Critical

Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets

The Hacker News

November 3, 2026 at 8:31 AM

Actively Exploited

Overview

BTCPay Server, a self-hosted cryptocurrency payment processor, has issued a warning after discovering that hackers have been stealing Bitcoin and Litecoin from hot wallets on servers running outdated software. The attacks specifically targeted versions of BTCPay Server up to and including 2.4.1, which was released on July 23, 2026. Users are strongly encouraged to update to the latest version to protect their assets. This incident highlights the ongoing risks associated with using older software versions, particularly in the cryptocurrency space where funds can be easily stolen. Users need to stay vigilant and ensure their systems are up-to-date to minimize the risk of similar attacks in the future.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: BTCPay Server versions 2.4.1 and earlier
Action Required: Upgrade to the latest version of BTCPay Server.
Timeline: Newly disclosed

Original Article Summary

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server

Impact

BTCPay Server versions 2.4.1 and earlier

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Upgrade to the latest version of BTCPay Server.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Update.

Read Original Article

Related Coverage

Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

The Hacker News

Synology is warning users to update their DiskStation Manager (DSM) software after discovering that attackers are exploiting a vulnerability that was patched in December 2024. The company noted that these ransomware attacks specifically target older versions of the DSM software, allowing threat actors to encrypt files and demand ransom from users. This situation affects anyone using Synology NAS devices that have not yet updated their software, putting sensitive data at risk. Synology's call to action emphasizes the importance of keeping software up to date to prevent falling victim to these types of attacks. Users should take immediate steps to secure their devices to avoid potential data loss and financial extortion.

Nov 3, 2026

New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food

The Hacker News

On November 2, 2023, supermarkets across Europe, including countries like Belgium, Sweden, and Estonia, experienced a wave of cyberattacks that targeted refrigeration systems. Attackers remotely altered the settings of refrigeration controls, causing fridges and freezers to warm up. While no chain reported extensive damage, several dozen stores were affected, leading to the disposal of chilled and frozen food and removal of items from shelves. This incident raises concerns about the security of critical infrastructure and how vulnerable it is to cyber threats. Danfoss, a Danish company that produces refrigeration controls, is involved in the investigation of these attacks, which could have broader implications for food safety and supply chains across the region.

Nov 3, 2026

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

The Hacker News

A serious security vulnerability has been discovered in Siemens SIMATIC IoT2050 Advanced devices, identified as CVE-2026-58115, which has a maximum severity score of 10.0. This flaw allows unauthenticated remote attackers to exploit missing authentication for a critical function, potentially enabling them to execute arbitrary code on the affected devices. This is particularly concerning as it poses significant risks to organizations that rely on these devices for their Internet of Things (IoT) applications. Researchers from VulnCheck have reported that this vulnerability is currently being actively exploited, meaning that organizations using these devices need to take immediate action to protect their systems. The urgency of the situation calls for heightened awareness and prompt remediation efforts to mitigate potential attacks.

Nov 3, 2026

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

The Hacker News

Researchers at Defused Cyber have identified a serious vulnerability in the CryptoPayment Gateway WordPress plugin, designated as CVE-2026-81648. This flaw has a maximum severity rating, scoring 10.0 on the CVSS scale. It allows unauthenticated users to delete arbitrary files from the server, which could lead to the exposure of sensitive wallet credentials. As a result, sites using this plugin are at risk, and immediate action is required to protect against potential exploitation. Users of the affected plugin need to ensure they apply necessary updates or implement workarounds to mitigate this risk.

Nov 3, 2026

Chinese hackers use ARTEX AI in automated attacks against 200 orgs

BleepingComputer

Chinese hackers have exploited ARTEX, an open-source AI tool designed for penetration testing, to launch automated attacks on over 200 organizations across 14 countries. This widespread campaign has raised concerns about the potential for increased cyber threats as more attackers adopt advanced technologies for malicious purposes. The targeted organizations span various sectors, indicating a broad impact that could affect sensitive data and operational integrity. As ARTEX automates certain aspects of penetration testing, its misuse by malicious actors poses significant risks to cybersecurity, prompting a need for organizations to bolster their defenses. Companies should remain vigilant and consider enhancing their security measures in light of these developments.

Nov 2, 2026

Fintech platform Sageworks taken offline after suspected cyberattack

BleepingComputer

Abrigo, a financial technology company, recently took its Sageworks risk management application offline due to suspected irregular activity, which is believed to be linked to a cyberattack. While the application has been restored, the borrower-facing features remain unavailable as the company works to assess the situation. This incident raises concerns about the security of fintech platforms and the potential risks to sensitive financial data. Users of the Sageworks application should remain vigilant as the situation develops and await further updates from Abrigo. The company has not provided specific details about the nature of the irregular activity or how it plans to address the vulnerabilities that may have been exploited.

Nov 2, 2026