credentials, and never reuse old seeds or restore compromised instances. Recovery requires creating a new wallet with a fresh seed, moving remaining funds, sweeping the hot wallet, preserving logs, building a fresh VM, and rotating all credentials to prevent further exposure. Andrew Camilleri said updating after the fact is not enough.

For Docker installations, the update process involves running sudo su -, navigating to the deployment directory, and executing ./btcpay-update.sh. Impacted users can also update to version 2.4.7 through Server Settings, Maintenance, Update.

BTCPay Server has not disclosed a total loss figure or the number of affected merchants. Bitquery estimated $1.63 million in Bitcoin and Litecoin were drained, with 87% of funds moved within eight hours on Nov. 1, 2026. Bitquery counted 682 sweeps in total as of 06:00 UTC on Nov. 2, 2026, and the 267 sweeps that came after BTCPay’s public warning were worth roughly $150,000. More than 99% of traced funds had not moved beyond the initial receiving addresses at Bitquery’s cutoff.

BTCPay Server offered a recovery bounty of 10% of returned funds, capped at 3 BTC. Victims may send reports to security@btcpayserver.org including version timeline and public transaction IDs, and they must also report thefts to local authorities.

The August 2026 vulnerability allowed attackers to obtain .macaroon credential files (authentication tokens) for LND, a Lightning Network node, but the November attacks targeted on-chain hot wallets instead. BTCPay confirmed on Aug. 7, 2026 that versions older than 2.4.2 contained a critical flaw attackers used to steal LND administrator macaroons, and attackers actively exploited the flaw before BTCPay released the patch.

BTCPay Server released version 2.4.7 on Oct. 29, 2026, fixing 85 issues, including one critical vulnerability discovered via Anthropic’s Frontier OSS scanner and 13 high-severity vulnerabilities. Nothing yet ties the November attack to the fixes in version 2.4.7.

Dorier advised merchants to limit hot wallet balances to operational funds only and store larger sums in watch-only wallets where private keys remain offline. Watch-only wallets were not affected, because attackers could not access funds without the seed phrase. Dorier told operators who have updated at least once since version 2.4.2 that they have no reason to panic.

Dorier warned, “Don’t put more than you are ready to lose in hot wallet. We can’t guarantee it won’t happen again.”

BTCPay Server has no overall control over merchant servers, requiring each operator to manually shut down or update their instances. The project’s public servers running version 2.4.7 were not attacked, but the project has not declared any version fully secure.

BTCPay’s documentation marks the hot wallet feature with a DANGER label and says it comes with security implications. BTCPay provides a self-hosted payment processing tool for businesses that removes intermediaries and fees while letting them accept Bitcoin and other digital assets into their own wallets, processing checkout invoices and payment verification including Lightning Network payments.

BTCPay continues to respond to affected users and receive incident reports. BTCPay restricted remote Lightning access following the August attack, and later fixed the August flaw in version 2.4.2.