BTCPay Server: Hot Wallets Swept on Outdated Servers

On 1 November 2026, BTCPay Server, the open-source, self-hosted payment processor used by many merchants to accept Bitcoin, began receiving reports that Bitcoin and Litecoin were being stolen from hot wallets on servers running its software. A hot wallet, in BTCPay's own definition, is one where the keys needed to spend funds are stored on the server itself. By 2 November the project had narrowed the problem down: the thefts targeted instances running version 2.4.1 or earlier. No total loss figure has been published.

What the project has confirmed#

According to BTCPay's security advisory, published on 2 November, the attackers "used a different method to exploit the vulnerability fixed in 2.4.2". That release came out on 7 August 2026, and several further security releases followed between August and October. The flaw had been patched for almost three months.

The advisory gives this timeline (UTC):

• 1 November, 13:46 – a wallet drain described in the incident reports takes place. The project says it has not established when exploitation first began.
• 1 November, 20:56 – BTCPay receives the first email reporting a theft.
• 1 November, 22:25 – BTCPay warns on X that hot wallets are "being swept by unauthorized attackers" and asks operators to shut down their instances.
• 2 November – an investigation update identifies 2.4.1 and earlier as the affected versions. LunaNode and other hosting providers take customer instances offline as a precaution.

Lead developer Nicolas Dorier said on X that the project's own public servers, running 2.4.7, were not attacked, and that the attacker "managed to log in as admin" on affected instances. BTCPay says it has seen no impact on servers that were already on 2.4.2 or later when the warning went out.

Why updating is not enough#

The most important part of the advisory is the recovery guidance. BTCPay says that anyone who ran 2.4.1 or earlier should move to a fresh server with a new wallet, even if no theft was noticed and even if they updated after the 1 November warning.

The recommended steps are: create a new wallet with a new seed on a trusted device and sweep any remaining funds into it; take the old server offline and preserve logs; install the latest release on a fresh virtual machine instead of restoring the old one; and replace any hosting, SSH, API and Lightning credentials the old server could reach. Funds in wallets whose spending keys are held off the server were not affected, according to the project.

What we can see on-chain#

BTCPay published two destination addresses from the incident reports, one Bitcoin and one Litecoin. We checked both on public block explorers on 4 November. The Bitcoin address has more than 800 transactions and has received about 20.3 BTC over its lifetime. It was still receiving small deposits in the early hours of 4 November UTC. The Litecoin address has received about 4,268 LTC in total.

These figures are not a loss total. BTCPay itself warns that some activity at these addresses predates the reported thefts, and that their balances "should not be treated as a confirmed total of losses". We cannot tell from the chain alone which deposits come from BTCPay servers. The continuing small inflows are consistent with unpatched servers still being drained, but they do not prove it.

Our view#

As XDRIP Digital Management LLC, we see two lessons here. First, a patch only protects the machines it is installed on. An unattended server that handles money is a standing risk. BTCPay itself points to "the rise in automated attacks using AI" as a reason to update promptly.

Second, keys stored on an internet-facing server are only as safe as that server. BTCPay's advice is to keep only the funds needed for daily operations in a hot wallet and move the rest to a wallet whose keys are held elsewhere. We agree.

Open questions remain: the total stolen, how many operators were hit, and when exploitation began.

Sources#

• BTCPay Server, security advisory (2 Nov 2026): https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/
• BTCPay Server on X, initial warning (1 Nov 2026, 22:25 UTC): https://x.com/BtcpayServer/status/2117020340815819262
• BTCPay Server on X, investigation update (2 Nov 2026): https://x.com/BtcpayServer/status/2117106238123123008
• Nicolas Dorier on X (2 Nov 2026): https://x.com/NicolasDorier/status/2117051298633900041
• Cointelegraph (updated 3 Nov 2026): https://cointelegraph.com/news/btcpay-server-hot-wallet-thefts-older-versions
• The Hacker News (3 Nov 2026): https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html
• mempool.space, reported BTC address: https://mempool.space/address/bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
• litecoinspace.org, reported LTC address: https://litecoinspace.org/address/ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee