Outdated BTCPay Server thefts traced to $1.63 million

What happened

Attackers exploited an already-patched BTCPay Server flaw to steal Bitcoin and Litecoin from hot wallets on outdated servers running version 2.4.1 or earlier. Blockchain analysis by Bitquery traced about $1.63 million to two addresses named by the project, a floor figure.

Why it matters

Operators who had not installed the fix, available since August 7, lost cryptocurrency directly; sweeps continued even after the November 1 warning to shut down instances. Wallets with spending keys held off the server, such as hardware wallets, were unaffected.

What to do

Update immediately to 2.4.2 or later; 2.4.7 is already out. Servers on 2.4.1 or earlier must be rebuilt on a fresh server with a new wallet and seed, sweeping remaining hot-wallet funds and replacing exposed credentials, even if already updated.

For the technical team

Affected

BTCPay Server · BTCPay Server up to version 2.4.1, released on 23 July 2026; the project saw no impact on servers already running 2.4.2 or later.

Exploitation

Exploitation confirmed by the project itself. Bitquery traced 18.38 BTC and 3,405 Litecoin (about $1.63 million) moved in 682 sweeps between October 30 and the morning of November 2; 267 further sweeps, worth about $150,000, occurred after the shutdown warning at 22:25 UTC on November 1.

Fix

Update to 2.4.2, released August 7, or later; 2.4.7 addresses 85 security findings, 1 critical and 13 high, with users on 2.4.5 or earlier strongly encouraged to update. On servers at 2.4.1 or earlier: rebuild on a fresh server with a new wallet and seed, sweep remaining hot-wallet funds, replace exposed credentials, preserve logs and avoid restoring the old server onto the new one.

Vector

BTCPay Server flaw fixed in 2.4.2; on instances running 2.4.1 or earlier, the thief signed in as administrator and swept hot wallets, according to Bitquery. The method differs from the August exploitation via LND, a Lightning Network implementation.

More details

87% of the traced funds moved in a single wave on the afternoon and evening of November 1, per Bitquery. The number of servers hit is unknown, since blockchain records wallets rather than systems; the total excludes other addresses, coins and Lightning funds, making $1.63 million a floor. BTCPay Server says some activity at the two addresses predates the reported thefts, balances should not be treated as confirmed losses, and the project has not published a loss total. The flaw had already been exploited in August via LND; at the time, the project said on-chain wallets, including hot wallets, were not affected. No actor has been attributed.

Timeline

1. 11/03/2026 11:32 AM

   New tracking puts $1.63 million in cryptocurrency stolen so far from outdated instances.

2. 11/03/2026 06:17 AM

   Project investigation confirms the Bitcoin and Litecoin thefts targeted servers running version 2.4.1 or earlier, urging users to update immediately.

3. 11/03/2026 05:39 AM

   TheHackersNews reports versions 2.4.1 and earlier were exploited to steal Bitcoin and Litecoin from hot wallets, and urges users to move to a fresh server and wallet even if no theft is detected.

Want the next updates in your inbox? Get the daily edition →

See all 5 updates

1. 11/02/2026 02:38 PM

   A November 2 advisory confirms fresh thefts of Bitcoin and Litecoin from hot wallets on servers running 2.4.1 or earlier through a different method, and urges rebuilding on a fresh server since patching alone may not remove an intruder.

2. 10/30/2026 12:25 PM

   Incident opened.

Sources 5 sources

• @DarkWebInformer @DarkWebInformer
• @DailyDarkWeb @DailyDarkWeb
• @TheHackersNews @TheHackersNews
• Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets The Hacker News
• Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency Infosecurity Magazine

See all news