BTCPay Server says attackers targeted instances running version 2.4.1 or older after reports of swept hot wallets. The team reports no credible drain reports from users on the latest 2.4.7 release, and the investigation continues.
BTCPay Server's investigation has identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older. The probe followed reports of unauthorized attackers sweeping hot wallets.
The open-source payment processor said it has no credible reports of hot wallet drains affecting users on the latest 2.4.7 release.
Founder says public servers were not hit
The team is urging everyone to keep their instances updated and has asked impacted users to send details and logs to [email protected]. Earlier, the platform had urged users to shut down their instances until the investigation was complete.
Founder Nicolas Dorier confirmed the finding. According to Dorier: "Our public servers were not attacked (on 2.4.7), it seems reports are before 2.4.2."
He added that the attacker managed to log in as admin on those instances, and the team is still trying to work out how. The team has traces that vulnerabilities in versions before 2.4.2 were used, and it plans a follow-up blog post.
Loss figures remain undisclosed
BTCPay Server has not disclosed how much was lost or how many servers were affected.
The latest development comes around three months after the project disclosed a vulnerability that was exploited to steal funds from some users. That flaw allowed attackers to obtain LND admin macaroon credentials from affected instances and use them to access connected LND wallets.
BTCPay Server is a free, self-hosted Bitcoin payment processor that lets individuals and merchants accept Bitcoin and Lightning Network payments without third-party intermediaries.
Source: CryptoPotato
Trading involves risk.
Risk Disclaimer
