{"id":3938,"date":"2026-11-03T09:48:11","date_gmt":"2026-11-03T09:48:11","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3938"},"modified":"2026-11-03T09:48:11","modified_gmt":"2026-11-03T09:48:11","slug":"hackers-exploit-btcpay-server-flaw-to-steal-bitcoin-and-litecoin-from-hot-wallets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3938","title":{"rendered":"Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 03, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Cryptocurrency<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhrr1rJlr2nztz8jEunAWtVXHyOHkJY2_KdeweNWBqwF18rmhPiFItEQ-yCex1vVsps856ArIDl7unaWJNiribZ9DgkmQ3o4pLa1BKQrjKEeFR63z4csXnBHah5wIp7H5xuUB7b1UIp06nk6BzLuxFW5aWh2g-PoLoZ74RjMOEUX7XdrDsHM1yFbjGHBzK8\/s1700-nu-rw-lo-l85-e365\/btcpay.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to <a href=\"https:\/\/x.com\/BtcpayServer\/status\/2117020340815819262\" target=\"_blank\">reports<\/a> of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions.<\/p>\n<p>\u00abOur investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier,\u00bb BTCPay Server <a href=\"https:\/\/blog.btcpayserver.org\/btcpay-server-security-incident-2-4-1-and-earlier\/\" target=\"_blank\">said<\/a>. \u00abThe attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026.\u00bb<\/p>\n<p>Users who are running versions 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even in scenarios where users have not noticed a theft. In the event of stolen funds or suspected unauthorized access, it&#8217;s imperative that users consider the entire machine and all secrets stored on it as compromised and follow the same recovery procedures.<\/p>\n<p>It&#8217;s currently unknown when the attackers behind the campaign first began exploiting the vulnerability, although reports began to surface around November 1, 2026.<\/p>\n<p>In a <a href=\"https:\/\/x.com\/BtcpayServer\/status\/2117106238123123008\" target=\"_blank\">post<\/a> on X, BTCPay Server said no \u00abcredible reports\u00bb of hot wallet drains have been reported from users running the latest 2.4.7 release. The version <a href=\"https:\/\/x.com\/BtcpayServer\/status\/2115835402536079674\" target=\"_blank\">addresses<\/a> one critical and several medium-severity security vulnerabilities discovered via Anthropic&#8217;s OSS scanner.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-governance-platform-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi9hjzSN2bSutSbaNO6ZWEm02wC6hue03kC4VKPSfsdPvcDX2PAvPE-u9QrLCw3POvN3hXFPlyYyFgkAgtKrs4I2oSb9BkIFOWQ_k1ISfIBdT2AoWNvq2Q2DF_3AyA4fJriKPHkTjqYFxu-Y_H4IH9uqscX8lh-puQ5cPmc_veAEr9p4fC0497XT8Fktlp6\/s728-nu-rw-lo-l85-e365\/tl-insidem-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>BTCPay Server has also shared two wallet addresses linked to these incidents &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<ul>\n<li>Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7<\/li>\n<li>Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee<\/li>\n<\/ul>\n<p>\u00abIf you need a hot wallet for daily operations, keep only the funds needed for those operations on the server and move the rest to a wallet whose spending keys are held off the server,\u00bb it cautioned.<\/p>\n<p>\u00abIf you run BTCPay Server through a hosting provider, your instance may have been shut down automatically to keep older versions from being exploited.\u00bb<\/p>\n<p>In August 2026, BTCPay Server <a href=\"https:\/\/blog.btcpayserver.org\/btcpay-server-security-incident-response-and-next-steps\/\" target=\"_blank\">disclosed<\/a> that a critical vulnerability had been weaponized by attackers to steal funds from some users. The issue, which affects all BTCPay Server versions, was patched in version 2.4.2. It&#8217;s unclear if the latest set of attacks is related to the same vulnerability.<\/p>\n<p>\u00abThe issue could allow an unauthenticated remote attacker to obtain .macaroon credential files for LND, an implementation of the Lightning Network,\u00bb it <a href=\"https:\/\/blog.btcpayserver.org\/security-advisory-btcpay-server-2-4-2\/\" target=\"_blank\">said<\/a> in the August alert. \u00abThose credentials could be used to take control of an LND node and move funds. The attacks we reviewed targeted only files with the .macaroon extension.\u00bb<\/p>\n<p>The development coincides with a string of security breaches and exploits across the cryptocurrency space, including the record theft of $6.43 billion from Binance by North Korean threat actors. That same day, prediction market giant Polymarket briefly halted trading after it was hit by a $2.65 million exploit following the compromise of software developed by DebugBear.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-dd\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWypk5aSrjVVXdRpyJaxKDe9VERLYId6cVdoZUwHGSe-EMh90qROsc-jk3uEKqB8-L4eSpBaka7err1zF86IrsEA4S2IZ8yyEsoZTsiGq2YvGuaCtdFvE8-ej7uEBhLbYJNENjs9umU6qmZCJ1aAzvG-ZDO0NtTVddy5hIGv4FBpDJp8UeOxYEzF5AeuK1\/s728-nu-rw-lo-l85-e36\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Hardware wallet maker Trezor also followed suit with a <a href=\"https:\/\/trezor.io\/blog\/news\/implant-reported-in-a-trezor-sold-by-cryptobilis\" target=\"_blank\">warning<\/a> that it received a responsible disclosure report alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis in August 2026. It&#8217;s assessed to be part of a sophisticated supply chain attack in which some of the devices sold via third-party resellers are physically tampered with to steal the victim&#8217;s seed phrase and use it to drain assets.<\/p>\n<h3>Mercado Bitcoin Discloses Security Incident<\/h3>\n<p>On Monday, Mercado Bitcoin, Brazil&#8217;s largest cryptocurrency exchange, <a href=\"https:\/\/x.com\/MercadoBitcoin\/status\/2117239507263132056\" target=\"_blank\">said<\/a> it&#8217;s temporarily pausing deposits and withdrawals following a <a href=\"https:\/\/arkm.com\/explorer\/entity\/mercado-bitcoin-hacker\" target=\"_blank\">security breach<\/a> that resulted in $49 million in stolen funds..<\/p>\n<p>\u00abAt this moment, the value of the assets involved is approximately $ 38 million,\u00bb it <a href=\"https:\/\/x.com\/MercadoBitcoin\/status\/2117395627529089233\" target=\"_blank\">said<\/a> in a post on X. \u00abIn a swift action with the crypto community and strategic partners \u2013 including Tether, Circle, Paxos, BRL1, and Chainalysis \u2013 we have already blocked US$ 11 million.\u00bb<\/p>\n<p>\u00abOther amounts eligible for blocking have been identified, and containment efforts continue. The resumption of services will occur as soon as full security conditions are met, and deadlines will be communicated exclusively through our official channels.\u00bb<\/p>\n<p>Tether CEO Paolo Ardoino <a href=\"https:\/\/x.com\/paoloardoino\/status\/2117272224814219720\" target=\"_blank\">confirmed<\/a> that the stablecoin issuer had frozen more than 4.5 million USDT in connection with the incident.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Nov 03, 2026Vulnerability \/ Cryptocurrency BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3939,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2846,4027,120,70,338,4029,4028,518,571,617],"class_list":["post-3938","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-bitcoin","tag-btcpay","tag-exploit","tag-flaw","tag-hackers","tag-hot","tag-litecoin","tag-server","tag-steal","tag-wallets"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3938"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3938\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3939"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}