# SZB-e9daeb8936: BTCPay Server says attacks on version 2.4.1 and earlier stole Bitcoin and Litecoin

Reports say Bitcoin and Litecoin were stolen from hot wallets on BTCPay Server instances running older versions. BTCPay Server says its investigation found the attacks targeted servers running version 2.4.1 (released 23 July 2026) or earlier.

- Type: Early warning
- Kind: Vulnerability
- Vendor: BTCPay Server
- Product: BTCPay Server
- Status: Reported, not confirmed
- Sources: 2 distinct
- First seen: 2026-11-02 09:38 UTC

> No statement or filing from BTCPay Server has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Update BTCPay Server to the latest version now
- Check hot wallets on your instance for unauthorized outflows
- Move remaining funds to new wallets if your instance ran 2.4.1 or earlier
- Review server access logs for suspicious activity

## Timeline

- 2026-11-02 09:37 UTC: Made public by Bluesky
- 2026-11-02 09:38 UTC: First seen by cve.now
- 2026-11-03 09:18 UTC: Record last updated

## Evidence (2 sources)

- 2026-11-02 · Social · [Bluesky](https://bsky.app/profile/cryptonews-poster.bsky.social/post/3mzczmpozrr2o): “BTCPay Server users, beware! Versions 2.4.1 & earlier have a vulnerability discovered by the incident response team.”
- 2026-11-03 · Press · [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html): “BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-e9daeb8936&body=https%3A%2F%2Fcve.now%2FSZB-e9daeb8936%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-e9daeb8936

### Has BTCPay Server confirmed it?

Bluesky and The Hacker News report it. No statement from BTCPay Server has reached cve.now yet.

Source: https://bsky.app/profile/cryptonews-poster.bsky.social/post/3mzczmpozrr2o, https://thehackernews.com/2026/11/hackers-exploit-btcpay-server-flaw-to.html

### What should BTCPay Server users do?

Update BTCPay Server to the latest version now. Check hot wallets on your instance for unauthorized outflows. Move remaining funds to new wallets if your instance ran 2.4.1 or earlier. Review server access logs for suspicious activity.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-e9daeb8936
Site guide for agents: https://cve.now/llms.txt