Search — “.macaroon”

BTCPay Server, a self-hosted cryptocurrency payment processor, says attackers stole Bitcoin and Litecoin from hot wallets on servers running 2.4.1 or earlier, and Bitquery reports about $1.62M (18.38 BTC and 3,405 LTC) across 682 sweeps. The sources do not name the exploited vulnerability or describe the attacker's on-host actions; they say the earlier August issue exposed .macaroon files, but it is unclear if the new attacks are related. Hunters should look for unexpected outbound wallet sweeps from hot wallets on BTCPay instances and treat older servers as compromised, using the published wallet addresses for matching.

BTCPay Server reports that Bitcoin and Litecoin were stolen from hot wallets on instances running version 2.4.1 or earlier, and says the attackers used a different method than the August 2026 issue fixed in 2.4.2. Users are advised to treat the whole machine and its secrets as compromised, move to a fresh server with a new wallet, and check two published wallet addresses. The sources do not describe the exploitation technique, so hunters should focus on whether LND .macaroon files were accessed on affected hosts and on the published addresses.