Critical

BTCPay Server warns of hot wallet crypto thefts on outdated instances

BleepingComputer

November 2, 2026 at 3:03 PM

Actively Exploited

Overview

BTCPay Server, a popular open-source cryptocurrency payment processor, has issued a warning about hackers stealing funds from hot wallets on older versions of its software. The maintainer emphasized that users must update to the latest version to protect their assets. Instances that haven't been updated are particularly vulnerable to these attacks, which could lead to significant financial losses for users. This alert serves as a reminder of the importance of keeping software up to date, especially in the rapidly evolving cryptocurrency space. Users who are still running outdated versions should take immediate action to secure their wallets and prevent unauthorized access.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: BTCPay Server versions prior to the latest release
Action Required: Users should update to the latest version of BTCPay Server to secure their hot wallets.
Timeline: Newly disclosed

Original Article Summary

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions. [...]

Impact

BTCPay Server versions prior to the latest release

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should update to the latest version of BTCPay Server to secure their hot wallets.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Update.

Read Original Article

Related Coverage

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft

The Hacker News

Binance recently reported a staggering theft of $6.43 billion from its platform, attributing the breach to a complex scheme involving fake job interviews and the misuse of an altered Homebrew installation. Attackers targeted two of Binance's engineers through social engineering tactics disguised as recruitment efforts. This incident is significant as it illustrates the lengths to which cybercriminals will go to infiltrate a major cryptocurrency exchange. The theft not only impacts Binance but also raises concerns for users and investors in the cryptocurrency space about the security of their assets. As the largest exchange globally, the breach may have wider implications for trust and security in the entire crypto market.

Nov 3, 2026

Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access

The Hacker News

Barracuda has revealed two serious vulnerabilities in its products that could allow attackers to bypass authorization and gain root access to affected devices. The first vulnerability is a pre-authentication authorization bypass, while the second is a command injection flaw. Together, these vulnerabilities have been assigned the CVE identifier CVE-2026-116606 and carry a high severity score of 9.3. This is particularly concerning because if exploited, attackers could gain full control over the device, potentially leading to significant data breaches or service disruptions. Users of Barracuda's products should take these findings seriously and ensure their systems are updated promptly to mitigate any risks associated with these vulnerabilities.

Nov 3, 2026

Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges

The Hacker News

Google has issued a warning about a new type of cyber attack known as LLMjacking, where attackers exploit enterprises' access to Large Language Models (LLMs) for fraudulent gain. These attackers typically acquire an API key through methods like phishing, source code leaks, or misconfigured environments. As a result, companies can face significant financial losses, with some reporting up to $1 million in additional cloud charges due to unauthorized use of AI services. This situation poses a serious risk to businesses relying on LLMs, highlighting the need for better security practices to protect sensitive access credentials. Companies must be vigilant and ensure their systems are properly configured to prevent such hijacking incidents.

Nov 3, 2026

cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes

The Hacker News

On November 2, an attacker compromised the update system of cPGuard, a security tool for Linux servers, and deployed a malicious script to its users. This script created a backdoor on the affected servers, allowing the attacker to collect sensitive information, including password hashes. The company behind cPGuard, OPSSHIELD, confirmed that some of this stolen data has already been retrieved by the attacker. The breach specifically affects users running cPGuard version 5.88.25 and later. This incident raises concerns about the security of update channels and the potential for attackers to exploit trusted software to infiltrate systems.

Nov 3, 2026

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

The Hacker News

Red Hat has released patches for a serious vulnerability in the Linux kernel's TCP code, identified as CVE-2026-98432. This flaw allows remote, unauthenticated attackers to exploit a use-after-free condition in the IPv4 TCP stack, potentially leading to remote code execution. The patched kernels are available for Red Hat Enterprise Linux versions 8, 9, and 10. In contrast, Ubuntu has not yet released a stable update for its long-term support versions, which are currently in an opt-in testing phase. This delay in Ubuntu's response raises concerns about the security of users relying on its systems until a formal fix is implemented.

Nov 3, 2026

Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets

The Hacker News

BTCPay Server, a self-hosted cryptocurrency payment processor, has issued a warning after discovering that hackers have been stealing Bitcoin and Litecoin from hot wallets on servers running outdated software. The attacks specifically targeted versions of BTCPay Server up to and including 2.4.1, which was released on July 23, 2026. Users are strongly encouraged to update to the latest version to protect their assets. This incident highlights the ongoing risks associated with using older software versions, particularly in the cryptocurrency space where funds can be easily stolen. Users need to stay vigilant and ensure their systems are up-to-date to minimize the risk of similar attacks in the future.

Nov 3, 2026