BTCPay Server warns operators to shut down outdated instances after hot wallet theft reports

BTCPay Server says it identified an attack vector affecting older versions of its payment software after reports that attackers were draining funds from users’ hot wallets. For high-risk payment operators, the practical takeaway is simple: if you are running version 2.4.1 or earlier, this is not a “monitor and wait” situation.

1. On Monday, BTCPay Server said its investigation found an attack vector targeting instances running version 2.4.1 or earlier, which was released July 23, 2026. The project said it had received no credible reports of hot wallet drains among users running version 2.4.7, its latest release, and urged operators to update their installations.
2. Before that, BTCPay told operators to shut down server instances while it investigated the unauthorized wallet withdrawal reports, and it also published instructions for doing so. That is the clearest sign the project saw active risk on live systems, not just a theoretical software issue.
3. BTCPay has not disclosed the number of affected operators, the value of stolen funds, or technical details showing how attackers accessed the wallets. It asked affected users to submit information and logs to its security team, which means the full scope is still not public.
4. The timing matters: the reports came less than three months after BTCPay restricted remote Lightning access following an August attack that exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds. It remains unclear whether the latest attack vector is connected to that earlier vulnerability.

For PSPs and merchants running BTCPay in high-risk verticals, the immediate operational question is not whether the issue is “interesting”; it is whether any production instance is still on an exposed version and whether hot wallet exposure can be reduced before reopening service.