The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, is warning users about attacks that have drained hot wallets on instances running outdated software. Operators using affected versions are urged to take their servers offline and update as soon as possible.
The project said its investigation identified an attack vector targeting BTCPay Server version 2.4.1, released on July 23, 2026, and earlier versions. It recommends upgrading to version 2.4.7, while noting that it has no credible reports of hot wallet thefts from users running the latest release.
BTCPay founder Nicolas Dorier said the attacks did not target public servers. Investigators are examining how the attacker gained administrator access to installations running versions older than 2.4.2.
BTCPay Server allows businesses to process Bitcoin and other digital-asset payments directly into their own wallets. The platform manages checkout invoices and payment verification, including transactions made through the Lightning Network.
On October 29, the project disclosed a critical vulnerability identified by Anthropic’s Frontier OSS scanner and released version 2.4.7 as an emergency security update. Dorier later said there were indications that the recent attacker had exploited vulnerabilities in versions older than 2.4.2, a link the project subsequently confirmed. BTCPay Server has not specified which flaw is being exploited in the current attacks.
Users who believe they are affected are asked to send details and activity logs to security@btcpayserver.org. The update can be installed through Server Settings → Maintenance → Update. Administrators using Docker can update by connecting over SSH, switching to the BTCPay deployment directory, and running the project’s update script.
The project previously warned, on August 7, that a flaw fixed in version 2.4.2 was being actively exploited to expose LND credential files, potentially allowing attackers to control affected Lightning nodes and steal funds.
Sources: BleepingComputer.