BTCPay Server Hot-Wallet Drains

Between October 30 and November 2, 2026, attackers drained the hot wallets of merchants running outdated BTCPay Server installations, making off with approximately $1.6 million — roughly 18.38 BTC and 3,405 LTC — in a campaign of 682 small automated sweeps against self-hosted payment servers.

What happened

BTCPay Server is open-source, self-hosted software that lets merchants accept Bitcoin and Lightning payments directly into their own hot wallets. BTCPay said the attacks "targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," and reported no credible drains on the current 2.4.7 release. The project has not disclosed exactly which flaw gave the thief administrative access; its lead developer noted "traces that pre-2.4.2 vulnerabilities were used," and a critical August 2026 bug — patched in version 2.4.2 on August 7 — had let unauthenticated attackers leak LND Lightning credentials.

Per Bitquery's investigation, the first visible sweep landed on October 30 at 08:22 UTC, and 87% of the funds moved in a single wave on November 1 between 14:12 and 22:16 UTC. BTCPay published its public alert at 22:25 on November 1 — about 62 hours after the first theft — yet 267 more sweeps worth roughly $150K followed through the morning of November 2. Of 682 total sweeps, about half were under $100, while 32 sweeps of $10,000 or more carried 77% of the value. BTCPay named a Bitcoin collecting address (bc1p0f7wm…) and a Litecoin one (ltc1qp49tm…); as of November 2 most of the loot still sat unmoved in fresh payout addresses, with no exchange cash-out observed.

Aftermath

• BTCPay urged every operator to treat the entire machine and all secrets on it as compromised, rebuild on a fresh server with a brand-new wallet seed, and keep only operational funds in hot storage.
• Operators were told that patching alone is insufficient: attackers may retain access through stolen credentials, so rotating API keys, admin passwords and enabling 2FA was advised.
• Version 2.4.7 had earlier fixed one critical and several medium-severity issues surfaced by automated open-source security scanning.
• No attacker identity has been established and the number of affected servers remains unknown; Bitquery's totals are a floor covering only the named wallets.

Why it matters

The BTCPay incident is an infrastructure-layer theft rather than a smart-contract exploit: the funds were taken not by breaking a protocol but by compromising the self-hosted software custodying them. It echoes a recurring 2026 pattern in which operational and server compromise — not contract bugs — drive custodial losses, as seen with the Gamdom server intrusion and the Mercado Bitcoin hot-wallet breach. It is also a sharp lesson in patch latency: the fix had shipped 86 days earlier, but hundreds of operators still ran vulnerable versions, and the long tail of sub-$100 sweeps shows attackers methodically scraping even tiny merchant balances once admin access is in hand.