Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets

Threat actors are actively exploiting a critical vulnerability in self-hosted BTCPay Server instances running version 2.4.1 or earlier to drain cryptocurrency hot wallets. The security issue allows unauthenticated remote attackers to retrieve sensitive .macaroon credential files, enabling full control over Lightning Network (LND) nodes and stored digital assets. Administrators are strongly advised to migrate to fresh servers and upgrade to version 2.4.7 or later to ensure complete remediation.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module identifies exposed BTCPay Server web instances on open ports, matching reported vulnerable software versions (v2.4.1 or earlier) via advertised HTTP application headers and detecting exposed sensitive credential file paths.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain