BTCPay Server Hot Wallet Thefts Hit Version 2.4.1 and Older: Update to 2.4.7 Now

Operators of the open-source payment processor BTCPay Server are being told to update immediately after a wave of hot wallet thefts hit instances running older versions of the software. The project says it has traced the attack vector to version 2.4.1, released July 23, 2026, and earlier, and that it has no credible reports of drained wallets on the latest release, 2.4.7.

The warning came Monday, after the project began receiving theft reports late Sunday UTC. According to BleepingComputer, the maintainer first asked hosting providers to take affected server instances offline as a precaution and advised operators to shut down while the unauthorized Bitcoin and Litecoin payments were investigated. Cointelegraph reported the same sequence: an emergency shutdown request, then a narrower finding once investigators had identified the attack path.

What BTCPay Server has said about the attack

BTCPay Server lets merchants accept Bitcoin and other digital assets straight into wallets they control, without a payment intermediary. That self-hosted design is also what makes the current situation difficult. Each operator is responsible for patching their own server, and a “hot wallet,” meaning one connected to the internet so it can process payments, is only as safe as the software guarding it.

Founder Nicolas Dorier said the attacks did not target public servers. Investigators have been focused on how the attacker was able to log in as an administrator on instances older than version 2.4.2, which shipped August 7. Dorier said early clues pointed to vulnerabilities in those older releases, and the project later confirmed that finding.

The timing is notable. On October 29, the project disclosed a critical vulnerability found using Anthropic’s Frontier OSS scanner and pushed out 2.4.7 as an emergency security update. The sources do not say whether that specific flaw is what attackers exploited. The project’s confirmed position is narrower: the attack vector affects 2.4.1 and earlier, and users on 2.4.7 have not reported drains.

What is still unknown

Much remains unclear. Cointelegraph noted that BTCPay has not disclosed how many operators were affected, how much was stolen, or the technical details of how attackers gained access. The outlet said it asked BTCPay for comment and had not received a reply before publication. BleepingComputer reported that the project is still responding to affected users and still receiving incident reports, so the scale of the hot wallet thefts may grow.

There is also a possible link to an earlier incident. In August, BTCPay restricted remote Lightning access after an attack that used a vulnerability to obtain Lightning Network Daemon credentials and steal funds. Cointelegraph said it is unclear whether the latest attack vector is connected to that episode.

What operators should do now

Anyone running 2.4.1 or older should treat their server as at risk and, per the project’s guidance, take it offline as soon as possible. The fix is to move to 2.4.7. Operators can do this through Server Settings, then Maintenance, then Update. Docker users can log in over SSH, run sudo su -, move into the btcpayserver-docker directory, and run ./btcpay-update.sh.

Users who lost funds are asked to email details and logs to security@btcpayserver.org and to report the losses to local authorities. The project’s message is blunt: keep your server updated.

For merchants who run their own payment infrastructure, the episode is a reminder that self-custody and self-hosting shift security duties onto the operator. When a patch cycle slips by a few months, the consequences can be immediate and irreversible. Until BTCPay publishes more details, the clearest protection against these hot wallet thefts is to be on 2.4.7.