BTCPay Server says attacks on version 2.4.1 and earlier stole Bitcoin and Litecoin
Reports say Bitcoin and Litecoin were stolen from hot wallets on BTCPay Server instances running older versions. BTCPay Server says its investigation found the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- BTCPay Server
- Product
- BTCPay Server
- Status
- Reported, not confirmed
- First seen
What to do
Update BTCPay Server to the latest version now
Check hot wallets on your instance for unauthorized outflows
Move remaining funds to new wallets if your instance ran 2.4.1 or earlier
Review server access logs for suspicious activity
Timeline
- Made public by Bluesky
- First seen by cve.now1 day
- Record last updated
On X 10
Coin Bureau@coinbureau🚨ALERT: BTCPay Server warns attackers are draining HOT WALLETS on outdated software. The attack targets version 2.4.1 or earlier. Operators are urged to update to version 2.4.7. No credible wallet-drain reports have been received for the latest release. An August attack also stole funds using compromised Lightning credentials, prompting remote access restrictions. It remains unclear whether the two attacks are connected. The stolen amount remains undisclosed.
Mando@rektmando🟥 Things I'm looking at today 🟥 Powered by @yeet Subscribe: mandominutes.com Crypto hacks abound, Binance outflows surge, AI stocks puke Crypto * BTC: 78,160 (0%) | BTC.D: 60.0% (+0.1%) * ETH: 2,290 (+1%) | BNB: 710 (0%) | SOL: 94 (-1%) * Fear & Greed: 38 | 24h Liq: $141M * BTC ETFs: -$643M | ETH ETFs: -$156M * Top Gainers: HASH, CASHCAT, BC, SHFL, PEARL * Crypto rebounds after Binance hack * ETH ETFs hit record 23-day outflow streak * Binance outflows surge as withdrawals resume * 90% of stolen assets replenished: Binance * 44% of stolen Binance funds are frozen * US helping Binance recover hack funds * CZ thanks FBI, Secret Service, IRS for freezes * FBI blames North Korea for Binance hack * CCP ‘real mastermind’ of Binance Hack: Reports * Binance hackers launder funds through Tron * ETH reorg pauses THORChain, slows hacker * Binance, Bitget hack funds commingled: ZachXBT * Trezor warned of hardware implant in device * HYPE selloff continues despite ICE tweet repost * Hyperliquid revenue hit $105M in Sep * Perp volumes on Pumpfun hits ATH * AXIS crashes, as insiders dump 42M tokens * Tether excess reserves double in Q3 * Coinbase execs may sell $2.2B of COIN shares * 50 firms now object to OKX-ICE tokenisation * 12 crypto sites hit by frontend attacks: Blockaid * BTCPay Server warns of wallet drains * b14g exploit drains 97M CORE tokens * Polymarket users report stolen funds * China CCP urges crypto-linked graft crackdown Macro * NASDAQ: $25,440 (-3%) | Gold: $3,900 (+1%) * This week: US midterms, PMI, Jobs data * HFs pull cash from US stocks at ATH pace * Dems sweep odds in midterms at 70% * US goods trade deficit widest since Mar 2025 * US uncovers $8B suspicious foreign payments * Judge dismisses Trump's WSJ suit again * Oil falls as Rubio says diplomacy with Iran preferred * Netanyahu reportedly presses Trump to strike Iran * Gulf states brace for harsher Iran retaliation * Ukraine restarts Russian refinery attacks * Ukraine, Russia public alert apps hacked * US pushes to restart Russian gas exports to EU * US-Canada trade deal close: Trump * Canada's housing slump nears US’ 2008 bust * US had no role in Bolsonaro's exit: Rubio * PBOC switches to new overnight policy rates * Italy scraps citizenship income welfare scheme * Japan weighs $500B defence spending plan AI & Tech * AI stocks puke on capex, growth concerns * OpenAI pares funding goal, now seeks ~$20B * OpenAI builds on Chip partnerships * Elon limits Grok Bot on revenue concerns * SpaceX revenue $731B in 2028: Sequoia * SpaceX loses bid to toss NAACP lawsuit * Space data centers cost up to 100x more: Google * Anthropic bans Claude Code game cloning * 71% Americans oppose a data center: Gallup * DeepSeek unveils autonomous coding agent * South Korea targets top sovereign AI model * Reddit shares collapse 30% after earnings * Salesforce to buy defence tech startup * NASA hopes commercial space can save Hubble * Flock ignoring contract cancellation requests * Billboards in multiple countries hacked @YEET: Crypto's Casino Just passed $3.6B in lifetime volume! Pionex: World’s Leading Bot Trading Platform gm
Walker⚡️@WalkerAmericaSince @carlabotcoin posted this video **two days ago**... ✅ Hackers pushed fake nuclear strike alerts through emergency apps in both Ukraine and Russia. ✅ Hackers took over supermarket fridges and freezers in seven European countries and cranked them up to 50°C, spoiling food at more than 115 stores. ✅ Attackers drained bitcoin from merchants running outdated BTCPay Server, taking about 18 BTC. ✅ Someone stole about $106M in stablecoins from an unnamed EU company's exchange accounts and laundered it into Monero. ✅ Hackers hijacked a dozen DeFi websites and redirected visitors to copies that emptied their wallets. ✅ Ransomware gangs started locking up Synology home and office storage drives and demanding bitcoin to unlock them. ✅ Attackers chained three Ivanti VPN zero-days together to get root access on fully patched corporate networks. ✅ Ubuntu servers stayed exposed to a critical Linux flaw that lets attackers take over a machine remotely. ✅ HYBE, the company behind BTS, admitted hackers stole employee passports, ID numbers and card details. ✅ Chainalysis, the firm that tracks crypto criminals, admitted an intruder using AI tools got into its customer data. ✅ Binance's hackers started running stolen funds through bitcoin mixers and swapped $46M in SOL into bitcoin. EVERY DAY IS ZERODAY.
Show 7 more posts
Lombard@Lombard_FinanceLast week in Bitcoin: → A record $6.3B breach of Binance on Oct 29, drove Bitcoin to a six-week low and triggered over $1.5B in liquidations; the haul included roughly 18,270 BTC. → Threshold paused the tBTC bridge on Oct 30 after a critical Linux kernel flaw, tBTC stayed fully backed, and Aave froze its $136M tBTC market. → US spot Bitcoin ETFs swung to a net weekly outflow of about $202M after a $643M single-day exit on Oct 30 led by IBIT and FBTC. → Strategy resumed buying with 811 BTC and repurchased $208M of STRC to reach 849,327 BTC. → Strive bought 6,182 BTC to reach 43,000. → Bitcoin Core patched three AI-found flaws, one that crashes Windows and macOS nodes. → BTCPay Server urged operators on version 2.4.1 or older to shut down after hot-wallet drains.
OXMallam.hl 🤘🌪️@Adellbahhackers are draining bitcoin and litecoin straight out of merchants' payment servers. the servers you run yourself. here is what is happening. btcpay server, the self hosted open source payment processor thousands of merchants use to accept crypto, is warning users to update immediately. attackers are stealing bitcoin and litecoin from hot wallets on instances running version 2.4.1 or earlier. the timeline makes it worse. in august, btcpay disclosed that a critical vulnerability had already been weaponized by attackers to steal funds. they shipped a fix in version 2.4.2 on august 7. the attackers now hitting servers are using a different method to exploit the same weakness. they went around the patch. nobody knows when this campaign started. reports only began surfacing around november 1. that means unknown servers could have been leaking funds for weeks while their owners thought a two month old patch kept them safe. the cruel part is who gets hit. btcpay exists so merchants do not have to trust a third party exchange. you run your own server, you hold your own keys, you stay sovereign. except the sovereign server also needs patching, monitoring and a security team, and most small merchants have none of those. here is the twist that stings. self custody was supposed to be the safe harbor after every exchange hack. but self hosted means self secured. the binance thief needed north korea level resources to take $6.3 billion. the btcpay thief just needed you to skip an update. check your btcpay version today. if it is 2.4.1 or older, update to the latest release now, then audit your hot wallet history for withdrawals you did not make. and set a reminder to patch the software that guards your money, because the people trying to take it never miss an update.
Kraist@CentralIgnis13Today's hacks Mercado Bitcoin: $48.5M across 10 chains. Hot wallets drained in a 34 minute window. 35,853 Ethereum deposit addresses emptied. Tether and Paxos froze $7.3M. Circle froze nothing. Supermarket fridges: Europe, round two. Sweden, Estonia, Ireland, Luxembourg, Belgium. Food set to 50°C. SuperValu pulled fresh stock from 13 stores. Same pattern as France three weeks ago 350 locations, tens of millions in damage. 12 DeFi sites: $138K via Name.com. Step Drainer. One registrar, one flaw, twelve victims. EU entity: $106M. Unnamed European org, multiple exchanges. Pulled as USDT and USDC, turned into ETH, aggressively converted to Monero. ZachXBT says not Lazarus. No victim named. BTCPay Server: BTC and LTC stolen. Old versions still running, patches existed, nobody applied them. Not an exploit. Negligence at industrial scale. Chainalysis: AI driven breach. Researcher names leaked. The watchers got watched. New week, same script.
ndeet ∞/21M@ndeetIf you still run BTCPay Server below version 2.4.2 don't just upgrade, read this and make sure you not update an already compromised server. x.com/BtcpayServer/s…
Bitcoin Africa Story@btcafricastoryIf you're still running a BTCPay Server version below 2.4.2, don't rush to upgrade. Read this first and make sure you're not updating an already compromised server. x.com/BtcpayServer/s…
Aayush Giri@AayushStackif you're running an old self-hosted btcpay server, check your version now. attackers have reportedly stolen bitcoin and litecoin from hot wallets on instances running version 2.4.1 or earlier. the uncomfortable part: the vulnerability had already been patched in august, but outdated installations remained exposed. open source doesn't automatically mean secure. patching, monitoring and key isolation still matter. affected operators should follow the project's latest recovery guidance. source: blog.btcpayserver.org
Morkie@_morkieCRYPTO SECURITY: BTCPay Server flaw exploited to drain $1.6M from merchant hot wallets. Hackers targeted outdated BTCPay Server installations (v2.4.1 and earlier) to steal Bitcoin and Litecoin from merchant hot wallets across 682 sweeps, prompting core developers to urge node operators to shut down instances and update to patched releases. 🪙⚠️
Evidence 2
- SocialBluesky
“BTCPay Server users, beware! Versions 2.4.1 & earlier have a vulnerability discovered by the incident response team.”
- PressThe Hacker News
“BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-e9daeb8936
Has BTCPay Server confirmed it?
Bluesky and The Hacker News report it. No statement from BTCPay Server has reached cve.now yet.Source: Bluesky, The Hacker News
What should BTCPay Server users do?
Update BTCPay Server to the latest version now. Check hot wallets on your instance for unauthorized outflows. Move remaining funds to new wallets if your instance ran 2.4.1 or earlier. Review server access logs for suspicious activity.