BTCPay Server

What happened

On November 1, 2026, attackers exploited a vulnerability in BTCPay Server versions 2.4.1 and earlier to compromise self-hosted installations and steal BTC and LTC from their hot wallets. The vulnerability had been patched in version 2.4.2 in August, but outdated installations remained exposed. BTCPay Server urged affected operators to take their servers offline, migrate to fresh installations, replace compromised wallet seeds, and rotate potentially exposed credentials. Wallets whose spending keys were held off-server, including hardware wallets, were unaffected

Details

Date

Nov 1, 2026

Kind

Hack or exploit

Method

Key Leaked via Infrastructure

How in

Keys, accounts and infrastructure

Target

People and personal wallets

Chains

Bitcoin, Litecoin

What would have stopped it all controls for this way in

• No one machine, person or organisation can move hot funds alone: keys in HSMs or MPC, threshold signers on separate infrastructure.
  Check: List every key that can move funds. For each: where it lives, who and what can reach it. Two keys behind one login count as one.
• Freeze contacts are arranged before they are needed: stablecoin issuers, the large exchanges, SEAL 911.
  Check: A contact sheet with named people, confirmed this quarter; one drill sending a freeze request.

General guidance for this kind of attack, not a finding about this incident.

How sure: 2 of 4 checks what the checks mean

• Witnesses2 independent sources report it
• Same storythey agree on the date and the loss
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• DefiLlama ↗no figure
• SlowMist Hacked ↗no figure

Related incidents