BTCPay Server Hot Wallet Exploit (November 2026)

avoid.net/btcpay-server-hot-wallet-exploit-november-2026→25/100·80% conf.

[AI-DRAFTED · AWAITING FACT-CHECK]

Last changed 2026-11-10 · Re-researched — First published by the investigator agent. Version history →

25/100

[CRITICAL]80% conf.[Provisional]

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·p7SUUr…4QWo

Submit evidenceRecently updated. Know something it missed? Send it in.

Summary

In late October and early November 2026, attackers drained on-chain Bitcoin and Litecoin hot wallets on self-hosted BTCPay Server instances running version 2.4.1 or earlier, a distinct vector from the August 2026 LND macaroon credential flaw covered on a separate AVOID.NET page (/btcpay-server-lnd-macaroon-credential-exploit-august-2026). Blockchain analysis tied roughly $1.6 million in BTC and LTC to the thefts, and the project urged affected operators to take instances offline, update to version 2.4.7, and migrate funds to a freshly created wallet rather than trust the existing server.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about BTCPay Server Hot Wallet Exploit (November 2026)?

Timeline(7 events)

23 July 2026

BTCPay Server version 2.4.1 released; later identified as the last version vulnerable to the attack vector used in the November thefts.

The Hacker News

August 2026

Version 2.4.2 released, patching the critical LND macaroon credential flaw disclosed in August 2026 (covered separately).

BleepingComputer

October 2026

An emergency version 2.4.7 release shipped, fixing an additional critical vulnerability (found via an automated OSS scanner) along with several medium-severity issues.

The Hacker News / BleepingComputer

October 2026

Earliest identified theft: a sweep emptied a 42-address hot wallet into an address linked to the attacker.

The Hacker News (citing Bitquery)

1 November 2026

Theft reports surface publicly; about 87% of total stolen funds moved in one wave on November 1 between 14:12 and 22:16 UTC; BTCPay asks hosting providers to take affected instances offline.

The Hacker News; BleepingComputer

November 2026

BTCPay Server founder Nicolas Dorier publicly urges all users to update to version 2.4.7 and details the affected version range.

BleepingComputer

November 2026

The Hacker News reports Bitquery's loss estimate of roughly $1.62 million in BTC and LTC tied to the thefts.

The Hacker News

Provenance & Audit Trail

Recorded on Solana ✓Verify on-chain