BTCPay Server vulnerability: about $1.63M traced to theft-linked addresses

What it is

An exploited vulnerability in BTCPay Server, in versions 2.4.1 and earlier, let attackers log in as administrator and sweep on-chain hot wallets between 30 October and the morning of 2 November 2026. BTCPay Server's incident update of 2 November says the flaw was fixed in 2.4.2, released 7 August 2026. Attackers used a different method against the same flaw.

How it works

The page gives no mechanism for how administrator access was obtained. It says only that the August 2026 use of this flaw drained funds via LND (Lightning), and that at that time on-chain and hot wallets were reported unaffected. The November attacks hit on-chain hot wallets.

Preconditions / Affected

• BTCPay Server 2.4.1 or earlier. The project had seen no impact on servers running 2.4.2 or later when it issued the warning.
• Spending keys held on the server. Wallets with keys stored off-server, such as hardware wallets, were unaffected.

What to do

• If you ran 2.4.1 or earlier, migrate to a new server with a fresh wallet and seed, even if you have since updated. The project states that "updating alone cannot remove access an attacker may already have gained."
• Install 2.4.7, which the project strongly urges.
• Preserve logs and transaction records.
• Replace exposed credentials.
• Do not copy the old server installation onto the replacement.
• Keep only operational funds on the server.

Caveats

• The $1.63M figure (18.38 BTC and 3,405 LTC) is funds traced to two addresses named by BTCPay Server, not a confirmed loss total. Bitquery excluded other addresses, other coins and Lightning funds.
• Bitquery counted 682 sweeps. About 87% of the traced funds moved in one wave on the afternoon and evening of 1 November.
• Sweeps continued after the project told operators to take instances offline at 22:25 UTC on 1 November: 267 more, worth about $150,000.
• BTCPay Server also asked VPS hosting providers to take affected instances offline.
• The page was produced with AI assistance and reviewed by an editorial team. The figures come from Bitquery and BTCPay Server, not from this outlet's own tracing.