"Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server said.
BTCPay Server: versions, patches, and immediate recommendations
BTCPay Server has urged users to install the latest release after reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older software. The project identified the exploited targets as instances on version 2.4.1 (released 23 July 2026) or earlier and said attackers used a different method to exploit the vulnerability fixed in 2.4.2 (released 7 August 2026).
BTCPay Server recommended that anyone still running 2.4.1 or earlier move to a fresh server with a new wallet even if they have not noticed theft. In cases of stolen funds or suspected unauthorized access, the project said users should consider the entire machine and all secrets on it compromised and follow the same recovery procedures.
In a post on X, BTCPay Server also said it had not received “credible reports” of hot wallet drains from users running the latest 2.4.7 release; that release, the project said, addresses one critical and several medium-severity security vulnerabilities discovered via Anthropic's OSS scanner.
The exploit vector: .macaroon credential files and LND
BTCPay Server's August disclosure described a critical vulnerability that could be weaponized to obtain .macaroon credential files for LND — an implementation of the Lightning Network. Those credentials, the project said then, could be used to take control of an LND node and move funds. The August alert noted the attacks reviewed targeted only files with the .macaroon extension.
BTCPay Server said the August issue affected all versions and was patched in 2.4.2. It remains unclear whether the November 2026 campaign is related to that same vulnerability; the project said attackers in the latest campaign "used a different method" to exploit the vulnerability fixed in 2.4.2.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadObserved thefts and the two wallets linked to the incidents
Reports of thefts tied to the campaign began to surface around November 1, 2026. BTCPay Server published two wallet addresses it linked to the incidents:
- Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
- Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee
The project cautioned operators who need a hot wallet for daily operations to keep only the funds necessary on the server and to move the remainder to a wallet whose spending keys are held off the server.
BTCPay Server also noted that if users run through a hosting provider, their instances may have been shut down automatically to prevent older versions from being exploited.
Related breaches, supply-chain warnings, and broader context
The BTCPay incidents come amid a wider run of high-profile cryptocurrency compromises described in the same reporting. The compilation includes the record theft of $6.43 billion from Binance by North Korean threat actors and a $2.65 million exploit against prediction market Polymarket after the compromise of software developed by DebugBear.
Hardware wallet maker Trezor warned that it had received a responsible disclosure alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis in August 2026, which it assessed as part of a sophisticated supply chain attack in which devices sold via third-party resellers were physically tampered with to steal seed phrases and drain assets.
Separately, Mercado Bitcoin — Brazil's largest cryptocurrency exchange — disclosed a security incident that led it to pause deposits and withdrawals after $49 million in stolen funds. Mercado Bitcoin posted that the value of the assets involved was approximately $38 million and that, in cooperation with partners including Tether, Circle, Paxos, BRL1, and Chainalysis, it had blocked US$11 million. Tether CEO Paolo Ardoino confirmed that Tether had frozen more than 4.5 million USDT in connection with the incident.
What this means for BTCPay Server users, hosting providers, and exchanges
BTCPay Server users: The project's guidance is specific — upgrade to the latest release (2.4.7 as reported), migrate wallets to a fresh server, and assume compromise if any unauthorized access is suspected. Keep only operational funds on a hot server and hold spending keys elsewhere.
Hosting providers: Instances running older code may be at risk and, as BTCPay Server noted, some providers may have shut down vulnerable instances to prevent exploitation. Providers will need to weigh automated containment against customer disruption and coordinate communications with affected operators.
Exchanges and stablecoin issuers: The linked Mercado Bitcoin disclosure and Tether's reported freezing of more than 4.5 million USDT underscore that rapid asset containment measures and coordination between exchanges and custody partners can limit losses. These responses were already visible in the Mercado Bitcoin case, where partners worked to block funds identified as eligible for blocking.
Several factual threads remain open: it is not yet known when attackers first began exploiting the current vulnerability, and the relationship between the August weaponized flaw and the November campaign is unclear. Those unanswered points will determine whether the events are isolated criminal campaigns or part of a continuing exploitation chain that targets hot-wallet operators and third-party resellers alike.
Source: https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html
