BTCPay Server has advised users to update its self-hosted cryptocurrency payment software after reports that attackers stole Bitcoin and Litecoin from Hot wallets on older instances. The project’s investigation found that the attacks targeted servers running version 2.4.1 or earlier.
The vulnerability was fixed in version 2.4.2, released on August 7, 2026. BTCPay Server recommends that users of version 2.4.1 or earlier migrate to a fresh server and create a new wallet, even if they have not detected a theft. Anyone who suspects unauthorized access should treat the machine and all secrets stored on it as compromised and follow the same recovery steps.
It is not known when the attackers began exploiting the flaw. Reports of the activity emerged around November 1, 2026. BTCPay Server said it had received no credible reports of hot-wallet drains from users running version 2.4.7, which addresses one critical and several medium-severity vulnerabilities identified through Anthropic’s OSS scanner.
The project also advised users who need a hot wallet for daily operations to keep only the funds required on the server and store the remaining assets in a wallet whose spending keys are held elsewhere. Instances managed by hosting providers may have been shut down automatically to prevent older versions from being exploited.
Sources: The Hacker News.