Short answer
BTCPay Server said on 1 November 2026 that it had received reports of Bitcoin and Litecoin stolen from hot wallets on servers running version 2.4.1 or earlier. It advises operators to move to a fresh server with a new wallet and seed, because updating alone may not remove an attacker's access.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | BTCPay Server |
|---|---|
| Incident type | Crypto theft |
| Status | Confirmed by the organization |
| Sector | Cryptocurrency payment software |
| Country | Global |
| Detected | 2026-11-01 |
| Disclosed | 2026-11-01 |
| People or records affected | Operators of self-hosted servers on 2.4.1 or earlier; blockchain analysis traced about $1.63 million, which is a floor, not a confirmed total |
What data was exposed
- Bitcoin and Litecoin held in hot wallets, meaning wallets whose spending keys are stored on the server
- Administrator access to affected servers, per blockchain analysis firm Bitquery
- Wallets with spending keys held off the server, such as hardware wallets, were not affected, according to BTCPay Server
What happened
BTCPay Server is open-source software that businesses host themselves to accept Bitcoin and other crypto payments. On 1 November 2026 its team received reports of Bitcoin and Litecoin stolen from hot wallets. In its incident notice, BTCPay says the first email reporting a theft arrived at 20:56 UTC that day, and that a wallet drain had already occurred at 13:46 UTC. When attackers first began exploiting the flaw is unknown.
At 22:25 UTC BTCPay posted a community warning asking operators to shut down their servers while it investigated, and it contacted hosting providers, including LunaNode, to take instances offline as a precaution. A 2 November update identified version 2.4.1 and earlier as affected.
The flaw and the timeline
BTCPay says the attackers used a different method to exploit a vulnerability that was fixed in version 2.4.2 on 7 August 2026. Infosecurity Magazine reports that the flaw was used in August to steal funds through LND, a Lightning Network implementation, and that BTCPay said at the time that on-chain wallets, including hot wallets, were not affected. The new wave shows that older servers were exposed in a further way. No CVE identifier or technical write-up has been published in the sources we reviewed.
How much has been taken
Infosecurity Magazine cites an analysis by Bitquery that traced 18.38 BTC and 3,405 LTC moved to two addresses in 682 sweeps between 30 October and the morning of 2 November, with the attacker logging in as an administrator. About 87% of traced funds moved in one wave on 1 November. After the 22:25 UTC warning, a further 267 sweeps worth about $150,000 followed. The article puts the traced total at about $1.63 million.
Treat that as a minimum. It excludes other addresses, other coins and Lightning funds, and BTCPay cautions that balances at the addresses are not confirmed losses. The number of servers compromised is unknown, because the blockchain records wallets, not machines.
What operators are told to do
BTCPay’s guidance is blunt. If you run 2.4.1 or earlier, move to a fresh server even if you have not noticed a theft and even if you have since updated. Create a new wallet and seed on a trusted device, sweep the remaining funds, preserve logs, and rebuild from a trusted release without restoring the old machine. Replace hosting, SSH, API and Lightning credentials from a trusted device. Going forward, keep only day-to-day funds in a hot wallet.
Scam risks around the incident
Incidents like this draw impostors. Expect fake security updates, look-alike download pages and messages offering to recover stolen coins for a fee. BTCPay says it will never need your seed phrase or private keys.
See our guides on crypto wallet drainer scams and recovery scams, and the data breach checklist.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'BTCPay security update' emails, GitHub issues or chat messages that ask you to paste a seed phrase or run a command.
- Recovery scammers who contact victims of the thefts and offer to 'trace and return' funds for an upfront fee.
- Fake migration tools or look-alike BTCPay download pages that carry wallet-stealing malware.
What to do if you are affected
- 01Check your version at the bottom of the BTCPay Server login page. If it is 2.4.1 or earlier, treat the server as at risk even if you have updated.
- 02Create a new wallet with a new seed on a trusted device and sweep remaining hot-wallet funds into it. Do not reuse the old seed.
- 03Take the old server offline, preserve logs and transaction records, and build a fresh VM from a trusted release. Do not restore the old server onto it.
- 04From a trusted device, replace exposed credentials: hosting, SSH, application, API and Lightning.
- 05If funds were stolen, report it to local authorities and email security@btcpayserver.org with your version, timestamps and transaction IDs. Never send seed phrases or keys.
Frequently asked questions
Which BTCPay Server versions are affected?
BTCPay Server says 2.4.1 (released 23 July 2026) and earlier. Servers already on 2.4.2 or later when the warning went out on 1 November showed no impact. The vulnerability was fixed in 2.4.2 on 7 August 2026.
Is updating enough?
No, according to BTCPay Server. Updating may not remove an attacker's existing access, and an unchanged balance does not rule out an earlier attack. It recommends a fresh server and a new wallet with a new seed.
How much was stolen?
BTCPay Server has not published a total. Infosecurity Magazine reports that blockchain analysis traced about $1.63 million in Bitcoin and Litecoin to linked addresses. That figure is a floor. BTCPay also warns that some activity at the destination addresses predates the reported thefts.
Are hardware wallets safe?
BTCPay Server says wallets whose spending keys are held off the server, including hardware wallets, were not affected.
Sources
- BTCPay Server Security Incident (2.4.1 and earlier), BTCPay Server blog, 2026-11-02
- Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency, Infosecurity Magazine, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.