Key Takeaways
- BTCPay Server confirmed that attackers exploited outdated software to steal Bitcoin and Litecoin from internet-connected hot wallets.
- The attacks targeted versions 2.4.1 and earlier, exploiting a vulnerability patched in August 2026.
- Operators running vulnerable versions have been urged to migrate to fresh servers and wallets, even if they have not detected unauthorized withdrawals.
BTCPay Server has issued an urgent security warning after attackers exploited outdated installations of its open-source cryptocurrency payment software to drain Bitcoin and Litecoin wallets.
In a Nov. 2 security advisory, the project confirmed that the attacks targeted servers running version 2.4.1 or earlier, exposing merchants who had not installed an August security patch.
The incident has renewed concerns about the security of self-hosted cryptocurrency payment infrastructure, particularly when private keys are stored on internet-connected servers.
BTCPay has not confirmed the number of affected operators or the total value of stolen cryptocurrency.
BTCPay Server Identifies Vulnerability Behind Bitcoin Wallet Thefts
BTCPay Server first received reports of unauthorized wallet withdrawals on Nov. 1, prompting an emergency warning advising operators to shut down their installations.
According to the project’s investigation, a wallet drain was reported at 13:46 UTC, while its security team received the first email reporting a theft at 20:56 UTC.
By 22:25 UTC, BTCPay had publicly warned operators and contacted hosting providers, including LunaNode, requesting precautionary shutdowns. Investigators subsequently established that attackers had exploited a vulnerability affecting software released on or before July 23.
The security weakness had already been patched in version 2.4.2 on Aug. 7, but attackers reportedly used a different exploitation method from the one identified during the earlier incident.
BTCPay said installations already running version 2.4.2 or later when the warning was issued showed no impact from these attacks.
Bitcoin and Litecoin Stolen as Earlier Security Flaw Resurfaces
The latest incident follows an August security breach involving vulnerabilities in BTCPay’s Lightning Network integration.
That earlier attack exposed credentials associated with Lightning payments, prompting an emergency software update.
The November thefts instead affected onchain hot wallets, where the private keys required to authorize transactions are stored directly on the server. This configuration allows merchants to automate payments but also creates an opportunity for attackers who obtain unauthorized access.
BTCPay identified one Bitcoin address and one Litecoin address associated with reported thefts.
However, the project cautioned that some transactions involving those addresses predated the known incidents, making their complete balances unreliable measures of confirmed losses.
Wallets whose spending keys were held outside the affected servers, including hardware wallets, were not compromised through this attack.
BTCPay Urges Users to Rebuild Servers and Move Funds
BTCPay has warned that installing the latest software may not be sufficient for operators whose systems were previously exposed.
Users running version 2.4.1 or earlier should create fresh wallets, transfer remaining funds, replace potentially compromised credentials, and rebuild their installations on new servers.
The recommendation also applies to operators who updated their software after the Nov. 1 warning.
BTCPay emphasized that attackers may retain access through stolen credentials even after a vulnerability has been patched.
The project recommends keeping only operational funds in hot wallets and storing larger balances using devices that retain private keys offline. Affected users have been asked to submit transaction records and sanitized server logs to the security team.
As the investigation continues, the incident highlights a recurring challenge for self-hosted cryptocurrency services: security patches can close known vulnerabilities, but outdated installations may remain exposed long after fixes are available.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
