If you run BTCPay Server to take Bitcoin payments, check your version today. Attackers are draining hot wallets on older installs. The project first asked operators to shut down their servers and has since urged them to update. Merchants who self-host their payment stack carry the patching duty themselves, and this incident shows what a lapse can cost.
What happened
According to Cointelegraph, BTCPay Server received reports of unauthorized parties taking funds from users’ hot wallets. The project first asked operators to shut down their instances while it investigated, and it shared instructions for doing so.
On Monday the project said its investigation had identified an attack vector affecting instances on version 2.4.1 or earlier. Cointelegraph reports that 2.4.1 came out on July 23, 2026. BTCPay said it had seen no credible reports of hot wallet drains among users on its latest release, version 2.4.7, and it urged operators to update.
The project has not said how many operators are affected, how much was stolen or how attackers reached the wallets. It has asked affected users to send information and logs to its security team. BTCPay did not reply to Cointelegraph’s request for comment before publication.
Why it matters
BTCPay is self-hosted software, so no vendor can flip a switch for everyone. Each operator decides when to update, and the gap between a fix shipping and an operator applying it is where attackers tend to work. The source does not say how far behind the affected operators were, so it would be a mistake to read this as proof that a small lag is enough to be exposed. It shows only that 2.4.1 and earlier are targeted, and that 2.4.7 is several releases newer.
This is also the second serious security episode in a short span. Cointelegraph notes that BTCPay restricted remote Lightning access less than three months ago, after an August attack used a vulnerability to obtain Lightning Network Daemon credentials and steal funds. It is unclear whether the two are linked. Even so, two incidents in one quarter will push merchants to ask harder questions about keeping spendable keys on an internet-facing server.
The wider lesson applies beyond Bitcoin. A hot wallet is convenient because funds are always available for payouts and refunds, and that same availability makes it a direct target. For more on the sector, see our crypto coverage.
What it means for you
Start with your version number. The project’s guidance came in two steps: a shutdown request while it investigated, then a call to update. If you run 2.4.1 or earlier and have not yet stopped your server, follow the shutdown instructions the project published. Then update to 2.4.7 specifically. The project has said nothing about versions 2.4.2 to 2.4.6, so do not assume an intermediate release is safe.
- Check wallet balances and transaction history for withdrawals you did not authorise, and keep logs intact.
- If you see suspicious activity, send details and logs to the BTCPay security team, as the project requests.
- Cut the balance held in the hot wallet to what you need for near-term operations, and move the rest to storage that is not on the server.
- Review any Lightning credentials and remote access settings, given the August incident.
- Assign a named owner for updates and set a regular review, so a release does not sit unapplied for months.
If you pay a host or agency to run BTCPay for you, ask which version they run, how fast they apply security releases and whether they hold your keys. Teams that cannot staff patching should weigh managed hosting or custody options against the cost of a drained wallet. Because the entry point is undisclosed, it is prudent to treat keys on a vulnerable instance as possibly compromised and to plan rotation accordingly.
What to watch
- A technical write-up from BTCPay explaining how attackers reached the wallets, and which versions it covers beyond 2.4.1.
- Any statement on whether this connects to the August LND credential theft.
- Figures on affected operators and stolen funds, which would show the scale.
- Changes to default settings or update prompts that make staying current harder to skip.
