EN PT-BR
← Voltar ao feed
critical cryptocurrency financial services

BTCPay Server 2.4.1 and earlier: attackers drain Bitcoin and Litecoin hot wallets, ~$1.63M traced; update to 2.4.7

3 fonte(s) · 3 atualização(ões) · publicado 02/11/2026 12:03 · coletado há 13 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 04/11/2026 00:01; os links antigos trazem para cá.

Fontes: infosecurity-magazine.com ↗ thehackernews.com ↗ bleepingcomputer.com ↗

BTCPay Server, the open-source self-hosted crypto payment processor, warned that attackers are draining hot wallets on instances running version 2.4.1 (released July 23, 2026) or older. Reports began around November 1, 2026, and the project says attackers signed in as administrators on versions older than 2.4.2. Founder Nicolas Dorier said the attacks did not target public servers (bleepingcomputer.com). Bitquery traced 18.38 Bitcoin and 3405 Litecoin (~$1.63M) across 682 sweeps between October 30 and November 2 to two attacker-controlled addresses, with 87% moved in a single wave on November 1 (infosecurity-magazine.com). The project reports no credible drains on the latest release, 2.4.7, and has not published an official loss total. Operators were first told to shut down servers pending investigation and are now urged to update to 2.4.7 and, for 2.4.1 or older, migrate to a fresh server with a new wallet.

Entenda a falha

A vulnerabilidade

BTCPay Server, the self-hosted open-source crypto payment processor, has an unnamed flaw, with no CVE, that let attackers log in as administrator on instances older than 2.4.2. Versions 2.4.1 and earlier are affected, and 2.4.2 (August 7, 2026) is described as fixing the exploited vulnerability. The attackers then swept on-chain hot wallets (Bitcoin, Litecoin). The project says attacks did not target public servers and reports no credible drains on 2.4.7. The articles do not say what access the attacker needed. Wallets with spending keys off the server were unaffected. Separately, the August 2.4.2 alert covered an unauthenticated flaw exposing LND .macaroon files, and 2.4.7 fixes one critical and several medium flaws found by Anthropic's scanner.

Como funciona

The articles do not describe the technical mechanism. What they report is the sequence: the attacker reached an outdated BTCPay Server instance and logged in as administrator, and with that access swept the hot wallet, whose keys live on the server, to two attacker-controlled addresses. Bitquery counted 682 sweeps between October 30 and November 2. The project says the attackers used a different method against the vulnerability fixed in 2.4.2 than the one seen in August, when the target was LND credential files.

Por que é vulnerável

The articles do not state the root cause or what the 2.4.2 fix changes. They show that exposure came from servers that never installed the August fix. Sources disagree on the link to August: Infosecurity Magazine says the same flaw was exploited then, while The Hacker News and BleepingComputer say it is unclear whether the two waves are related. Because the attacker gained administrative access, the project warns that updating cannot revoke access already obtained.

Como foi descoberta

The thefts surfaced through exploitation in the wild, with reports starting around November 1, 2026. The project's incident response linked them to versions 2.4.1 or older, published an incident update on November 2 and told operators to shut down at 22:25 UTC on November 1. Bitquery traced 18.38 Bitcoin and 3405 Litecoin (about $1.63M) to two addresses named by the project, 87% in one wave on November 1. That figure is a floor, and BTCPay says some activity at those addresses may predate the thefts. No official loss total exists. On October 29 the project had separately disclosed a critical flaw found via Anthropic's Frontier OSS scanner, fixed in 2.4.7.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 00:16.

Detalhes técnicos

  • The project's incident response identified an attack vector affecting 2.4.1 or older, letting the attacker log in as administrator on instances older than 2.4.2 (bleepingcomputer.com). The project has not named the exact flaw, and no CVE identifiers were listed (thehackernews.com).
  • BTCPay says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (August 7, 2026) (thehackernews.com); infosecurity-magazine.com states the exploited flaw is the one fixed in 2.4.2.
  • The August 2026 2.4.2 alert described an actively exploited issue where an unauthenticated remote attacker could obtain .macaroon credential files for LND (Lightning Network), allowing control of an LND node and theft of funds. Reviewed attacks then targeted only .macaroon files (thehackernews.com); on-chain hot wallets were reportedly unaffected then (infosecurity-magazine.com).
  • On October 29 the project disclosed a critical vulnerability found via Anthropic's Frontier OSS scanner, leading to the emergency release of 2.4.7 (bleepingcomputer.com). 2.4.7 fixes one critical and several medium-severity flaws found by that scanner (thehackernews.com).
  • Sweeps worth about $150,000 continued even after BTCPay issued a shutdown warning at 22:25 UTC (infosecurity-magazine.com).
  • BTCPay published two attacker-linked wallet addresses (thehackernews.com). Bitquery could not determine the number of compromised servers because blockchain data reflects wallets, not systems; its figure excludes other addresses, coins and Lightning funds, so it is a floor estimate (infosecurity-magazine.com).
  • Hosting providers may have shut down older instances automatically (thehackernews.com).

Remediação

  • Update to 2.4.7 via Server Settings → Maintenance → Update. For Docker deployments, log in over SSH, run sudo su -, cd btcpayserver-docker and ./btcpay-update.sh (bleepingcomputer.com).
  • Take instances on 2.4.1 or older offline as soon as possible (bleepingcomputer.com).
  • Rebuild on a fresh server with a new wallet and seed even if already updated, because patching cannot revoke access already obtained. Treat the whole machine and all secrets on it as compromised, and do not restore the compromised server image onto new infrastructure (thehackernews.com, infosecurity-magazine.com).
  • Preserve logs and transaction records and rotate exposed credentials (infosecurity-magazine.com). Affected users should send details and activity logs to [email protected] (bleepingcomputer.com).
  • Keep only operational funds in the server hot wallet; hold the rest in a wallet whose spending keys are off the server. Wallets with off-server keys (e.g., hardware wallets) were unaffected (thehackernews.com, infosecurity-magazine.com).

Relatos divergentes

  • Link to the August incident: infosecurity-magazine.com states the same flaw was previously exploited in August, while thehackernews.com says it is unclear whether this wave is related, and bleepingcomputer.com says the same of the 2.4.2 LND flaw. The project says a different method was used against the 2.4.2-fixed vulnerability (thehackernews.com).
  • Losses: Bitquery's ~$1.63M (infosecurity-magazine.com) is not an official figure; BTCPay noted some activity at those addresses may predate the thefts, so it should not be treated as confirmed loss.
  • Rebuild guidance: bleepingcomputer.com advises updating to 2.4.7, while later reports (thehackernews.com, infosecurity-magazine.com) advise migrating to a fresh server and wallet, which is the more cautious and more recent guidance.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 03/11/2026 11:30 · coletado 03/11 12:01

    Attackers Exploit Unpatched BTCPay Server Flaw to Drain Hot Wallets, $1.63M Traced

    ler a análise desta fonte

    BTCPay Server, an open-source cryptocurrency payment platform, confirmed that attackers exploited a vulnerability fixed in version 2.4.2 (released August 7, 2026) to steal funds from hot wallets on instances still running 2.4.1 or earlier. Blockchain intelligence firm Bitquery traced 18.38 Bitcoin and 3405 Litecoin (~$1.63M) across 682 sweeps between October 30 and November 2 to two attacker-controlled addresses, with 87% of funds moved in a single wave on November 1. The attacker signed in as an administrator and swept the hot wallets; sweeps worth about $150,000 continued even after BTCPay Server issued a shutdown warning at 22:25 UTC. The same flaw was previously exploited in August to steal funds via the Lightning Network implementation LND, though on-chain hot wallets were reportedly unaffected at that time.

    Technical Details

    The vulnerability, patched in version 2.4.2, allowed attackers to gain administrative access to BTCPay Server instances and sweep hot wallet balances. Bitquery could not determine the exact number of compromised servers since blockchain data reflects wallets rather than systems, and its $1.63M figure excludes other addresses, coins, and Lightning funds, making it a floor estimate. BTCPay Server noted that some activity at the identified addresses may predate the reported thefts, so balances should not be treated as confirmed losses, and the project has not published an official total.

    Remediation

    BTCPay Server urges all operators running version 2.4.1 or earlier to rebuild on a fresh server with a new wallet and seed, even if already updated, since patching alone cannot revoke access an attacker may have already obtained. Wallets with spending keys held off-server (e.g., hardware wallets) were unaffected. Operators should preserve logs and transaction records, rotate exposed credentials, keep only operational funds on the server, and avoid restoring the compromised server image onto new infrastructure.

  2. thehackernews.com ↗ · pub. 03/11/2026 05:31 · coletado 03/11 08:00

    Attackers exploit BTCPay Server 2.4.1 and earlier to drain Bitcoin and Litecoin from hot wallets

    ler a análise desta fonte

    BTCPay Server, the self-hosted open-source crypto payment processor, has warned of Bitcoin and Litecoin thefts from hot wallets on instances running version 2.4.1 (released 23 July 2026) or earlier. Reports began to surface around 1 November 2026, and the start of exploitation is unknown. BTCPay says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (7 August 2026). It is unclear whether this wave is related to the August 2026 incident, in which a critical flaw was weaponized to steal funds. The project reports no credible hot wallet drains on the latest 2.4.7 release.

    Technical Details

    • The August 2026 alert described an issue allowing an unauthenticated remote attacker to obtain .macaroon credential files for LND (Lightning Network). Those credentials could be used to take control of an LND node and move funds. Reviewed attacks targeted only .macaroon files.
    • Version 2.4.7 fixes one critical and several medium-severity flaws found via Anthropic's OSS scanner.
    • BTCPay Server published two attacker-linked wallet addresses (see IOCs).
    • Hosting providers may have shut down older instances automatically.
    • The article lists no CVE identifiers.

    Remediation

    • Upgrade to the latest release (2.4.7).
    • Users on 2.4.1 or earlier should move to a fresh server with a new wallet, even if no theft was noticed. Treat the whole machine and all secrets on it as compromised.
    • Keep only the funds needed for daily operations in the server hot wallet. Hold the rest in a wallet whose spending keys are off the server.
  3. bleepingcomputer.com ↗ · pub. 02/11/2026 12:03 · coletado 02/11 13:00 primeiro registro

    BTCPay Server hot wallets drained via attack on instances running version 2.4.1 or earlier

    ler a análise desta fonte

    The maintainers of BTCPay Server, an open-source self-hosted cryptocurrency payment processor, warned that attackers are draining "hot wallets" on instances running version 2.4.1 (July 23, 2026) or older. Operators were first told to shut down their servers pending an investigation, and are now urged to update to 2.4.7. Founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on how the attacker obtained administrator access on versions older than 2.4.2. The project has not said which flaw is being exploited, and has no credible reports of drains on 2.4.7.

    Technical Details

    • The project's incident response identified an attack vector affecting versions 2.4.1 or older. The attacker was able to log in as an administrator on instances older than 2.4.2.
    • On October 29, the project disclosed a critical vulnerability found via Anthropic's Frontier OSS scanner, which led to the emergency release of 2.4.7.
    • On August 7, version 2.4.2 had warned of an actively exploited flaw that exposed LND credential files, letting attackers control Lightning nodes and steal funds. The article does not say whether this is related to the current attacks.
    • BleepingComputer had not received a response from the project about the exploited flaw at publication time.

    Remediation

    • Update to 2.4.7 via Server Settings → Maintenance → Update.
    • For Docker deployments, log in over SSH, run sudo su -, cd btcpayserver-docker and ./btcpay-update.sh.
    • Instances on 2.4.1 or older should be taken offline as soon as possible.
    • Affected users should send details and activity logs to [email protected].