BTCPay Server hot wallets drained via attack on instances running version 2.4.1 or earlier
The maintainers of BTCPay Server, an open-source self-hosted cryptocurrency payment processor, warned that attackers are draining "hot wallets" on instances running version 2.4.1 (July 23, 2026) or older. Operators were first told to shut down their servers pending an investigation, and are now urged to update to 2.4.7. Founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on how the attacker obtained administrator access on versions older than 2.4.2. The project has not said which flaw is being exploited, and has no credible reports of drains on 2.4.7.
Entenda a falha
A vulnerabilidade
BTCPay Server, the self-hosted open-source crypto payment processor, is being used to drain hot wallets on instances running 2.4.1 (July 23, 2026) or older. The project says the attacker was able to log in as an administrator on versions older than 2.4.2. No CVE has been assigned and the project has not said which flaw is exploited. Dorier said the attacks did not target public servers. Version 2.4.7 is the recommended fix, and the project has no credible reports of drains on it. The articles do not say what the attacker needs beyond reaching the instance.
Como funciona
The articles do not describe the mechanism. What is known is the outcome: an attacker gets administrator access to an outdated instance, and from that position hot wallets are drained. BTCPay handles checkout invoices and payment verification, including Lightning payments, so an administrator can reach the funds the server controls. How the login as administrator is achieved has not been disclosed.
Por que é vulnerável
The root cause has not been published. Dorier said there were clues that the attacker used vulnerabilities present in versions earlier than 2.4.2, and the project later confirmed this. Two other issues are context only: version 2.4.2 (August 7) warned of an exploited flaw exposing LND credential files, and 2.4.7 was an emergency release for a critical bug found on October 29. The articles do not say whether either is linked to these attacks.
Como foi descoberta
The project's incident response investigation identified the attack vector after unauthorized payments and hot wallet drains were reported. Operators were first told to shut down their servers, then to update to 2.4.7. The project asked affected users to send details and activity logs to [email protected]. BleepingComputer asked the project which flaw is exploited and had received no reply at publication. Separately, the critical flaw disclosed on October 29, which led to 2.4.7, was found through Anthropic's Frontier OSS scanner.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 13:16.
Detalhes técnicos
- The project's incident response identified an attack vector affecting versions 2.4.1 or older. The attacker was able to log in as an administrator on instances older than 2.4.2.
- On October 29, the project disclosed a critical vulnerability found via Anthropic's Frontier OSS scanner, which led to the emergency release of 2.4.7.
- On August 7, version 2.4.2 had warned of an actively exploited flaw that exposed LND credential files, letting attackers control Lightning nodes and steal funds. The article does not say whether this is related to the current attacks.
- BleepingComputer had not received a response from the project about the exploited flaw at publication time.
Remediação
- Update to 2.4.7 via Server Settings → Maintenance → Update.
- For Docker deployments, log in over SSH, run
sudo su -,cd btcpayserver-dockerand./btcpay-update.sh. - Instances on 2.4.1 or older should be taken offline as soon as possible.
- Affected users should send details and activity logs to [email protected].
Linha do tempo
-
BTCPay Server hot wallets drained via attack on instances running version 2.4.1 or earlier
ler a análise desta fonte ocultar
The maintainers of BTCPay Server, an open-source self-hosted cryptocurrency payment processor, warned that attackers are draining "hot wallets" on instances running version 2.4.1 (July 23, 2026) or older. Operators were first told to shut down their servers pending an investigation, and are now urged to update to 2.4.7. Founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on how the attacker obtained administrator access on versions older than 2.4.2. The project has not said which flaw is being exploited, and has no credible reports of drains on 2.4.7.
Technical Details
- The project's incident response identified an attack vector affecting versions 2.4.1 or older. The attacker was able to log in as an administrator on instances older than 2.4.2.
- On October 29, the project disclosed a critical vulnerability found via Anthropic's Frontier OSS scanner, which led to the emergency release of 2.4.7.
- On August 7, version 2.4.2 had warned of an actively exploited flaw that exposed LND credential files, letting attackers control Lightning nodes and steal funds. The article does not say whether this is related to the current attacks.
- BleepingComputer had not received a response from the project about the exploited flaw at publication time.
Remediation
- Update to 2.4.7 via Server Settings → Maintenance → Update.
- For Docker deployments, log in over SSH, run
sudo su -,cd btcpayserver-dockerand./btcpay-update.sh. - Instances on 2.4.1 or older should be taken offline as soon as possible.
- Affected users should send details and activity logs to [email protected].