# wallet drainer

Published articles for wallet drainer.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## BTCPay Server warns of hot wallet crypto thefts on outdated instances

DevFeed: [BTCPay Server warns of hot wallet crypto thefts on outdated instances](<https://devfeed.tech/articles/btcpay-server-warns-of-hot-wallet-crypto-thefts-on-outdated-instances-112485.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances/>)

Author: Bill Toulas

Published: 2026-11-02T15:03:07Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [known exploitable vulnerabilities](<https://devfeed.tech/topics/known-exploitable-vulnerabilities.md>), [Bitcoin](<https://devfeed.tech/topics/bitcoin.md>)

Tags: [actor](<https://devfeed.tech/tags/actor.md>), [administrator](<https://devfeed.tech/tags/administrator.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [alert](<https://devfeed.tech/tags/alert.md>), [anthropic](<https://devfeed.tech/tags/anthropic.md>), [assets](<https://devfeed.tech/tags/assets.md>), [attack](<https://devfeed.tech/tags/attack.md>), [bitcoin](<https://devfeed.tech/tags/bitcoin.md>), [btcpay-server](<https://devfeed.tech/tags/btcpay-server.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [crypto](<https://devfeed.tech/tags/crypto.md>), [crypto-drainer](<https://devfeed.tech/tags/crypto-drainer.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [hackers](<https://devfeed.tech/tags/hackers.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [infosec-computer-security](<https://devfeed.tech/tags/infosec-computer-security.md>), [install](<https://devfeed.tech/tags/install.md>), [latest](<https://devfeed.tech/tags/latest.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [payment](<https://devfeed.tech/tags/payment.md>), [processor](<https://devfeed.tech/tags/processor.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [source](<https://devfeed.tech/tags/source.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [wallet](<https://devfeed.tech/tags/wallet.md>), [wallet-drainer](<https://devfeed.tech/tags/wallet-drainer.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

BTCPay Server says attackers drained hot wallets on instances running version 2.4.1 or earlier by exploiting an attack vector associated with versions before 2.4.2. The project urges affected operators to take those instances offline and update to 2.4.7; it reports no credible hot wallet drain reports from users on 2.4.7. Administrators can update through Server Settings -> Maintenance -> Update, or, for Docker installations, over SSH using the project's update script. The investigation is ongoing, and affected users are asked to report losses to the project and local authorities.

### Source excerpt

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions. [...]

## When a Wallet Drainer Asks DNS Where to Go

DevFeed: [When a Wallet Drainer Asks DNS Where to Go](<https://devfeed.tech/articles/when-a-wallet-drainer-asks-dns-where-to-go-84243.md>)

Original publisher: [Read original article](<https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/>)

Author: Infoblox Threat Intel

Published: 2026-10-09T14:00:31Z

Content type: article

Language: en

Sources: [Infoblox](<https://devfeed.tech/sources/infoblox-blog.md>)

Topics: [Domain Name System (DNS)](<https://devfeed.tech/topics/dns-resolution-process.md>), [DNSSEC](<https://devfeed.tech/topics/dnssec.md>), [DNS security](<https://devfeed.tech/topics/dns-security.md>), [Cloudflare](<https://devfeed.tech/topics/cloudflare.md>)

Tags: [1-1-1-1](<https://devfeed.tech/tags/1-1-1-1.md>), [ai-developed-malware](<https://devfeed.tech/tags/ai-developed-malware.md>), [attack](<https://devfeed.tech/tags/attack.md>), [c2](<https://devfeed.tech/tags/c2.md>), [cloud-hosted-infrastructure](<https://devfeed.tech/tags/cloud-hosted-infrastructure.md>), [cloudflare-pages](<https://devfeed.tech/tags/cloudflare-pages.md>), [crypto-phishing](<https://devfeed.tech/tags/crypto-phishing.md>), [cryptocurrency-theft](<https://devfeed.tech/tags/cryptocurrency-theft.md>), [detecting-dns-command-and-control](<https://devfeed.tech/tags/detecting-dns-command-and-control.md>), [dns](<https://devfeed.tech/tags/dns.md>), [dns-abuse](<https://devfeed.tech/tags/dns-abuse.md>), [dns-c2](<https://devfeed.tech/tags/dns-c2.md>), [dns-over-https](<https://devfeed.tech/tags/dns-over-https.md>), [dns-txt-records](<https://devfeed.tech/tags/dns-txt-records.md>), [doh-abuse](<https://devfeed.tech/tags/doh-abuse.md>), [https](<https://devfeed.tech/tags/https.md>), [infoblox-threat-intel](<https://devfeed.tech/tags/infoblox-threat-intel.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [noir-drainer](<https://devfeed.tech/tags/noir-drainer.md>), [phishing-kit](<https://devfeed.tech/tags/phishing-kit.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [wallet-drainer](<https://devfeed.tech/tags/wallet-drainer.md>), [walletconnect](<https://devfeed.tech/tags/walletconnect.md>)

### AI overview

The Noir cryptocurrency wallet drainer uses DNS TXT records and public DNS-over-HTTPS services to locate its active backend pool, allowing operators to redirect existing lure pages when infrastructure changes. The report describes the drainer's wallet-permission theft flow and unusually detailed source comments, while noting that AI assistance is a possibility rather than a confirmed fact.

### Source excerpt

How the Noir kit uses DNS TXT records and DoH as a dynamic infrastructure control plane Executive summary We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first [...] The post When a Wallet Drainer Asks DNS Where to Go appeared first on Infoblox Blog.