BTCPay Server Hot Wallets Drained on Outdated Instances

Active. The BTCPay Server project reports attackers are draining hot wallets on instances running version 2.4.1 or older, per BleepingComputer on November 2, 2026. Confidence: high on the maintainer’s statement, low on scope. Losses are not quantified.

Reported by the project

• The maintainer says it “identified an attack vector targeting instances running version 2.4.1 (July 23, 2026) or earlier.”
• The unauthorized payments involve Bitcoin and Litecoin held in hot wallets, meaning keys kept on the server.
• The project says it has “no credible reports of hot wallet drains for users running the latest 2.4.7 release.”
• Founder Nicolas Dorier said the attacks did not target public servers. The investigation focuses on how the attacker logged in as an administrator on versions older than 2.4.2, released August 7.
• The project began receiving theft reports Sunday evening UTC. It asked VPS hosting providers to take affected instances offline as a precaution.
• The project advises 2.4.7 and recommends taking 2.4.1 or older instances offline. It also asks affected users to send details to its security contact and report losses to local authorities.

Timeline

• October 29: the project disclosed a critical vulnerability found via Anthropic’s Frontier OSS scanner and released 2.4.7 as an emergency security update.
• November 1, evening UTC: first theft reports.
• November 2: the maintainer published a security alert and incident report, and says it is still receiving reports.

Unconfirmed

• The specific vulnerability used is not named in the sources.
• Whether the October 29 flaw is the same one used in the thefts is not established. Dorier said there were clues pointing to flaws in versions before 2.4.2, and the project later said the same.
• Total losses and the number of affected operators are not reported.
• Attribution: none.

Related coverage is in the threat intel hub.