EN PT-BR
← Voltar ao feed
critical cryptocurrency financial services

Attackers exploit BTCPay Server 2.4.1 and earlier to drain Bitcoin and Litecoin from hot wallets

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 05:31 · coletado há 1 hora

BTCPay Server, the self-hosted open-source crypto payment processor, has warned of Bitcoin and Litecoin thefts from hot wallets on instances running version 2.4.1 (released 23 July 2026) or earlier. Reports began to surface around 1 November 2026, and the start of exploitation is unknown. BTCPay says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (7 August 2026). It is unclear whether this wave is related to the August 2026 incident, in which a critical flaw was weaponized to steal funds. The project reports no credible hot wallet drains on the latest 2.4.7 release.

Entenda a falha

A vulnerabilidade

Attackers are stealing Bitcoin and Litecoin from hot wallets on BTCPay Server instances running 2.4.1 (released 23 July 2026) or earlier. BTCPay says they used a different method to exploit the vulnerability fixed in 2.4.2 (7 August 2026). No CVE is listed. The August 2026 alert described an unauthenticated remote attacker obtaining LND .macaroon credential files, which allow control of an LND node and movement of funds. The articles do not confirm that this wave uses that same flaw. Version 2.4.7 is the latest release and has no credible reports of hot wallet drains.

Como funciona

The articles only describe the August 2026 case: an unauthenticated remote request reaches a vulnerable BTCPay Server instance, which exposes the .macaroon credential files used to authenticate to LND, the Lightning Network node implementation. With those files the attacker can act as an authorized client of the LND node and move funds out of the hot wallet. The articles do not explain the method used in the current wave or the exact step where the server fails.

Por que é vulnerável

The articles do not state the root cause. They only say the August flaw let an unauthenticated attacker obtain .macaroon files, which implies credential files were reachable without authorization. The fix landed in 2.4.2, and 2.4.7 fixes one critical and several medium-severity flaws found via Anthropic's OSS scanner. The articles do not say what those fixes change.

Como foi descoberta

Reports of thefts began to surface around 1 November 2026, and BTCPay Server says it is unknown when exploitation started. BTCPay investigated and found the attacks targeted servers on 2.4.1 or earlier, and it published two attacker-linked wallet addresses. The earlier August 2026 flaw was disclosed by BTCPay after attackers weaponized it to steal funds. The critical and medium flaws fixed in 2.4.7 were found via Anthropic's OSS scanner. It is unclear whether this wave is related to the August incident.

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 08:15.

Detalhes técnicos

  • The August 2026 alert described an issue allowing an unauthenticated remote attacker to obtain .macaroon credential files for LND (Lightning Network). Those credentials could be used to take control of an LND node and move funds. Reviewed attacks targeted only .macaroon files.
  • Version 2.4.7 fixes one critical and several medium-severity flaws found via Anthropic's OSS scanner.
  • BTCPay Server published two attacker-linked wallet addresses (see IOCs).
  • Hosting providers may have shut down older instances automatically.
  • The article lists no CVE identifiers.

Remediação

  • Upgrade to the latest release (2.4.7).
  • Users on 2.4.1 or earlier should move to a fresh server with a new wallet, even if no theft was noticed. Treat the whole machine and all secrets on it as compromised.
  • Keep only the funds needed for daily operations in the server hot wallet. Hold the rest in a wallet whose spending keys are off the server.

Linha do tempo

  1. thehackernews.com ↗ · pub. 03/11/2026 05:31 · coletado 03/11 08:00 primeiro registro

    Attackers exploit BTCPay Server 2.4.1 and earlier to drain Bitcoin and Litecoin from hot wallets

    ler a análise desta fonte

    BTCPay Server, the self-hosted open-source crypto payment processor, has warned of Bitcoin and Litecoin thefts from hot wallets on instances running version 2.4.1 (released 23 July 2026) or earlier. Reports began to surface around 1 November 2026, and the start of exploitation is unknown. BTCPay says the attackers used a different method to exploit the vulnerability fixed in 2.4.2 (7 August 2026). It is unclear whether this wave is related to the August 2026 incident, in which a critical flaw was weaponized to steal funds. The project reports no credible hot wallet drains on the latest 2.4.7 release.

    Technical Details

    • The August 2026 alert described an issue allowing an unauthenticated remote attacker to obtain .macaroon credential files for LND (Lightning Network). Those credentials could be used to take control of an LND node and move funds. Reviewed attacks targeted only .macaroon files.
    • Version 2.4.7 fixes one critical and several medium-severity flaws found via Anthropic's OSS scanner.
    • BTCPay Server published two attacker-linked wallet addresses (see IOCs).
    • Hosting providers may have shut down older instances automatically.
    • The article lists no CVE identifiers.

    Remediation

    • Upgrade to the latest release (2.4.7).
    • Users on 2.4.1 or earlier should move to a fresh server with a new wallet, even if no theft was noticed. Treat the whole machine and all secrets on it as compromised.
    • Keep only the funds needed for daily operations in the server hot wallet. Hold the rest in a wallet whose spending keys are off the server.