BTCPay Server, the open-source self-hosted cryptocurrency payment processor, said on 2 November 2026 that it received reports on 1 November of Bitcoin and Litecoin being stolen from hot wallets on BTCPay Server instances, and that its investigation found the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier.

The project says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (released 7 August 2026); it has not named a CVE. Its timeline, converted to Perth time, records a wallet drain at 21:46 on 1 November, the first theft report by email at 04:56 on 2 November, and a warning on X at 06:25 on 2 November asking operators to shut down their servers; it also asked VPS hosting providers, including LunaNode, to take BTCPay Server instances offline as a precaution.

BTCPay says it has seen no impact on servers that were already running 2.4.2 or later when it issued that warning, that funds in wallets whose spending keys are held off the server, including hardware wallets, were unaffected, that it has not established when exploitation began, and that activity at the reported destination addresses should not be treated as a confirmed total of losses. (source: BTCPay Server)

According to BleepingComputer, on 29 October BTCPay disclosed a critical vulnerability discovered through Anthropic's Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update, and BTCPay says it has no credible reports of hot wallet drains for users running 2.4.7. (source: BleepingComputer)

Correction (02 Nov 2026): removed BTCPay Server's posts on X as a source; removed details no other source gives. (source: BTCPay Server; BleepingComputer)