If you run a BTCPay Server instance on an older version, your hot wallet funds may already be at risk. The project issued an urgent warning this week after reports surfaced of Bitcoin and Litecoin being stolen from hot wallets on servers running outdated software.
The attacks targeted instances running BTCPay Server 2.4.1, released July 23, 2026, or earlier. According to the project, the attackers used a different method to exploit a vulnerability that was fixed in version 2.4.2, released August 7, 2026.
That is a crucial detail. The patch has been available for months. These attacks are not exploiting a new zero-day. They are hitting people who did not update.
What BTCPay Server Is Telling Users to Do
The recommendation is blunt and unusually severe.
Users running versions 2.4.1 or earlier are advised to move to a fresh server with a new wallet, even if they have not noticed a theft. If funds have been stolen or unauthorized access is suspected, the project says to treat the entire machine and all secrets stored on it as compromised.
That means rotating every credential, not just wallet keys. It means assuming the host is no longer trustworthy.
Reports of the thefts began surfacing around November 1, 2026. It is not currently known when the attackers first started exploiting the flaw.
The Wallets Involved
BTCPay Server published two addresses tied to the incidents.
|
Currency |
Address |
|
Bitcoin |
bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 |
|
Litecoin |
ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee |
If you run an exchange, a block explorer, or a wallet service, those addresses should be flagged immediately.
The Version 2.4.7 Fix
The latest release, 2.4.7, addresses one critical vulnerability and several medium-severity issues discovered through Anthropic's OSS scanner.
BTCPay Server stated on X that no credible reports of hot wallet drains have come from users running 2.4.7. That is not a guarantee of absolute safety, but it is the first version that has not been tied to an active incident.
The Earlier August Disclosure
This is not the first time BTCPay Server has dealt with a critical flaw being exploited in the wild.
In August 2026, the project disclosed that an unauthenticated remote attacker could obtain .macaroon credential files for LND, the Lightning Network implementation. Those credentials could be used to take control of an LND node and move funds.
That vulnerability was patched in version 2.4.2, and the attacks reviewed at the time targeted only files with the .macaroon extension.
It is unclear whether the latest wave of thefts is related to the same underlying vulnerability or a different exploit path against the same patched surface.
The Broader Crypto Security Crisis
This incident lands in the middle of a genuinely awful stretch for cryptocurrency security.
- Binance: $6.43 billion stolen by North Korean threat actors, the largest crypto theft on record.
- Polymarket: $2.65 million exploit after the compromise of software from DebugBear, briefly halting trading.
- Trezor: a responsible disclosure alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis in August 2026, assessed as part of a sophisticated supply chain attack.
- Mercado Bitcoin: Brazil's largest exchange paused deposits and withdrawals after a breach resulting in roughly $49 million in stolen funds.
The Mercado Bitcoin case is worth examining in detail, because the industry response tells you something about how prepared the ecosystem is.
Mercado Bitcoin: $49 Million Breach
Mercado Bitcoin said the value of the assets involved was approximately $38 million at the time of its statement, a reduction from earlier reporting. In coordination with Tether, Circle, Paxos, BRL1, and Chainalysis, the exchange blocked $11 million.
Additional amounts eligible for blocking have been identified, and containment efforts continue. The exchange said services would resume once full security conditions are met.
Tether CEO Paolo Ardoino confirmed that the stablecoin issuer froze more than 4.5 million USDT in connection with the incident.
That is the stablecoin freeze mechanism working as designed. It is also the only reason a meaningful portion of that money is coming back.
What BTCPay Server Operators Must Do
- Upgrade to 2.4.7 immediately. Anything older is exposed.
- Move to a fresh server with a new wallet if you were running 2.4.1 or earlier, even if nothing appears stolen.
- Treat the host as compromised. Rotate every credential on the machine, not just the wallet keys.
- Move idle funds off the server. BTCPay's own guidance is explicit. Keep only the funds needed for daily operations on a hot wallet, and hold the rest in a wallet whose spending keys are held off the server.
- Check the published wallet addresses against your transaction history.
- Review server logs for unexpected access to .macaroon files, which was the pattern in the August attacks.
- Note that hosting providers may have shut down your instance. BTCPay warned that instances running older versions might have been automatically stopped by hosting providers trying to prevent exploitation.
FAQ
What is BTCPay Server?
It is a self-hosted, open-source cryptocurrency payment processor. Merchants run their own instance and control their own keys, which is the whole point of the software.
Which versions are affected?
BTCPay Server 2.4.1, released July 23, 2026, and earlier. The vulnerability was fixed in 2.4.2, and the latest release is 2.4.7.
What is actually being stolen?
Bitcoin and Litecoin from hot wallets on affected instances. The August attack targeted .macaroon credential files for LND, which could be used to take control of a node and move funds.
I updated to 2.4.2. Am I safe?
The project is advising anyone who ran 2.4.1 or earlier to move to a fresh server with a new wallet, even if no theft is apparent. Updating closes the exploit path, but it does not guarantee the machine was never compromised.
What are the attacker wallet addresses?
Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee
Why is this happening alongside so many other crypto breaches?
The sector is under sustained pressure. The Binance theft, the Polymarket exploit, the Trezor supply chain allegation, and the Mercado Bitcoin breach all landed in the same window. That is not a coincidence. It is a target-rich environment.
