BTCPay Server Hot Wallets Drained on Unpatched Self-Hosted Instances

Scope: BTCPay Server, versions 2.4.1 and earlier (fixed in 2.4.2, released August 7, 2026)

Severity: Red

BTCPay Server, a self-hosted open-source cryptocurrency payment processor, confirmed on November 1 and 2, 2026 that attackers have been stealing Bitcoin and Litecoin from hot wallets on instances still running version 2.4.1 or earlier, exploiting a vulnerability that was actually fixed back on August 7 in version 2.4.2. Blockchain analysis firm Bitquery traced approximately 1.63 million dollars worth of Bitcoin and Litecoin, spanning 682 separate wallet sweeps, moving to two attacker-linked addresses between October 30 and November 2 alone, though BTCPay Server has not published a confirmed total loss figure or count of affected merchants, meaning the real scope is likely larger. BTCPay Server has been direct about the limits of simply patching after the fact: operators who were running the vulnerable version are told to move to an entirely fresh server with a brand new wallet, because updating software does not undo access an attacker already obtained, and a hot wallet’s private keys cannot be rotated the way a password can. The project also flagged that anyone who ever connected BTCPay Server to a Lightning node should rotate that node’s credentials regardless of current patch status, since a compromised server could have issued itself long-lived access tokens that outlive the software update entirely. Operators running BTCPay Server must update to version 2.4.7 today, and anyone who was ever on version 2.4.1 or earlier must treat the server and any connected hot wallet or Lightning node as compromised, moving funds and credentials to entirely new infrastructure rather than reusing the existing one.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.