BTCPay Server Flaw Exploited to Drain Bitcoin and Litecoin Hot Wallets

BTCPay Server, the open-source, self-hosted cryptocurrency payment processor, is urging operators to upgrade immediately after reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older releases. According to The Hacker News, the project's investigation traced the attacks to servers running BTCPay Server 2.4.1 — released on 23 July 2026 — or earlier.

Because BTCPay Server is self-hosted, there is no central vendor pushing patches to every deployment. That architectural choice, one of the project's selling points for merchants who want to avoid custodial payment processors, also means the security of each instance depends on its operator applying updates promptly. In this case, a meaningful population of deployments apparently did not.

What the project has disclosed

The project's public statement confirms that funds were taken from hot wallets on vulnerable instances and that the affected version range is 2.4.1 and earlier. Operators are directed to install the latest release. Readers should consult the official advisory for the precise patched version, the underlying technical cause, and any indicators of compromise, since those details matter for anyone assessing whether their server was exposed.

What is clear from the framing is that this is an active, in-the-wild exploitation campaign rather than a theoretical weakness. The attackers appear to have identified vulnerable instances and extracted keys or signed transactions directly, resulting in the loss of Bitcoin and Litecoin balances held online.

Why hot wallets are the prize

BTCPay Server supports both hot wallets, where private keys reside on the server for automated payment processing, and hardware or watch-only configurations where keys stay offline. Hot wallet setups are convenient for merchants who want automatic settlement, but they concentrate risk: anyone who achieves code execution or reads the relevant key material on the host can move funds without further authorization.

That dynamic explains the emphasis on hot wallets in the disclosure. Merchants who followed hardened guidance — keeping signing keys on a hardware device and using BTCPay Server in a watch-only or partially signed transaction workflow — were structurally less exposed, though they should still patch and audit.

Practical guidance for BTCPay Server operators

  • Upgrade now. Move to the latest release and confirm the running version after restart, since containers and package managers can silently keep an old image.
  • Treat exposed hot wallets as compromised. If an instance ran an affected version and was reachable from the internet, assume key material may have been harvested. Generate new wallets and move remaining funds to a fresh, preferably hardware-backed setup.
  • Rotate everything adjacent to the wallet. That includes API keys, Lightning node credentials, and any secrets stored alongside the BTCPay deployment.
  • Review logs for anomalous activity. Look for unexpected API calls, unfamiliar login sources, new store or user creation, and outbound connections that don't match normal payment traffic.
  • Reduce the attack surface. Restrict administrative access, avoid exposing the instance broadly, and keep the host OS and dependencies patched.
  • Reassess hot wallet reliance. For meaningful balances, a watch-only or hardware-signing configuration limits the blast radius of any future server compromise.

The wider lesson

Self-hosted payment infrastructure shifts responsibility to the operator. That is a trade-off many merchants accept deliberately, but it only works when patch hygiene keeps pace with disclosures. Version 2.4.1 shipped in late July 2026; by early November, exploitation was underway against instances still running it or older builds. A four-month window is ample time for attackers to scan for fingerprintable deployments and for defenders to close the gap.

For the broader self-hosted software ecosystem, the incident is a reminder that "open source and self-hosted" is not a security guarantee on its own. It is a model that requires disciplined maintenance — monitoring advisories, automating updates where feasible, and treating internet-facing services that hold value as high-priority assets.

BTCPay Server users should check their version today, and merchants who accepted payments through an affected hot wallet should review transaction history for unauthorized outflows. The project's advisory remains the authoritative source for remediation specifics.

Original source: The Hacker News — Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets