BTCPay Server Hot Wallet Flaw Drains Crypto on Older Instances

Key points

• Attackers targeted outdated BTCPay Server instances, including 2.4.1 and earlier.
• Hot wallets holding Bitcoin and Litecoin were compromised and funds were taken.
• No CVE identifier has been assigned; operators are being directed to newer software.
• The activity was reported on 23 July 2026, with related dates in November 2026.

Unidentified actors exploited a security weakness in BTCPay Server to compromise hot wallets and move cryptocurrency out of affected deployments. The problem affects older installations, specifically releases up to and including 2.4.1. The activity was first reported on 23 July 2026, and additional related dates appear in November 2026. No CVE has been assigned, which makes patch tracking and public vulnerability scanning harder for defenders.

BTCPay Server is used to accept Bitcoin and Litecoin payments, and hot wallets are online by design, so a compromise can translate directly into lost funds. The attackers' method involved abusing the flaw and draining balances rather than merely reading data. Because the affected versions are older, exposure is concentrated among operators who have deferred maintenance or pinned legacy builds.

For K-12 and government teams, the risk is not hypothetical if any district, school, or supporting vendor runs BTCPay Server for payments, donations, or internal crypto handling. Theft from a hot wallet is immediate and often irreversible, and the absence of a CVE means incident responders may not see a familiar advisory. The dates around late July and November 2026 suggest the issue has been observed over time, not just as a single event.

What to watch: confirmation of the exact fixed release, any indicators of compromise from the vendor, and whether other BTCPay Server deployments report similar losses. Operators should inventory instances, verify versions, and treat any system at 2.4.1 or lower as untrusted until upgraded. Until a CVE or detailed advisory appears, change management and asset tracking are the main controls.

What to do now

1. Inventory every BTCPay Server instance and identify any running 2.4.1 or earlier; isolate those hosts from the network until patched.
2. Upgrade to a release newer than 2.4.1 from the vendor's official source, then verify the running version and restart services.
3. Assume any hot wallet on an affected instance is compromised: rotate wallet keys, move remaining funds to a new wallet, and review transaction history.
4. Search logs for unauthorized wallet operations, API access, and outbound connections around 23 July 2026 and November 2026; preserve evidence.
5. Restrict administrative access to BTCPay Server with MFA, IP allowlists, and least privilege; remove unused integrations.
6. Monitor vendor channels for a CVE or updated advisory, and subscribe to government sector threat intel for BTCPay Server activity.
7. For districts that cannot upgrade immediately, disable hot wallet functionality or take the service offline; document compensating controls.

Original source

The Hacker News