BTCPay Server urges upgrade after hot wallet thefts hit older versions

The latest:

Bitcoin and Litecoin have been stolen from hot wallets on self-hosted BTCPay Server instances running outdated software, the open-source payment processor said, urging every user to upgrade immediately. Its investigation found the attacks hit servers on version 2.4.1, released July 23, 2026, or earlier, with attackers deploying a different method to exploit a vulnerability already fixed in August.

Details:

• The affected versions: BTCPay Server said the thefts targeted instances running 2.4.1, released July 23, 2026, or any earlier build. The attackers exploited the same vulnerability patched in 2.4.2 on August 7, 2026, but through a different method, according to the project’s investigation.
• The recommended fix: Users on 2.4.1 or earlier are told to migrate to a fresh server with a newly generated wallet, even if no theft has been noticed. Where funds were taken or unauthorized access is suspected, the project advises treating the machine and every secret stored on it as compromised.
• The current release: In a post on X, the project said no credible reports of hot wallet drains had come from users on the latest 2.4.7 release. That version fixes one critical and several medium-severity vulnerabilities found through Anthropic’s open-source scanner.
• The timeline: BTCPay Server has not established when exploitation began, saying only that reports started surfacing around November 1, 2026. It also said it was unclear whether the current wave is connected to the same flaw exploited in August.
• The tracked addresses: The project published two wallet addresses tied to the incidents, one Bitcoin and one Litecoin, for users and investigators to monitor. It warned that instances running through hosting providers may have been shut down automatically to block exploitation of older versions.
• The operational advice: For merchants who need a hot wallet daily, the project said to keep only operating funds on the server. “Move the rest to a wallet whose spending keys are held off the server,” it cautioned.
• The August precedent: BTCPay Server disclosed in August 2026 that a critical flaw affecting all versions had been weaponized to steal funds. An unauthenticated remote attacker could obtain .macaroon credential files for LND, a Lightning Network implementation, then take over a node and move funds.
• Brazil’s largest exchange: Mercado Bitcoin paused deposits and withdrawals Monday after a breach it tied to $49 million in stolen funds, later saying roughly $38 million in assets was involved. It said $11 million was blocked with Tether, Circle, Paxos, BRL1 and Chainalysis, and gave no restart date.
• The wider wave: Tether CEO Paolo Ardoino confirmed the issuer froze more than 4.5 million USDT linked to the Mercado Bitcoin incident. Separately, Polymarket briefly halted trading after a $2.65 million exploit tied to compromised DebugBear software.
• The hardware angle: Trezor warned it received a responsible disclosure report alleging a hardware implant in a Safe 5 unit bought from reseller CryptoBilis in August 2026, assessed as a supply chain attack in which tampered devices leak seed phrases so assets can be drained.

Background:

BTCPay Server is self-hosted and open-source, meaning merchants run their own instances and are responsible for patching them. Hot wallets keep spending keys on the connected server, which makes an unpatched instance directly exploitable for theft rather than merely exposed to data loss.

Between the lines:

The self-hosted model explains the slow containment: with no central operator, each merchant must notice the advisory and rebuild independently, and hosting providers resorted to shutting instances down automatically. That a flaw patched in August was re-exploited through a different method in November suggests the original fix narrowed one path without closing the underlying weakness.

What’s next

Watch whether BTCPay Server links the November thefts to the August LND credential flaw, and when Mercado Bitcoin restores deposits and withdrawals. The exchange said timelines will come only through its official channels.