BTCPay Server warns of hot wallet crypto thefts on outdated instances - BleepingComputer
BTCPay Server, an open-source cryptocurrency payment processor, has urged users to update to version 2.4.7 after hackers drained 'hot wallets' on outdated instances.
The maintainer of BTCPay Server has urged users to install the latest version as hackers have been draining 'hot wallets' on instances running older versions. Operators were initially advised to shut down their servers pending a full investigation into the unauthorized Bitcoin and Litecoin payments.
BTCPay Server provides businesses with a self-hosted payment processing solution that allows them to accept Bitcoin and other digital assets directly into their own wallets, eliminating payment intermediaries or paying platform processing fees. It handles checkout invoices and payment verification, including payments over the Lightning Network.
Vulnerability Details
Early Monday, the maintainer said it had 'identified an attack vector targeting instances running version 2.4.1 (July 23, 2026) or earlier' and strongly urged users to update to version 2.4.7. Dorier clarified that the attacks did not target public servers.
Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
Response Measures
On October 29, BTCPay disclosed a critical vulnerability discovered via Anthropic's Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update.
The maintainer said they are currently responding to affected users and continue to receive incident reports. Users who lost funds should send details to [email protected] and report losses to local authorities. Impacted users should update to version 2.4.7 through Server Settings → Maintenance → Update.
Related
