BTCPay Server Identifies Attack Vector in Versions 2.4.1 and Earlier

BTCPay Server said its incident response investigation identified an attack vector affecting installations running version 2.4.1 or older, adding a technical finding to its review of hot-wallet reports.

For users on version 2.4.7, the project said there are currently no credible reports of hot wallets being stolen. It recommended users keep BTCPay Server updated and said affected people could email details and logs to security@btcpayserver.org.

The finding follows the project’s earlier warning to shut down instances during its investigation of hot-wallet reports. BTCPay Server is software that lets operators process Bitcoin (BTC) payments on infrastructure they host. Its hot-wallet setup can keep a wallet seed on the server to sign transactions.

BTCPay Server released version 2.4.1 on July 23, 2026.