Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot wallets

The BTCPay Server project (open-source self-hosted Bitcoin/Lightning payment processor) said early on 2026-11-02 that it found an attack vector targeting instances running 2.4.1 (Jul 23, 2026) or older. Attackers log in as administrator and drain the server's hot wallets. Operators were first told to shut down their servers while the project investigated. The project has no credible reports of drains on the latest 2.4.7. The exploited flaw is not disclosed. Separately, 2.4.7 (Oct 29) was an emergency fix for a critical bug found by Anthropic's Frontier OSS scanner, and 2.4.2 (Aug 7) fixed an actively exploited flaw that exposed LND credential files and let attackers take over Lightning nodes. Start date and number of victims: unknown.

Summary written from the sources below. Check the originals before acting.

Known so far

5/6

critical

no CVSS yet; severity from the sources

known so far5 of 6

missing: primary source

First public: Nov 2, 2026 UTC
Last modified: Nov 2, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-11-02 15:43 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
BTCPay Server	self-hosted	<= 2.4.1 (attacked); < 2.4.7 (missing latest security fix)	2.4.7

Who cares: campaign, early-warning
Not affected if: –

How to check

Check your BTCPay Server version (shown in the footer or Server Settings); 2.4.1 or older is targeted, and anything below 2.4.7 is missing the latest security fix
Look for admin logins, new admin users or API keys you did not create, and changed store or wallet settings
Look for hot wallet (on-chain or Lightning/LND) payouts or channel closes you did not start
IPs, hashes and other indicators: unknown

The fix

Update to BTCPay Server 2.4.7 now (Server Settings > Maintenance > Update; Docker: as root, cd btcpayserver-docker and run ./btcpay-update.sh)
If you run 2.4.1 or older and cannot update right away, take the instance offline

Know the next one before it finds you.

Get started free

Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot wallets

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

BTCPay Server

self-hosted

<= 2.4.1 (attacked); < 2.4.7 (missing latest security fix)

2.4.7

Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot wallets

Who is affected

How to check

The fix

Know the next one before it finds you.

Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot wallets

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

Sources