Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets

Summary: Attackers stole $1.62 million in cryptocurrency - 18.38 BTC and 3,405 LTC - from hot wallets on BTCPay Server instances running version 2.4.1 or earlier, across 682 separate sweeps tracked by Bitquery. BTCPay Server said the attacks used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026, and that reports began surfacing around November 1, 2026, with 87% of the money moved in one wave that day between 14:12 and 22:16 UTC.
Bottom line: The first sweep Bitquery observed came less than a day after BTCPay shipped version 2.4.7, and 77% of the stolen money came from just 32 sweeps of $10,000 or more - meaning patching the code did not stop wallets that were already exposed.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026