BTCPay Server has confirmed that attackers stole Bitcoin and Litecoin from hot wallets on older self-hosted payment servers, and its recovery advice now goes beyond installing an update.
In a Nov. 2, 2026 security advisory, the open-source payment project said the attacks targeted servers running BTCPay Server 2.4.1, released July 23, 2026, or earlier. BTCPay Server said the attackers used a different method to exploit a vulnerability that was fixed in version 2.4.2 on Aug. 7, 2026.
BTCPay Server is a self-hosted, open-source cryptocurrency payment processor that lets businesses and other operators accept payments into connected wallets. The incident is most relevant to installations that kept spending keys on the payment server itself.
BTCPay Server said a hot wallet stores the keys needed to spend funds on the server. That setup can make refunds, payouts, and daily operations easier, but it also means a server compromise can become a wallet compromise.
The project said it had seen no impact from these attacks on servers that were already running 2.4.2 or later when its Nov. 1, 2026 warning was issued. It also said wallets whose spending keys were held off the server, including hardware wallets, were unaffected by the reported thefts.
Why patching may not close the incident
BTCPay Server’s recovery guidance says updating alone cannot remove access an attacker may already have gained. It also warns that an unchanged wallet balance does not rule out earlier unauthorized access.
For servers that ran 2.4.1 or earlier, the project recommends moving to a fresh server with a new wallet after sweeping any remaining hot-wallet funds. If attackers reached passwords, API keys, Lightning credentials, wallet seeds, or other secrets on the old machine, those secrets may remain useful after an update.
Loss estimates are still provisional
BTCPay Server published a Bitcoin address and a Litecoin address identified in incident reports, but cautioned that some activity at those addresses appears to predate the thefts described in the reports it had received. The project said balances and transaction histories at those addresses should not be treated as a confirmed total of losses.
Blockchain analytics firm Bitquery estimated that about US$1.63 million in Bitcoin and Litecoin had been swept to the two addresses BTCPay Server named. Bitquery said it counted 18.38 BTC and 3,405 LTC across 682 sweeps between Oct. 30 and Nov. 2, 2026, with figures stopping at 06:00 UTC on Nov. 2.
That estimate gives a sense of possible scale, but it is not an official loss total. Bitquery also cautioned that its attributions may be incomplete or revised as more information becomes available. BTCPay Server has not confirmed a final dollar figure or the number of affected operators.
How the incident unfolded
The incident remains under investigation. The public timeline now spans several security releases and two separate theft waves discussed by BTCPay Server.
Aug. 7, 2026: BTCPay Server 2.4.2 was released. The August advisory said it fixed a critical vulnerability affecting prior versions and focused on LND macaroon credential exposure. That advisory said BTCPay Server’s on-chain wallets, including hot wallets, were not affected by that specific LND credential risk.
Oct. 29, 2026: GitHub release notes for BTCPay Server 2.4.7 described it as a bug-fix release addressing security, reliability, and payment-accounting issues, with 85 scanner findings fixed.
Nov. 1, 2026 at 13:46 UTC: BTCPay Server said a wallet drain described in incident reports occurred. The project said it had not established when attackers first began exploiting the vulnerability.
Nov. 1, 2026 at 20:56 UTC: BTCPay Server received its first email reporting a theft.
Nov. 1, 2026 at 22:25 UTC: BTCPay Server warned the community and asked operators to shut down servers while it investigated.
Nov. 2, 2026: BTCPay Server published an investigation update identifying 2.4.1 and earlier as the affected versions.
What affected operators are being told to do
BTCPay Server’s advisory tells operators who ran 2.4.1 or earlier to assume broader exposure, especially if hot-wallet funds were present. Its recommended response includes several steps:
Create a new wallet with a fresh seed on a trusted device, then sweep any remaining hot-wallet funds into it. Do not reuse the old seed on a replacement server.
Take the old server offline while preserving relevant logs and transaction records.
Provision a fresh virtual machine and install the latest supported BTCPay Server release from trusted sources.
Avoid restoring the entire old server onto the new machine.
From a trusted device, revoke and replace credentials the old server could access, including hosting, SSH, application, API, and Lightning credentials. Do not enter new credentials on the old machine.
Report stolen funds to local authorities and send relevant incident details to security@btcpayserver.org, without sharing seed phrases, private keys, passwords, or other secrets.
BTCPay Server said the same rebuild guidance applies even if an operator running an affected version has not noticed missing funds, and even if the operator updated after the Nov. 1 warning.
The custody tradeoff is back in focus
The incident highlights the operating burden that comes with self-hosted payment infrastructure. BTCPay Server’s model can remove a payment intermediary, but it also leaves patching, key placement, monitoring, backups, and incident response with the operator.
A hot wallet can act like a checkout till: useful for day-to-day movement of funds, but risky as a place to keep more than operating balances. BTCPay Server’s own recommendation remains to accept payments into wallets whose spending keys are not held on the server when possible, and to keep only the funds needed for daily operations in any hot wallet that must stay online.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
