Add as a preferred source on GoogleBTCPay Server Warns of Hot Wallet Drains on Older Software
The project identified version 2.4.1 and earlier as affected and said it had no credible reports of hot-wallet drains among users on its latest release, version 2.4.7.
BTCPay Server warned operators to shut down server instances during an investigation into hot-wallet thefts, then identified versions 2.4.1 and earlier as affected by an attack vector.
On Monday, the Bitcoin payment software project said its investigation found the vector targeted instances running version 2.4.1 or earlier. Version 2.4.1 was released July 23, 2026. BTCPay Server identified version 2.4.7 as its latest release and reported no credible hot-wallet drain reports from users on that version.
An earlier notice asked operators to shut down server instances as the team investigated unauthorized wallet withdrawals. BTCPay Server is urging operators to install the current release. It also asked affected users to submit information and logs to its security team.
BTCPay Server has not released a tally of affected operators or stolen funds; details of the wallet access remain unknown.
The latest warning follows BTCPay Server’s earlier restriction on remote Lightning access. In an August attack, intruders exploited a flaw to obtain Lightning Network Daemon (LND) credentials and take funds.
Simon Yoon
ReporterSimon Yoon reports on blockchain technology for TokenPost. Send corrections or tips to info@tokenpost.com.