BTCPay Server Investigates Hot Wallet Exploits on Legacy Instances
Attackers targeted outdated versions of the open-source payment processor to drain hot wallets.
1Vulnerability in Legacy Versions
BTCPay Server identified an attack vector affecting instances running version 2.4.1 or older. These versions, released before July 23, 2026, allowed unauthorized actors to gain administrative access to user instances. The team confirmed that users operating the current 2.4.7 release remain unaffected by these specific hot wallet draining incidents.
2Unauthorized Admin Access Mechanism
Founder Nicolas Dorier confirmed that attackers successfully logged in as administrators on outdated servers. While the exact technical mechanism remains under investigation, traces indicate that vulnerabilities present prior to version 2.4.2 were leveraged. The team is currently analyzing logs to determine how these specific entry points were exploited by attackers.
3Immediate Mitigation and Response
The platform initially advised users to shut down their instances entirely until the investigation concluded. Currently, the team urges all operators to update their software to the latest version immediately. Impacted users are requested to submit detailed logs to the security email address to assist in the ongoing forensic analysis.
4Scope of the Incident
BTCPay Server has not disclosed the total number of affected servers or the specific amount of funds lost during these sweeps. Because the platform is a self-hosted, open-source payment processor, it does not hold user funds, meaning attackers targeted the connected hot wallets directly through the compromised administrative interfaces.
5Platform Architecture Context
BTCPay Server functions as a decentralized payment processor, enabling merchants to accept Bitcoin and Lightning Network payments without third-party intermediaries. Payments are routed directly to user-connected wallets, avoiding subscription or transaction fees. This architecture places the responsibility of server security and software updates directly on the individual instance owner.
6History of Security Vulnerabilities
This incident follows a previous security scare approximately three months ago. In that instance, a vulnerability allowed attackers to obtain LND admin macaroon credentials, granting them unauthorized access to connected LND wallets. These recurring issues highlight the critical importance of maintaining updated software environments for self-hosted cryptocurrency payment infrastructure.
7Broader Crypto Security Landscape
The incident coincides with a massive $6 billion crypto heist involving Binance, which has been attributed to the state-sponsored cyber warfare group TraderTraitor. While the BTCPay Server incident is distinct, it occurs within a climate of heightened security scrutiny across the entire cryptocurrency ecosystem following these large-scale exploitation events.
8Future Security Communication
The BTCPay Server team plans to release a comprehensive blog post detailing their findings once the investigation is complete. This transparency is intended to help users understand the specific risks associated with legacy versions. Moving forward, the platform continues to emphasize the necessity of rigorous patch management for all self-hosted instances.
Original article: CryptoPotato — BTCPay Server Investigates Hot Wallet Exploits on Legacy Instances