BTCPay Server flaw exploited to steal cryptocurrency from wallets

Hackers stole cryptocurrency from hot wallets on BTCPay Server instances running version 2.4.1 or earlier. The project said in an incident update on 2 November 2026 that attackers used a different method to exploit a vulnerability fixed in version 2.4.2, released on 7 August. It reported no impact on servers already running version 2.4.2 or later when it issued its warning.

Blockchain intelligence firm Bitquery traced 18.38 Bitcoin and 3,405 Litecoin, worth about $1.63m, to two addresses identified by BTCPay Server. The funds were moved in 682 sweeps between 30 October and the morning of 2 November. Bitquery said the attacker signed in as an administrator and emptied the servers’ hot wallets. It could not establish how many servers were affected, as blockchain records identify wallets, not systems.

Its estimate excludes other addresses and coins, including Lightning funds, so it is a minimum; BTCPay Server also cautioned that some activity at the addresses may predate the thefts and has not published a total loss figure. Bitquery counted 267 further sweeps worth about $150,000 after the project told operators to shut down instances at 22:25 UTC on 1 November.

BTCPay Server urged operators of affected versions to move to a fresh server with a new wallet and seed, even if they had since updated, because updating alone may not remove an attacker’s existing access. The project said wallets whose spending keys are held off the server, such as hardware wallets, were unaffected. It also advised preserving logs and transaction records, replacing exposed credentials and not restoring an old server onto a new one.