Science & Tech · Cybersecurity · 2 hrs ago
BTCPay Server urges users to update after hot wallet thefts
BTCPay Server has urged users to update after attackers stole funds from hot wallets on older versions of its payment software.
The open-source platform lets businesses accept Bitcoin and other digital assets directly into their own wallets, without a payment intermediary.
The attacks targeted self-hosted instances running version 2.4.1 or earlier, and investigators found attackers had gained administrator access.
The project says it has no credible reports of hot wallet thefts from users running version 2.4.7, released as an emergency security update.
The specific flaw used in the latest attacks has not been disclosed, and the incident follows a separate security warning in August about exposed Lightning Network credentials.
Users on older versions should take their instances offline and update to 2.4.7, while affected operators are asked to send activity logs to the project’s security team.
BTCPay Server has urged users to update after attackers drained hot wallets on instances running older versions of its software.
The project identified an attack vector targeting instances running version 2.4.1 or earlier and recommends updating to version 2.4.7.
Founder Nicolas Dorier said the attacks targeted self-hosted instances, not public servers.
The project has not clarified which flaw was exploited in the recent attacks.
Users running version 2.4.1 or older are advised to take their instances offline until they update.
- Who
- BTCPay Server users running older versions of the payment processing software.
- What
- Attackers drained hot wallets on some outdated instances. The project urged users to update to version 2.4.7.
- When
- The reports were published on November 2 and 3, 2026. The attack timing is not stated.
- Where
- Self-hosted BTCPay Server instances; the attacks did not target public servers.
- Why
- Investigators said attackers used an attack vector to gain administrative access to instances running versions older than 2.4.2. The specific flaw has not been disclosed.
This story does not have two clearly opposing sides.
BTCPay Server released version 2.4.2 and warned of an actively exploited flaw exposing Lightning Network Daemon credential files.
The company disclosed a critical vulnerability discovered via Anthropic’s Frontier OSS scanner, prompting an emergency security update.
The maintainer said it had identified an attack vector targeting instances running version 2.4.1 or earlier.
BleepingComputer reported that BTCPay Server was warning users about hot wallet thefts on outdated instances.
SC Media reported the urgent advisory and recommendation to update.
- Recommended version
- 2.4.7
- Targeted versions
- 2.4.1 or earlier
- Attacks
- Hot wallets drained on some older instances
- Affected deployment type
- Self-hosted instances, not public servers
- Incident contact
- security@btcpayserver.org
3 sources
What people are saying
Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release.
We again urge everyone to keep their BTCPay Server updated.
Posts on X
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older. We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server
🚨 We're releasing BTPay Server 2.4.7 an emergency update fixing one critical and several medium-severity security vulnerabilities brought to our attention through @Anthropic's frontier OSS scanner. We recommend that you update your BTCPay Server as soon as possible.