Hackers Target BTCPay Wallets Through Security Flaw in BTCPay Server

Hackers have targeted outdated BTCPay Server installations, stealing Bitcoin and Litecoin from cryptocurrency hot wallets. The incident has raised concerns among businesses and merchants that rely on BTCPay Server to accept digital currency payments without using third-party payment processors.

BTCPay Server is an open-source, self-hosted cryptocurrency payment platform. It allows businesses to receive payments directly into their own wallets. However, attackers reportedly exploited weaknesses in older software versions to gain administrative access and drain funds stored in connected hot wallets.

The BTCPay Server project identified versions 2.4.1 and earlier as affected by the latest attacks. It urged operators to take vulnerable servers offline, upgrade their installations, and move funds into newly created wallets. Blockchain analytics firm Bitquery traced approximately $1.62 million in Bitcoin and Litecoin transfers linked to the incident.

What Is BTCPay Server?

BTCPay Server is a free, open-source payment processor designed for businesses, online stores, and organizations that want to accept cryptocurrency. Unlike traditional payment services, it allows merchants to operate their own payment infrastructure and receive funds directly into wallets they control.

The platform supports Bitcoin payments and Lightning Network transactions. It also provides invoice management, payment verification, checkout integration, and other tools for handling cryptocurrency transactions.

Its self-hosted design gives businesses greater control over their payment systems. However, this arrangement also places responsibility for software updates, server security, access management, and wallet protection on the operators.

When a merchant stores wallet spending keys directly on an internet-connected server, those funds are considered part of a hot-wallet setup. If an attacker compromises the server and obtains the necessary access, the attacker may be able to move the cryptocurrency without the owner’s approval.

Hackers Exploit Older BTCPay Server Versions

The BTCPay Server project reported that the latest attacks targeted installations running version 2.4.1, released on July 23, 2026, or earlier. The attackers reportedly used a different method to exploit a vulnerability addressed in version 2.4.2, released on August 7.

The project began receiving reports of unauthorized Bitcoin and Litecoin withdrawals around November 1, 2026. Its initial response included advising operators to shut down vulnerable servers while the investigation continued.

BTCPay Server founder Nicolas Dorier said the investigation focused on how attackers obtained administrator access to older installations. The project also warned hosting providers about affected instances and requested precautionary shutdowns.

According to BTCPay Server, there were no credible reports of hot-wallet drains affecting users running the latest version 2.4.7. The project encouraged everyone to install the updated release rather than continue operating outdated software.

Approximately $1.62 Million in Cryptocurrency Stolen

Blockchain analytics company Bitquery investigated transactions connected to two wallet addresses identified by BTCPay Server. Its analysis traced approximately $1.62 million in cryptocurrency transfers, including 18.38 Bitcoin and 3,405 Litecoin.

The investigation identified 682 separate transfers, commonly described as wallet sweeps. These transactions moved cryptocurrency from affected wallets toward addresses associated with the incident.

Bitquery reported that approximately 87% of the traced funds moved in one major wave on November 1. Some transfers were relatively small, while a limited number of larger transactions accounted for a significant portion of the total.

The $1.62 million figure represents Bitquery’s analysis of the identified blockchain addresses, not an official total loss figure published by BTCPay Server. The actual number of affected installations and victims has not been established publicly.

How the BTCPay Server Vulnerability Affected Hot Wallets

A hot wallet stores the keys needed to spend cryptocurrency on a device or server connected to the internet. This arrangement makes routine payments convenient because transactions can be processed without manually connecting a separate hardware wallet for every operation.

However, keeping spending keys on a server creates additional security risks. If attackers gain sufficient control over that environment, they may be able to access sensitive wallet information and initiate unauthorized transactions.

In the latest BTCPay Server incident, attackers reportedly obtained administrator access to vulnerable installations and drained connected hot wallets. The project said the attacks involved a different exploitation method from the issue previously addressed in version 2.4.2.

The full technical details of the latest attack have not been publicly established. Therefore, it is important not to assume that every affected installation was compromised through an identical sequence of actions.

Connection to the August 2026 Security Incident

The latest wallet thefts followed an earlier BTCPay Server security incident disclosed in August 2026. In that incident, attackers exploited a vulnerability that exposed LND administrator macaroon credentials.

LND is an implementation of the Lightning Network. Macaroons are authentication credentials that can grant access to specific services and operations. If attackers obtain administrator-level credentials, they may gain control over a connected Lightning node and potentially move funds.

BTCPay Server addressed the credential exposure issue in version 2.4.2. The project explained that the earlier attacks involved LND credentials and did not affect its on-chain hot wallets at that time.

The November incidents involved a different attack method targeting older installations. Although the two incidents are connected through the affected software and security history, their specific impacts should be distinguished.

Why Self-Hosted Cryptocurrency Servers Face Security Risks

Self-hosted payment infrastructure offers businesses greater independence, but it also requires consistent security maintenance. Unlike a fully managed payment service, a self-hosted installation depends heavily on the operator’s ability to configure, update, and protect the environment.

Outdated software can leave known weaknesses available to attackers. Weak administrator passwords, exposed management interfaces, insufficient access controls, and poor credential management can create additional opportunities for compromise.

Hot wallets introduce another concern because their spending keys remain accessible to the online server. Even when a business uses strong network security, a successful server compromise can put funds at risk.

For this reason, businesses should separate payment operations from long-term cryptocurrency storage. A hot wallet should contain only the amount needed for routine transactions, while larger reserves should remain in wallets whose spending keys are stored away from the server.

BTCPay Server’s Security Recommendations

BTCPay Server urged operators using affected versions to take protective action. The project recommended moving to a fresh server with a newly created wallet, even if the operator had not noticed any unauthorized withdrawals.

Users should treat an affected machine and the secrets stored on it as potentially compromised. Simply installing an update on an old server may not be sufficient when attackers could already have accessed credentials or other sensitive information.

Important security measures include:

• Upgrade the software: Install BTCPay Server version 2.4.7 or a newer supported release before returning the installation to service.
• Rebuild affected servers: Move away from potentially compromised installations and deploy a clean environment.
• Create a new wallet: Generate a new wallet and seed phrase using a trusted device. Never reuse the old compromised seed.
• Move remaining funds: Transfer available cryptocurrency to a newly created wallet with secure spending-key storage.
• Protect administrator access: Enable two-factor authentication, change administrator passwords, and rotate API keys.
• Review server activity: Investigate suspicious logins, unexpected transactions, and unauthorized configuration changes.

Operators who experienced losses should also contact BTCPay Server through its official security channel and report the incident to relevant authorities.

How Businesses Can Protect Cryptocurrency Hot Wallets

The BTCPay Server incident highlights the importance of separating everyday payment operations from cryptocurrency reserves. Businesses should avoid keeping large balances in wallets connected directly to public-facing servers.

Cold storage provides an additional layer of protection because spending keys remain offline or outside the compromised server environment. Hardware wallets can help achieve this separation when configured and used correctly.

Organizations should also establish a regular software maintenance schedule. Security updates should receive priority, particularly when developers disclose actively exploited vulnerabilities.

Monitoring is another important part of wallet protection. Businesses can review transaction activity, monitor administrator logins, and configure alerts for unexpected withdrawals. Regular backups and tested recovery procedures can also reduce disruption after a security incident.

Conclusion

The BTCPay Server security incident demonstrates how outdated cryptocurrency payment infrastructure can expose business funds to cybercriminals. Attackers targeted installations running version 2.4.1 or earlier and reportedly drained Bitcoin and Litecoin from connected hot wallets.

Bitquery traced approximately $1.62 million in cryptocurrency transfers associated with the attacks, although the full number of victims and total losses remain unclear. BTCPay Server urged affected operators to upgrade, rebuild potentially compromised systems, and create new wallets.

For businesses using self-hosted cryptocurrency payment systems, the lesson is clear: software maintenance and wallet security must work together. Keeping hot-wallet balances limited, protecting administrator credentials, and storing long-term funds away from online servers can reduce the impact of future attacks.

FAQs

What happened in the BTCPay Server security incident?

Hackers targeted outdated BTCPay Server installations and stole Bitcoin and Litecoin from connected hot wallets. The project identified versions 2.4.1 and earlier as affected by the latest attacks.

How much cryptocurrency was stolen from BTCPay wallets?

Bitquery traced approximately $1.62 million in Bitcoin and Litecoin transfers associated with the incident. BTCPay Server has not publicly confirmed the total number of victims or overall losses.

Which BTCPay Server versions were affected?

The latest attacks targeted installations running version 2.4.1 or earlier. BTCPay Server recommended upgrading to version 2.4.7 or a newer supported release.

Were hardware wallets affected by the attack?

Wallets that keep their spending keys outside the compromised server environment were not affected by the reported hot-wallet draining method. Hardware wallets can provide this separation when properly configured.

What should BTCPay Server users do to protect their funds?

Users should update their installations, rebuild potentially compromised servers, create new wallets with new seed phrases, rotate credentials, and move funds away from vulnerable environments. Businesses should also keep only necessary operating funds in hot wallets.

Explore More BTECH WORLD