"Updating alone cannot remove access an attacker may already have gained," BTCPay Server warned on November 2 as it described a campaign that emptied hot wallets on outdated instances of its software.
What happened: hot wallets on outdated BTCPay Server instances were emptied
Hackers targeted BTCPay Server instances running version 2.4.1 or earlier and stole cryptocurrency from hot wallets, with blockchain tracing linking roughly $1.63m in Bitcoin and Litecoin to addresses associated with the thefts. BTCPay Server reported the incident in an update on November 2 and said the attackers signed in to servers as administrators and swept their hot wallets.
The project said the emptied wallets sat on servers that had never installed a patch released on August 7, and it has not published a total loss figure. BTCPay Server also cautioned that some activity at the two addresses it named appears to predate the reported thefts, and therefore balances should not be treated as confirmed losses.
Patch history: version 2.4.2 fixed the vulnerability on August 7
BTCPay Server said the vulnerability exploited in the recent thefts had been fixed in version 2.4.2, which was released on August 7. The project reported it had seen no impact on servers already running 2.4.2 or later when it issued its warning.
BTCPay Server also noted that a related flaw had been exploited in August to steal funds through LND, a Lightning Network implementation, though at that time BTCPay Server said on-chain wallets, including hot wallets, were not affected. In the recent campaign, however, attackers used a different method to exploit the vulnerability fixed in 2.4.2.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageBlock-chain tracing by Bitquery: 18.38 BTC and 3,405 LTC moved in 682 sweeps
Blockchain intelligence firm Bitquery traced 18.38 Bitcoin and 3,405 Litecoin to two addresses named by BTCPay Server. According to Bitquery, those coins were moved in 682 sweeps between October 30 and the morning of November 2.
Bitquery reported that 87% of the traced funds moved in a single wave on the afternoon and evening of November 1. After BTCPay Server told operators at 22:25 UTC that night to shut down their instances, Bitquery counted 267 further sweeps — movements it estimated at about $150,000 — continuing into the following hours. The firm noted its figure is a floor because blockchain records show wallets rather than systems and it left out other addresses and coins, including Lightning funds.
BTCPay Server's guidance to operators and what's claimed to be safe
BTCPay Server urged operators running version 2.4.1 or earlier to rebuild on a fresh server with a new wallet and seed, explicitly warning that updating alone may not remove an attacker’s prior access. It advised operators to preserve logs and transaction records, replace exposed credentials and avoid restoring the old server onto a new one.
The project said wallets whose spending keys are held off the server — including hardware wallets — were unaffected. BTCPay Server recommended keeping only operational funds on a server wallet and moving to a setup where spending keys are not stored on the server.
What this means for BTCPay Server operators, hardware-wallet users, and blockchain analysts
- BTCPay Server operators: Those running 2.4.1 or earlier are being told to migrate to fresh servers with new wallets and seeds; simply applying the update is not presented as sufficient if an attacker already had access.
- Operators using hardware wallets or wallets whose spending keys are off-server: BTCPay Server said these wallets were not affected, underscoring the project's specific guidance to limit on-server holdings to operational amounts.
- Blockchain analysts and responders: Bitquery's tracing shows a high-frequency sweeping pattern — 682 sweeps with concentrated movement on November 1 and continued sweeps after the shutdown advisory — and the firm cautioned that its visible totals omit Lightning funds and other addresses, making its estimate a floor rather than a final tally.
BTCPay Server's fix has been available since August 7, but the wallets emptied in this incident sat on servers that had never installed it. The project's public guidance and Bitquery's tracing together sketch a picture of a campaign that used administrative access to sweep hot wallets, moved funds in hundreds of small transfers, and continued activity even after operators were warned to shut down. BTCPay Server has not published a comprehensive loss total, and some on-chain activity tied to the named addresses predates the reported thefts, leaving the final accounting incomplete.
