BTCPay Server thefts have prompted an urgent update warning after attackers drained cryptocurrency from hot wallets on outdated installations. On November 2, the project confirmed an attack vector affecting version 2.4.1 and earlier, urging operators to upgrade to version 2.4.7.
Attackers access older installations
The project began receiving reports of unauthorised Bitcoin and Litecoin payments on the evening of November 1, UTC. Initially, maintainers advised operators to shut down their servers while investigators examined the incidents. They also asked virtual private server hosting providers to take affected installations offline as a precaution.
BTCPay Server founder Nicolas Dorier said the investigation focused on how an attacker gained administrator access to older installations. Although the project had recently disclosed another critical vulnerability, evidence pointed towards weaknesses in versions preceding 2.4.2. Maintainers subsequently confirmed that the identified attack vector targeted version 2.4.1, released on July 23, 2026, and earlier releases.
Meanwhile, the project said it had received no credible reports of hot wallet drains affecting users running version 2.4.7. That statement reflects the reports available during the investigation, rather than a guarantee against every possible attack. Maintainers continue to receive incident reports and assist affected operators.
Recent security updates draw attention
BTCPay Server provides an open-source, self-hosted payment processor that lets businesses accept cryptocurrency directly into their own wallets. It manages checkout invoices and verifies payments, including transactions through the Lightning Network. As a result, merchants can process payments without relying on a payment intermediary or paying platform processing fees.
The project released version 2.4.2 on August 7. Later, on October 29, it issued version 2.4.7 as an emergency security update after Anthropic’s Frontier OSS scanner uncovered a critical vulnerability. However, investigators linked the reported BTCPay Server thefts to the older attack vector affecting installations running version 2.4.1 or earlier.
This distinction separates the recently disclosed vulnerability from the weaknesses implicated in the wallet drains. Nevertheless, maintainers urged all operators to install the latest release. Users should therefore follow the project’s current update guidance rather than assume an older installation remains suitable.
Operators urged to update and report losses
The project recommends taking installations running version 2.4.1 or earlier offline as soon as possible. Operators can then update through Server Settings → Maintenance → Update. For Docker deployments, the published instructions direct administrators to connect through SSH and run the update script from the deployment directory.
Meanwhile, anyone who lost funds in the BTCPay Server thefts should send incident details to security@btcpayserver.org. Maintainers also asked victims to report their losses to local authorities. The investigation remains ongoing as the project gathers further information from affected users.
0 responses to “BTCPay Server thefts target outdated hot wallets”