# BTCPay Server: affected hosts need a fresh VM and wallet

Canonical: https://www.oktsec.com/radar/btcpay-server-hot-wallet-incident-november-2026
Publisher: Oktsec
Language: en
Published: 2026-11-03T17:00:17Z
Updated: 2026-11-03T17:00:17Z
Record reviewed: 2026-11-03T17:00:17Z
Latest evidence check: 2026-11-03T17:00:17Z
Disclosed: 2026-11-01

BTCPay reports hot-wallet thefts targeting 2.4.1 and earlier. Its recovery guidance also covers servers upgraded from those versions after the November 1 warning.

## Evidence and response priority

- Category: Platform incident
- Oktsec priority: Act now
- Rationale: The project reports thefts and requires rebuilding hosts within the stated version and timing scope, even after a subsequent upgrade.
- Evidence: Incident confirmed by provider
- Verification: Vendor confirmed
- Fix status: Additional action required
- Exposure requirement: Application or configuration dependent
- Vendor: BTCPay Server
- Products: BTCPay Server

## Technical overview

The project reports no observed impact from these attacks on servers already running 2.4.2 or later at the warning. Keys held off-server were unaffected by the thefts, but older servers still need rebuilding.

Signs of unauthorized access or theft require the same recovery even after updating. The first exploitation date and total loss remain unestablished. Wallet balances and destination-address totals do not settle either question.

## Recommended response

Rebuild affected hosts on a fresh VM with a new wallet and seed; updating alone is insufficient.

Relevant to: Teams responsible for the affected deployments.

## Response checklist

1. **Check version history** — Record the version at the November 1 warning and any later upgrade.
2. **Move remaining funds safely** — Use a trusted device, new wallet and new seed. Never reuse the old seed.
3. **Preserve evidence and rebuild** — Take the old host offline after preserving logs. Install the latest supported release on a fresh VM; do not restore the whole old server.
4. **Replace exposed credentials** — Revoke passwords and keys accessible to the old host from a trusted device. Do not enter replacement secrets on it.

## Relevance to AI environments

Include automated workflows in the response inventory; the evidence does not establish AI involvement in the attack.

## Sources

- [BTCPay incident scope and recovery guidance](https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/) — BTCPay Server; Vendor notice; checked 2026-11-03T17:00:17Z

## Editorial record

- 2026-11-03T17:00:17Z: Added source scope and a practical response checklist.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/btcpay-server-hot-wallet-incident-november-2026) · [Build a response plan](https://www.oktsec.com/radar/btcpay-server-hot-wallet-incident-november-2026#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=btcpay-server-hot-wallet-incident-november-2026&service=exposure_check)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.