Hackers are draining bitcoin from stores that didn't update their BTCPay software

The first reports came in on the evening of November 1. Operators of BTCPay Server, open-source software that lets online stores accept bitcoin payments, saw their wallets being emptied. Bitcoin and litecoin were leaving for unknown addresses, without any authorization.

The project first asked all operators to shut down their servers while it investigated. It also asked virtual private server (VPS) hosting providers to take affected instances offline as a precaution. On November 2, according to BleepingComputer, the team identified the common thread: all victims were running version 2.4.1, released on July 23, 2026, or an older version.

A flaw fixed in August, exploited in November

According to BleepingComputer, the investigation is trying to understand how the attacker was able to log in as an administrator on instances older than version 2.4.2, released on August 7. According to BTCPay's incident report, the stolen funds came from "hot wallets," meaning those whose spending key is stored on the server. Wallets whose keys are kept elsewhere, for example on a hardware wallet, were not affected.

This is not the project's first alert. On August 7, it had urged users to upgrade to version 2.4.2 immediately. A critical flaw was then being exploited to steal funds from Lightning (LND) nodes, Bitcoin's fast payment network. Evidently, not all operators followed. According to BleepingComputer, version 2.4.7, the latest, was released urgently after another critical flaw was disclosed on October 29. That flaw was reportedly found using a code analysis tool from Anthropic. According to Nicolas Dorier, quoted by the site, the evidence points rather to flaws in versions older than 2.4.2.

The project's founder, Nicolas Dorier, says the attacks do not target public BTCPay servers. The project says it has "no credible report" of theft from users of version 2.4.7. Neither the amount stolen nor the number of affected servers has been disclosed.

What to do if you run a BTCPay server

As is often the case, these thefts do not stem from an unknown flaw: they target servers that went months without an update.

• Check your version. If it is 2.4.1 or older, take the instance offline as soon as possible.
• Upgrade to 2.4.7. Standard installation: Server Settings menu, then Maintenance, then Update. Docker installation: log in over SSH, become administrator with sudo su -, enter the folder with cd btcpayserver-docker, then run ./btcpay-update.sh.
• Consider the funds in a hot wallet left on an old version as exposed. The project recommends moving whatever remains, then starting over on a new server with a new wallet, even if no theft has occurred. You should also change the credentials the old server had access to (hosting provider, SSH, API, Lightning).
• If you lost funds, write to security@btcpayserver.org with the details, and file a complaint with the police.

This is not the first cryptocurrency software to serve as an entry point this fall, as the booby-trapped Polymarket tool showed. The question to watch: how many servers were still running a July version, and how much was stolen?