BTCPay Server hit by security vulnerability causing hot wallet theft, officials urgently advise users of older versions to shut down servers and migrate

BlockBeats news, November 5 — Open-source Bitcoin payment processing tool BTCPay Server received multiple reports on November 1 that Bitcoin and Litecoin hot wallets on its platform were being subjected to unauthorized fund theft. On November 2, the project team released an investigation update confirming that the attack targeted servers running BTCPay Server version 2.4.1 (released July 23, 2026) or earlier, with attackers exploiting a vulnerability that had been fixed in version 2.4.2, released on August 7.

The investigation showed that attackers used various methods to exploit the old-version vulnerability, successfully gaining administrator privileges on the servers and emptying funds from hot wallets. After discovering the anomaly, BTCPay Server issued an emergency alert on November 1, advising all instance operators to temporarily shut down their servers to cooperate with the investigation. Founder Nicolas Dorier subsequently confirmed that only servers running versions prior to 2.4.2 (especially 2.4.1) were affected, while users running the latest version 2.4.7 had no credible loss reports. Some affected service providers, such as LunaNode, automatically shut down at-risk old-version instances to prevent further losses.

In response to the incident, officials provided clear recovery guidance: merely updating the software version is no longer sufficient to eliminate the risk, because attackers may have already gained persistent access on the old servers. Officials strongly recommend that all users still running 2.4.1 or earlier versions (including those who upgraded only after the November 1 warning) immediately take the following measures: first, transfer any remaining funds from old hot wallets to a new wallet created with a brand-new mnemonic seed; second, take the old server offline and preserve relevant logs for investigation; finally, install the latest version on a brand-new virtual machine and connect it to the new wallet, and under no circumstances restore the old server in its entirety to the new machine.

It is worth noting that funds stored outside the server (such as hardware wallets) were not affected by this incident, and officials still recommend that merchants adopt this safer method of receiving payments. This vulnerability is related to one that was fixed in August of this year, when attackers had manipulated nodes by obtaining administrative credentials for LND (Lightning Network Daemon). Despite the severity of the vulnerability, as of now it has not been assigned a CVE number, nor is it in CISA's Known Exploited Vulnerabilities catalog.