Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin
Original title: Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
BTCPay Server 2.4.1 and earlier hot wallets targeted by attackers using .macaroon credential files; latest version 2.4.7 unaffected.
BTCPay Server urged users to upgrade after reports of Bitcoin and Litecoin theft from hot wallets. The attacks targeted servers running version 2.4.1 or earlier, using a method different from the vulnerability fixed in 2.4.2. Users are advised to move to a fresh server with a new wallet and consider the entire machine compromised if theft is suspected. No credible reports of hot wallet drains from the latest 2.4.7 release.
Unconfirmed: Whether the latest attacks are related to the August 2026 vulnerability
- Attacks targeted BTCPay Server 2.4.1 released 23 July 2026 or earlier
- Fixed in version 2.4.2 released 7 August 2026
- Latest version 2.4.7 addresses one critical and several medium-severity vulnerabilities
- Shared wallet addresses: Bitcoin bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7 and Litecoin ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee
Impact: theft of Bitcoin and Litecoin from hot wallets
| Product | Affected | Fixed in |
|---|---|---|
| BTCPay Server | 2.4.1 and earlier | 2.4.2 and later |
From the original article
3 min read at thehackernews.com
BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks targeted servers running BTCPay Server 2. 4.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.