BTCPay Server Warns of Hot Wallet Thefts on Outdated Software
Operators urged to update instances after attackers drained funds from older software versions.
1Critical Security Alert Issued
BTCPay Server has issued an urgent warning to platform operators following reports of unauthorized fund withdrawals from hot wallets. The project identified a specific attack vector targeting older software versions. Operators were initially advised to shut down their server instances entirely while the security team investigated the nature of these ongoing malicious activities.
2Vulnerable Software Versions Identified
The investigation confirmed that the vulnerability affects instances running version 2.4.1 or earlier, which was originally released on July 23, 2026. Users currently operating these outdated versions are at high risk of exploitation. The platform has explicitly urged all affected operators to update their installations to the latest version, 2.4.7, to mitigate risks.
3Current Status of Latest Releases
BTCPay Server stated that they have received no credible reports of hot wallet drains among users who have already upgraded to version 2.4.7. This indicates that the latest patch effectively addresses the identified security flaw. Operators are encouraged to verify their current software version immediately to ensure they are running the secure release.
4Lack of Specific Disclosure
The platform has not yet disclosed the total number of affected operators or the specific monetary value of the stolen funds. Furthermore, technical details regarding the exact mechanism attackers used to access the wallets remain undisclosed. Affected users have been asked to submit their logs and relevant information directly to the security team.
5History of Recent Vulnerabilities
This security incident occurs less than three months after BTCPay restricted remote Lightning access. That previous August attack exploited a vulnerability to obtain Lightning Network Daemon credentials, resulting in fund theft. It remains unclear if the current attack vector is directly connected to the security flaws identified during that previous August incident.
6Operational Response and Mitigation
BTCPay provided specific instructions for operators to safely shut down their servers during the initial investigation phase. This proactive measure was intended to prevent further unauthorized access while the team analyzed the breach. The platform continues to monitor the situation closely, though they did not respond to requests for further official comment.
7Broader Industry Security Context
The incident highlights the persistent risks associated with self-hosted payment infrastructure and the critical importance of timely software updates. As payment platforms become primary targets for attackers, maintaining up-to-date versions is essential for protecting user assets. Similar industry events, such as recent large-scale exchange outflows, underscore the volatility of digital asset security.
8Future Security Outlook
Moving forward, the focus remains on patching vulnerabilities and ensuring operator compliance with security updates. The lack of technical transparency regarding the current exploit suggests that further analysis is required to fully understand the attack surface. Operators must remain vigilant and prioritize security patches to prevent future unauthorized access to their wallets.