Skip to content
securitytabs

LiveUpdated

BTCPay Server urges updates after hot wallet thefts on outdated instances

Attackers have drained cryptocurrency from online wallets on older versions of BTCPay Server, a self-hosted payment system for accepting crypto. Operators running old versions are urged to install the latest release now.

Hot wallet thefts on outdated BTCPay Server instances
Hot wallet thefts on outdated BTCPay Server instances

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor that users host themselves, urged users to install the latest version after hackers drained hot wallets (wallets kept online for payments) on instances running older versions. [1]

BTCPay Server says its investigation found the attacks targeted servers running version 2.4.1, released on 23 July 2026, or earlier. Bitcoin and Litecoin were reported stolen. [2]

Scale of the losses

Infosecurity Magazine reports that more than a million dollars has been traced so far. The coverage describes the cause as a flaw in the software; the excerpts available do not give a CVE identifier or technical details. [3][2]

What is not yet known

The sources reviewed do not say how many servers were affected, who is behind the thefts, or what the flaw is. Operators should rely on the project's own announcement for further details. [1][2][3]

Timeline

  1. BTCPay Server said its investigation found the attacks targeted version 2.4.1 or earlier. [2]

  2. BTCPay Server's maintainer urged users to install the latest version after hot wallet thefts. [1]

  3. BTCPay Server released version 2.4.1, the newest version named as affected or older. [2]

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Businesses that accept crypto through a self-hosted BTCPay Server, or whose provider runs one, may be exposed if the software is version 2.4.1 or earlier. [2]

What to do

  1. Ask whoever runs your BTCPay Server which version it is and have it updated to the latest release. [1]
  2. Check the balances of hot wallets connected to the server for unexpected withdrawals. [1][3]

Mid-size company

A small IT or security team

What to know

The attacks targeted instances on version 2.4.1 or earlier, so unpatched self-hosted servers are the exposure. [2]

What to do

  1. Inventory BTCPay Server instances and upgrade any running 2.4.1 or earlier to the latest version. [1][2]
  2. Review hot wallet transaction history for unauthorized transfers of Bitcoin or Litecoin. [2]

Large enterprise

A security operations team

What to know

Thefts of more than a million dollars have been traced so far, and no technical indicators have been published in the sources reviewed. [3]

What to do

  1. Identify all BTCPay Server deployments, including those run by business units or partners, and upgrade versions 2.4.1 or earlier. [2][1]
  2. Audit hot wallet activity and open an incident review for any unexplained outbound transfers. [1][3]

Sources

  1. [1]BleepingComputer · Nov 2, 15:03 UTC
    BTCPay Server warns of hot wallet crypto thefts on outdated instancescontext
  2. [2]The Hacker News · Nov 3, 08:31 UTC
    Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Walletscontext
  3. [3]Infosecurity Magazine · Nov 3, 14:30 UTC
    Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrencycontext