BTCPay Server warns of hot wallet crypto thefts on outdated instances

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions.

Operators were initially advised to shut down their servers pending a full investigation into the unauthorized Bitcoin and Litecoin payments.

The BTCPay Server project provides businesses with a self-hosted payment processing solution that allows them to accept Bitcoin and other digital assets directly into their own wallets, eliminating payment intermediaries or paying platform processing fees.

It handles checkout invoices and payment verification, including payments over the Lightning Network.

Early Monday, the maintainer said it had "identified an attack vector targeting instances running version 2.4.1 (July 23, 2026) or earlier" and strongly urged users to update to version 2.4.7.

BTCPay founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on determining how the threat actor was able to log in as an administrator to instances running versions older than 2.4.2.

On October 29, the company disclosed a critical vulnerability discovered via Anthropic's Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update.

However, Dorier said that there were clues that the attacker used vulnerabilities in BTCPay Server versions earlier than 2.4.2, released on August 7, which the project later confirmed.

"Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older," BTCPay Server says.

"We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated."

The BTCPay project began receiving reports of theft yesterday evening (UTC) and responded by asking VPS hosting providers to take affected server instances offline as a precaution to protect customers.

In a security alert today, the project maintainer said that it is currently responding to affected users and continues to receive incident reports. Users who lost funds as a result of the recent attacks are asked to send details to security@btcpayserver.org, and to report the losses to local authorities.

Impacted users should update to version 2.4.7 through Server Settings → Maintenance → Update.

For Docker installations, administrators can update BTCPay Server by logging in over SSH, running sudo su -, changing to the deployment directory with cd btcpayserver-docker, and executing ./btcpay-update.sh.

If running 2.4.1 or older, it is recommended to take the instance offline as soon as possible.

Update [10:23 EST]: Article update with information from the security incident report BTCPay Server published earlier today.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.