BTCPAY NOW SAYS ITS AUGUST BUG DRAINED HOT WALLETS — THE ADDRESS IT NAMED TOOK IN 19 BITCOIN, MORE THAN 2 AFTER THE WARNING — 18.86 NOW SITS UNMOVED
BTCPay Server has now said what emptied those hot wallets. Its incident post, up by 14:24 UTC on November 2, 2026, says attackers hit servers on 2.4.1 or older and “used a different method to exploit the vulnerability fixed in 2.4.2,” the August 7 release. That answers the question we left open earlier that day. It also runs against the August advisory on that flaw, which told merchants: “BTCPay Server’s on-chain wallets, including hot wallets, are not affected.” That sentence was still up when we checked at 17:38 UTC, and the new post doesn’t mention it. The post does say: “We wish we had done more to reach users still running older versions.”
The post names one bitcoin address, so I checked it: bc1p0f7w...n63r7. At block 974,277, mempool.space and blockstream.info agree it has taken in 19.0168 bitcoin from others across 671 transactions since October 30. By block 974,389 it was 19.4372 across 753. BTCPay warns its history “should not be treated as a confirmed total of losses,” and anyone can pay any address, so that isn’t a loss count. But look at the shape. Of those transactions, 580, worth 18.3251 bitcoin, have one output and no change. They pull coins from 10,431 addresses, and one of them spends 1,316 coins at once. A merchant wallet that makes a new address for each invoice would look like that when it’s emptied.
Now the timing. BTCPay’s timeline lists a drain at 13:46 UTC on November 1, which matches block 974,131 on this address. Its first email came at 20:56 and its public warning at 22:25. By then 16.7278 bitcoin had landed. Another 2.289 confirmed after the warning, across 350 transactions, 32 of them after the incident post, with six more waiting at 17:34 UTC on November 2. A transaction can be signed before it confirms, so those aren’t all new break-ins. BTCPay also says: “We have not established when attackers first began exploiting the vulnerability.” The chain has a clue. On October 30, 14 transactions paid this address from two-of-two scripts with no timelock, which is what a cooperative Lightning channel close looks like. Those channels were funded between September 2023 and July 2025. There are 43 such closes so far, worth 0.2384 bitcoin. August’s flaw exposed LND credentials. I can’t prove the October 30 closes were theft, and BTCPay says some activity here predates the thefts reported to it.
Then there’s where it went. The address has paid out to 20 others, several in round amounts a person would type: 5.5 bitcoin, 4.71, 1.3. Eighteen of those payments, 18.8624 bitcoin, hadn’t moved at block 974,389. Anyone can watch them. Nobody can stop them. BTCPay gives no loss figure and no count of servers. It tells anyone who ran 2.4.1 or older to sweep to a new seed on a fresh server, because updating doesn’t remove access a thief already has. It also says wallets with keys held off the server “were unaffected by these thefts.” At the time of this writing, bitcoin was $77,507.