BTCPay founder ties hot-wallet sweeps to admin logins on servers older than 2.4.2

Hot-wallet sweeps reported on Sunday appear to involve servers running releases older than 2.4.2, said Nicolas Dorier, founder of BTCPay Server.

The attacker logged in as admin on those instances and the team is still figuring out how.

Investigation pins the attack vector on 2.4.1 releases or earlier

BTCPay sent out an alert at 5:25 p.m. ET Sunday. It counseled anyone running an instance to shut it down with ./btcpay-down.sh until the investigation is over.

Dorier posted about 2 hours later. BTCPay’s own public servers running 2.4.7 were not attacked, he said.

Dorier later stated the team had traces that “pre 2.4.2 vulnerabilities were used.”

BTCPay’s update at 11:07 p.m. ET narrowed the target. The investigation found an attack vector targeting instances running on 2.4.1 released July 23 or earlier versions.

The project had “no credible reports of hot wallet drains” from users on 2.4.7, which shipped October 29. It advised operators to keep the software updated and asked victims to send details and logs to its security team.

Some hosting providers may have automatically shut instances down to prevent older versions from being exploited. BTCPay thanked LunaNode and others for their prompt action.

Operators who have updated at least once since 2.4.2 was released have “no reason to panic,” Dorier said. He also warned users not to keep too much in a hot wallet, promising a blog post with more detail.

Sunday’s drains reached funds the August advisory ruled safe

Since BTCPay is self-hosted, the project can’t change a merchant’s server or shut it down. Its hot-wallet mode signs payments with a seed stored on that server, which means whoever controls that server can move the coins.

The 2.4.2 line dates back to August. BTCPay released version 2.4.2 on August 7 to patch a critical vulnerability that was already under attack, Cryptopolitan reported.

Every previous release, including 2.4.2 release candidates, allowed an unauthenticated attacker to steal LND macaroon credentials. An attacker could commandeer a Lightning node and use it to move its funds.

Foundation and Citadel21 reported attacks on their Lightning nodes. Craig Raw, developer of the Sparrow Wallet, said he was also hit.

With the 2.4.2 release, LND’s macaroons were automatically made again. When operators exposed LND through their own proxy, Tor service, or forwarded port, they had to change those credentials by hand.

Version 2.4.2 also patched a separate TOTP two-factor bypass via the Greenfield API’s Basic Authentication, reported August 4. BTCPay said the bug was not related to the macaroon hack.

BTCPay’s advisory said its own on-chain wallets, including hot wallets, were not affected by that flaw. Reports on Sunday said hot wallets were being swept.

Neither BTCPay nor Dorier has said if the attacker exploited the August macaroon bug or some other pre-2.4.2 vulnerability. In August, backers put up a recovery bounty of 10% of returned funds, up to 3 BTC.

River reported that average merchant usage of Bitcoin grew 74% in 2025, with Lightning volume surpassing $1 billion per month.