Version

River

Bitcoin

Hot-wallet sweeps reported on Sunday appear to involve servers running releases older than 2.4.2, said Nicolas Dorier, founder of BTCPay Server.
The attacker logged in as admin on those instances and the team is still figuring out how.
<h3 id="span-style-font-weight-400-investigation-pins-the-attack-vector-on-2-4-1-releases-or-earlier-span">Investigation pins the attack vector on 2.4.1 releases or earlier</h3>
BTCPay sent out an <a href="https://x.com/BtcpayServer/status/2117020340815819262" rel="noopener noreferrer nofollow">alert</a> at 5:25 p.m. ET Sunday. It counseled anyone running an instance to shut it down with ./btcpay-down.sh until the investigation is over.
Dorier posted about 2 hours later. BTCPay’s own public servers running 2.4.7 were not attacked, he said.
<img src="https://www.cryptopolitan.com/wp-content/uploads/2026/11/2026-11-02-btcpay-hot-wallet-sweeps-admin-logins-2-4-2-01.png" alt="BTCPay founder ties hot-wallet sweeps to admin logins on servers older than 2.4.2." width="625" height="424">
Dorier later <a href="https://x.com/NicolasDorier/status/2117072276122464473" rel="noopener noreferrer nofollow">stated</a> the team had traces that “pre 2.4.2 vulnerabilities were used.”
BTCPay’s <a href="https://x.com/BtcpayServer/status/2117106238123123008" rel="noopener noreferrer nofollow">update</a> at 11:07 p.m. ET narrowed the target. The investigation found an attack vector targeting instances running on 2.4.1 released July 23 or earlier versions.
The project had “no credible reports of hot wallet drains” from users on 2.4.7, which shipped October 29. It advised operators to keep the software updated and asked victims to send details and logs to its security team.
Some hosting providers may have automatically shut instances down to prevent older versions from being exploited. BTCPay thanked <a href="https://x.com/BtcpayServer/status/2117106240098611681" rel="noopener noreferrer nofollow">LunaNode</a> and others for their prompt action.
Operators who have updated at least once since 2.4.2 was released have “no reason to panic,” Dorier <a href="https://x.com/NicolasDorier/status/2117107091328639417" rel="noopener noreferrer nofollow">said</a>. He also warned users not to keep too much in a hot wallet, promising a blog post with more detail.
<h3 id="span-style-font-weight-400-sunday-s-drains-reached-funds-the-august-advisory-ruled-safe-span">Sunday’s drains reached funds the August advisory ruled safe</h3>
Since BTCPay is self-hosted, the project can’t change a merchant’s server or shut it down. Its hot-wallet <a href="https://docs.btcpayserver.org/Wallet/#signing-with-a-hot-wallet" rel="noopener noreferrer nofollow">mode</a> signs payments with a seed stored on that server, which means whoever controls that server can move the coins.
The 2.4.2 line dates back to August. BTCPay released version 2.4.2 on August 7 to patch a critical vulnerability that was already under attack, <a href="https://www.cryptopolitan.com/btcpay-emergency-patch-exposes-merchant-side-bitcoin-security-risk/" rel="noopener noreferrer nofollow">Cryptopolitan</a> reported.
Every previous release, including 2.4.2 release candidates, allowed an unauthenticated attacker to steal LND macaroon credentials. An attacker could commandeer a Lightning node and use it to move its funds.
Foundation and Citadel21 reported attacks on their Lightning nodes. Craig Raw, developer of the Sparrow Wallet, said he was also hit.
With the 2.4.2 release, LND’s macaroons were automatically made again. When operators exposed LND through their own proxy, Tor service, or forwarded port, they had to change those credentials by hand.
Version 2.4.2 also patched a separate TOTP two-factor bypass via the Greenfield API’s Basic Authentication, reported August 4. BTCPay said the bug was not related to the macaroon hack.
BTCPay’s <a href="https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/" rel="noopener noreferrer nofollow">advisory</a> said its own on-chain wallets, including hot wallets, were not affected by that flaw. Reports on Sunday said hot wallets were being swept.
Neither BTCPay nor Dorier has said if the attacker exploited the August macaroon bug or some other pre-2.4.2 vulnerability. In August, backers put up a recovery <a href="https://www.cryptopolitan.com/bitcoin-holds-near-64000-as-btcpay-backers-pledge-3-btc-exploit-bounty/" rel="noopener noreferrer nofollow">bounty</a> of 10% of returned funds, up to 3 BTC.
River reported that average merchant usage of Bitcoin grew 74% in 2025, with Lightning volume surpassing $1 billion per month.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.

Attacker logged in as admin on old BTCPay servers before hot-wallet drains, founder says

Table of Contents

Cryptopolitan_News

Other articles published on Nov 2, 2026

Join our free newsletter for daily crypto updates!