# BTCPay Server Warns of Hot Wallet Thefts on Outdated Software Operators urged to update instances after attackers drained funds from older software versions. - **Source:** [Cointelegraph.com News](https://brifing.si/source/2e81e982-0137-4db0-8ac2-351f37085775) - **Published:** 2026-11-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0799d315-6542-4e8d-8b39-efcaa8e7272c ## Critical Security Alert Issued BTCPay Server has issued an urgent warning to platform operators following reports of unauthorized fund withdrawals from hot wallets. The project identified a specific attack vector targeting older software versions. Operators were initially advised to shut down their server instances entirely while the security team investigated the nature of these ongoing malicious activities. ## Vulnerable Software Versions Identified The investigation confirmed that the vulnerability affects instances running version 2.4.1 or earlier, which was originally released on July 23, 2026. Users currently operating these outdated versions are at high risk of exploitation. The platform has explicitly urged all affected operators to update their installations to the latest version, 2.4.7, to mitigate risks. ## Current Status of Latest Releases BTCPay Server stated that they have received no credible reports of hot wallet drains among users who have already upgraded to version 2.4.7. This indicates that the latest patch effectively addresses the identified security flaw. Operators are encouraged to verify their current software version immediately to ensure they are running the secure release. ## Lack of Specific Disclosure The platform has not yet disclosed the total number of affected operators or the specific monetary value of the stolen funds. Furthermore, technical details regarding the exact mechanism attackers used to access the wallets remain undisclosed. Affected users have been asked to submit their logs and relevant information directly to the security team. ## History of Recent Vulnerabilities This security incident occurs less than three months after BTCPay restricted remote Lightning access. That previous August attack exploited a vulnerability to obtain Lightning Network Daemon credentials, resulting in fund theft. It remains unclear if the current attack vector is directly connected to the security flaws identified during that previous August incident. ## Operational Response and Mitigation BTCPay provided specific instructions for operators to safely shut down their servers during the initial investigation phase. This proactive measure was intended to prevent further unauthorized access while the team analyzed the breach. The platform continues to monitor the situation closely, though they did not respond to requests for further official comment. ## Broader Industry Security Context The incident highlights the persistent risks associated with self-hosted payment infrastructure and the critical importance of timely software updates. As payment platforms become primary targets for attackers, maintaining up-to-date versions is essential for protecting user assets. Similar industry events, such as recent large-scale exchange outflows, underscore the volatility of digital asset security. ## Future Security Outlook Moving forward, the focus remains on patching vulnerabilities and ensuring operator compliance with security updates. The lack of technical transparency regarding the current exploit suggests that further analysis is required to fully understand the attack surface. Operators must remain vigilant and prioritize security patches to prevent future unauthorized access to their wallets. ## Sources covering this story - https://cointelegraph.com/news/btcpay-server-hot-wallet-thefts-older-versions?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._