Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
Binance has a flaw rated critical -- the kind of severity that moves a fix from the to-do list to today's priority.
Binance has a flaw rated critical -- the kind of severity that moves a fix from the to-do list to today's priority.
This requires a user to open a crafted file or document in Binance.
An employee opens a file in Binance as part of normal work; if that build is affected, the vulnerable path can be reached without anything looking unusual.
BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions.
Users who are running versions 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even in scenarios where users have not noticed a theft.
It's currently unknown when the attackers behind the campaign first began exploiting the vulnerability, although reports began to surface around November 1, 2026.
Anyone running Binance 2.4.1 is exposed, specifically wherever Binance is actually deployed rather than just licensed or installed somewhere unused.
In the event of stolen funds or suspected unauthorized access, it's imperative that users consider the entire machine and all secrets stored on it as compromised and follow the same recovery procedures.
In a post on X, BTCPay Server said no credible reports of hot wallet drains have been reported from users running the latest 2.4.7 release.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
In August 2026, BTCPay Server disclosed that a critical vulnerability had been weaponized by attackers to steal funds from some users.
Those credentials could be used to take control of an LND node and move funds.
The affected versions are 2.4.1, so that's the range to check against your own deployment.
The version addresses one critical and several medium-severity security vulnerabilities discovered via Anthropic's OSS scanner.
The issue, which affects all BTCPay Server versions, was patched in version 2.4.2.
The attacks we reviewed targeted only files with the .macaroon extension. The development coincides with a string of security breaches and exploits across the cryptocurrency space, including the record theft of $6.43 billion from Binance by North Korean threat actors.
Other amounts eligible for blocking have been identified, and containment efforts continue.
Since its initial discovery in 2018, experts have investigated several sources of the malware and now believe Russian language group Wizard Spider created it.
Confirm whether Binance 2.4.1 is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
Organizations can use this window to block the threat before final deployment.
What happened
Binance has a critical flaw that elevates its urgency for a fix from the to-do list to today's priority.
This vulnerability requires a user to open a crafted file or document in Binance.
An employee may inadvertently open a file as part of their normal work; if the affected build is in use, the vulnerable path can be accessed without any obvious signs.
What changed
BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software following reports of Bitcoin and Litecoin thefts from hot wallets on instances running older versions.
Users running versions 2.4.1 or earlier are advised to migrate to a fresh server with a new wallet, even if they have not observed any theft.
It remains unclear when the attackers began exploiting the vulnerability, although reports began to emerge around November 1, 2026.
Who is affected
Anyone using Binance 2.4.1 is at risk, particularly in environments where Binance is actively deployed rather than merely licensed or installed on unused systems.
In cases of stolen funds or suspected unauthorized access, users must treat the entire machine and all stored secrets as compromised and follow appropriate recovery procedures.
BTCPay Server stated in a post on X that no credible reports of hot wallet drains have been received from users running the latest 2.4.7 release.
Why it matters
The advisory highlights the real security impact an attacker could achieve once the vulnerable path is exploited.
In August 2026, BTCPay Server disclosed that a critical vulnerability had been weaponized by attackers to steal funds from certain users.
Compromised credentials could enable an attacker to take control of an LND node and move funds.
Technical details
The affected version is 2.4.1, making it crucial to check against your own deployment.
This version addresses one critical vulnerability along with several medium-severity security issues identified via Anthropic's OSS scanner.
The vulnerability, which impacts all BTCPay Server versions, was patched in version 2.4.2.
Response
The reviewed attacks specifically targeted files with the .macaroon extension. This development coincides with a series of security breaches and exploits in the cryptocurrency sector, including the historic theft of $6.43 billion from Binance by North Korean threat actors.
Additional amounts eligible for blocking have been identified, and containment efforts are ongoing.
Since its initial discovery in 2018, experts have investigated various sources of the malware and now suspect that the Russian language group Wizard Spider is behind it.
What security teams should do
Verify whether Binance 2.4.1 is present in your asset and software inventory.
Although no exploitation has been reported yet, this status may change, so continue monitoring vendor guidance while you remediate.
Organizations can use this opportunity to block the threat before final deployment.