Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets Ravie LakshmananNov 03, 2026Vulnerability / Cryptocurrency BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server said. "The attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026." Users who are running versions 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even in scenarios where users have not noticed a theft. In the event of stolen funds or suspected unauthorized access, it's imperative that users consider the entire machine and all secrets stored on it as compromised and follow the same recovery procedures. It's currently unknown when the attackers behind the campaign first began exploiting the vulnerability, although reports began to surface around November 1, 2026. In a post on X, BTCPay Server said no "credible reports" of hot wallet drains have been reported from users running the latest 2.4.7 release. The version addresses one critical and several medium-severity security vulnerabilities discovered via Anthropic's OSS scanner. BTCPay Server has also shared two wallet addresses linked to these incidents - Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee "If you need a hot wallet for daily operations, keep only the funds needed for those operations on the server and move the rest to a wallet whose spending keys are held off the server," it cautioned. "If you run BTCPay Server through a hosting provider, your instance may have been shut down automatically to keep older versions from being exploited." In August 2026, BTCPay Server disclosed that a critical vulnerability had been weaponized by attackers to steal funds from some users. The issue, which affects all BTCPay Server versions, was patched in version 2.4.2. It's unclear if the latest set of attacks is related to the same vulnerability. "The issue could allow an unauthenticated remote attacker to obtain .macaroon credential files for LND, an implementation of the Lightning Network," it said in the August alert. "Those credentials could be used to take control of an LND node and move funds. The attacks we reviewed targeted only files with the .macaroon extension." The development coincides with a string of security breaches and exploits across the cryptocurrency space, including the record theft of $6.43 billion from Binance by North Korean threat actors. That same day, prediction market giant Polymarket briefly halted trading after it was hit by a $2.65 million exploit following the compromise of software developed by DebugBear. Hardware wallet maker Trezor also followed suit with a warning that it received a responsible disclosure report alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis in August 2026. It's assessed to be part of a sophisticated supply chain attack in which some of the devices sold via third-party resellers are physically tampered with to steal the victim's seed phrase and use it to drain assets. Mercado Bitcoin Discloses Security Incident On Monday, Mercado Bitcoin, Brazil's largest cryptocurrency exchange, said it's temporarily pausing deposits and withdrawals following a security breach that resulted in $49 million in stolen funds.. "At this moment, the value of the assets involved is approximately $ 38 million," it said in a post on X. "In a swift action with the crypto community and strategic partners – including Tether, Circle, Paxos, BRL1, and Chainalysis – we have already blocked US$ 11 million." "Other amounts eligible for blocking have been identified, and containment efforts continue. The resumption of services will occur as soon as full security conditions are met, and deadlines will be communicated exclusively through our official channels." Tether CEO Paolo Ardoino confirmed that the stablecoin issuer had frozen more than 4.5 million USDT in connection with the incident. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cryptocurrency, Cyber Attack, Cybercrime, data breach, Vulnerability Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility AI-Generated Fake Login Pages Are Making Account Takeovers Easier Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security