{"id":"CMP-202611-gwy5vh","kind":"campaign","aliases":[],"related":[],"title":"Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot wallets","description":null,"summary":"The BTCPay Server project (open-source self-hosted Bitcoin/Lightning payment processor) said early on 2026-11-02 that it found an attack vector targeting instances running 2.4.1 (Jul 23, 2026) or older. Attackers log in as administrator and drain the server's hot wallets. Operators were first told to shut down their servers while the project investigated. The project has no credible reports of drains on the latest 2.4.7. The exploited flaw is not disclosed. Separately, 2.4.7 (Oct 29) was an emergency fix for a critical bug found by Anthropic's Frontier OSS scanner, and 2.4.2 (Aug 7) fixed an actively exploited flaw that exposed LND credential files and let attackers take over Lightning nodes. Start date and number of victims: unknown.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-02T15:43:52+00:00","products":[{"name":"BTCPay Server","fixed":["2.4.7"],"affected":"<= 2.4.1 (attacked); < 2.4.7 (missing latest security fix)","ecosystem":"self-hosted"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Check your BTCPay Server version (shown in the footer or Server Settings); 2.4.1 or older is targeted, and anything below 2.4.7 is missing the latest security fix\n- Look for admin logins, new admin users or API keys you did not create, and changed store or wallet settings\n- Look for hot wallet (on-chain or Lightning/LND) payouts or channel closes you did not start\n- IPs, hashes and other indicators: unknown","fix":"- Update to BTCPay Server 2.4.7 now (Server Settings > Maintenance > Update; Docker: as root, cd btcpayserver-docker and run ./btcpay-update.sh)\n- If you run 2.4.1 or older and cannot update right away, take the instance offline\n- If you see signs of compromise, move the remaining hot wallet funds to a new wallet, rotate admin passwords, API keys and LND credentials, and send details and logs to security@btcpayserver.org","status":"open","published_at":null,"first_seen_at":"2026-11-02T15:43:52+00:00","triaged_at":"2026-11-02T15:43:52+00:00","updated_at":"2026-11-02T15:43:52+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-02':46B '-11':45B '-202611':20A '2.4.1':11A,56B '2.4.2':125B '2.4.7':98B,106B '2026':44B,59B '23':58B '29':108B '7':127B 'activ':130B 'admin':5A 'administr':66B 'anthrop':119B 'attack':1A,51B,62B,140B 'aug':126B 'bitcoin/lightning':38B 'btcpay':8A,22A,29B 'bug':116B 'campaign':24B 'cmp':19A 'credenti':136B 'credibl':91B 'critic':115B 'date':146B 'disclos':104B 'drain':15A,68B,94B 'earli':26B,42B 'early-warn':25B 'emerg':111B 'exploit':100B,131B 'expos':134B 'file':137B 'first':76B 'fix':112B,128B 'flaw':101B,132B 'found':49B,117B 'frontier':121B 'gwy5vh':21A 'host':37B 'hot':17A,72B 'instanc':10A,54B 'investig':86B 'jul':57B 'latest':97B 'let':139B 'lightn':143B 'lnd':135B 'log':2A,63B 'node':144B 'number':148B 'oct':107B 'older':13A,61B 'open':33B 'open-sourc':32B 'oper':74B 'oss':122B 'outdat':7A 'payment':39B 'processor':40B 'project':31B,85B,88B 'report':92B 'run':55B 'said':41B 'scanner':123B 'self':36B 'self-host':35B 'separ':105B 'server':9A,23A,30B,70B,82B 'shut':79B 'sourc':34B 'start':145B 'take':141B 'target':53B 'told':77B 'unknown':151B 'vector':52B 'victim':150B 'wallet':18A,73B 'warn':27B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["btcpayserver","server"],"ptokens":["btcpay","server"],"labels":["campaign","critical","earlywarning","vendor"],"first_public_at":"2026-11-02T15:03:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-gwy5vh","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T15:43:52+00:00","fetched_at":"2026-11-02T15:43:52+00:00","note":null}],"documents":[{"id":52554,"url":"https://www.bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances/","title":"BTCPay Server warns of hot wallet thefts targeting outdated instances (BleepingComputer)","kind":"blog","source":"blog","publisher":null,"text":"BleepingComputer (Bill Toulas), 2026-11-02. BTCPay Server maintainers identified an attack vector targeting instances running 2.4.1 (Jul 23, 2026) or older; attackers logged in as administrator and drained hot wallets. Urges update to 2.4.7; operators first told to shut down servers. No credible reports of drains on 2.4.7. Oct 29: critical vuln found via Anthropic Frontier OSS scanner prompted emergency 2.4.7. Aug 7 (2.4.2): actively exploited flaw exposing LND credential files. Flaw in current attacks not disclosed. Affected users send logs to security@btcpayserver.org. Update via Server Settings > Maintenance > Update or btcpay-update.sh in btcpayserver-docker. Take 2.4.1-or-older instances offline.","published_at":"2026-11-02T15:03:07+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}