Attackers drained Bitcoin and Litecoin from hot wallets on BTCPay Server installations running version 2.4.1 or earlier, the open-source payment processor confirmed on 2 November, in a second wave of thefts against a flaw patched in August.

The November attacks

BTCPay Server said the first theft report arrived by email at 20:56 UTC on Sunday 1 November, after a wallet drain logged at 13:46 UTC that day. A public warning went out the same evening, and by 2 November it had identified version 2.4.1 and earlier releases as the targets. The attackers used a different method to exploit the vulnerability fixed in version 2.4.2, released 7 August 2026.

The flaw behind the thefts

The flaw is tracked as CVE-2026-119757 and scored 9.8. In the official Docker deployment, the Nginx template exposed the Lightning node's REST interface on port 8080 and its gRPC interface on port 10009 without authentication. The WalletUnlocker and State endpoints are not protected by macaroon credentials, so an unauthenticated attacker could retrieve the node's .macaroon files. The CVE record was only published on 5 November, about 90 days after the fix shipped, and the August advisory had already confirmed exploitation and fund theft.

What to do now

Servers already on 2.4.2 or later when the warning landed show no impact, BTCPay Server said, and wallets whose spending keys are held off the server, including hardware wallets, were unaffected. The project published one Bitcoin and one Litecoin destination address from the incident reports, but warned some activity at those addresses predates the thefts, so their balances are not a confirmed total of losses. Operators on 2.4.1 or earlier should rebuild on a fresh server with a new wallet and seed and rotate every credential, not just update. The latest release is 2.4.7.