BTCPay Server warns of hot wallet thefts on outdated software

The Bitcoin payment platform BTCPay Server has issued an urgent advisory to its operators following reports of unauthorized attackers draining funds from hot wallets. The project identified a specific attack vector affecting instances running version 2.4.1 or earlier, which was originally released on July 23, 2026. As users search for information on btcpay server, the project has emphasized the importance of maintaining up-to-date installations to ensure the security of their assets.

BTCPay Server urges operators to update to version 2.4.7 to prevent unauthorized hot wallet fund drains.

Addressing the btcpay server security risks

Following initial reports of suspicious activity, the platform took the precautionary step of advising operators to shut down their server instances while an investigation was conducted. The project provided specific instructions to assist operators in this process. According to the platform, no credible reports of fund theft have been linked to users running the latest version, 2.4.7. Consequently, the team is strongly recommending that all users update their software immediately.

At this stage, the project has not disclosed the total number of affected operators or the specific value of the funds stolen. Furthermore, technical details regarding the method used by attackers to access the wallets remain undisclosed. The security team has requested that any users who believe they were affected submit relevant information and system logs for further analysis.

This security incident occurs less than three months after the platform was forced to restrict remote Lightning access. That earlier event involved a vulnerability that allowed attackers to obtain Lightning Network Daemon credentials and subsequently steal funds. It is currently unclear if the recent attack vector is related to the August security breach. Cointelegraph attempted to contact the project for further clarification, but no response was received prior to the publication of this report.

Why it matters

This development highlights the critical importance of software maintenance for self-hosted payment infrastructure. Operators who fail to apply security patches are left vulnerable to exploitation, which can lead to direct financial losses. For users and businesses relying on these tools to process transactions, these warnings underscore the necessity of monitoring official security advisories to protect digital assets from emerging threats.