Operators of BTCPay Server, the self-hosted payment processor many merchants run in place of a hosted gateway, are being told the coins are already gone if they stayed on old code. Reports of Bitcoin and Litecoin drained from hot wallets began surfacing around November 1.
The project’s investigation points at instances running version 2.4.1, released on July 23, or anything earlier. Attackers used a route that bypassed the repair shipped in 2.4.2 back in August, so a merchant who updated once and stopped has still been exposed for months.
A clean server, not a clean-up
The advice is blunt. Move to a fresh machine with a new wallet even where no theft is visible, because a host that has been touched cannot be assumed to hold any safe secret, from the wallet keys to the SSH configuration.
No drains have been reported from users on the current 2.4.7 release, which clears one critical and several medium-severity bugs found by Anthropic’s open-source scanner. Some hosting providers shut down older instances on their own to cut off exploitation.
The August flaw is still the reference point
The earlier incident allowed an unauthenticated attacker to obtain macaroon credential files for LND, the Lightning Network implementation, and use them to control a node and move funds. Whether the new wave reuses that same weakness is not yet clear.
For practical hardening: keep only working balances on the server, keep spending keys elsewhere, and publish the two wallet addresses the project released so victims can flag stolen funds.
