BTCPay Server: hot wallets drained on instances running 2.4.1 or earlier (flaw fixed in 2.4.2)
Severity: critical · Patch status: patched · Since 2026-08-07
In early November 2026 the BTCPay Server project received reports that Bitcoin and Litecoin were being stolen from hot wallets on self-hosted servers. Its 2 November investigation update says the attacks targeted instances on version 2.4.1 (released 23 July 2026) or earlier, and that the attackers used a different method against the flaw fixed in version 2.4.2 (released 7 August 2026). The project has not published the method, the start date or a loss total. It says one wallet drain happened on 1 November at 13:46 UTC, and it names one Bitcoin and one Litecoin destination address, warning that activity at those addresses predates the reported thefts. It reports no credible drains on 2.4.2 or later and calls 2.4.7 (29 October 2026) the latest release. For anyone on 2.4.1 or earlier the advice is to move to a fresh server with a new wallet, even if no theft has been noticed, and to treat the machine and its stored secrets as compromised if funds are missing. The August 2026 advisory for the same 2.4.2 fix described theft of LND macaroon credentials and said on-chain and hot wallets were not affected; the November post does not say whether the macaroon route was used.
What to do
- Run BTCPay Server 2.4.7 (the latest release); 2.4.2 is the minimum fixed version, and the project reports no hot-wallet losses on 2.4.2 or later
- If running 2.4.1 or earlier, sweep the remaining hot-wallet funds to a new wallet with a new seed on a freshly provisioned VM; do not restore the old server onto the new machine
- Take the old server offline and preserve logs and transaction records before replacing it
- From a trusted device, rotate every credential the old server could reach (hosting, SSH, application, API and Lightning credentials); do not enter new credentials on the old machine
- If funds are missing or access is suspected, treat the whole machine and its secrets as compromised; report thefts to security@btcpayserver.org and to local authorities
- Check for transfers to the two reported destination addresses, but do not treat their balances as a confirmed loss total
- Keep only operating funds on the server and hold spending keys off-server; if you run LND, check the node for payments, channel closures or peers you did not make
- If hosted by a provider, ask the provider for a fresh VM; the project reports that LunaNode and other hosts shut instances down as a precaution
Fixed versions
- 2.4.2 (original fix)
- 2.4.7 (latest, with additional security fixes)
Sources
All live incidents on Threat Watch
