// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighBTCCVSS not assigned

BTCPay Server hot wallets had Bitcoin and Litecoin stolen

BTCPay Server received reports of Bitcoin and Litecoin being stolen from hot wallets on Nov 1, targeting servers on version 2.4.1 or earlier.

· 2 min read
AI-generated image of hands beside blurred cryptocurrency wallet software on office monitors.
AI-generated image, not a photo of the event.
Key takeaways
  • BTCPay Server received reports of Bitcoin and Litecoin being stolen from hot wallets on Nov 1.
  • The attacks targeted BTCPay Server 2.4.1 and earlier.
  • BTCPay Server fixed the vulnerability in version 2.4.2, released on Aug 7.

BTCPay Server received reports on Nov 1 that Bitcoin and Litecoin were being stolen from hot wallets. Its investigation found that the attacks targeted servers running version 2.4.1, released on Jul 23, or earlier.

BTCPay Server said wallets whose spending keys were held off the server, including hardware wallets, were unaffected by these thefts.

BTCPay Server is a free, open-source, self-hosted Bitcoin payment processor that lets merchants receive payments directly into their own wallets. BTCPay Server said the attackers used a different method to exploit the vulnerability fixed in version 2.4.2, released on Aug 7.

On this page

Bitquery traced 18.38 Bitcoin and 3,405 Litecoin across 682 sweeps

Bitquery traced 18.38 Bitcoin and 3,405 Litecoin to two addresses across 682 wallet sweeps between Oct 30 and the morning of Nov 2, according to the blockchain intelligence company.

It said 87% of the traced funds moved in one wave on Nov 1, with 267 further sweeps occurring after BTCPay Server’s warning. Bitquery could not determine how many servers were hit because blockchain records identify wallets rather than systems.

BTCPay Server told affected operators to replace servers and wallets

BTCPay Server urged users running version 2.4.1 or earlier to move to a fresh server with a new wallet. It said that updating alone cannot remove access an attacker may already have gained.

The company advised creating a new wallet with a new seed, moving remaining hot-wallet funds into it, taking the old server offline, and preserving logs and transaction records.

The timeline began with a wallet drain at 13:46 on Nov 1

BTCPay Server said a wallet drain occurred at 13:46 on Nov 1, but it had not established when exploitation began. The first email reporting a theft arrived at 20:56.

BTCPay Server said it had not established when attackers first began exploiting the vulnerability. The company warned operators on X at 22:25 on Nov 1 and asked them to shut down their servers while it investigated.

It urged operators who need hot wallets for daily operations to keep only the funds needed for those operations on the server and move the rest to wallets whose spending keys are held off the server.

What to do now

  1. Move to a fresh server with a new wallet if you are running BTCPay Server 2.4.1 or earlier.
  2. From a trusted device, revoke and replace credentials the old server could access.

FAQ

What happened to BTCPay Server hot wallets?

BTCPay Server received reports of Bitcoin and Litecoin being stolen from hot wallets on Nov 1. The company found that the attacks targeted servers running version 2.4.1 or earlier.

Which BTCPay Server versions were affected?

The attacks targeted BTCPay Server 2.4.1 and earlier. BTCPay Server said it had seen no impact on servers already running version 2.4.2 or later when it issued its warning.

How much cryptocurrency did Bitquery trace?

Bitquery traced 18.38 Bitcoin and 3,405 Litecoin to two addresses across 682 wallet sweeps between Oct 30 and the morning of Nov 2.

How should affected BTCPay Server users respond?

BTCPay Server urged affected users to move to a fresh server with a new wallet and replace potentially exposed credentials. Updating alone cannot remove access an attacker may already have gained.

What is a hot wallet in this incident?

BTCPay Server said wallets whose spending keys were held off the server, including hardware wallets, were unaffected by these thefts.

Sources

  1. Security Incident Affecting BTCPay Server 2.4.1 and Earlier | BTCPay Server Blog, BTCPay ServerPrimary
  2. Security Advisory: Update BTCPay Server to 2.4.2 Immediately | BTCPay Server Blog, BTCPay ServerPrimary
  3. Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency, Infosecurity Magazine
  4. BTCPay urges Bitcoin merchants to replace wallets after hackers steal an estimated $1.6 million, CryptoSlate
  5. BTCPay Server Reveals How Attackers Targeted Older Instances in Hot Wallet Incident, CryptoPotato
  6. BTCPay Server, Wikipedia
How we checked this story
ClaimSourceStatus
BTCPay Server received reports of Bitcoin and Litecoin being stolen from hot wallets on 1 November 2026.BTCPay ServerConfirmed
BTCPay Server found that the attacks targeted servers running version 2.4.1, released on 23 July 2026, or earlier.BTCPay ServerConfirmed
Attackers used a different method to exploit the vulnerability fixed in BTCPay Server 2.4.2, released on 7 August 2026.BTCPay ServerConfirmed
BTCPay Server said the attacks had no impact on servers already running version 2.4.2 or later when it issued its warning.BTCPay ServerConfirmed
BTCPay Server warned that updating alone cannot remove access an attacker may already have gained.BTCPay ServerConfirmed
BTCPay Server said wallets whose spending keys were held off the server, including hardware wallets, were unaffected by these thefts.BTCPay ServerConfirmed
BTCPay Server advised creating a new wallet with a new seed and moving remaining hot-wallet funds into it.BTCPay ServerConfirmed
BTCPay Server’s timeline says the vulnerability was fixed in version 2.4.2 on 7 August.BTCPay ServerConfirmed
BTCPay Server said a wallet drain occurred at 13:46 on 1 November, but it had not established when exploitation began.BTCPay ServerConfirmed
BTCPay Server received its first email reporting a theft at 20:56 on 1 November.BTCPay ServerConfirmed
BTCPay Server warned the community on X at 22:25 on 1 November and asked operators to shut down their servers.BTCPay ServerConfirmed
Bitquery traced 18.38 Bitcoin and 3,405 Litecoin to two addresses across 682 wallet sweeps between 30 October and 2 November.Bitquery, via Infosecurity MagazineAttributed
Bitquery said 87% of the traced funds moved in one wave on 1 November, and 267 further sweeps occurred after BTCPay’s warning.Bitquery, via Infosecurity MagazineAttributed
Bitquery could not determine how many servers were hit because blockchain records identify wallets rather than systems.Bitquery, via Infosecurity MagazineAttributed
BTCPay Server urged operators to keep only funds needed for daily operations on a hot wallet and move the rest off the server.BTCPay ServerConfirmed
BTCPay Server said attackers had exploited the earlier vulnerability and that users were affected and funds were stolen.BTCPay ServerConfirmed
BTCPay Server is a free, open-source, self-hosted Bitcoin payment processor that lets merchants receive payments directly into their wallets.WikipediaConfirmed

Could not verify

  • How many servers or merchants were compromised is not established
  • How much cryptocurrency was conclusively stolen is not established
  • Whether the identified destination-address balances represent confirmed losses is not established
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok