BTCPay Server has identified a new attack vector impacting earlier versions of its payment software, leading to reports of unauthorized withdrawals from users’ hot wallets.
Older versions targeted
The open-source Bitcoin payment processor stated that attackers focused on BTCPay Server installations running version 2.4.1 or earlier. This version had been in use since its release on July 23, 2026. BTCPay advised its users to upgrade immediately, emphasizing that its latest version, 2.4.7, appeared unaffected by these recent incidents.
No confirmed cases of hot wallet losses have been linked to users who had already updated to version 2.4.7. The BTCPay team issued repeated calls for server administrators to check their setups and promptly update to the latest software release to reduce potential risks.
BTCPay Server’s investigation has so far found no credible reports of wallet drains among users operating version 2.4.7, and the team is urging all operators to take immediate action by upgrading their systems.
Operators still running outdated versions have been specifically instructed to take their systems offline and follow published security guidelines. BTCPay has warned that failing to update may leave funds especially vulnerable to ongoing attacks.
Limited details shared by BTCPay
Although BTCPay confirmed the hot wallet incidents, it has not disclosed how many operators are affected, the amount of cryptocurrency lost, or the technical mechanisms used in the attack. The project urged impacted users to send relevant logs and details to its security team to assist in the ongoing investigation.
BTCPay is a widely used, self-hosted Bitcoin payment processor that enables businesses and individuals to accept Bitcoin and Lightning Network payments. The platform is known for its open-source model and focus on user autonomy, making it popular among a range of merchants.
Mini dictionary: Hot wallet — A cryptocurrency wallet that remains connected to the internet, allowing for quick transactions but often exposing stored funds to higher security risks compared to so-called ‘cold’ (offline) wallets.
The development follows a previous security incident less than three months ago. At that time, BTCPay restricted remote Lightning access after attackers leveraged a flaw to obtain Lightning Network Daemon (LND) credentials and move funds out of user accounts.
| Version | Status | Hot Wallet Risk |
|---|---|---|
| 2.4.1 and earlier | Vulnerable | Confirmed incidents reported |
| 2.4.7 (latest) | Recommended | No incidents reported |
Investigation continues
BTCPay has not yet confirmed whether the current vulnerability is linked to the earlier Lightning incident. The team continues to work on understanding the root cause and has asked the community for input and technical logs related to any suspicious wallet activity.
BTCPay encouraged all affected users to supply security logs, stressing that community feedback is essential to its investigation and resolution efforts.
Industry participants are monitoring the situation, as incidents like these highlight ongoing security challenges in maintaining crypto payment platforms. BTCPay’s recommended actions underscore the importance of frequent updates and safety checks for self-hosted cryptocurrency software.
