74 openlast updated

HomeOctober 2026 patch cycleBTCPay Server 2.4.1 and older: hot wallets drained

Patch nowEnterpriseHomelabfrom 2026-10

BTCPay Server 2.4.1 and older: hot wallets drained

Part of October 2026 patch cycle

Vendor
BTCPay Server
Products
BTCPay Server 2.4.1 and earlier and BTCPay Server 2.4.2
Published
Status
Open

Call: Patch now, but patching isn’t the fix. BTCPay Server, the self-hosted Bitcoin payment processor, says attackers stole Bitcoin and Litecoin from hot wallets on servers running 2.4.1 or older. The hole was fixed in 2.4.2 on Aug 7. Attackers found a new way to exploit it. If you’re on 2.4.1 or older, BTCPay’s advice is to move to a fresh server with a new wallet, not just update.

What breaks: Your hot wallet empties. BTCPay’s timeline (UTC) runs like this:

  • Nov 1, 13:46: the first wallet drain in the incident reports. When exploitation actually started is unknown.
  • Nov 1, 20:56: the first theft report.
  • Nov 1, 22:25: BTCPay told everyone on X to shut their servers down.
  • Nov 2: BTCPay named 2.4.1 and older as affected.

Founder Nicolas Dorier told Decrypt the attackers had admin access on affected servers. BTCPay hasn’t published a CVE or technical detail for the new method. The same bug was used in August to steal LND Lightning credentials (.macaroon files). BTCPay hasn’t said how many servers were hit. LunaNode and other VPS hosts took BTCPay instances offline as a precaution.

Who’s hit: Anyone running BTCPay Server 2.4.1 (Jul 23) or older, with keys on the server. That includes servers updated after the Nov 1 warning. BTCPay says it has seen no impact on servers that were already on 2.4.2 or later when the warning went out. Wallets whose spending keys live off the server, such as hardware wallets, weren’t affected.

What to do if you were on 2.4.1 or older:

  • Move the money first. On a trusted device, create a new wallet with a new seed and sweep the remaining hot-wallet funds into it. Reusing the old seed on a new server leaves the funds exposed.
  • Take the old server offline, and keep its logs and transaction records.
  • Build a fresh VM with the latest BTCPay release and connect the new wallet. Don’t restore the old server wholesale.
  • Replace credentials the old server could reach, from a trusted device: hosting, SSH, application, API and Lightning.
  • If you were already on 2.4.2 or later: install the latest release and get on with your day.
  • If funds were stolen: report it through BTCPay’s security policy with your version, timeline, and transaction IDs. Never send seeds or keys. Also report the theft to local authorities.

BTCPay’s standing advice still holds: accept payments into a wallet whose keys aren’t on the server, and keep only working cash in a hot wallet.

Sources: BTCPay incident report, BTCPay 2.4.2 advisory, BleepingComputer, Decrypt.

Sources

More from October 2026 patch cycle