BTCPay Server flaw linked to Bitcoin and Litecoin wallet thefts

BTCPay Server has urged users to upgrade to the latest software after reports that Bitcoin and Litecoin were stolen from hot wallets on installations running older builds. The firm said the attacks targeted servers running BTCPay Server 2.4.1 (released 23 July 2026) or earlier, exploiting a vulnerability that was fixed in 2.4.2 (released 7 August 2026).

BTCPay emphasised that users on 2.4.1 or older should migrate to a fresh server with a new wallet, even if no theft has yet been detected, and warned that if funds are stolen or access is suspected, the entire machine and all secrets on it should be treated as compromised and recovery procedures followed accordingly. Reported activity began circulating around 1 November 2026, though the precise start of exploitation remains unclear.

BTCPay Server later noted that there have been no “credible reports” of hot wallet drains from users running the latest 2.4.7 release, which addresses one critical and several medium-severity vulnerabilities found by Anthropic’s OSS scanner. The vendor also shared two wallet addresses tied to the incidents: Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 and Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee.

BTCPay cautioned that hot wallets used for daily operations should hold only the minimum needed on the server, with remaining funds stored offline. If BTCPay Server is run via a hosting provider, the provider may have shut down the affected instance to prevent exploitation of older versions.