Attackers are stealing Bitcoin and Litecoin from BTCPay Server shops running old software. Anyone who accepts crypto this way should check their version now.
Thieves are emptying crypto from online payment servers that run old versions of BTCPay Server. The project says the attacks hit version 2.4.1 or older, and it is urging everyone to move to the latest release, 2.4.7.
BTCPay Server is free, open-source software that lets a business accept crypto payments. It is self-hosted, meaning the owner runs it on their own server instead of relying on a payment company. Reports of stolen Bitcoin and Litecoin began around November 1, 2026. The coins were taken from hot wallets, which are wallets kept on the server so it can send money quickly.
BTCPay Server says the attackers used a different method to exploit the same vulnerability that was fixed in version 2.4.2 on August 7, 2026. Version 2.4.1 came out on July 23, 2026. Anything from that release or earlier was a target.
The risk falls on businesses and individuals who run their own BTCPay Server, especially those who have not updated in months. If your server holds a hot wallet and runs 2.4.1 or older, it is in the group the attackers went after.
Some people may already be offline. BTCPay Server says that if you use a hosting provider, your instance may have been shut down automatically to stop old versions from being exploited.
People on the latest release, 2.4.7, are in better shape. BTCPay Server says it has seen no credible reports of hot wallet drains on that version. It also fixes one critical and several medium-severity security problems found with Anthropic's OSS scanner. That is a good reason to stay current, not a guarantee.
The steps are in the alert box above. The key point is that updating alone may not be enough if you ran an old version. BTCPay Server advises moving to a fresh server with a new wallet, even if you have not noticed any missing funds. If money did disappear, treat the whole machine and every secret stored on it as compromised.
The project also offers a simple rule for hot wallets: keep only what daily operations need on the server, and hold the rest in a wallet whose spending keys are kept off the server.
It is not known when the attackers first started. It is also unclear whether these attacks are tied to the August problem, when BTCPay Server said attackers had used a critical flaw to steal funds from some users. That flaw could let an outsider with no login obtain credential files for LND, software used with the Lightning Network, and then take control of a node and move funds.
BTCPay Server has shared two wallet addresses linked to the thefts. The attacks arrive during a rough stretch for crypto security, with several other large breaches reported across the industry.
If you run BTCPay Server, update to 2.4.7, and if you ever ran 2.4.1 or older, rebuild on a fresh server with a new wallet.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfSecurity firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
Read more: Scammers are targeting store refunds and gift cards before the holidaysA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websites
