BTCPay Server, the Bitcoin payment platform, told operators to shut down their servers after receiving reports of attackers draining hot wallets. On Monday, the project said the attack vector it identified targets instances running version 2.4.1 or earlier.
What BTCPay Server said
In an initial warning, the project asked operators to shut down their server instances while it investigated the reports of unauthorized wallet withdrawals. BTCPay also shared instructions for taking servers offline.
On Monday, in a follow-up, BTCPay said its investigation had identified an attack vector targeting instances running version 2.4.1 or earlier. Version 2.4.1 was released on July 23, 2026.
The project said it had received no credible reports of hot wallet drains from users running its latest release, 2.4.7, and urged operators to update their installations.
Which versions are targeted
BTCPay Server version | What BTCPay says |
|---|---|
2.4.1 or earlier | Targeted by the identified attack vector |
2.4.7 (latest) | No credible drain reports |
The project's only explicit recommendation is to update to 2.4.7. BTCPay has not announced a fix separate from that update and has not publicly described how the attack works.
What to do if you run BTCPay
- Shut down your server, per the initial warning, if you are on version 2.4.1 or earlier
- Update your installation to 2.4.7, the release BTCPay has no credible drain reports for
- If you were affected, submit information and logs to the BTCPay security team
What is still unknown
BTCPay has not yet disclosed three key details about the incident:
- The number of affected operators
- The value of stolen funds
- Technical details on how attackers gained access to the wallets
The incident comes less than three months after BTCPay restricted remote Lightning access following an August attack. That attack exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds.
It is unclear whether the new attack vector is connected to the August vulnerability.