Hackers drain hot wallets on outdated BTCPay Server instances, users urged to update to 2.4.7

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged operators to install the latest release after attackers began draining hot wallets on instances running outdated versions. Operators were initially advised to shut down their servers pending a full investigation into the unauthorized payments. BTCPay Server provides businesses with a self-hosted payment processing solution that allows them to accept Bitcoin and other digital assets directly into their own wallets, eliminating payment intermediaries and platform processing fees. The software handles checkout invoices and payment verification, including payments over the Lightning Network. Early Monday, the maintainer said its investigation had identified an attack vector targeting instances running version 2.4.1, released July 23, 2026, or earlier, and strongly urged users to update to version 2.4.7. BTCPay founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on determining how the threat actor was able to log in as an administrator on instances running versions older than 2.4.2. On October 29, the project disclosed a critical vulnerability discovered through Anthropic's Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update. Dorier said there were clues that the attacker used vulnerabilities in BTCPay Server versions earlier than 2.4.2, which the project later confirmed. "Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older," BTCPay Server said in a statement. "We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated." The project has not clarified which flaw is being exploited in the recent attacks. BleepingComputer contacted BTCPay Server for more details about the vulnerability but did not receive a response by publication time. The disclosure follows an earlier warning on August 7, when version 2.4.2 was released with an alert about an actively exploited flaw exposing LND credential files that allowed attackers to control affected Lightning nodes and steal funds. Impacted users should update to version 2.4.7 through Server Settings, then Maintenance and Update. Administrators running Docker installations can update by logging in over SSH, running sudo su -, changing to the deployment directory with cd btcpayserver-docker and executing ./btcpay-update.sh. Anyone running version 2.4.1 or older is advised to take their instance offline as soon as possible, and impacted users are asked to send all details and activity logs to security@btcpayserver.org.