Verify a decision

{"actor":"system:backfill","investigation_id":"3e7686c9-177e-44f7-8c16-e2c2e46acd66","kind":"publish","page_slug":"btcpay-server-hot-wallet-exploit-november-2026","published_at":"2026-11-10T04:12:33.582Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"BTCPay Server Hot Wallet Exploit (November 2026)","sections":[{"content":"Beginning around November 1, 2026, operators of self-hosted BTCPay Server instances reported unauthorized outbound Bitcoin and Litecoin transactions from on-chain hot wallets, where signing keys for the payment gateway are stored directly on the server rather than on a separate hardware device or Lightning node. BTCPay Server's investigation identified an attack vector targeting instances running version 2.4.1 (released July 23, 2026) or earlier. According to blockchain analytics firm Bitquery, roughly $1.62 million was stolen -- about 18.38 BTC and 3,405 LTC across 682 sweeps -- with about 87% of the funds moved in a single wave on November 1 between 14:12 and 22:16 UTC. The earliest identified theft (a sweep emptying a 42-address wallet) reportedly occurred on October 30, less than a day after the emergency 2.4.7 release shipped. The exact technical entry point attackers used to gain administrative access had not been publicly disclosed as of the reporting window, though BTCPay founder Nicolas Dorier said the attacks did not appear to target publicly exposed servers directly and that the investigation was focused on how attackers obtained administrator-level access on pre-2.4.2 instances.","heading":"Nature of the exploit and losses","severity":"critical","sources":[{"credibility":2,"name":"The Hacker News: Hackers Exploit BTCPay Server Flaw To Steal Hot Wallet Funds","type":"news_article","url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"},{"credibility":2,"name":"BleepingComputer: BTCPay Server warns of hot wallet thefts targeting outdated instances","type":"news_article","url":"https://bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances"},{"credibility":2,"name":"Decrypt: Bitcoin Payment Service BTCPay Warns Critical Flaw Is Under Active Attack","type":"news_article","url":"https://decrypt.co/375159/bitcoin-payment-service-btcpay-critical-flaw-active-attack"}]},{"content":"In August 2026, BTCPay Server disclosed a separate critical vulnerability affecting all versions that could let an unauthenticated remote attacker obtain LND .macaroon credential files, which could then be used to take control of a merchant's Lightning node and move funds. That flaw was patched in version 2.4.2, released August 7, 2026, and is covered on AVOID.NET's existing page for that incident. BTCPay has stated that on-chain hot wallets were not affected by the August issue, and as of early November 2026 it remained unclear whether the November on-chain hot-wallet thefts share a root cause with the August Lightning-node exploit; the project has not indicated the two are connected and described the November attack method as distinct.","heading":"Relationship to the August 2026 LND macaroon flaw","severity":"medium","sources":[{"credibility":2,"name":"CoinDesk: Another Bitcoin infrastructure exploit hits, this time draining merchant Lightning nodes","type":"news_article","url":"https://coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes"},{"credibility":2,"name":"The Hacker News: Hackers Exploit BTCPay Server Flaw To Steal Hot Wallet Funds","type":"news_article","url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"}]},{"content":"BTCPay Server initially asked VPS hosting providers to take affected instances offline as a precaution and instructed self-managed operators to shut down instances using the project's btcpay-down.sh script while the investigation continued. The project urged all users on version 2.4.1 or earlier to update to 2.4.7 before bringing an instance back online, but cautioned that updating alone cannot remove access an attacker may have already obtained; it recommended that operators on vulnerable versions move to a freshly provisioned server with a new wallet and new seed phrase, enable two-factor authentication, change admin passwords, and rotate API keys. BTCPay reported no credible reports of hot wallet drains among users already running 2.4.7, which separately patched a critical vulnerability found via an automated OSS scanner along with several medium-severity issues. Users who lost funds were directed to report to security@btcpayserver.org and to local law enforcement.","heading":"Project response and recommended mitigations","severity":"high","sources":[{"credibility":2,"name":"BleepingComputer: BTCPay Server warns of hot wallet thefts targeting outdated instances","type":"news_article","url":"https://bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances"},{"credibility":2,"name":"The Hacker News: Hackers Exploit BTCPay Server Flaw To Steal Hot Wallet Funds","type":"news_article","url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"}]}],"sources_used":[{"credibility":2,"name":"The Hacker News: Hackers Exploit BTCPay Server Flaw To Steal Hot Wallet Funds","type":"news_article","url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"},{"credibility":2,"name":"BleepingComputer: BTCPay Server warns of hot wallet thefts targeting outdated instances","type":"news_article","url":"https://bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances"},{"credibility":2,"name":"Decrypt: Bitcoin Payment Service BTCPay Warns Critical Flaw Is Under Active Attack","type":"news_article","url":"https://decrypt.co/375159/bitcoin-payment-service-btcpay-critical-flaw-active-attack"},{"credibility":2,"name":"Cointelegraph: BTCPay restricts remote Lightning access after attackers steal funds","type":"news_article","url":"https://cointelegraph.com/news/btcpay-restricts-remote-lightning-access-after-attackers-steal-funds"},{"credibility":2,"name":"CoinDesk: Another Bitcoin infrastructure exploit hits, this time draining merchant Lightning nodes","type":"news_article","url":"https://coindesk.com/tech/2026/08/08/another-bitcoin-infrastructure-exploit-hits-this-time-draining-merchant-lightning-nodes"}],"summary":"In late October and early November 2026, attackers drained on-chain Bitcoin and Litecoin hot wallets on self-hosted BTCPay Server instances running version 2.4.1 or earlier, a distinct vector from the August 2026 LND macaroon credential flaw covered on a separate AVOID.NET page (/btcpay-server-lnd-macaroon-credential-exploit-august-2026). Blockchain analysis tied roughly $1.6 million in BTC and LTC to the thefts, and the project urged affected operators to take instances offline, update to version 2.4.7, and migrate funds to a freshly created wallet rather than trust the existing server.","timeline":[{"date":"2026-07-23","date_evidence":"version 2.4.1 (released July 23, 2026)","event":"BTCPay Server version 2.4.1 released; later identified as the last version vulnerable to the attack vector used in the November thefts.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"},{"date":"2026-08","date_evidence":"2.4.2, which was released August 7","date_original":"2026-08-07","event":"Version 2.4.2 released, patching the critical LND macaroon credential flaw disclosed in August 2026 (covered separately).","source":"BleepingComputer","source_url":"https://bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances"},{"date":"2026-10","event":"An emergency version 2.4.7 release shipped, fixing an additional critical vulnerability (found via an automated OSS scanner) along with several medium-severity issues.","source":"The Hacker News / BleepingComputer","source_url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"},{"date":"2026-10","date_evidence":"The first sweep was on October 30, less than a day after version 2.4.7 shipped.","date_original":"2026-10-30","event":"Earliest identified theft: a sweep emptied a 42-address hot wallet into an address linked to the attacker.","source":"The Hacker News (citing Bitquery)","source_url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"},{"date":"2026-11-01","date_evidence":"Reports began surfacing around November 1, 2026","event":"Theft reports surface publicly; about 87% of total stolen funds moved in one wave on November 1 between 14:12 and 22:16 UTC; BTCPay asks hosting providers to take affected instances offline.","source":"The Hacker News; BleepingComputer","source_url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"},{"date":"2026-11","date_evidence":"Early Monday (November 2)","date_original":"2026-11-02","event":"BTCPay Server founder Nicolas Dorier publicly urges all users to update to version 2.4.7 and details the affected version range.","source":"BleepingComputer","source_url":"https://bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances"},{"date":"2026-11","date_original":"2026-11-03","event":"The Hacker News reports Bitquery's loss estimate of roughly $1.62 million in BTC and LTC tied to the thefts.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html"}]},"v":1}