Affected Systems
BTCPay Server versions 2.4.1 and earlier. The vulnerability was patched in version 2.4.2 (released August 7, 2026), with current stable version 2.4.7 addressing additional critical and medium-severity issues. Affects self-hosted instances processing Bitcoin and Litecoin payments via hot wallets.
Exploitation Status
Active exploitation confirmed. Attacks began around November 1, 2026, targeting servers running unpatched versions. BTCPay Server reports no credible hot wallet drains from users on version 2.4.7. Attacker wallet addresses have been published. The vulnerability may be related to a previously disclosed LND .macaroon credential theft issue allowing unauthenticated remote attackers to control Lightning Network nodes.
Business Impact
Organizations running BTCPay Server for cryptocurrency payment processing face direct financial loss through hot wallet theft. Even if no theft has been observed, servers running versions 2.4.1 or earlier must be considered fully compromised, including all secrets and credentials stored on the machine. Hosting providers have begun automatically shutting down vulnerable instances. No CVE has been assigned, complicating vulnerability tracking and compliance reporting.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade BTCPay Server to version 2.4.7 or later on all instances
- If running version 2.4.1 or earlier, migrate to a fresh server with new wallet credentials; treat the entire machine and all stored secrets as compromised
- Review Bitcoin wallet bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 and Litecoin wallet ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee for any outbound transactions from your hot wallets
- Limit hot wallet balances to only funds required for immediate daily operations; move remaining funds to cold storage with offline signing keys
- Audit LND .macaroon credential files for unauthorized access or exfiltration, particularly if Lightning Network functionality is enabled