BTCPay Server 2.4.1 and Earlier: Hot Wallets Drained

Not stated. BTCPay Server: balances at the reported destination addresses "should not be treated as a confirmed total of losses".

Root cause: Per BTCPay Server: attackers used "a different method to exploit the vulnerability fixed in 2.4.2" (released 7 Aug 2026). The vulnerability itself is not described in the advisory.

Timeline, as sourced: Per BTCPay Server (UTC): 7 Aug, 2.4.2 released; 1 Nov 13:46, a wallet drain in the reports; 20:56, first theft report; 22:25, community warning on X; 2 Nov, update naming 2.4.1 and earlier, advisory posted.

Claimed (BTCPay Server) (advisory (opens in a new tab)): on 1 Nov it received reports of Bitcoin and Litecoin stolen from hot wallets, where the spending keys sit on the server. The attacks targeted servers running 2.4.1 (released 23 Jul 2026) or earlier. It has "seen no impact" on servers already on 2.4.2 or later when the 1 Nov warning went out. It asked VPS hosts, including LunaNode, to take instances offline as a precaution.

Claimed (BTCPay Server): operators on 2.4.1 or earlier should sweep remaining hot-wallet funds to a new wallet with a new seed, take the old server offline, provision a fresh VM and rotate every credential the old server could reach, even if no theft was noticed. In its words, "updating alone cannot remove access an attacker may already have gained." Wallets whose spending keys are held off the server, including hardware wallets, were unaffected.

Reported destination addresses, per the advisory: Bitcoin bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 (opens in a new tab) and Litecoin ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee (opens in a new tab). BTCPay says some activity there predates the reported thefts.

Unknown: the vulnerability, when exploitation began, and total losses.