Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets - The Hacker News

BTCPay Server has urged users to install the latest version of its software after reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions.

The company said its investigation found that these attacks targeted servers running BTCPay Server 2.4.1 or earlier. The attackers used a different method to exploit the vulnerability fixed in version 2.4.2, which was released on 7 August 2026.

Users who are running versions 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even in scenarios where users have not noticed a theft.

It's currently unknown when the attackers behind the campaign first began exploiting the vulnerability, although reports began to surface around November 1, 2026.

In a post on X, BTCPay Server said no credible reports of hot wallet drains have been reported from users running the latest 2.4.7 release. The version addresses one critical and several medium-severity security vulnerabilities discovered via Anthropic's OSS scanner.

BTCPay Server has also shared two wallet addresses linked to these incidents. The company cautioned that if users need a hot wallet for daily operations, they should keep only the funds needed for those operations on the server and move the rest to a wallet whose spending keys are held off the server.

If users run BTCPay Server through a hosting provider, their instance may have been shut down automatically to keep older versions from being exploited.

August vulnerability and broader crypto breaches

In August 2026, BTCPay Server disclosed that a critical vulnerability had been weaponized by attackers to steal funds from some users. The issue, which affects all BTCPay Server versions, was patched in version 2.4.2.

The company said the issue could allow an unauthenticated remote attacker to obtain .macaroon credential files for LND, an implementation of the Lightning Network. Those credentials could be used to take control of an LND node and move funds.

The attacks reviewed by BTCPay Server targeted only files with the .macaroon extension. It's unclear if the latest set of attacks is related to the same vulnerability.

The development coincides with a string of security breaches and exploits across the cryptocurrency space. This includes the record theft of $6.43 billion from Binance by North Korean threat actors.

On the same day, prediction market giant Polymarket briefly halted trading after it was hit by a $2.65 million exploit following the compromise of software developed by DebugBear.

Hardware wallet maker Trezor also followed suit with a warning that it received a responsible disclosure report alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis in August 2026.

The implant is assessed to be part of a sophisticated supply chain attack in which some of the devices sold via third-party resellers are physically tampered with to steal the victim's seed phrase and use it to drain assets.

Mercado Bitcoin incident and Tether's role

On Monday, Mercado Bitcoin, Brazil's largest cryptocurrency exchange, said it's temporarily pausing deposits and withdrawals following a security breach that resulted in $49 million in stolen funds.

The company said in a post on X that the value of the assets involved is approximately $38 million. In a swift action with the crypto community and strategic partners, including Tether, Circle, Paxos, BRL1, and Chainalysis, it has already blocked $11 million.

Other amounts eligible for blocking have been identified, and containment efforts continue. The resumption of services will occur as soon as full security conditions are met, and deadlines will be communicated exclusively through its official channels.

The BTCPay Server vulnerability highlights the persistent security risks in the cryptocurrency ecosystem. Users are advised to keep their software updated and to follow best practices for securing their digital assets.