BTCPay Server reports hot-wallet thefts on outdated installations
The project reports Bitcoin and Litecoin thefts from servers running 2.4.1 or earlier. It recommends rebuilding those systems and replacing access, even after a late update.
Going deeper
Generated image · SecuFocus
At a glance
Key points
Running an old BTCPay Server for payments? On November 1 the project received theft reports involving wallets whose spending keys were held on the server. Its investigation points to version 2.4.1 and earlier. Updating after the warning does not remove access an attacker may already have gained: the team recommends a fresh server and a new wallet for those installations.
When the server was updated matters
BTCPay Server’s incident update describes Bitcoin and Litecoin thefts reported on November 1, 2026. Affected servers were running 2.4.1, released in July, or earlier. The team says attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on August 7.
The project says it has seen no impact from these attacks on servers already running 2.4.2 or later when it issued its November 1 warning. That observation is not a guarantee for an old machine updated only after the warning.
A fresh machine needs fresh secrets too
For a 2.4.1-or-earlier installation, the team recommends preparing a new wallet, moving remaining funds from a trusted device and rebuilding on a fresh machine. This recommendation also applies without a visible theft, or if the server was updated after the warning.
Preserve logs and transaction records before replacing the environment. Do not restore the entire potentially compromised server image onto the new machine. Review and replace old passwords and access keys from a known-clean system; an exposed recovery phrase does not become secret again on a different server.
These steps can move funds and interrupt payment processing. Follow the project’s procedure with the person responsible for the installation. Never share recovery phrases, private keys or passwords with support or a supposed recovery service.
The August advisory is not the full scope of November’s thefts
The August advisory focused on LND credential files, for one Lightning implementation, and described the scope observed then. The new incident describes another method targeting hot wallets on old servers. Concluding that non-LND installations are unaffected by this alert would reuse the wrong scope.
The project says funds whose spending keys were kept off the server were unaffected by these thefts. It nevertheless maintains its recommendation to rebuild an old server. Balances at public addresses linked to the investigation are not a confirmed total of losses; we do not turn them into one.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.