---
id: "CMP-202611-gwy5vh"
kind: "campaign"
aliases: []
title: "Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot wallets"
severity: "critical"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "BTCPay Server", "fixed": ["2.4.7"], "affected": "<= 2.4.1 (attacked); < 2.4.7 (missing latest security fix)", "ecosystem": "self-hosted"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-02T15:43:52+00:00"
updated_at: "2026-11-02T15:43:52+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-02T15:43:52+00:00"}]
---

# Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot wallets

The BTCPay Server project (open-source self-hosted Bitcoin/Lightning payment processor) said early on 2026-11-02 that it found an attack vector targeting instances running 2.4.1 (Jul 23, 2026) or older. Attackers log in as administrator and drain the server's hot wallets. Operators were first told to shut down their servers while the project investigated. The project has no credible reports of drains on the latest 2.4.7. The exploited flaw is not disclosed. Separately, 2.4.7 (Oct 29) was an emergency fix for a critical bug found by Anthropic's Frontier OSS scanner, and 2.4.2 (Aug 7) fixed an actively exploited flaw that exposed LND credential files and let attackers take over Lightning nodes. Start date and number of victims: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- self-hosted:BTCPay Server affected <= 2.4.1 (attacked); < 2.4.7 (missing latest security fix) fixed 2.4.7

## How to check

- Check your BTCPay Server version (shown in the footer or Server Settings); 2.4.1 or older is targeted, and anything below 2.4.7 is missing the latest security fix
- Look for admin logins, new admin users or API keys you did not create, and changed store or wallet settings
- Look for hot wallet (on-chain or Lightning/LND) payouts or channel closes you did not start
- IPs, hashes and other indicators: unknown

## Fix

- Update to BTCPay Server 2.4.7 now (Server Settings > Maintenance > Update; Docker: as root, cd btcpayserver-docker and run ./btcpay-update.sh)
- If you run 2.4.1 or older and cannot update right away, take the instance offline
- If you see signs of compromise, move the remaining hot wallet funds to a new wallet, rotate admin passwords, API keys and LND credentials, and send details and logs to security@btcpayserver.org

## Timeline

- 2026-11-02T15:43:52+00:00 analyst

## Documents

- [describes] BTCPay Server warns of hot wallet thefts targeting outdated instances (BleepingComputer) https://www.bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_